Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Slow DNS after 22.05

    Scheduled Pinned Locked Moved DHCP and DNS
    270 Posts 31 Posters 138.3k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • T
      tentpiglet
      last edited by

      I am also encountering this problem with DNS running on a pfSense VM running on my Proxmox server. Randomly hostnames, like facebook.com, will stop resolving, and then start up again after a brief period of time. No rhyme or reason. No pattern I can find.

      As a temporary workaround, I installed a pihole container on proxmox to provide DNS services to my LAN, serve the pihole DNS address to my clients via DHCP. No issues at all after that, everything works fine.

      Definitely something in the pfSense DNS.

      GertjanG 1 Reply Last reply Reply Quote 0
      • M
        Mikymike82
        last edited by

        I encountered the same issues wit the upgrade to 22.05. After trying some suggestions ont this forum topic and reverting back after comming to the conlusion that noting realy resorted the problem, i have enabled the option: DNS Query Forwarding. After i set this my problems seemed to have been resolved. Any other setting is set to the standard "pfsense" defaults.

        GertjanG 1 Reply Last reply Reply Quote 0
        • GertjanG
          Gertjan @Mikymike82
          last edited by

          @mikymike82 @Kempain @tentpiglet

          If you have to forward to some DNS resolver then the quality of your DNS depends on what this DNS server is answering you.

          If you decide to use the pfSense default DNS setting, pfSense resolves for you using the 13 ( ! ) available root servers, then DNS will work fine.
          I can tell, as I'm using the settings Netgate proposes by default : never had an issue for the last 10+ years.

          These settings (first and third) are not default :

          fb188b8f-cc1e-4783-bb7f-bb4ed43ca9c5-image.png

          "for historical reasons".

          No "help me" PM's please. Use the forum, the community will thank you.
          Edit : and where are the logs ??

          T M 2 Replies Last reply Reply Quote 0
          • T
            tentpiglet @Gertjan
            last edited by

            @gertjan

            My pfSense DNS resolver settings were the 'default' ones provided out of the box. I made no special modifications. DNS resolution was incredibly unstable.

            Switching to the pi-hole container resolved my issues.

            johnpozJ M 2 Replies Last reply Reply Quote 0
            • johnpozJ
              johnpoz LAYER 8 Global Moderator @tentpiglet
              last edited by

              @tentpiglet said in Slow DNS after 22.05:

              DNS resolution was incredibly unstable.

              Do you have IPv6? Other thread around here seems that setting unbound not to use IPv6 in its queries has helped..

              server:
              do-ip6: no
              

              An intelligent man is sometimes forced to be drunk to spend time with his fools
              If you get confused: Listen to the Music Play
              Please don't Chat/PM me for help, unless mod related
              SG-4860 24.11 | Lab VMs 2.8, 24.11

              1 Reply Last reply Reply Quote 0
              • GertjanG
                Gertjan @tentpiglet
                last edited by Gertjan

                @tentpiglet said in Slow DNS after 22.05:

                pfSense VM running on my Proxmox server

                22.05 or 2.6.0 ?

                UNstable means :
                You found it 'not running', and no process 'unbound' was present when you list processes ?
                Or the process unbound was there, but didn't answer ?
                An nslookup from a PC on a LAN failed ?

                C:\Users\gwkro>nslookup
                Server default :   pfSense.main.net
                Address:  192.168.1.1
                
                > facebook.com
                Server :   pfSense.main.net
                Address:  192.168.1.1
                
                Réponse ne faisant pas autorité :
                Nom :    facebook.com
                Addresses:  2a03:2880:f15a:83:face:b00c:0:25de
                          31.13.77.35
                
                >
                

                edit : how many times a day unbound restarts ?
                Just ask your pfSense :

                grep 'start' /var/log/resolver.log
                ......
                <30>1 2022-07-28T09:31:43.284577+02:00 pfSense.main.net unbound 60716 - - [60716:0] info: start of service (unbound 1.15.0).
                <30>1 2022-07-29T14:35:14.991568+02:00 pfSense.main.net unbound 47871 - - [47871:0] info: start of service (unbound 1.15.0).
                <30>1 2022-07-29T14:39:18.227880+02:00 pfSense.main.net unbound 94551 - - [94551:0] info: start of service (unbound 1.15.0).
                <30>1 2022-08-01T00:00:42.825487+02:00 pfSense.main.net unbound 7853 - - [7853:0] info: start of service (unbound 1.15.0).
                <30>1 2022-08-03T10:22:14.251824+02:00 pfSense.main.net unbound 20236 - - [20236:0] info: start of service (unbound 1.15.0).
                <30>1 2022-08-03T10:22:52.446334+02:00 pfSense.main.net unbound 82360 - - [82360:0] info: start of service (unbound 1.15.0).
                <30>1 2022-08-03T11:04:04.591690+02:00 pfSense.main.net unbound 88564 - - [88564:0] info: start of service (unbound 1.15.0).
                <30>1 2022-08-04T08:02:35.997090+02:00 pfSense.main.net unbound 14697 - - [14697:0] info: start of service (unbound 1.15.0).
                <30>1 2022-08-04T10:59:24.370800+02:00 pfSense.main.net unbound 59771 - - [59771:0] info: start of service (unbound 1.15.0).
                <30>1 2022-08-06T10:09:10.552646+02:00 pfSense.main.net unbound 67115 - - [67115:0] info: start of service (unbound 1.15.0).
                <30>1 2022-08-08T00:00:44.809011+02:00 pfSense.main.net unbound 9808 - - [9808:0] info: start of service (unbound 1.15.0).
                <30>1 2022-08-09T10:35:25.013811+02:00 pfSense.main.net unbound 44307 - - [44307:0] info: start of service (unbound 1.15.0).
                

                No "help me" PM's please. Use the forum, the community will thank you.
                Edit : and where are the logs ??

                T 1 Reply Last reply Reply Quote 0
                • M
                  Mikymike82 @Gertjan
                  last edited by

                  @gertjan My PFsense was until the upgrade to 22.05 in "standard config" I have never changed anything to my DNS. I even did a complete new installation to replicate the issue. 22.01 no problems and after upgrading to 22.05 my dns resolution was a complete mess.

                  GertjanG 1 Reply Last reply Reply Quote 1
                  • J
                    Jax
                    last edited by

                    Really, I think it's clear something broke in 22.05 and there's not any point in pretending it's a user problem. We've all experienced this and found some work arounds. Perhaps the maintainers should take a serious look at the code and try to figure out why so many users experienced the same phenomenon.

                    johnpozJ 1 Reply Last reply Reply Quote 3
                    • M
                      Mikymike82 @tentpiglet
                      last edited by

                      @tentpiglet I think my solution might (temporarily) help you out with the DNS issues you and others in this topic are experiencing. 1,5 weeks of stable connection so far.

                      1 Reply Last reply Reply Quote 0
                      • GertjanG
                        Gertjan @Mikymike82
                        last edited by Gertjan

                        @mikymike82 said in Slow DNS after 22.05:

                        my dns resolution was a complete mess

                        What about answering questions ?

                        Btw : I used a bare bone system (old Dell desktop, added a Quad Intel NIC) for nearly 10 years.
                        Since last Juin I'm using a SG 4100. Works great.
                        I have DNS statistics.

                        @jax said in Slow DNS after 22.05:

                        why so many users experienced the same phenomenon

                        120 thousand plus active users - all without DNS ?
                        That is, I can tell that my DNS works. edit : showing another way to see the resolver restarting.

                        @mikymike82 said in Slow DNS after 22.05:

                        22.01 no problems and after upgrading to 22.05

                        If you don't use IPv6, do what @johnpoz said.

                        Btw : I never used 22.01 - 22.01 was pre installed on my 4100, but I upgraded the day I received the unit.

                        No "help me" PM's please. Use the forum, the community will thank you.
                        Edit : and where are the logs ??

                        1 Reply Last reply Reply Quote 0
                        • johnpozJ
                          johnpoz LAYER 8 Global Moderator @Jax
                          last edited by johnpoz

                          @jax said in Slow DNS after 22.05:

                          We've all experienced

                          We are??? I am not having any issues..

                          why so many users experienced the same phenomenon.

                          So many users? like the handful posted here? Where are these users posting that they are having issues? The 1000's and 1000's of them that are running 22.05? All having issues? Some how I have seem to have missed that it was such a wide spread problem - very odd since I am on the board like all day pretty much every day.. And some how I have missed that its everyone having the issue..

                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                          If you get confused: Listen to the Music Play
                          Please don't Chat/PM me for help, unless mod related
                          SG-4860 24.11 | Lab VMs 2.8, 24.11

                          1 Reply Last reply Reply Quote 0
                          • provelsP
                            provels
                            last edited by provels

                            FWIW, I have had no problems on the VM and package set in my sig, clean built 2.6>22.01>22.05. I use IPv4/v6.

                            Peder

                            MAIN - pfSense+ 24.11-RELEASE - Adlink MXE-5401, i7, 16 GB RAM, 64 GB SSD. 500 GB HDD for SyslogNG
                            BACKUP - pfSense+ 23.01-RELEASE - Hyper-V Virtual Machine, Gen 1, 2 v-CPUs, 3 GB RAM, 8GB VHDX (Dynamic)

                            johnpozJ 1 Reply Last reply Reply Quote 0
                            • johnpozJ
                              johnpoz LAYER 8 Global Moderator @provels
                              last edited by

                              @provels But how can that be - we clearly all having issues, maybe your having an issue and just don't know it ;) hehehehe

                              An intelligent man is sometimes forced to be drunk to spend time with his fools
                              If you get confused: Listen to the Music Play
                              Please don't Chat/PM me for help, unless mod related
                              SG-4860 24.11 | Lab VMs 2.8, 24.11

                              1 Reply Last reply Reply Quote 0
                              • K
                                Kempain
                                last edited by

                                Managed to capture some nslookups when DNS bombed out.
                                It's really tricky to troubleshoot because it happens sporadically and randomly.

                                Interestingly requests to pfSense timed out twice, then it only returned an IPv6 address without IPv4, then it returned both IPv6 and IPv4. Maybe this adds some credence to the issue being related to IPv6 but who knows. IPv6 was returned first in this particular case so disabling IPv6 would have likely caused more harm.

                                I still want to check the unbound service to see how often that is restarting which I'll try do later to see if those 2 events line up.

                                pfSense DNS issue.png

                                johnpozJ 1 Reply Last reply Reply Quote 1
                                • johnpozJ
                                  johnpoz LAYER 8 Global Moderator @Kempain
                                  last edited by

                                  @kempain said in Slow DNS after 22.05:

                                  I still want to check the unbound service to see how often that is restarting which I'll try do later to see if those 2 events line up.

                                  Also simple enough to just see how long its been running..

                                  [22.05-RELEASE][admin@sg4860.local.lan]/root: unbound-control -c /var/unbound/unbound.conf status
                                  version: 1.15.0
                                  verbosity: 1
                                  threads: 4
                                  modules: 2 [ validator iterator ]
                                  uptime: 333105 seconds
                                  options: control(ssl)
                                  unbound (pid 13952) is running...
                                  [22.05-RELEASE][admin@sg4860.local.lan]/root: 
                                  

                                  So mine has been up 333K seconds, or getting close to 4 days.. Last time I posted it was like 10 days, another 6 days. I tend to restart it when doing something for some thread, where they need an option or something - think last one someone was asking how to block youtube, etc.

                                  But you have no purposely restarted unbound/pfsense and your status shows that its only been up a short amount of time - something is wrong.

                                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                                  If you get confused: Listen to the Music Play
                                  Please don't Chat/PM me for help, unless mod related
                                  SG-4860 24.11 | Lab VMs 2.8, 24.11

                                  K 1 Reply Last reply Reply Quote 1
                                  • K
                                    Kempain @johnpoz
                                    last edited by

                                    Cheers @johnpoz

                                    So looks like mine is restarting relatively regularly.

                                    dbdb9a92-dfdd-4159-9b5f-537e3ea23d6b-image.png

                                    af33088e-4a2a-4d63-8268-ec48cf2b320d-image.png

                                    Cool_CoronaC 1 Reply Last reply Reply Quote 0
                                    • Cool_CoronaC
                                      Cool_Corona @Kempain
                                      last edited by

                                      590ff612-b03d-4008-bf5e-b0cd5afba061-billede.png

                                      Unbound on 2.5.2

                                      johnpozJ 1 Reply Last reply Reply Quote 0
                                      • johnpozJ
                                        johnpoz LAYER 8 Global Moderator @Cool_Corona
                                        last edited by

                                        @cool_corona @Kempain 300 some seconds unbound being up, doesn't bode well for caching name server ;)

                                        An intelligent man is sometimes forced to be drunk to spend time with his fools
                                        If you get confused: Listen to the Music Play
                                        Please don't Chat/PM me for help, unless mod related
                                        SG-4860 24.11 | Lab VMs 2.8, 24.11

                                        Cool_CoronaC 1 Reply Last reply Reply Quote 0
                                        • Cool_CoronaC
                                          Cool_Corona @johnpoz
                                          last edited by

                                          @johnpoz How to track all unbound restarts?

                                          1 Reply Last reply Reply Quote 0
                                          • T
                                            tentpiglet @Gertjan
                                            last edited by

                                            @johnpoz said in Slow DNS after 22.05:

                                            Do you have IPv6?

                                            No. Although I think pfSense assigns a link local address to my wan and lan interface, my ISP does not provide me with a ip6 address.

                                            @gertjan said in Slow DNS after 22.05:

                                            22.05 or 2.6.0 ?

                                            22.05-RELEASE (amd64)
                                            built on Wed Jun 22 18:56:13 UTC 2022
                                            FreeBSD 12.3-STABLE

                                            UNstable means :
                                            You found it 'not running', and no process 'unbound' was present when you list processes ?
                                            Or the process unbound was there, but didn't answer ?
                                            An nslookup from a PC on a LAN failed ?

                                            unstable means I'm using a browser on a client and I get a "DNS_PROBE_FINISHED_NXDOMAIN" error (google chome), and when I hit the reload button a few moments later, the page will be found.

                                            edit : how many times a day unbound restarts ?

                                            grep 'start of service' /var/log/resolver.log | wc -l

                                            64

                                            first entry was at 10:21am local time this morning, so that's over the past 2 hours.

                                            johnpozJ 1 Reply Last reply Reply Quote 1
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.