unbound stops responding every hour
-
Hi,
for quite some time I have noticed name resolution problems behind my pfsense installation. Further debugging shows that the pfsense with unbound enabled fails to resolve names every hour:
Sa. 10 Sep. 2022 11:00:22 CEST ;; connection timed out; no servers could be reached
Sa. 10 Sep. 2022 11:00:40 CEST ;; Query time: 227 msec
Sa. 10 Sep. 2022 11:00:55 CEST ;; Query time: 87 msec
Sa. 10 Sep. 2022 11:01:10 CEST ;; Query time: 150 msec
Sa. 10 Sep. 2022 11:01:26 CEST ;; connection timed out; no servers could be reached...
Sa. 10 Sep. 2022 11:59:53 CEST ;; Query time: 4 msec
Sa. 10 Sep. 2022 12:00:08 CEST ;; connection timed out; no servers could be reached
Sa. 10 Sep. 2022 12:00:26 CEST ;; connection timed out; no servers could be reached
Sa. 10 Sep. 2022 12:00:44 CEST ;; connection timed out; no servers could be reached
Sa. 10 Sep. 2022 12:01:02 CEST ;; connection timed out; no servers could be reached
Sa. 10 Sep. 2022 12:01:20 CEST ;; connection timed out; no servers could be reached
Sa. 10 Sep. 2022 12:01:38 CEST ;; Query time: 1 msecThis is very consistent and every hour. I do not see unbound reloads or restarts. I am using surricata and pfblockerng. pfblockerng updates are set to daily so they should not influence this. I looked at all syslogs available but am at a loss as to where to look. I am pretty sure I did not have this with 2.5 but cannot really prove this.
Any help would be greatly appreciated. What could this be?
Cron jobs look unsuspicious as well.
dhcp is setup so that new ip addresses are not reported to unbound and trigger restarts/reloads.
-
Some additional information.
I disabled surricata without any change. I tcpdumped dns. When this occurs (very shortly after the full hour) I can still see incoming dns requests on the LAN interface but no responses back whatsoever. It really looks as if unbound itself stops operating for roughly 60-90 seconds at least on the inside facing interfaces for no apparent reason.
Loglevel increase has so far not helped. will increase to maximum to see what happens....
-
Looks as if this is related to the "enable python module" and pfblockerng. I disabled both and since then it runs smoothly. This is somewhat consistent with some "remains in waiting" state messages I spotted in the log.