1

How To Access DNSSEC DNS Server Listening On 127.0.0.1:53 On Mac OSX Host, From VirtualBox Guest VM Windows XP Prof 32-bit ?

My host/physical computer machine is an Apple MacBook with Mac OS X (64-bit, Yosemite 10.10.3).

Host MacOSX is running VirtualBox (VBox) hypervisor software.

Host MacOSX also has "unbound", a full-dnssec dns server/resolver, running-at & listening-on 127.0.0.1:53 (ip.address:port). The "unbound" is functioning as a DNSSEC DNS Validating Resolver. Unbound was obtained via Homebrew, and then it needed further configuration.

I have used steps, processes & general instruction, shown in below link, to load & enable "Unbound", a full DNSSEC DNS Server/Resolver in Mac OSX:

https://stackoverflow.com/questions/31043217/how-to-enable-unbound-dnssec-dns-resolver-on-mac-os-x-10-10-3-yosemite

Primary network adapter in host MacOS currently using DHCP dynamic (not fixed) ip-address 192.168.10.50, obtained from my local router/gateway 192.168.10.1

My guest VM (virtual machine) name: "WinXP", and OS is Windows XP prof 32-bit, it also has 512MB RAM, 6GB (virtual) Hard Drive, 1 CPU core.

VBox (VirtualBox) Network Adapter 1 is by-default set into (or "Attached to") NAT mode. All other vbox network adapters are disabled. So ip-address inside guest-VM currently is 10.0.2.15 . Guest gateway+dhcp+dns is now 10.0.2.2

Inside guest side WinXP Firefox web-browser, i have installed "DNSSEC-TLSA validator" extension, from https://www.dnssec-validator.cz/ website. DNSSEC & TLSA validator extension is then configured currently to use the 10.0.2.2 as a dnssec dns server.
But when i visit www.Dnssec-Validator.cz ( or https://www.isc.org/ ) website, both "DNSSEC" & "TLSA"/DANE status-icons in firefox, remain grey-colored :( They suppose to be displaying green-colored KEY-icon.

In host side MacOSX firefox i have exact same extension, and extension is configured to use local 127.0.0.1 as dnssec dns ("unbound") server, and both status-icons (in firefox) are green-colored when that same https://www.dnssec-validator.cz/ or https://www.ISC.org/ websites are visited.

This command (in host MacOSX Terminal) showed below table: netstat -nr

Internet:
Destination        Gateway            Flags        Refs      Use   Netif Expire
default            192.168.10.1       UGSc           13        0     en0
127                127.0.0.1          UCS             0        0     lo0
127.0.0.1          127.0.0.1          UH             39   952572     lo0
169.254            link#4             UCS             0        0     en0
192.168.10         link#4             UCS             0        0     en0
192.168.10.1/32    link#4             UCS             1        0     en0
192.168.10.1       10:6f:3f:xx:xx:xx  UHLWIir        15      639     en0   1153
192.168.10.50/32   link#4             UCS             0        0     en0

In host side, in Mac OSX "Terminal", when i ran below "dig" commands, i did received dns response with "ad" flag & "NOERROR" status, which is indicating my host side dnssec resolving is working fine:

dig @127.0.0.1 in TLSA _443._tcp.www.dnssec-validator.cz. +dnssec
dig @127.0.0.1 in TLSA _443._tcp.www.isc.org. +dnssec

ISC BIND utilities include the "dig" tool, so i obtained BIND 32-bit for windows, zip file, from www.ISC.org website. Decompressed zip file by using 7-Zip, renamed decompressed subfolder into "BIND-UTILS", then moved it inside this new folder C:\Programs\
Inside guest PATH environment variable, i added below at end of existing other folder names/paths: ;C:\Programs\BIND-UTILS\

In guest VM, WinXP, i did these & observed below result:

C:\Documents and Settings\Erik> dig @10.0.2.2 in TLSA _443._tcp.www.isc.org. +dnssec

; <<>> DiG 9.10.2-P1 <<>> @10.0.2.2 in TLSA _443._tcp.www.isc.org. +dnssec
; (1 server found)
;; global options: +cmd
;; connection timed out; no servers could be reached

C:\Documents and Settings\Erik> ipconfig /all

Windows IP Configuration

        Host Name . . . . . . . . . . . . : erik-pc
        Primary Dns Suffix  . . . . . . . :
        Node Type . . . . . . . . . . . . : Unknown
        IP Routing Enabled. . . . . . . . : No
        WINS Proxy Enabled. . . . . . . . : No
        DNS Suffix Search List. . . . . . : nothing.invalid

Ethernet adapter Local Area Connection:

        Connection-specific DNS Suffix  . : nothing.invalid
        Description . . . . . . . . . . . : AMD PCNET Family Ethernet Adapter (P
CI)
        Physical Address. . . . . . . . . : 08-00-27-XX-XX-XX
        Dhcp Enabled. . . . . . . . . . . : Yes
        Autoconfiguration Enabled . . . . : Yes
        IP Address. . . . . . . . . . . . : 10.0.2.15
        Subnet Mask . . . . . . . . . . . : 255.255.255.0
        Default Gateway . . . . . . . . . : 10.0.2.2
        DHCP Server . . . . . . . . . . . : 10.0.2.2
        DNS Servers . . . . . . . . . . . : 10.0.2.2
        Lease Obtained. . . . . . . . . . : Thursday, June 25, 2015 5:48:23 PM
        Lease Expires . . . . . . . . . . : Friday, June 26, 2015 5:48:23 PM

In above, shown "nothing.invalid" in guest WinXP, is obtained by guest from host DNS settings. Inside host MacOS's Network DNS, under "Search Domains" section: "nothing.invalid" is specified.

In guest WinXP, below commands were tried & below result were observed:

C:\Documents and Settings\Erik> ping google.com

Pinging google.com [216.58.216.14] with 32 bytes of data:

PING: transmit failed, error code 31.
Reply from 216.58.216.14: bytes=32 time=21ms TTL=127
Reply from 216.58.216.14: bytes=32 time=11ms TTL=127
Reply from 216.58.216.14: bytes=32 time=19ms TTL=127

Ping statistics for 216.58.216.14:
    Packets: Sent = 4, Received = 3, Lost = 1 (25% loss),
Approximate round trip times in milli-seconds:
    Minimum = 11ms, Maximum = 21ms, Average = 17ms

C:\Documents and Settings\Erik> nslookup google.com
*** Can't find server name for address 10.0.2.2: Non-existent domain
*** Default servers are not available
Server:  UnKnown
Address:  10.0.2.2

Non-authoritative answer:
Name:    google.com
Address:  216.58.216.14

But in guest-side WinXP Firefox, the "DNSSEC" & "TLSA" icons are green-colored when https://www.dnssec-validator.cz/ website is visited. Indicating firefox is able to resolve DNSSEC queries properly.

So PROBLEM is, some apps inside guest VM WinXP are able to resolve DNSSEC query, and some are not able to resolve DNS or DNSSEC queries.

I tried below, in guest WinXP, and received below table:

C:\Documents and Settings\Erik> route PRINT
===========================================================================
Interface List
0x1 ........................... MS TCP Loopback interface
0x10003 ...08 00 27 xx xx xx ...... AMD PCNET Family Ethernet Adapter (PCI) - Pa
cket Scheduler Miniport
===========================================================================
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0         10.0.2.2       10.0.2.15       20
         10.0.2.0    255.255.255.0        10.0.2.15       10.0.2.15       20
        10.0.2.15  255.255.255.255        127.0.0.1       127.0.0.1       20
   10.255.255.255  255.255.255.255        10.0.2.15       10.0.2.15       20
        127.0.0.0        255.0.0.0        127.0.0.1       127.0.0.1       1
        224.0.0.0        240.0.0.0        10.0.2.15       10.0.2.15       20
  255.255.255.255  255.255.255.255        10.0.2.15       10.0.2.15       1
Default Gateway:          10.0.2.2
===========================================================================
Persistent Routes:
  None

What options & solutions are available for my case ? (so that, my guest VM's all apps can use host machine's dnssec dns server).

Should i also install an "unbound" server/resolver inside guest Win-XP ? and should i set it up as a forwarding dns server toward vmnet gateway ip-address 10.0.2.2 (or toward host side 127.0.0.1, how) ?

I would prefer a solution that can keep network adapter at NAT mode, and still able to access host 127.0.0.1:53 from guest-side apps, but how to ? do i need host-only adapter from vbox to access host from guest ?

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.