Error: dns_probe_started

[JonathanLee]

I had this same issue when I updated to the new PfSense. To resolve it I had to add in the custom settings in DNS resolver for unbound. It was like my IPv4 was trying to connect to IPv6 websites intermittently even with DoH blocked. That custom setting fixed it for me as I have no IPv6 from the ISP

[guile]

@johnpoz

My unbound status:

[2.6.0-RELEASE][admin@firewall.local.com]/root: unbound-control -c /var/unbound/unbound.conf status
version: 1.13.2
verbosity: 1
threads: 2
modules: 2 [ validator iterator ]
uptime: 7006 seconds
options: control(ssl)
unbound (pid 39208) is running...

I restarted the service when the error ocurred. Ill keep checking the status using the command.

Im not using DoH, im just trying to block users to use DoH. All the configurations I posted, can I disable them all?

[guile]

@JonathanLee ill try ur config. This config, right?

server:include: /var/unbound/pfb_dnsbl.*conf
do-ip4: yes
prefer-ip4: yes
do-ip6: no
prefer-ip6: no
private-address: ::/0
dns64-ignore-aaaa: *.*
do-not-query-address: ::
do-not-query-address: ::1
do-not-query-address: ::/0

[johnpoz]

@guile said in Error: dns_probe_started:

uptime: 7006 seconds

So its only been running for not even 2 hours.. Did you on purpose restart it for something..

I would check that, next time you have a problem.. Did unbound just restart.. that should just run and run and run.. I have seen mine run for months without a restart, etc. My restarts when I restart it for say adding a host override or something, etc.

[guile]

@johnpoz yea, I manually restarted when the error occurred. ill check the uptime, next time when the error appear. But probably is not the case, because when the error appears takes like 5 minutes to internet comes back. And a service restart takes like 10 seconds.

[JonathanLee]

@guile add it into GUI under custom options inside DNS resolver towards the bottom. Let me know if it fixes it. For me all the sudden I had all my machines trying to connect to AAAA records (IPv6) again I only have IPv4 from my ISP, so it will not connect to any IPv6 urls. No big deal most all have IPv4

[guile]

@JonathanLee

Ok, up and running. Lets see if this will fix the problem:

[JonathanLee]

@guile Hello, just curious what you use include: /var/unbound/pfb_dnsbl.*conf for, is this for pf blocker? I am using squid guard that is why I asked.

I have a monster list of DoH servers I block with Squidguard.

[JonathanLee]

@guile Let us know if this fixes the intermittent issues. I use to never have this problem before, that custom option fixed it. Furthermore, I can still access everything I need every website I need has both IPv6 and IPv4 so its not a big deal for me.

[guile]

@JonathanLee

The line:

var/unbound/pfb_dnsbl.*conf 

Is auto generated by pfBlocker. Why u dont use pfBlocker to block DoH? You dont need to have a huge list, just check the list and u good. Like this:

[guile]

@JonathanLee Ok, ill let u know.

For now is working.. not a single error.