Cannot access dns resolver settings
-
pfSense 23.01 & pfBlockerNG 3.2.0_3 with "unbound python mode".
In the above state when I select "Services -> DNS Resolver" then General settings pulls up a text page of options "General DNS Resolver Options" and the page cannot be closed nor removed without editing the URL. My url is https://192.168.x.x/services_unbound.php
This page does not allow me to move beyond it like it used to in the past versions of -devel (I only recently switched to the standard package).
Even it this is to act as a warning that the pfSense page being blocked is purposeful because of the DNSBL mode setting I should not have to edit the url to move to a different menu page.
-
@jonh Screenshot?
The Resolver page is pfSense not part of pfBlocker. It should show the normal site menus etc. -
Thanks for your quick response.
Sorry, I thought I saw this same sort of page in -devel but I'm obviously mistaken.I just disabled pfBlockerNG thinking I could access the resolver but I'm still stuck on this page, even tried reboot.
-
@jonh That looks like the bottom of the page, skipping all the settings above that. Also appears to be missing formatting/CSS, unless an alt theme is being used…? Hmm, if so change to the default theme.
Any problems while upgrading? Did you restart early by chance?
-
@steveits said in Cannot access dns resolver settings:
@jonh That looks like the bottom of the page, skipping all the settings above that. Also appears to be missing formatting/CSS, unless an alt theme is being used…? Hmm, if so change to the default theme.
I never changed the theme. It is pfSense although now that you have mentioned it I'll cycle through all the others.
Any problems while upgrading?
No, everything worked quite well. I upgraded the same day it was released.
Did you restart early by chance?
Not that I can recall. In fact, doesn't it just simply restart itself? My best memory is I did nothing, it just restarted. FWIW, I'm running on an SG-5100
I've been having DNS problems and toggling back and forth between pfBlockerNG unbound & 'unbound using python' trying to figure out where my problem is.
Last week I had toggled DNS logging to level 3. After installing the latest release of pfBlockerNG pkg I revisited the DNS page and toggled logging back to level 1. Today I started having the same issues with DNS servfails and toggled it back to level 3 again. Now, I'm getting stuck with the page display and oddly am unable to navigate away from it without editing the url path.
-
@jonh ok, sometimes people wait 5-10 minutes and reboot early assuming it’s stuck.
Browser cache??
Re:DNS, there are a few recent threads. If you use forwarding uncheck the option to use DNSSEC. There’s also a patch because it doesn’t set the correct ACLs for IPv6 if set to listen on All interfaces.
-
@steveits said in Cannot access dns resolver settings:
@jonh ok, sometimes people wait 5-10 minutes and reboot early assuming it’s stuck.
Browser cache??
I'll try that
Switching theme to dark did not make any difference.
Re:DNS, there are a few recent threads.
I've been reading them but not having much luck.
If you use forwarding uncheck the option to use DNSSEC.
Not using forwarding although I switched to it briefly last week trying to get a stable platform. But I've been on Resolver for quite awhile.
There’s also a patch because it doesn’t set the correct ACLs for IPv6 if set to listen on All interfaces.
Not using IPv6
-
@steveits said in Cannot access dns resolver settings:
@jonh ok, sometimes people wait 5-10 minutes and reboot early assuming it’s stuck.
Browser cache??
That was it.
Cleared cache, logged out & closed the browser page, and then the browser itself.
Logged back in and the offending page popped up but allowed me to click around it and close, revealing the settings page.
Thanks!
Now on to trying to get rid of these DNS servfails that happen off & on without rhyme or reason.
-
@jonh said in Cannot access dns resolver settings:
Now on to trying to get rid of these DNS servfails
Ask the unbound/resolver log how often unbound restarts :
grep 'of unbound' /var/log/resolver.log
as, while doing so, DNS is not available for that a (small) moment.
-
@gertjan said in Cannot access dns resolver settings:
@jonh said in Cannot access dns resolver settings:
Now on to trying to get rid of these DNS servfails
Ask the unbound/resolver log how often unbound restarts :
grep 'of unbound' /var/log/resolver.log
as, while doing so, DNS is not available for that a (small) moment.
Thank you for this idea. On the day that I posted this query there were no unbound restarts. However, this morning there were a total of 3. Here is the output of one of these restarts. It happens at time :45 seconds. I get a fair number of those outnettcp errors but not many of them precede a restart. No one was using their devices at this time so it was not noticed when it happened.
I'm using quad9 for dns, in general settings I have 9.9.9.9 & 149.112.112.112
This morning while trying to open a nytimes story (via link from mastodon) my iPad timed out after 1 minute with server didn't answer. I have confirmed that unbound did not restart at that time but have to yet isolated the exact resolver log entries during that event.
All that said, it appears that unbound is NOT my problem although during earlier problems restarting unbound 'fixed' it. Apparently a coincidence.
Does my log entries offer any ideas?
Feb 24 10:15:26 pfSense unbound[28020]: [28020:3] debug: cache memory msg=642930 rrset=682189 infra=8306 val=0 Feb 24 10:15:30 pfSense unbound[28020]: [28020:2] debug: outnettcp got tcp error -1 Feb 24 10:15:30 pfSense unbound[28020]: [28020:2] debug: outnettcp got tcp error -1 Feb 24 10:15:32 pfSense unbound[28020]: [28020:3] debug: outnettcp got tcp error -1 Feb 24 10:15:32 pfSense unbound[28020]: [28020:1] debug: outnettcp got tcp error -1 Feb 24 10:15:32 pfSense unbound[28020]: [28020:1] debug: outnettcp got tcp error -1 Feb 24 10:15:32 pfSense unbound[28020]: [28020:3] debug: outnettcp got tcp error -1 Feb 24 10:15:33 pfSense unbound[28020]: [28020:3] debug: outnettcp got tcp error -1 Feb 24 10:15:33 pfSense unbound[28020]: [28020:3] debug: outnettcp got tcp error -1 Feb 24 10:15:34 pfSense unbound[28020]: [28020:3] debug: outnettcp got tcp error -1 Feb 24 10:15:35 pfSense unbound[28020]: [28020:1] debug: outnettcp got tcp error -1 Feb 24 10:15:36 pfSense unbound[28020]: [28020:3] debug: outnettcp got tcp error -1 Feb 24 10:15:36 pfSense unbound[28020]: [28020:3] debug: outnettcp got tcp error -1 Feb 24 10:15:36 pfSense unbound[28020]: [28020:3] debug: outnettcp got tcp error -1 Feb 24 10:15:36 pfSense unbound[28020]: [28020:3] debug: outnettcp got tcp error -1 Feb 24 10:15:36 pfSense unbound[28020]: [28020:3] debug: outnettcp got tcp error -1 Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] debug: new control connection from 127.0.0.1 port 10564 Feb 24 10:15:45 **pfSense unbound[28020]: [28020:0] info: control cmd: reload** Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info: service stopped (unbound 1.17.1). Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info: server stats for thread 0: 2271 queries, 1072 answers from cache, 1199 recursions, 50 prefetch, 0 rejected by ip ratelimiting Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info: server stats for thread 0: requestlist max 33 avg 6.01521 exceeded 0 jostled 0 Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info: mesh has 0 recursion states (0 with reply, 0 detached), 0 waiting replies, 1199 recursion replies sent, 0 replies dropped, 0 states jostled out Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info: average recursion processing time 30.967323 sec Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info: histogram of recursion processing times Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info: [25%]=0.0428481 median[50%]=0.109035 [75%]=24.963 Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info: lower(secs) upper(secs) recursions Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info: 0.000000 0.000001 215 Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info: 0.016384 0.032768 2 Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info: 0.032768 0.065536 269 Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info: 0.065536 0.131072 171 Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info: 0.131072 0.262144 78 Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info: 0.262144 0.524288 23 Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info: 0.524288 1.000000 18 Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info: 1.000000 2.000000 21 Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info: 2.000000 4.000000 12 Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info: 4.000000 8.000000 20 Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info: 8.000000 16.000000 40 Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info: 16.000000 32.000000 54 Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info: 32.000000 64.000000 53 Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info: 64.000000 128.000000 116 Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info: 128.000000 256.000000 87 Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info: 256.000000 512.000000 20 Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] debug: cache memory msg=66072 rrset=66072 infra=8306 val=0 Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info: server stats for thread 1: 6133 queries, 2495 answers from cache, 3638 recursions, 125 prefetch, 0 rejected by ip ratelimiting Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info: server stats for thread 1: requestlist max 37 avg 5.7486 exceeded 0 jostled 0 Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info: mesh has 0 recursion states (0 with reply, 0 detached), 0 waiting replies, 3638 recursion replies sent, 0 replies dropped, 0 states jostled out Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info: average recursion processing time 29.475670 sec Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info: histogram of recursion processing times Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info: [25%]=0.0446824 median[50%]=0.0828214 [75%]=16.8889 Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info: lower(secs) upper(secs) recursions Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info: 0.000000 0.000001 475 Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info: 0.001024 0.002048 1 Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info: 0.008192 0.016384 3 Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info: 0.016384 0.032768 4 Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info: 0.032768 0.065536 1173 Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info: 0.065536 0.131072 618 Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info: 0.131072 0.262144 254 Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info: 0.262144 0.524288 57 Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info: 0.524288 1.000000 35 Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info: 1.000000 2.000000 24 Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info: 2.000000 4.000000 22 Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info: 4.000000 8.000000 43 Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info: 8.000000 16.000000 18 Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info: 16.000000 32.000000 27 Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info: 32.000000 64.000000 178 Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info: 64.000000 128.000000 367 Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info: 128.000000 256.000000 309 Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info: 256.000000 512.000000 30 Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] debug: cache memory msg=66072 rrset=66072 infra=8306 val=0 Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info: server stats for thread 2: 2843 queries, 1147 answers from cache, 1696 recursions, 50 prefetch, 0 rejected by ip ratelimiting Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info: server stats for thread 2: requestlist max 37 avg 8.39233 exceeded 0 jostled 0 Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info: mesh has 0 recursion states (0 with reply, 0 detached), 0 waiting replies, 1696 recursion replies sent, 0 replies dropped, 0 states jostled out Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info: average recursion processing time 29.209126 sec Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info: histogram of recursion processing times Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info: [25%]=0.0455832 median[50%]=0.118321 [75%]=46.9213 Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info: lower(secs) upper(secs) recursions Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info: 0.000000 0.000001 264 Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info: 0.008192 0.016384 2 Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info: 0.032768 0.065536 404 Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info: 0.065536 0.131072 221 Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info: 0.131072 0.262144 89 Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info: 0.262144 0.524288 41 Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info: 0.524288 1.000000 16 Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info: 1.000000 2.000000 12 Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info: 2.000000 4.000000 10 Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info: 4.000000 8.000000 13 Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info: 8.000000 16.000000 36 Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info: 16.000000 32.000000 81 Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info: 32.000000 64.000000 178 Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info: 64.000000 128.000000 236 Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info: 128.000000 256.000000 92 Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info: 256.000000 512.000000 1 Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] debug: cache memory msg=66072 rrset=66072 infra=8306 val=0 Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info: server stats for thread 3: 9581 queries, 4282 answers from cache, 5299 recursions, 267 prefetch, 0 rejected by ip ratelimiting Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info: server stats for thread 3: requestlist max 28 avg 1.4267 exceeded 0 jostled 0 Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info: mesh has 0 recursion states (0 with reply, 0 detached), 0 waiting replies, 5299 recursion replies sent, 0 replies dropped, 0 states jostled out Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info: average recursion processing time 9.252341 sec Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info: histogram of recursion processing times Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info: [25%]=0.0416209 median[50%]=0.0610783 [75%]=0.129583 Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info: lower(secs) upper(secs) recursions Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info: 0.000000 0.000001 712 Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info: 0.001024 0.002048 1 Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info: 0.002048 0.004096 2 Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info: 0.004096 0.008192 2 Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info: 0.008192 0.016384 1 Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info: 0.016384 0.032768 4 Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info: 0.032768 0.065536 2231 Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info: 0.065536 0.131072 1045 Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info: 0.131072 0.262144 469 Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info: 0.262144 0.524288 188 Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info: 0.524288 1.000000 93 Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info: 1.000000 2.000000 55 Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info: 2.000000 4.000000 35 Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info: 4.000000 8.000000 28 Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info: 8.000000 16.000000 18 Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info: 16.000000 32.000000 47 Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info: 32.000000 64.000000 62 Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info: 64.000000 128.000000 121 Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info: 128.000000 256.000000 176 Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info: 256.000000 512.000000 9 Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] debug: cache memory msg=66072 rrset=66072 infra=8306 val=0 Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] notice: Restart of unbound 1.17.1. Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] debug: duplicate acl address ignored. Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info: [pfBlockerNG]: pfb_unbound.py script exiting Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] debug: module config: "python iterator" Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] notice: init module 0: python Feb 24 10:15:46 pfSense unbound[28020]: [28020:0] info: [pfBlockerNG]: pfb_unbound.py script loaded Feb 24 10:15:51 pfSense unbound[28020]: [28020:0] info: [pfBlockerNG]: init_standard script loaded Feb 24 10:15:51 pfSense unbound[28020]: [28020:0] notice: init module 1: iterator Feb 24 10:15:51 pfSense unbound[28020]: [28020:0] debug: target fetch policy for level 0 is 3 Feb 24 10:15:51 pfSense unbound[28020]: [28020:0] debug: target fetch policy for level 1 is 2 Feb 24 10:15:51 pfSense unbound[28020]: [28020:0] debug: target fetch policy for level 2 is 1 Feb 24 10:15:51 pfSense unbound[28020]: [28020:0] debug: target fetch policy for level 3 is 0 Feb 24 10:15:51 pfSense unbound[28020]: [28020:0] debug: target fetch policy for level 4 is 0 Feb 24 10:15:51 pfSense unbound[28020]: [28020:1] debug: Forward zone server list: Feb 24 10:15:51 pfSense unbound[28020]: [28020:2] debug: Forward zone server list:
-
@jonh said in Cannot access dns resolver settings:
I'm using quad9 for dns, in general settings I have 9.9.9.9 & 149.112.112.112
That's for pfSense only, and irrelevant for resolving, unless you have forwarding on...which you said you didn't. If you do, you need to disable DNSSEC.
"DNSSEC is already enforced by Quad9, and enabling DNSSEC at the forwarder level can cause false DNSSEC failures."Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] debug: new control connection from 127.0.0.1 port 10564
Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info: control cmd: reloadLooks to me like it was restarted on request...settings change? DHCP lease registration?
-
@steveits said in Cannot access dns resolver settings:
Looks to me like it was restarted on request...settings change? DHCP lease registration?
I have all of my clients are using pfSense for DNS although there are a few on my network where google is programed into the firmware.
There was no manual restart (I did do a manual restart of unbound today but not at that time) nor were any changes to client dhcp being done at that time. That said, I'll use my 7th decade age as an excuse and therefor I'll pay more attention in the future.
You are correct, I'm not using forwarding resolver and I am aware of the DNSSEC requirement to not be used.
These frequent periods of no response (hanging?) were not experienced in 22.04 and pfBlockerNG-devel.