Error: dns_probe_started

JonathanLee

@guile do you use IPv6 ? My ISP has not IPv6 so it's set to none. I noticed I had to add advanced options to DNS resolver for unbound to only resolve A records and ignore AAAA records. Even with it set to none for IPv6 on LAN and WAN interfaces the unbound was still resolving and handing out AAAA records.

johnpoz

@JonathanLee said in Error: dns_probe_started:

set to none for IPv6 on LAN and WAN interfaces the unbound was still resolving and handing out AAAA records.

because AAAA records can be resolved over IPv4. if your client asks for AAAA then it will be resolved. Would depend on your client if it asks for AAAA, I found that firefox for example even when the client has no viable IPv6 GUA it will still ask for AAAA.

you can disable that in firefox with setting in about:config

network.dns.disableIPv6

Set it to true and firefox no longer asks for AAAA

I get it maybe the resource is local, and AAAA will resolve to some link local address? But what about when the client machine firefox is running doesn't even have a link-local IPv6 address.. Why would it ask for AAAA?

   Connection-specific DNS Suffix  . : local.lan                                 
   Description . . . . . . . . . . . : Killer E2600 Gigabit Ethernet Controller  
   Physical Address. . . . . . . . . : B0-4F-13-0B-FD-16                         
   DHCP Enabled. . . . . . . . . . . : Yes                                       
   Autoconfiguration Enabled . . . . : Yes                                       
   IPv4 Address. . . . . . . . . . . : 192.168.9.100(Preferred)                  
   Subnet Mask . . . . . . . . . . . : 255.255.255.0                             
   Lease Obtained. . . . . . . . . . : Friday, June 30, 2023 8:53:43 AM          
   Lease Expires . . . . . . . . . . : Thursday, July 6, 2023 8:53:43 AM         
   Default Gateway . . . . . . . . . : 192.168.9.253                             
   DHCP Server . . . . . . . . . . . : 192.168.9.253                             
   DNS Servers . . . . . . . . . . . : 192.168.3.10                              
   NetBIOS over Tcpip. . . . . . . . : Enabled

guile

@Tzvia nah.. i NEED to block social media in my work. But some users can access. Thats why im using pfBlocker.

guile

@JonathanLee i dont use ipv6.. i just set to none in the configuration. Ill try what u said.

JonathanLee

@guile This is mine, I do have some redundant settings per johnpoz.

Screenshot 2023-07-04 at 7.27.09 AM.png

Screenshot 2023-07-04 at 7.31.52 AM.png
(now my DNS resolves only A records)

I also block DoH with my proxy. Now it only resolves to A records.

guile

This post is deleted!

guile

Just happened again. The problem is DNS related, but I can ping and nslookup Google:

johnpoz

@guile said in Error: dns_probe_started:

The problem is DNS related, but I can ping and nslookup Google:

well then its Not dns related. Its your browser, most likely trying to do doh that is the problem.. clearly dns is working if you can do a nslookup and ping the name and it gets an IP.

JonathanLee

@guile notice what is resolved first it's a IPv6 you got to fix that in your resolver.

guile

@johnpoz i mean.. the problem says: dns_probe_started. Thats why im supossing is DNS related.

I tested on all browsers: Chrome, Firefox, Opera and Edge.. all the same error. Maybe is DNS related, because im blocking DoH with pfBlocker.

pfBlocker > IP > IPV4:

DNSBL Safesearch:

johnpoz

@guile if you do a nslookup to pfsense IP and it resolves, ie answers your fqdn query. then how is it dns related - unless your browser is not using pfsense for its dns..

Unless your unbound is restarting and your browser asks, and fails, and by time you ask via your nslookup it has restarted. Look in your log, is unbound restarting a lot?

Do a query like this to see how long its been running.

[23.05.1-RELEASE][admin@sg4860.local.lan]/: unbound-control -c /var/unbound/unbound.conf status
version: 1.17.1
verbosity: 1
threads: 4
modules: 2 [ validator iterator ]
uptime: 94572 seconds
options: control(ssl)
unbound (pid 3856) is running...
[23.05.1-RELEASE][admin@sg4860.local.lan]/:

So my unbound has been running for 94500 seconds, or 26 some hours.. Which makes sense because I had restarted it yesterday a few times playing with something else for another thread.

If you weren't using doh, then blocking doh would have no effect.. If you were blocking doh and the browser was trying to use it - then it would always fail.. But from your ping and nslookup dns is working, so maybe its restarting a lot - which if your registering dhcp that can be a problem, etc

JonathanLee

I had this same issue when I updated to the new PfSense. To resolve it I had to add in the custom settings in DNS resolver for unbound. It was like my IPv4 was trying to connect to IPv6 websites intermittently even with DoH blocked. That custom setting fixed it for me as I have no IPv6 from the ISP

guile

@johnpoz

My unbound status:

[2.6.0-RELEASE][admin@firewall.local.com]/root: unbound-control -c /var/unbound/unbound.conf status
version: 1.13.2
verbosity: 1
threads: 2
modules: 2 [ validator iterator ]
uptime: 7006 seconds
options: control(ssl)
unbound (pid 39208) is running...

I restarted the service when the error ocurred. Ill keep checking the status using the command.

Im not using DoH, im just trying to block users to use DoH. All the configurations I posted, can I disable them all?

guile

@JonathanLee ill try ur config. This config, right?

server:include: /var/unbound/pfb_dnsbl.*conf
do-ip4: yes
prefer-ip4: yes
do-ip6: no
prefer-ip6: no
private-address: ::/0
dns64-ignore-aaaa: *.*
do-not-query-address: ::
do-not-query-address: ::1
do-not-query-address: ::/0

johnpoz

@guile said in Error: dns_probe_started:

uptime: 7006 seconds

So its only been running for not even 2 hours.. Did you on purpose restart it for something..

I would check that, next time you have a problem.. Did unbound just restart.. that should just run and run and run.. I have seen mine run for months without a restart, etc. My restarts when I restart it for say adding a host override or something, etc.

guile

@johnpoz yea, I manually restarted when the error occurred. ill check the uptime, next time when the error appear. But probably is not the case, because when the error appears takes like 5 minutes to internet comes back. And a service restart takes like 10 seconds.

JonathanLee

@guile add it into GUI under custom options inside DNS resolver towards the bottom. Let me know if it fixes it. For me all the sudden I had all my machines trying to connect to AAAA records (IPv6) again I only have IPv4 from my ISP, so it will not connect to any IPv6 urls. No big deal most all have IPv4

guile

@JonathanLee

Ok, up and running. Lets see if this will fix the problem:

JonathanLee

@guile Hello, just curious what you use include: /var/unbound/pfb_dnsbl.*conf for, is this for pf blocker? I am using squid guard that is why I asked.

I have a monster list of DoH servers I block with Squidguard.

Screenshot 2023-07-05 at 10.26.01 AM.png

JonathanLee

@guile Let us know if this fixes the intermittent issues. I use to never have this problem before, that custom option fixed it. Furthermore, I can still access everything I need every website I need has both IPv6 and IPv4 so its not a big deal for me.