No DNS after upgrading from 23.01 to 23.05 - unbound issue?

haraldinho · Jun 11, 2023, 1:57 PM

@SteveITS Hey Steve, I appreciate your help. I just tried both settings that you indicated, but they do not resolve the issue. DNS is still erratic and I cannot see available packages in Package Manager and also it does not show the update status on the dashboard.

I had disabled all IPv6 on all interfaces previously.

I was going through the output of ps -auxwwd and my eye caught this section, I am not sure if it is related:

root       46599   0.0  0.0  13336  2820 u0- I    15:02    0:00.00 |-- /bin/sh /etc/rc.update_pkg_metadata now
root       47042   0.0  0.0  13336  2812 u0- I    15:02    0:00.00 | `-- /bin/sh /usr/local/sbin/pfSense-upgrade -uf
root       49188   0.0  0.0  12672  2160 u0- I    15:02    0:00.00 |   `-- /usr/bin/lockf -s -t 5 /tmp/pfSense-upgrade.lock /usr/local/libexec/pfSense-upgrade -uf
root       49640   0.0  0.0  13336  3180 u0- I    15:02    0:00.01 |     `-- /bin/sh /usr/local/libexec/pfSense-upgrade -uf
root       56944   0.0  0.0  13336  2780 u0- I    15:02    0:00.00 |       `-- /bin/sh /usr/local/sbin/pfSense-repo-setup
root       59363   0.0  0.1  17064  5068 u0- I    15:02    0:00.04 |         `-- /usr/local/sbin/pfSense-repoc-static (pfSense-repoc-stati)

It is still there after a reboot. Not sure what it exactly indicates, but it suggests the upgrade did not completely finish? Any thoughts?

Is there any other logging that I could inspect that would be able to shed more light on the DNS matter?

haraldinho · Jun 11, 2023, 7:09 PM

@SteveITS @stephenw10 The issue in this post looks really very much similar to my problem.

TAC57 · Jun 11, 2023, 9:59 PM

@haraldinho Our problems look very similar!

My Package manager is not able to retrieve a list of packages. I've tried to delete packages I don't need and I can't.
I can't load Latest version.
System is very sluggish going from tab to tab.

Are you also getting this Notice: 'An error occurred while uploading the encrypted Netgate pfSense Plus configuration to https://acb.netgate.com/save ( Unable to resolve acb.netgate.com ) @ 2023-06-09 18:26:04'

If you come up with something I'd really appreciate hearing from you.

Can you recommend absolute basic DNS Resolver settings just to see if I can get this working.

Gertjan · Jun 12, 2023, 6:38 AM

@TAC57 said in No DNS after upgrading from 23.01 to 23.05 - unbound issue?:

Can you recommend absolute basic DNS Resolver settings

The default resolver settings.
The one Netgate has put in place when you've installed pfSense.

login-to-view

Note : The certificate selected isn't important, just pick 'one'.
You can leave the Custom option box empty.

login-to-view

and :

login-to-view

If your uplink isn't discriminating your "Internet" access (read : your ISP isn't messing around with 'what you are allowed to visit - and what not) these settings work perfectly well.

haraldinho · Jun 12, 2023, 6:44 AM

@Gertjan Are the settings in the images the default 23.05 resolver settings or are they representing your working 23.05 configuration?
Are you not forwarding?

Gertjan · Jun 12, 2023, 7:09 AM

@haraldinho said in No DNS after upgrading from 23.01 to 23.05 - unbound issue?:

or are they representing your working 23.05 configuration?

Good question.
The first image : 99 % default, as I'm pretty sure about all these settings.

The second image : I enforce DNSSEC, and keep the local cache updated when resolved host names TTL reaches zero.

Of course I'm not forwarding, as I don't feel the need to hand over all DNS request to some other company. I never understood why I have to do this. I chose pfSense because it can resolve for itself.

Edit : the settings I'm using are pretty much the same for the last .... decade.
I've tested forwarding to 1.1.1.1, 8.8.8.8 etc to port 53 and 853 (TLS) - mixing IPv4 and Ipv6.
Worked perfectly fine for me.
I'm using a Netgate 4100 - and my ISP doesn't play tricks on me ( I guess ).

TAC57 · Jun 12, 2023, 9:30 AM

@Gertjan I made all the changes above, rebooted, and thought I was in business. I could get my package list and could (did) delete a number of packages I don't need that I couldn't delete previously. DNS Lookup responses looked good. I didn't have a notice that an error occurred while upload pfSense config.

After logging off and back on I'm back to the way it was. One difference though, DNS Lookup no reports back immediately instead of taking awhile. I'm sure this is because Name server is 127.0.0.1.

Gertjan · Jun 12, 2023, 9:50 AM

@TAC57

login-to-view

"1 ms" because "google.com was already in the local DNS (resolver) cache.

More typical :

login-to-view

You should see hundreds if not thousands if entries here :

login-to-view

This line (arrow) :

login-to-view

should occur as less frequent as possible.

haraldinho · Jun 12, 2023, 11:18 AM

@Gertjan @TAC57 Have a look at this topic. This is exactly what we are experiencing in my opinion. There seems also to be a solution by turning off ASLR, but I need to dig into it more. It's a long thread, I need to read it carefully.

TAC57 · Jun 12, 2023, 11:46 AM

@haraldinho Jeez, that is a long thread, thanks for pointing it out! Per my other topic I jumped back to 2.6.0 on my backup box and everything is working just fine now.

How do I turn off 'ASLR'? I'm be glad to jump over to my 23.05 install and give it a try.

Thanks again.

haraldinho · Jun 12, 2023, 11:47 AM

@TAC57 Search the thread, it is in there somewhere

Gertjan · Jun 12, 2023, 1:33 PM

@haraldinho said in No DNS after upgrading from 23.01 to 23.05 - unbound issue?:

@Gertjan @TAC57 Have a look at this topic. This is exactly what we are experiencing in my opinion. There seems also to be a solution by turning off ASLR, but I need to dig into it more. It's a long thread, I need to read it carefully

I don't need to re read that thread - I was posting there.

Btw : Before, using 23.01 the ALSR bit of my /usr/local/sbin/unbound as unset.
Now, using 23.05, it is set.

[23.05-RELEASE][root@pfSense.going.down]/root: elfctl /usr/local/sbin/unbound
File '/usr/local/sbin/unbound' features:
noaslr          'Disable ASLR' is set.
noprotmax       'Disable implicit PROT_MAX' is unset.
nostackgap      'Disable stack gap' is unset.
wxneeded        'Requires W+X mappings' is unset.
la48            'amd64: Limit user VA to 48bit' is unset.

But, as shown in the other tread, I could not find any issues while using unbound in forwarding mode to 8.8.8.8 or 1.1.1.1. I've been forwarding for two weeks, never had any issues.

I'm back to resolving mode as it is 'less hassle' and 'works out of the box'. That is, if your uplink (ISP) isn't playing tricks on you.

haraldinho · Jun 12, 2023, 3:53 PM

@Gertjan @TAC57 @SteveITS There seems to be some good news: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=270912

"Jaap Akkerhuis 2023-06-01 12:41:18 UTC
A fix is developed by upstairs. There will be a new release within weeks with this fix. For the inpatients among us, a prerelease is made available https://github.com/NLnetLabs/unbound/issues/887#issuecomment-1570136710."