Upgrading from 2.3.2 -> 2.3.2-p1 - DNS Resolver service failed

[dumplab]

After the upgrade the DNS Resolver doesn't start when using pfBlocker with DNSBL.

Systemlog:
rc.bootup: The command '/usr/local/sbin/unbound -c /var/unbound/unbound.conf' returned exit code '1', the output was '/var/unbound/unbound.conf:93: error: cannot open include file '/var/unbound/pfb_dnsbl.conf': No such file or directory read /var/unbound/unbound.conf failed: 1 errors in configuration file [1475819560] unbound[35120:0] fatal error: Could not read config file: /var/unbound/unbound.conf'

Workaround:

• Disable pfBlocker DNSBL
• Restart DNS Resolver
• Enable pfBlocker DNSBL
• Run Update, the file will be rebuild

….

UPDATE PROCESS START [ 10/07/16 07:43:21 ]

===[  DNSBL Process  ]================================================
Missing DNSBL stats and/or Unbound DNSBL conf file - Rebuilding

After reloading the firewall, the problem still exists

[EDIT] seems to be a only problem when /var in RAM

[tonymorella]

FYI just did the same upgrade and did not have an issue.

[RonpfS]

It is good practice to disable packages like pfBlockerNG, Snort, Suricata, etc that can interfere with internet access or DNS before doing an upgrade.

[BBcan177]

@dumplab:

After the upgrade the DNS Resolver doesn't start when using pfBlocker with DNSBL.

The package has a feature to backup and restore the DNSBL database for RAMDisk installations.

There is an open Redmine, to fix this for certain scenarios:
https://redmine.pfsense.org/issues/6603

[Mr. Jingles]

One year and three heart surgeries later my doc told me not to stress. I did  :P

BB, on my backup pfsense, Dell R200, there is indeed the problem that after the upgrade to 2.3.2-1 Unbound will refuse to start as long as DNSBL is active, and GUI becomes very inresponsive (nonresponsive/nonresponsive/deresponsive/antiresponsive: pick one  :-* ).

[BBcan177]

Hey Mr.J…

Sorry for any added stress.. :)  However, this is something that needs to be fixed in pfSense Unbound... There is an open Redmine here:

https://redmine.pfsense.org/issues/6603

Basically, if you take a backup with DNSBL enabled... Then use this backup configuration in a new machine that doesn't have pfBlockerNG/DNSBL installed, then Unbound will not start since the Unbound Custom options is trying to load "server:include: /var/unbound/pfb_dnsbl.conf"....

So either remove that line, and restart Unbound, or take the future backups with DNSBL disabled...

or create a dummy file :

touch /var/unbound/pfb_dnsbl.conf

Hopefully the devs apply a patch to fix this issue once and for all….

[Ibor Daru]

@BBcan177:

The package has a feature to backup and restore the DNSBL database for RAMDisk installations.

Where can I find that feature precisely? Thanks in advance!

[BBcan177]

@Ibor:

@BBcan177:

The package has a feature to backup and restore the DNSBL database for RAMDisk installations.

Where can I find that feature precisely? Thanks in advance!

Its done automatically in the background when RAMDisks are enabled…. No real need to touch it...