How To Access DNSSEC DNS Server Listening On 127.0.0.1:53 On Mac OSX Host, From VirtualBox Guest VM Windows XP Prof 32-bit ?
My host/physical computer machine is an Apple MacBook with Mac OS X (64-bit, Yosemite 10.10.3).
Host MacOSX is running VirtualBox (VBox) hypervisor software.
Host MacOSX also has "unbound", a full-dnssec dns server/resolver, running-at & listening-on 127.0.0.1:53 (ip.address:port). The "unbound" is functioning as a DNSSEC DNS Validating Resolver. Unbound was obtained via Homebrew, and then it needed further configuration.
I have used steps, processes & general instruction, shown in below link, to load & enable "Unbound", a full DNSSEC DNS Server/Resolver in Mac OSX:
Primary network adapter in host MacOS currently using DHCP dynamic (not fixed) ip-address 192.168.10.50, obtained from my local router/gateway 192.168.10.1
My guest VM (virtual machine) name: "WinXP", and OS is Windows XP prof 32-bit, it also has 512MB RAM, 6GB (virtual) Hard Drive, 1 CPU core.
VBox (VirtualBox) Network Adapter 1 is by-default set into (or "Attached to") NAT mode. All other vbox network adapters are disabled. So ip-address inside guest-VM currently is 10.0.2.15 . Guest gateway+dhcp+dns is now 10.0.2.2
Inside guest side WinXP Firefox web-browser, i have installed "DNSSEC-TLSA validator" extension, from https://www.dnssec-validator.cz/ website. DNSSEC & TLSA validator extension is then configured currently to use the 10.0.2.2 as a dnssec dns server.
But when i visit www.Dnssec-Validator.cz ( or https://www.isc.org/ ) website, both "DNSSEC" & "TLSA"/DANE status-icons in firefox, remain grey-colored :( They suppose to be displaying green-colored KEY-icon.
In host side MacOSX firefox i have exact same extension, and extension is configured to use local 127.0.0.1 as dnssec dns ("unbound") server, and both status-icons (in firefox) are green-colored when that same https://www.dnssec-validator.cz/ or https://www.ISC.org/ websites are visited.
This command (in host MacOSX Terminal) showed below table: netstat -nr
Internet: Destination Gateway Flags Refs Use Netif Expire default 192.168.10.1 UGSc 13 0 en0 127 127.0.0.1 UCS 0 0 lo0 127.0.0.1 127.0.0.1 UH 39 952572 lo0 169.254 link#4 UCS 0 0 en0 192.168.10 link#4 UCS 0 0 en0 192.168.10.1/32 link#4 UCS 1 0 en0 192.168.10.1 10:6f:3f:xx:xx:xx UHLWIir 15 639 en0 1153 192.168.10.50/32 link#4 UCS 0 0 en0
In host side, in Mac OSX "Terminal", when i ran below "dig" commands, i did received dns response with "ad" flag & "NOERROR" status, which is indicating my host side dnssec resolving is working fine:
dig @127.0.0.1 in TLSA _443._tcp.www.dnssec-validator.cz. +dnssec dig @127.0.0.1 in TLSA _443._tcp.www.isc.org. +dnssec
ISC BIND utilities include the "dig" tool, so i obtained BIND 32-bit for windows, zip file, from www.ISC.org website. Decompressed zip file by using 7-Zip, renamed decompressed subfolder into "BIND-UTILS", then moved it inside this new folder C:\Programs\
Inside guest PATH environment variable, i added below at end of existing other folder names/paths:
In guest VM, WinXP, i did these & observed below result:
C:\Documents and Settings\Erik> dig @10.0.2.2 in TLSA _443._tcp.www.isc.org. +dnssec ; <<>> DiG 9.10.2-P1 <<>> @10.0.2.2 in TLSA _443._tcp.www.isc.org. +dnssec ; (1 server found) ;; global options: +cmd ;; connection timed out; no servers could be reached C:\Documents and Settings\Erik> ipconfig /all Windows IP Configuration Host Name . . . . . . . . . . . . : erik-pc Primary Dns Suffix . . . . . . . : Node Type . . . . . . . . . . . . : Unknown IP Routing Enabled. . . . . . . . : No WINS Proxy Enabled. . . . . . . . : No DNS Suffix Search List. . . . . . : nothing.invalid Ethernet adapter Local Area Connection: Connection-specific DNS Suffix . : nothing.invalid Description . . . . . . . . . . . : AMD PCNET Family Ethernet Adapter (P CI) Physical Address. . . . . . . . . : 08-00-27-XX-XX-XX Dhcp Enabled. . . . . . . . . . . : Yes Autoconfiguration Enabled . . . . : Yes IP Address. . . . . . . . . . . . : 10.0.2.15 Subnet Mask . . . . . . . . . . . : 255.255.255.0 Default Gateway . . . . . . . . . : 10.0.2.2 DHCP Server . . . . . . . . . . . : 10.0.2.2 DNS Servers . . . . . . . . . . . : 10.0.2.2 Lease Obtained. . . . . . . . . . : Thursday, June 25, 2015 5:48:23 PM Lease Expires . . . . . . . . . . : Friday, June 26, 2015 5:48:23 PM
In above, shown "nothing.invalid" in guest WinXP, is obtained by guest from host DNS settings. Inside host MacOS's Network DNS, under "Search Domains" section: "nothing.invalid" is specified.
In guest WinXP, below commands were tried & below result were observed:
C:\Documents and Settings\Erik> ping google.com Pinging google.com [22.214.171.124] with 32 bytes of data: PING: transmit failed, error code 31. Reply from 126.96.36.199: bytes=32 time=21ms TTL=127 Reply from 188.8.131.52: bytes=32 time=11ms TTL=127 Reply from 184.108.40.206: bytes=32 time=19ms TTL=127 Ping statistics for 220.127.116.11: Packets: Sent = 4, Received = 3, Lost = 1 (25% loss), Approximate round trip times in milli-seconds: Minimum = 11ms, Maximum = 21ms, Average = 17ms C:\Documents and Settings\Erik> nslookup google.com *** Can't find server name for address 10.0.2.2: Non-existent domain *** Default servers are not available Server: UnKnown Address: 10.0.2.2 Non-authoritative answer: Name: google.com Address: 18.104.22.168
But in guest-side WinXP Firefox, the "DNSSEC" & "TLSA" icons are green-colored when https://www.dnssec-validator.cz/ website is visited. Indicating firefox is able to resolve DNSSEC queries properly.
So PROBLEM is, some apps inside guest VM WinXP are able to resolve DNSSEC query, and some are not able to resolve DNS or DNSSEC queries.
I tried below, in guest WinXP, and received below table:
C:\Documents and Settings\Erik> route PRINT =========================================================================== Interface List 0x1 ........................... MS TCP Loopback interface 0x10003 ...08 00 27 xx xx xx ...... AMD PCNET Family Ethernet Adapter (PCI) - Pa cket Scheduler Miniport =========================================================================== =========================================================================== Active Routes: Network Destination Netmask Gateway Interface Metric 0.0.0.0 0.0.0.0 10.0.2.2 10.0.2.15 20 10.0.2.0 255.255.255.0 10.0.2.15 10.0.2.15 20 10.0.2.15 255.255.255.255 127.0.0.1 127.0.0.1 20 10.255.255.255 255.255.255.255 10.0.2.15 10.0.2.15 20 127.0.0.0 255.0.0.0 127.0.0.1 127.0.0.1 1 22.214.171.124 240.0.0.0 10.0.2.15 10.0.2.15 20 255.255.255.255 255.255.255.255 10.0.2.15 10.0.2.15 1 Default Gateway: 10.0.2.2 =========================================================================== Persistent Routes: None
What options & solutions are available for my case ? (so that, my guest VM's all apps can use host machine's dnssec dns server).
Should i also install an "unbound" server/resolver inside guest Win-XP ? and should i set it up as a forwarding dns server toward vmnet gateway ip-address 10.0.2.2 (or toward host side 127.0.0.1, how) ?
I would prefer a solution that can keep network adapter at NAT mode, and still able to access host 127.0.0.1:53 from guest-side apps, but how to ? do i need host-only adapter from vbox to access host from guest ?