Private Domains setting is hard to find under non-DNSBL use cases

[delan]

Important notices

Before you add a new report, we ask you kindly to acknowledge the following:

• I have read the contributing guide lines at https://github.com/opnsense/core/blob/master/CONTRIBUTING.md
• I am convinced that my issue is new after having checked both open and closed issues at https://github.com/opnsense/core/issues?q=is%3Aissue

Is your feature request related to a problem? Please describe.

On my network, the search domains are home.daz.cat (containing private IPv4 addresses) followed by daz.cat (containing public addresses). For example, storage.home.daz.cat is 172.19.42.3, and storage.daz.cat is 2403:5800:c200:8600:5054:ff:fe01:4018.

But home.daz.cat is served publicly, which annoys unbound’s DNS rebinding prevention:

[17554:2] debug: sanitize: removing public name with private address <storage.home.daz.cat.> 172.19.42.3#53

Describe solutions and alternatives

At first I thought the only solution was to add a domain override (Services > Unbound DNS > Overrides), which happens to add private-domain and domain-insecure in addition to the forward-zone, but eventually I found Blocklist > Private Domains. Thankfully the setting works regardless of whether DNSBL is enabled.

Given my use case, I think this is a confusing place to put the setting. What do you think about moving it to Advanced or similar, and updating the help text to be less “DNSBL only”?

Additional context

• blog post about the pfSense counterpart

[fichtner]

Yes, it needs to be moved. And no it won’t be done fast and easy because a lot of work is still needed to modernise the code base we inherited.

I have this on my radar, but it’s a bigger issue than keeping track of when a single option is moved somewhere else regardless of if it’s properly documented or not. That’s another story.

Cheers,
Franco

[delan]

No worries, thanks for the quick reply!

[fichtner]

For a bit more context where private-domain setting came from #5104

[OPNsense-bot]

This issue has been automatically timed-out (after 180 days of inactivity).

For more information about the policies for this repository,
please read https://github.com/opnsense/core/blob/master/CONTRIBUTING.md for further details.

If someone wants to step up and work on this issue,
just let us know, so we can reopen the issue and assign an owner to it.