unbound and the trick is to use
ipfilter for translating the incoming client DNS queries to 10.139.1.1 and 10.139.1.2. By default these are forwarded to next netvm in chain (if I understand it correctly). This translation is usually done automatically on VPN qubes that use NetworkManager via its own hooks. But since I didn’t want to run NetworkManager, I had to do it myself.
I added following code to
# This will Flush PR-QBS chain
iptables -t nat -F PR-QBS
# Redirects all the DNS traffic to localhost:53
iptables -t nat -I PR-QBS -i vif+ -p udp --dport 53 -j DNAT --to-destination 127.0.0.1
# Accepts the traffic coming to localhost
# from XEN's virtual interfaces on port 53
iptables -I INPUT -i vif+ -p udp --dport 53 -d 127.0.0.1 -j ACCEPT
# Enable the traffic coming from the virtual interfaces
# forwarded to the loopback interface
# enabling the route_localnet flag on them
echo 1 > /proc/sys/net/ipv4/conf/default/route_localnet
So my unbound service is listening to 127.0.0.1, and that’s also what I have in
/etc/resolv.conf (for local testing on the unbound box).