Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Netgate 1100 dns stops

    General pfSense Questions
    6
    50
    4.7k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • stephenw10S
      stephenw10 Netgate Administrator
      last edited by

      It's not actually unusual to see that logged multiple times when Unbound is restarted. And that isn't usually a sign of a problem. For example here I restarted manually it on my edge, logs filtered for restarts:

      Sep 23 15:57:15 	unbound 	97113 	[97113:0] info: start of service (unbound 1.15.0).
Sep 23 15:57:17 	unbound 	97113 	[97113:0] info: start of service (unbound 1.15.0).
Sep 23 15:57:18 	unbound 	97113 	[97113:0] info: start of service (unbound 1.15.0).
Sep 23 15:57:20 	unbound 	97113 	[97113:0] info: start of service (unbound 1.15.0).
Sep 23 15:57:41 	unbound 	97113 	[97113:0] info: start of service (unbound 1.15.0).
Sep 23 15:57:42 	unbound 	97113 	[97113:0] info: start of service (unbound 1.15.0).

      The question of how Unbound is managed is... another question! 😉
      But it should not stop t responding normally after that.

      Steve

      GertjanG 1 Reply Last reply Reply Quote 0
      • GertjanG
        Gertjan @stephenw10
        last edited by

        @stephenw10
        Manually restarting, because, for example, your editing the config, is normal.

        This is a more graphical way to look at my unbound restarts.

        and most of these restarts are a result of of my interaction with unbound, directly, or indirectly, like me trying out things with pfBlockerng-devel - like switching between unbound and python mode so I think I can answer something here on the forum after testing it myself

        When I'm not at work for a week - then unbound won't restart in that week.
        Only pfBlockerng-devel will break that cycle.
        For me, unbound 1.15.0, is very stable.

        Using 22.05 on a 4100 - and yes, I'm using IPv4 (two third of the traffic) and IPv6 (one third of the traffic).

        No "help me" PM's please. Use the forum, the community will thank you.
        Edit : and where are the logs ??

        1 Reply Last reply Reply Quote 0
        • stephenw10S
          stephenw10 Netgate Administrator
          last edited by

          Yup, it doesn't restart often for me either but when it does it logs several restarts in a row like that.

          When OP checks his resolver logs I would expect it to show that as the last thing that happened. If it was showing continuous restarts that would be a much bigger issue.

          If the Unbound service just stops a cannot be restarted I expect to see some errors logged either in the Resolver or System log.

          Steve

          1 Reply Last reply Reply Quote 0
          • F
            Freek_Box @Gertjan
            last edited by

            @gertjan

            Running version 21.05.2-RELEASE (arm64)

            1 Reply Last reply Reply Quote 0
            • stephenw10S
              stephenw10 Netgate Administrator
              last edited by

              Any reason you're not running something newer?

              F 1 Reply Last reply Reply Quote 0
              • F
                Freek_Box @stephenw10
                last edited by

                @stephenw10

                4d36ffaf-13b6-4d85-b4c1-b908216f494c-image.png

                I asume I'm on the latest version?

                S GertjanG 2 Replies Last reply Reply Quote 0
                • S
                  SteveITS Rebel Alliance @Freek_Box
                  last edited by

                  @freek_box Nope, that's last year.
                  https://docs.netgate.com/pfsense/en/latest/releases/index.html#pfsense-plus-software
                  https://docs.netgate.com/pfsense/en/latest/troubleshooting/upgrades.html#upgrade-not-offered-library-errors

                  Pre-2.7.2/23.09: Only install packages for your version, or risk breaking it. Select your branch in System/Update/Update Settings.
                  When upgrading, allow 10-15 minutes to restart, or more depending on packages and device speed.
                  Upvote 👍 helpful posts!

                  F 1 Reply Last reply Reply Quote 1
                  • GertjanG
                    Gertjan @Freek_Box
                    last edited by

                    @freek_box said in Netgate 1100 dns stops:

                    I asume I'm on the latest version?

                    Add the RSS widget on your dashboard :

                    756b3318-6899-48c8-91d0-0a25b10033c0-image.png

                    https://www.netgate.com/blog/pfsense-plus-software-version-22.05-now-available
                    so you'll have a double check on what happening and available.

                    This :

                    298af18d-a1a5-4249-8f25-b9cb40fb8653-image.png

                    is strange.
                    The check for available updates succeeded, but the info coming back said "21.05.2-Release", so, you're fine.
                    As already said above, use the Troubleshooting Upgrades suggestions. You will find 22.05 avaible.

                    No "help me" PM's please. Use the forum, the community will thank you.
                    Edit : and where are the logs ??

                    1 Reply Last reply Reply Quote 0
                    • F
                      Freek_Box @SteveITS
                      last edited by

                      @steveits

                      I did the:
                      Navigate to System > Updates
                      Set Branch to Previous stable version
                      Wait a few moments for the upgrade check to complete

                      But now it shows:

                      74666a34-5166-417d-a38b-de6f51a7e7c4-image.png

                      1 Reply Last reply Reply Quote 0
                      • stephenw10S
                        stephenw10 Netgate Administrator
                        last edited by

                        At the command line run:

                        pkg-static -d update

                        What error does it return?

                        1 Reply Last reply Reply Quote 0
                        • F
                          Freek_Box
                          last edited by

                          @stephenw10

                          DBG(1)[40213]> pkg initialized
                          Updating pfSense-core repository catalogue...
                          DBG(1)[40213]> PkgRepo: verifying update for pfSense-core
                          DBG(1)[40213]> Pkgrepo, begin update of '/var/db/pkg/repo-pfSense-core.sqlite'
                          DBG(1)[40213]> Request to fetch pkg+https://repo.netgate.com/pkg/pfSense_plus-v21_05_2_aarch64-core/meta.conf
                          DBG(1)[40213]> opening libfetch fetcher
                          DBG(1)[40213]> Fetch > libfetch: connecting
                          DBG(1)[40213]> Fetch: fetching from: https://repo00.atx.netgate.com/pkg/pfSense_plus-v21_05_2_aarch64-core/meta.conf with opts "i"
                          1082900480:error:141F0006:SSL routines:tls_construct_cert_verify:EVP lib:/var/jenkins/workspace/pfSense-build-release-tarballs/BUILD_NODE/pkg-aarch64/OS_MAJOR_VERSION/freebsd12/PLATFORM/aws/crypto/openssl/ssl/statem/statem_lib.c:283:
                          DBG(1)[40213]> Fetch: fetching from: https://repo00.atx.netgate.com/pkg/pfSense_plus-v21_05_2_aarch64-core/meta.conf with opts "i"
                          Certificate verification failed for /C=US/ST=Texas/L=Austin/O=Rubicon Communications, LLC (Netgate)/CN=repo00.atx.netgate.com
                          1082900480:error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed:/var/jenkins/workspace/pfSense-build-release-tarballs/BUILD_NODE/pkg-aarch64/OS_MAJOR_VERSION/freebsd12/PLATFORM/aws/crypto/openssl/ssl/statem/statem_clnt.c:1915:
                          Segmentation fault (core dumped)

                          1 Reply Last reply Reply Quote 0
                          • F
                            Freek_Box
                            last edited by

                            When I do:
                            pkg-static clean -ay; pkg-static install -fy pkg pfSense-repo pfSense-upgrade

                            I get:
                            pkg-static: Repository pfSense missing. 'pkg update' required
                            pkg-static: No package database installed. Nothing to do!
                            Updating pfSense-core repository catalogue...
                            1082900480:error:141F0006:SSL routines:tls_construct_cert_verify:EVP lib:/var/jenkins/workspace/pfSense-build-release-tarballs/BUILD_NODE/pkg-aarch64/OS_MAJOR_VERSION/freebsd12/PLATFORM/aws/crypto/openssl/ssl/statem/statem_lib.c:283:
                            Certificate verification failed for /C=US/ST=Texas/L=Austin/O=Rubicon Communications, LLC (Netgate)/CN=repo01.atx.netgate.com
                            1082900480:error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed:/var/jenkins/workspace/pfSense-build-release-tarballs/BUILD_NODE/pkg-aarch64/OS_MAJOR_VERSION/freebsd12/PLATFORM/aws/crypto/openssl/ssl/statem/statem_clnt.c:1915:
                            Child process pid=4480 terminated abnormally: Segmentation fault

                            1 Reply Last reply Reply Quote 0
                            • stephenw10S
                              stephenw10 Netgate Administrator
                              last edited by

                              The segfault like that indicates the crypto chip is in an unreachable state. You need to completely power cycle the device to reset it. So halt the device then remove the power for 10s or so. It should update correctly when rebooted.
                              https://docs.netgate.com/pfsense/en/latest/troubleshooting/upgrades.html#segmentation-fault-in-pkg

                              Steve

                              F leresL 2 Replies Last reply Reply Quote 0
                              • F
                                Freek_Box @stephenw10
                                last edited by

                                @stephenw10

                                I have no possibility to unplug it is that a problem? The device is hours away from me.

                                S 1 Reply Last reply Reply Quote 0
                                • S
                                  SteveITS Rebel Alliance @Freek_Box
                                  last edited by

                                  @freek_box If you click that doc page URL it's a known issue. It shouldn't affect normal operations but does affect packages and therefore upgrades. I believe it's just a one time fix though. I haven't had it recur on my 2100.

                                  Pre-2.7.2/23.09: Only install packages for your version, or risk breaking it. Select your branch in System/Update/Update Settings.
                                  When upgrading, allow 10-15 minutes to restart, or more depending on packages and device speed.
                                  Upvote 👍 helpful posts!

                                  1 Reply Last reply Reply Quote 0
                                  • stephenw10S
                                    stephenw10 Netgate Administrator
                                    last edited by

                                    Unfortunately I know of no other way to reset that once it has entered that state. It will not be able to connect to the update repo until the crypto chip is reachable again.

                                    F 1 Reply Last reply Reply Quote 0
                                    • F
                                      Freek_Box @stephenw10
                                      last edited by

                                      @stephenw10 only rebooting is not enough?

                                      GertjanG stephenw10S 2 Replies Last reply Reply Quote 0
                                      • GertjanG
                                        Gertjan @Freek_Box
                                        last edited by Gertjan

                                        @freek_box
                                        Noop.
                                        The 'crypto chip' van't be reset using a command.
                                        A 10 seconds power down can bring it back online.

                                        edit : that is : a clean, commanded power down by the GUI or console(SSH),. Some ripping out the power and put it back in again could create other issues like a dirty file system.

                                        So : console or SSH option 6.
                                        Or GUI : Diagnostics > Halt System
                                        Let the system shut down.
                                        Then, remove the power for 10 seconds.
                                        Power back in.
                                        Done.

                                        No "help me" PM's please. Use the forum, the community will thank you.
                                        Edit : and where are the logs ??

                                        1 Reply Last reply Reply Quote 0
                                        • stephenw10S
                                          stephenw10 Netgate Administrator @Freek_Box
                                          last edited by

                                          @freek_box said in Netgate 1100 dns stops:

                                          only rebooting is not enough?

                                          It is not. The crypto chip remains powered as long as the PSU is connected to the device.

                                          Steve

                                          1 Reply Last reply Reply Quote 0
                                          • F
                                            Freek_Box
                                            last edited by

                                            So how do I know if I'm on the correct version? I also have a VPS running with version:
                                            a8e32727-a8c5-41de-8bfa-c86b0675cc45-image.png

                                            GertjanG 1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post