Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Cannot access dns resolver settings

    Scheduled Pinned Locked Moved pfBlockerNG
    12 Posts 3 Posters 1.1k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • J
      JonH @SteveITS
      last edited by

      @steveits

      Thanks for your quick response.
      Sorry, I thought I saw this same sort of page in -devel but I'm obviously mistaken.

      Resolver.png

      I just disabled pfBlockerNG thinking I could access the resolver but I'm still stuck on this page, even tried reboot.

      S 1 Reply Last reply Reply Quote 0
      • S
        SteveITS Galactic Empire @JonH
        last edited by

        @jonh That looks like the bottom of the page, skipping all the settings above that. Also appears to be missing formatting/CSS, unless an alt theme is being used…? Hmm, if so change to the default theme.

        Any problems while upgrading? Did you restart early by chance?

        Pre-2.7.2/23.09: Only install packages for your version, or risk breaking it. Select your branch in System/Update/Update Settings.
        When upgrading, allow 10-15 minutes to restart, or more depending on packages and device speed.
        Upvote 👍 helpful posts!

        J 1 Reply Last reply Reply Quote 0
        • J
          JonH @SteveITS
          last edited by

          @steveits said in Cannot access dns resolver settings:

          @jonh That looks like the bottom of the page, skipping all the settings above that. Also appears to be missing formatting/CSS, unless an alt theme is being used…? Hmm, if so change to the default theme.

          I never changed the theme. It is pfSense although now that you have mentioned it I'll cycle through all the others.

          Any problems while upgrading?

          No, everything worked quite well. I upgraded the same day it was released.

          Did you restart early by chance?

          Not that I can recall. In fact, doesn't it just simply restart itself? My best memory is I did nothing, it just restarted. FWIW, I'm running on an SG-5100

          I've been having DNS problems and toggling back and forth between pfBlockerNG unbound & 'unbound using python' trying to figure out where my problem is.

          Last week I had toggled DNS logging to level 3. After installing the latest release of pfBlockerNG pkg I revisited the DNS page and toggled logging back to level 1. Today I started having the same issues with DNS servfails and toggled it back to level 3 again. Now, I'm getting stuck with the page display and oddly am unable to navigate away from it without editing the url path.

          S 1 Reply Last reply Reply Quote 0
          • S
            SteveITS Galactic Empire @JonH
            last edited by

            @jonh ok, sometimes people wait 5-10 minutes and reboot early assuming it’s stuck.

            Browser cache??

            Re:DNS, there are a few recent threads. If you use forwarding uncheck the option to use DNSSEC. There’s also a patch because it doesn’t set the correct ACLs for IPv6 if set to listen on All interfaces.

            Pre-2.7.2/23.09: Only install packages for your version, or risk breaking it. Select your branch in System/Update/Update Settings.
            When upgrading, allow 10-15 minutes to restart, or more depending on packages and device speed.
            Upvote 👍 helpful posts!

            J 2 Replies Last reply Reply Quote 0
            • J
              JonH @SteveITS
              last edited by

              @steveits said in Cannot access dns resolver settings:

              @jonh ok, sometimes people wait 5-10 minutes and reboot early assuming it’s stuck.

              Browser cache??

              I'll try that

              Switching theme to dark did not make any difference.

              Re:DNS, there are a few recent threads.

              I've been reading them but not having much luck.

              If you use forwarding uncheck the option to use DNSSEC.

              Not using forwarding although I switched to it briefly last week trying to get a stable platform. But I've been on Resolver for quite awhile.

              There’s also a patch because it doesn’t set the correct ACLs for IPv6 if set to listen on All interfaces.

              Not using IPv6

              1 Reply Last reply Reply Quote 0
              • J
                JonH @SteveITS
                last edited by

                @steveits said in Cannot access dns resolver settings:

                @jonh ok, sometimes people wait 5-10 minutes and reboot early assuming it’s stuck.

                Browser cache??

                That was it.

                Cleared cache, logged out & closed the browser page, and then the browser itself.

                Logged back in and the offending page popped up but allowed me to click around it and close, revealing the settings page.

                Thanks!

                Now on to trying to get rid of these DNS servfails that happen off & on without rhyme or reason.

                GertjanG 1 Reply Last reply Reply Quote 0
                • GertjanG
                  Gertjan @JonH
                  last edited by

                  @jonh said in Cannot access dns resolver settings:

                  Now on to trying to get rid of these DNS servfails

                  Ask the unbound/resolver log how often unbound restarts :

                  grep 'of unbound' /var/log/resolver.log

                  as, while doing so, DNS is not available for that a (small) moment.

                  No "help me" PM's please. Use the forum, the community will thank you.
                  Edit : and where are the logs ??

                  J 1 Reply Last reply Reply Quote 0
                  • J
                    JonH @Gertjan
                    last edited by JonH

                    @gertjan said in Cannot access dns resolver settings:

                    @jonh said in Cannot access dns resolver settings:

                    Now on to trying to get rid of these DNS servfails

                    Ask the unbound/resolver log how often unbound restarts :

                    grep 'of unbound' /var/log/resolver.log

                    as, while doing so, DNS is not available for that a (small) moment.

                    Thank you for this idea. On the day that I posted this query there were no unbound restarts. However, this morning there were a total of 3. Here is the output of one of these restarts. It happens at time :45 seconds. I get a fair number of those outnettcp errors but not many of them precede a restart. No one was using their devices at this time so it was not noticed when it happened.

                    I'm using quad9 for dns, in general settings I have 9.9.9.9 & 149.112.112.112

                    This morning while trying to open a nytimes story (via link from mastodon) my iPad timed out after 1 minute with server didn't answer. I have confirmed that unbound did not restart at that time but have to yet isolated the exact resolver log entries during that event.

                    All that said, it appears that unbound is NOT my problem although during earlier problems restarting unbound 'fixed' it. Apparently a coincidence.

                    Does my log entries offer any ideas?

                    Feb 24 10:15:26 pfSense unbound[28020]: [28020:3] debug: cache memory msg=642930 rrset=682189 infra=8306 val=0
Feb 24 10:15:30 pfSense unbound[28020]: [28020:2] debug: outnettcp got tcp error -1
Feb 24 10:15:30 pfSense unbound[28020]: [28020:2] debug: outnettcp got tcp error -1
Feb 24 10:15:32 pfSense unbound[28020]: [28020:3] debug: outnettcp got tcp error -1
Feb 24 10:15:32 pfSense unbound[28020]: [28020:1] debug: outnettcp got tcp error -1
Feb 24 10:15:32 pfSense unbound[28020]: [28020:1] debug: outnettcp got tcp error -1
Feb 24 10:15:32 pfSense unbound[28020]: [28020:3] debug: outnettcp got tcp error -1
Feb 24 10:15:33 pfSense unbound[28020]: [28020:3] debug: outnettcp got tcp error -1
Feb 24 10:15:33 pfSense unbound[28020]: [28020:3] debug: outnettcp got tcp error -1
Feb 24 10:15:34 pfSense unbound[28020]: [28020:3] debug: outnettcp got tcp error -1
Feb 24 10:15:35 pfSense unbound[28020]: [28020:1] debug: outnettcp got tcp error -1
Feb 24 10:15:36 pfSense unbound[28020]: [28020:3] debug: outnettcp got tcp error -1
Feb 24 10:15:36 pfSense unbound[28020]: [28020:3] debug: outnettcp got tcp error -1
Feb 24 10:15:36 pfSense unbound[28020]: [28020:3] debug: outnettcp got tcp error -1
Feb 24 10:15:36 pfSense unbound[28020]: [28020:3] debug: outnettcp got tcp error -1
Feb 24 10:15:36 pfSense unbound[28020]: [28020:3] debug: outnettcp got tcp error -1
Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] debug: new control connection from 127.0.0.1 port 10564
Feb 24 10:15:45 **pfSense unbound[28020]: [28020:0] info: control cmd:  reload**
Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info: service stopped (unbound 1.17.1).
Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info: server stats for thread 0: 2271 queries, 1072 answers from cache, 1199 recursions, 50 prefetch, 0 rejected by ip ratelimiting
Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info: server stats for thread 0: requestlist max 33 avg 6.01521 exceeded 0 jostled 0
Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info: mesh has 0 recursion states (0 with reply, 0 detached), 0 waiting replies, 1199 recursion replies sent, 0 replies dropped, 0 states jostled out
Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info: average recursion processing time 30.967323 sec
Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info: histogram of recursion processing times
Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info: [25%]=0.0428481 median[50%]=0.109035 [75%]=24.963
Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info: lower(secs) upper(secs) recursions
Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info:    0.000000    0.000001 215
Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info:    0.016384    0.032768 2
Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info:    0.032768    0.065536 269
Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info:    0.065536    0.131072 171
Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info:    0.131072    0.262144 78
Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info:    0.262144    0.524288 23
Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info:    0.524288    1.000000 18
Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info:    1.000000    2.000000 21
Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info:    2.000000    4.000000 12
Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info:    4.000000    8.000000 20
Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info:    8.000000   16.000000 40
Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info:   16.000000   32.000000 54
Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info:   32.000000   64.000000 53
Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info:   64.000000  128.000000 116
Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info:  128.000000  256.000000 87
Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info:  256.000000  512.000000 20
Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] debug: cache memory msg=66072 rrset=66072 infra=8306 val=0
Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info: server stats for thread 1: 6133 queries, 2495 answers from cache, 3638 recursions, 125 prefetch, 0 rejected by ip ratelimiting
Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info: server stats for thread 1: requestlist max 37 avg 5.7486 exceeded 0 jostled 0
Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info: mesh has 0 recursion states (0 with reply, 0 detached), 0 waiting replies, 3638 recursion replies sent, 0 replies dropped, 0 states jostled out
Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info: average recursion processing time 29.475670 sec
Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info: histogram of recursion processing times
Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info: [25%]=0.0446824 median[50%]=0.0828214 [75%]=16.8889
Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info: lower(secs) upper(secs) recursions
Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info:    0.000000    0.000001 475
Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info:    0.001024    0.002048 1
Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info:    0.008192    0.016384 3
Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info:    0.016384    0.032768 4
Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info:    0.032768    0.065536 1173
Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info:    0.065536    0.131072 618
Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info:    0.131072    0.262144 254
Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info:    0.262144    0.524288 57
Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info:    0.524288    1.000000 35
Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info:    1.000000    2.000000 24
Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info:    2.000000    4.000000 22
Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info:    4.000000    8.000000 43
Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info:    8.000000   16.000000 18
Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info:   16.000000   32.000000 27
Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info:   32.000000   64.000000 178
Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info:   64.000000  128.000000 367
Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info:  128.000000  256.000000 309
Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info:  256.000000  512.000000 30
Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] debug: cache memory msg=66072 rrset=66072 infra=8306 val=0
Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info: server stats for thread 2: 2843 queries, 1147 answers from cache, 1696 recursions, 50 prefetch, 0 rejected by ip ratelimiting
Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info: server stats for thread 2: requestlist max 37 avg 8.39233 exceeded 0 jostled 0
Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info: mesh has 0 recursion states (0 with reply, 0 detached), 0 waiting replies, 1696 recursion replies sent, 0 replies dropped, 0 states jostled out
Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info: average recursion processing time 29.209126 sec
Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info: histogram of recursion processing times
Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info: [25%]=0.0455832 median[50%]=0.118321 [75%]=46.9213
Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info: lower(secs) upper(secs) recursions
Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info:    0.000000    0.000001 264
Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info:    0.008192    0.016384 2
Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info:    0.032768    0.065536 404
Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info:    0.065536    0.131072 221
Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info:    0.131072    0.262144 89
Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info:    0.262144    0.524288 41
Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info:    0.524288    1.000000 16
Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info:    1.000000    2.000000 12
Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info:    2.000000    4.000000 10
Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info:    4.000000    8.000000 13
Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info:    8.000000   16.000000 36
Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info:   16.000000   32.000000 81
Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info:   32.000000   64.000000 178
Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info:   64.000000  128.000000 236
Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info:  128.000000  256.000000 92
Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info:  256.000000  512.000000 1
Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] debug: cache memory msg=66072 rrset=66072 infra=8306 val=0
Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info: server stats for thread 3: 9581 queries, 4282 answers from cache, 5299 recursions, 267 prefetch, 0 rejected by ip ratelimiting
Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info: server stats for thread 3: requestlist max 28 avg 1.4267 exceeded 0 jostled 0
Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info: mesh has 0 recursion states (0 with reply, 0 detached), 0 waiting replies, 5299 recursion replies sent, 0 replies dropped, 0 states jostled out
Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info: average recursion processing time 9.252341 sec
Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info: histogram of recursion processing times
Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info: [25%]=0.0416209 median[50%]=0.0610783 [75%]=0.129583
Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info: lower(secs) upper(secs) recursions
Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info:    0.000000    0.000001 712
Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info:    0.001024    0.002048 1
Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info:    0.002048    0.004096 2
Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info:    0.004096    0.008192 2
Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info:    0.008192    0.016384 1
Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info:    0.016384    0.032768 4
Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info:    0.032768    0.065536 2231
Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info:    0.065536    0.131072 1045
Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info:    0.131072    0.262144 469
Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info:    0.262144    0.524288 188
Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info:    0.524288    1.000000 93
Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info:    1.000000    2.000000 55
Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info:    2.000000    4.000000 35
Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info:    4.000000    8.000000 28
Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info:    8.000000   16.000000 18
Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info:   16.000000   32.000000 47
Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info:   32.000000   64.000000 62
Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info:   64.000000  128.000000 121
Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info:  128.000000  256.000000 176
Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info:  256.000000  512.000000 9
Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] debug: cache memory msg=66072 rrset=66072 infra=8306 val=0
Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] notice: Restart of unbound 1.17.1.
Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] debug: duplicate acl address ignored.
Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info: [pfBlockerNG]: pfb_unbound.py script exiting
Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] debug: module config: "python iterator"
Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] notice: init module 0: python
Feb 24 10:15:46 pfSense unbound[28020]: [28020:0] info: [pfBlockerNG]: pfb_unbound.py script loaded
Feb 24 10:15:51 pfSense unbound[28020]: [28020:0] info: [pfBlockerNG]: init_standard script loaded
Feb 24 10:15:51 pfSense unbound[28020]: [28020:0] notice: init module 1: iterator
Feb 24 10:15:51 pfSense unbound[28020]: [28020:0] debug: target fetch policy for level 0 is 3
Feb 24 10:15:51 pfSense unbound[28020]: [28020:0] debug: target fetch policy for level 1 is 2
Feb 24 10:15:51 pfSense unbound[28020]: [28020:0] debug: target fetch policy for level 2 is 1
Feb 24 10:15:51 pfSense unbound[28020]: [28020:0] debug: target fetch policy for level 3 is 0
Feb 24 10:15:51 pfSense unbound[28020]: [28020:0] debug: target fetch policy for level 4 is 0
Feb 24 10:15:51 pfSense unbound[28020]: [28020:1] debug: Forward zone server list:
Feb 24 10:15:51 pfSense unbound[28020]: [28020:2] debug: Forward zone server list:
                    S 1 Reply Last reply Reply Quote 0
                    • S
                      SteveITS Galactic Empire @JonH
                      last edited by

                      @jonh said in Cannot access dns resolver settings:

                      I'm using quad9 for dns, in general settings I have 9.9.9.9 & 149.112.112.112

                      That's for pfSense only, and irrelevant for resolving, unless you have forwarding on...which you said you didn't. If you do, you need to disable DNSSEC.
                      "DNSSEC is already enforced by Quad9, and enabling DNSSEC at the forwarder level can cause false DNSSEC failures."

                      Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] debug: new control connection from 127.0.0.1 port 10564
                      Feb 24 10:15:45 pfSense unbound[28020]: [28020:0] info: control cmd: reload

                      Looks to me like it was restarted on request...settings change? DHCP lease registration?

                      Pre-2.7.2/23.09: Only install packages for your version, or risk breaking it. Select your branch in System/Update/Update Settings.
                      When upgrading, allow 10-15 minutes to restart, or more depending on packages and device speed.
                      Upvote 👍 helpful posts!

                      J 1 Reply Last reply Reply Quote 0
                      • J
                        JonH @SteveITS
                        last edited by

                        @steveits said in Cannot access dns resolver settings:

                        Looks to me like it was restarted on request...settings change? DHCP lease registration?

                        I have all of my clients are using pfSense for DNS although there are a few on my network where google is programed into the firmware.

                        There was no manual restart (I did do a manual restart of unbound today but not at that time) nor were any changes to client dhcp being done at that time. That said, I'll use my 7th decade age as an excuse and therefor I'll pay more attention in the future.

                        You are correct, I'm not using forwarding resolver and I am aware of the DNSSEC requirement to not be used.

                        These frequent periods of no response (hanging?) were not experienced in 22.04 and pfBlockerNG-devel.

                        1 Reply Last reply Reply Quote 0
                        • First post
                          Last post
                        Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.