Error: dns_probe_started
-
@guile notice what is resolved first it's a IPv6 you got to fix that in your resolver.
-
@johnpoz i mean.. the problem says: dns_probe_started. Thats why im supossing is DNS related.
I tested on all browsers: Chrome, Firefox, Opera and Edge.. all the same error. Maybe is DNS related, because im blocking DoH with pfBlocker.
pfBlocker > IP > IPV4:
DNSBL Safesearch:
-
@guile if you do a nslookup to pfsense IP and it resolves, ie answers your fqdn query. then how is it dns related - unless your browser is not using pfsense for its dns..
Unless your unbound is restarting and your browser asks, and fails, and by time you ask via your nslookup it has restarted. Look in your log, is unbound restarting a lot?
Do a query like this to see how long its been running.
[23.05.1-RELEASE][admin@sg4860.local.lan]/: unbound-control -c /var/unbound/unbound.conf status version: 1.17.1 verbosity: 1 threads: 4 modules: 2 [ validator iterator ] uptime: 94572 seconds options: control(ssl) unbound (pid 3856) is running... [23.05.1-RELEASE][admin@sg4860.local.lan]/:So my unbound has been running for 94500 seconds, or 26 some hours.. Which makes sense because I had restarted it yesterday a few times playing with something else for another thread.
If you weren't using doh, then blocking doh would have no effect.. If you were blocking doh and the browser was trying to use it - then it would always fail.. But from your ping and nslookup dns is working, so maybe its restarting a lot - which if your registering dhcp that can be a problem, etc
-
I had this same issue when I updated to the new PfSense. To resolve it I had to add in the custom settings in DNS resolver for unbound. It was like my IPv4 was trying to connect to IPv6 websites intermittently even with DoH blocked. That custom setting fixed it for me as I have no IPv6 from the ISP
-
My unbound status:
[2.6.0-RELEASE][admin@firewall.local.com]/root: unbound-control -c /var/unbound/unbound.conf status version: 1.13.2 verbosity: 1 threads: 2 modules: 2 [ validator iterator ] uptime: 7006 seconds options: control(ssl) unbound (pid 39208) is running...I restarted the service when the error ocurred. Ill keep checking the status using the command.
Im not using DoH, im just trying to block users to use DoH. All the configurations I posted, can I disable them all?
-
@JonathanLee ill try ur config. This config, right?
server:include: /var/unbound/pfb_dnsbl.*conf do-ip4: yes prefer-ip4: yes do-ip6: no prefer-ip6: no private-address: ::/0 dns64-ignore-aaaa: *.* do-not-query-address: :: do-not-query-address: ::1 do-not-query-address: ::/0 -
@guile said in Error: dns_probe_started:
uptime: 7006 seconds
So its only been running for not even 2 hours.. Did you on purpose restart it for something..
I would check that, next time you have a problem.. Did unbound just restart.. that should just run and run and run.. I have seen mine run for months without a restart, etc. My restarts when I restart it for say adding a host override or something, etc.
-
@johnpoz yea, I manually restarted when the error occurred. ill check the uptime, next time when the error appear. But probably is not the case, because when the error appears takes like 5 minutes to internet comes back. And a service restart takes like 10 seconds.
-
@guile add it into GUI under custom options inside DNS resolver towards the bottom. Let me know if it fixes it. For me all the sudden I had all my machines trying to connect to AAAA records (IPv6) again I only have IPv4 from my ISP, so it will not connect to any IPv6 urls. No big deal most all have IPv4
-
-
@guile Hello, just curious what you use include: /var/unbound/pfb_dnsbl.*conf for, is this for pf blocker? I am using squid guard that is why I asked.
I have a monster list of DoH servers I block with Squidguard.
-
@guile Let us know if this fixes the intermittent issues. I use to never have this problem before, that custom option fixed it. Furthermore, I can still access everything I need every website I need has both IPv6 and IPv4 so its not a big deal for me.
-
The line:
var/unbound/pfb_dnsbl.*confIs auto generated by pfBlocker. Why u dont use pfBlocker to block DoH? You dont need to have a huge list, just check the list and u good. Like this:
-
@JonathanLee Ok, ill let u know.
For now is working.. not a single error.
