diff options
| author | Warren Baker <warren@decoy.co.za> | 2010-12-17 19:12:12 +0200 |
|---|---|---|
| committer | Warren Baker <warren@decoy.co.za> | 2010-12-17 19:12:12 +0200 |
| commit | f6776caca5afceaa1a8349cca3d263c6635bf7fb (patch) | |
| tree | ef9575b238fb8f78a212a56cc9b6bef66b6f3e26 /config/unbound/unbound.xml | |
| parent | baed1fbf528a885c1c07bf38d1a5821f8c681828 (diff) | |
| download | pfsense-packages-f6776caca5afceaa1a8349cca3d263c6635bf7fb.tar.gz pfsense-packages-f6776caca5afceaa1a8349cca3d263c6635bf7fb.tar.bz2 pfsense-packages-f6776caca5afceaa1a8349cca3d263c6635bf7fb.zip | |
Add DNS Rebinding check as checkbox. If any DNS answers return RFC1918 address the answer is stripped, unless the domain is configured in domainoverrides. With this option disabled all RFC1918 answers will be returned. Possibly need to break this and few other options into rowhelper type page...
Diffstat (limited to 'config/unbound/unbound.xml')
| -rw-r--r-- | config/unbound/unbound.xml | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/config/unbound/unbound.xml b/config/unbound/unbound.xml index f7a851eb..43947698 100644 --- a/config/unbound/unbound.xml +++ b/config/unbound/unbound.xml @@ -118,6 +118,13 @@ <type>checkbox</type> <default_value>on</default_value> </field> + <field> + <fieldname>private_address</fieldname> + <fielddescr>Private Address support</fielddescr> + <description>With this option enabled <a href="http://tools.ietf.org/html/rfc1918">RFC1918</a> addresses are stripped away from DNS answers. Additionally, the DNSSEC validator may mark the answers bogus. This protects against <a href="http://en.wikipedia.org/wiki/DNS_rebinding">DNS Rebinding</a>. <br/> <b>Note:</b> Domain Overrides and Host entries will be allowed to return answers if this option is enabled.</description> + <type>checkbox</type> + <default_value>on</default_value> + </field> <!--<field> <fieldname>regdhcp</fieldname> <fielddescr>Register DHCP leases</fielddescr> |