Unbound: Host Overrides and DHCP Registration issue

So I am using unbound as the resolver on opnsense for LAN clients and also making use of the host overrides feature, and I am running into an issue that I can't see a relevant config option for, so hoping someone has some insight on what I can do here.

In DHCP settings I specify the domain name for clients, for example my-local-domain.org. Clients receive that, all is well. In Unbound, I have some host override entries within that domain in order to reflect static ip addresses, i.e. server1.my-local-domain.org = 192.168.0.2.

The problem I am trying to prevent happening is either a rogue device connecting to the network and sending a DHCP request using a hostname that matches an entry in host overrides, i.e. server1, as this results in unbound adding that DHCP issued IP to the DNS A record for server1.my-local-domain.org. Another way this comes about is if I plug in a network cable to the wrong port on the network card in server1, one that isn't configured with a static ip and also has a different MAC address. I then realise my mistake and plug the cable into the right port, but often need to restart unbound or wait for the DNS cache to expire to remove the incorrect ip from the DNS A record for server1.my-local-domain.org.

This is like a moron induced dns poisoning on my behalf, but I can't see an option that effectively says "don't register dhcp leases in unbound dns if an existing host override entry is present" - am i missing something?

thanks!

Posted Dec 13, 2022, 11:19 AM UTC

21
lihaarp•

I actually think that's a bug. DHCP clients are registered within unbound, but never de-registered. So any changes like your poisoning attack will not be reflected until unbound is restarted.

1