Post #736321
2026-03-20 05:54 UTC
I integrated an unbound instance as the DNS resolver of my homegrown CGNAT gateway yesterday. Hooked it up to the main (userland) routing process with a pair of veth devices so that all of the DNS-related networking went out the same path as the rest of the customer IP traffic and never touched the host network stack.
This worked great, except… only with some authoritative servers! The root servers worked fine, as did .com TLD, example.com resolved great… but things like google.com didn’t.
Replies (1)
-
@karppinen@mastodon.online 2026-03-20 05:59
…this was a ”fun” day of debugging. My thoughts immediately went to NAT bugs (the unbound process is behind NAT44/NAT66), MTU issues, routing problems at our network core, even rate limiting after my extended testing. But no, it was nothing like that. Consistently, root servers worked, some other ones too, but most domain names would not resolve no matter what.