From 1612910654f7d99d73b499664263a605dec3f085 Mon Sep 17 00:00:00 2001 From: Graham McIntire Date: Thu, 14 May 2026 09:04:22 -0500 Subject: [PATCH] resolvers: enable IPv6 in unbound (listen, do-ip6, access-control) Listen on ::0, set do-ip6: yes for IPv6 upstream resolution, and add IPv6 access-control: default-deny ::0/0, allow ::1 and the VNTX 2606:1c80::/32 allocation. --- ansible/roles/resolvers/templates/unbound.conf.j2 | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/ansible/roles/resolvers/templates/unbound.conf.j2 b/ansible/roles/resolvers/templates/unbound.conf.j2 index 877267a..c5e10e2 100644 --- a/ansible/roles/resolvers/templates/unbound.conf.j2 +++ b/ansible/roles/resolvers/templates/unbound.conf.j2 @@ -59,6 +59,7 @@ server: # interface: 2001:DB8::5 # interface: eth0@5003 interface: 0.0.0.0 + interface: ::0 # enable this feature to copy the source address of queries to reply. # Socket options are not supported on all platforms. experimental. @@ -252,7 +253,7 @@ server: do-ip4: yes # Enable IPv6, "yes" or "no". - do-ip6: no + do-ip6: yes # If running unbound on an IPv6-only host, domains that only have # IPv4 servers would become unresolveable. If NAT64 is available in @@ -326,6 +327,9 @@ server: access-control: 172.1.0.0/15 allow access-control: 100.64.0.0/10 allow access-control: 216.180.128.0/20 allow + access-control: ::0/0 refuse + access-control: ::1 allow + access-control: 2606:1c80::/32 allow # tag access-control with list of tags (in "" with spaces between) # Clients using this access control element use localzones that