Openvpn and unbound combined break dig command

• when doing DNS lookup against remote unbound server over OpenVPN connection
• results not coming back, or say "reply from unexpected source" 
• ping and ssh work fine

• fix unbound.conf 
• "interface" parameter -> local ip instead of "0.0.0.0"
• replies will have the local ip and not the OpenVPN ip now

Sample reply when still broken:

;; reply from unexpected source: 192.168.30.1#53, expected 172.30.1.54#53

unbound: default to Google's DNS

forward-zone:
       name: "."
       forward-addr: 8.8.8.8
       forward-addr: 8.8.4.4

unbound: custom records

server:
        verbosity: 1
        interface: 0.0.0.0
        access-control: 10.0.0.0/8 allow

        local-zone: "mydomain.internal" static
        local-data: "app01.mydomain.internal          IN A 10.0.0.10"
        local-data: "app02.mydomain.internal          IN A 10.0.0.11"
        local-data: "biggie01.mydomain.internal       IN A 10.0.0.12"
        local-data: "mysql01.mydomain.internal        IN A 10.0.0.20"
        local-data: "mysql02.mydomain.internal        IN A 10.0.0.31"
        local-data: "apache01.mydomain.internal       IN A 10.0.0.200"

Simple unbound upstart script

1. put below in /var/tmp/unbound.conf
2. pkill unbound
3. lsof -nP -i :53
4. pgrep unbound
5. cp -v /var/tmp/unbound.conf /etc/init/
6. start unbound
7. status unbound
8. status unbound
9. start unbound

start on runlevel [3]
expect fork
exec unbound

Build unbound from source on redhat/centos

NOTE: unbound is now available via epel repo on Amazon Linux

1. install requirements
1. yum groupinstall "Development Tools"
2. yum install openssl-devel
3. yum install expat-devel
2. build
1. ldns
1. wget http://www.nlnetlabs.nl/downloads/ldns/ldns-1.6.16.tar.gz
2. tar zxvf ldns-1.6.16.tar.gz
3. cd ldns-1.6.16/
4. ./configure --disable-gost --disable-ecdsa
5. make
6. make install
2. unbound
1. wget http://unbound.net/downloads/unbound-latest.tar.gz
2. tar zxvf unbound-latest.tar.gz
3. cd unbound-1.4.20/
4. ./configure --disable-gost --disable-ecdsa
5. make
6. make install
3. add libs to system lib path
1. vi /etc/ld.so.conf.d/ldnsandunbound.conf
1. add this one line
1. /usr/local/lib
2. sudo ldconfig
4. add unbound user
1. adduser --system unbound
5. tweak config
1. vi /usr/local/etc/unbound/unbound.conf
1. see simple sample below
6. run
1. unbound
7. check
1. lsof -nP -i :53
8. stop
1. pkill unbound
9. restart
1. unbound

server:

        verbosity: 1

        interface: 0.0.0.0

        access-control: 10.0.0.0/16 allow

forward-zone:

       name: "my-vpc.internal"

       forward-addr: 252.252.199.199

       forward-first: no

Taken: https://calomel.org/unbound_dns.html