DNS_PROBE_FINISHED_NXDOMAIN sporadically for anywhere from 30secs to 10min. works flawlessly at all other times
-
@SteveITS to be clear, you aren't necessarily recommending I update, right?
-
any suggestions for tracing this?
Take a look at the various log files in the pfSense GUI and see if any have high activity. Or "ls -l /var/log" and see if that shows any logs with close-together timestamps.
It could be benign, for instance some people leave the dashboard open all day and pfSense logs all the web requests to update that.
to be clear, you aren't necessarily recommending I update, right?
2.7.2 is better than 2.7.1, is all. Is there a reason you're not updating? There were patches (via System Patches package) just released for 2.7.2 (and 23.09.1).
-
@SteveITS said in DNS_PROBE_FINISHED_NXDOMAIN sporadically for anywhere from 30secs to 10min. works flawlessly at all other times:
Is there a reason you're not updating?
cause everything was working great and I didn't want anything to break lololol
@SteveITS said in DNS_PROBE_FINISHED_NXDOMAIN sporadically for anywhere from 30secs to 10min. works flawlessly at all other times:
"ls -l /var/log"
this just returned a list of the logs...did i do it wrong?
@SteveITS said in DNS_PROBE_FINISHED_NXDOMAIN sporadically for anywhere from 30secs to 10min. works flawlessly at all other times:
Take a look at the various log files in the pfSense GUI
i flipped through every log and submenu log in the gui and nothing even closely matched up with the regular 3 minute interval of the sshguard "Exiting on signal" and "Now Monitoring Attacks"
-
@RickyBaker said in DNS_PROBE_FINISHED_NXDOMAIN sporadically for anywhere from 30secs to 10min. works flawlessly at all other times:
returned a list of the logs
Right but if you can't see timestamps indicating they are rotating every few minutes, it's not any of those logs.
In System Logs/Settings is Log Rotation Size (Bytes) set low?
Ultimately the logs are likely not related to your symptom.
-
@RickyBaker said in DNS_PROBE_FINISHED_NXDOMAIN sporadically for anywhere from 30secs to 10min. works flawlessly at all other times:
to be clear, you aren't necessarily recommending I update, right?
Boils down to the question : what do 'we' remember about 2.7.0 (years ago ?)
Maybe you and we are looking for an issue that was resolved long time, but we don't remember. The forum can tell you of course. For me, I'm just human, and I focus on the current version, and use the Form search button for the ancient issues.Also, keep in mind : ok to use old version but when deciding to do so you become basically your own tech supporter because of what I've outlined above.
I get it, when we started to talk about 'kea' you didn't understand what we were talking about ...
Btw : you should only install and update pfSense packages (always build against the latest pfSense version) with an up to date pfSense version.
-
@SteveITS said in DNS_PROBE_FINISHED_NXDOMAIN sporadically for anywhere from 30secs to 10min. works flawlessly at all other times:
In System Logs/Settings is Log Rotation Size (Bytes) set low?
I don't believe I've ever changed these settings:
Is this low? -
@Gertjan said in DNS_PROBE_FINISHED_NXDOMAIN sporadically for anywhere from 30secs to 10min. works flawlessly at all other times:
so you become basically your own tech supporter
Happy to update if it helps troubleshooting. Why does this say i'm up to date but also say I'm on 2.7.0 and 2.7.2 is the latest stable release?
-
@RickyBaker said in DNS_PROBE_FINISHED_NXDOMAIN sporadically for anywhere from 30secs to 10min. works flawlessly at all other times:
Why does this say i'm up to date but also say I'm on 2.7.0 and 2.7.2 is the latest stable release?
https://docs.netgate.com/pfsense/en/latest/releases/2-7-1.html#troubleshooting
Your log size field is grayed out so is the default.
-
@SteveITS said in DNS_PROBE_FINISHED_NXDOMAIN sporadically for anywhere from 30secs to 10min. works flawlessly at all other times:
Your log size field is grayed out so is the default.
is that good/what you'd want to see?
-
@SteveITS I messaged my wife to ask her if any internet events had happened today and said, literally this second. I was connected to the VPN and working on the pfsense AS i texted her. I immediately refreshed the DNS Resolver log and pasted them here:
https://pastebin.com/jDipsG94
nothing interesting in the General or DHCP logs that i could tell. After pasting I raced to open a webpage to see if I was having issues. I typed 2 random words into google and opened the first link and it opened fine. I'm so perplexed.
In the meantime, since I'm so stumped. I'm working on updating to 2.7.2. I found this post @Gertjan referenced at some point. the command line suggestions early on the post seem to have gotten me in the right direction cause I'm now seeing this instead of "up to date", but clicking on update within the GUI or option 13 while ssh'ed into the pfsense both result in failure. I'm now realizing there's a bit more to the thread so I'm gonna see if there was anything further I missed but just want to document my current efforts. If anyone has any idea what this failure means, i'd love to know, thanks!
-
@RickyBaker said in DNS_PROBE_FINISHED_NXDOMAIN sporadically for anywhere from 30secs to 10min. works flawlessly at all other times:
https://pastebin.com/jDipsG94
One thing :
The DNS log was being bombarded (you use the debug mode 3 or higher, that's ok but be aware that that creates a lot of log activity, and log files can get rotated fast as they tend to get filled up fast.
Up until April 28, 09h23 ..... and then it stops - nothing anymore.
Some shut the device down ? (power switch ? that's very bad)Then at April 29, 14h00, unbound starts, but the first part of start log sequence is missing.
Was the pfSense switched of during April 28, 09h23 and April 29, 14h00 ?
Keep an eye on free disk space.
Disable level 3+ resolver (unbound) logging as soon as possible. -
@Gertjan said in DNS_PROBE_FINISHED_NXDOMAIN sporadically for anywhere from 30secs to 10min. works flawlessly at all other times:
Was the pfSense switched of during April 28, 09h23 and April 29, 14h00 ?
umm not at 2pm on Monday April 29th but I do believe that I reset the pfsense from the GUI on Sunday Apr 28 in the morning. I didn't think this was this instance but I know that I tried to reboot from the GUI before and it just wouldn't reboot (waited 10 minutes or so) so i pushed the power button (I know I'm not supposed to, but i wasn't sure what else to do). I can say pretty confidently that it wasn't, at least purposely, turned off at 2pm on Monday. That time seems awfully specific as well (i.e. 14:00:01) like some kind of schedule?
@Gertjan said in DNS_PROBE_FINISHED_NXDOMAIN sporadically for anywhere from 30secs to 10min. works flawlessly at all other times:
Disable level 3+ resolver (unbound) logging as soon as possible.
Yes i turned on debugging to try to troubleshoot it, i understand to change it back asap, but I need to identify this problem first....thank you for pointing that out though...
-
@Gertjan said in DNS_PROBE_FINISHED_NXDOMAIN sporadically for anywhere from 30secs to 10min. works flawlessly at all other times:
Up until April 28, 09h23 ..... and then it stops - nothing anymore.
Some shut the device down ? (power switch ? that's very bad)looking at your paste though...it def wasn't down from sunday at 9 to monday at 2pm...? It was down for the amt of time it takes to reboot. that is perplexing?
-
@RickyBaker I think i misunderstood, apologies. I had another weird internet event last night at 17:18 in the evening and when i went to go paste the logs I discovered what you were alluding too. the DNS Resolver log seems to have stopped updating yesterday at 14;00. what gives? I didn't discover til this morning the "restart log" button so i tried to change the log level to 2 as a bootleg way to "restart" it. Well the DNS NX DOMAIN event happened again on mutliple devices between 6:09 and 6:15 but I couldn't get to a computer til 6:42 and the DNS Resolver log set to 2000 entries didn't go past 6:42. So my question is which log level is appropriate to troubleshoot this? Any other logs I should change the logging level on? This issueis becoming very problematic.
I've also added about 6 IP address to the blacklist of various LANs, waiting to see what, if anything, breaks. All the mac addresses were "no vendor" results on a mac address lookup, anything to look into that?
-
@RickyBaker said in DNS_PROBE_FINISHED_NXDOMAIN sporadically for anywhere from 30secs to 10min. works flawlessly at all other times:
All the mac addresses were "no vendor" results on a mac address lookup
If I were to guess - those would be mobile devices, apple or android - they love to use made up mac address - you know for your privacy ;) You can turn it off on the device.. So it uses its actual mac
-
As probably already said above (I didn't check) : you don't want unbound to get restarted every xx seconds (minutes).
So : uncheck this one :
From now on, you should see very few :
Maybe once a day ?
And remember : under pfBlockerng control, unbound can also get restarted.
To see unbound (DNS) activity, I use this :
tail -f /var/unbound/var/log/pfblockerng/dns_reply.logas I have pfBlocker already running.
You can set unbound logging back to "Level 1 basic operations".What you also can try is : use the unbound settings as pre initialized by Netgate.
De activate forwarding.
Ditch 8.8.8.8 8 etc.
You'll be using the default resolving.This is what I'm using :
and is rock solid for close to a decade.
Don't worry about 8.8.8.8 etc, they will get over it ;)No "help me" PM's please. Use the forum, the community will thank you.
Edit : and where are the logs ?? -
@Gertjan said in DNS_PROBE_FINISHED_NXDOMAIN sporadically for anywhere from 30secs to 10min. works flawlessly at all other times:
Don't worry about 8.8.8.8 etc, they will get over it ;)
hahaha - made me laugh.. Oh man they are going to wonder why Ricky stopped asking for dns..
-
First, thanks for all the screenshots and suggestions, really appreciate the time, i'm going nuts.
@Gertjan said in DNS_PROBE_FINISHED_NXDOMAIN sporadically for anywhere from 30secs to 10min. works flawlessly at all other times:
So : uncheck this one :
Since @johnpoz first message i've had this unenabled in the DNS Resolver settings menu:
are you still seeing this constant restarting in the current log? Is there somewhere else i can disable or does a similar setting live elsewhere in the menu?@Gertjan said in DNS_PROBE_FINISHED_NXDOMAIN sporadically for anywhere from 30secs to 10min. works flawlessly at all other times:
And remember : under pfBlockerng control, unbound can also get restarted.
I still don't think i have pfblockerng installed. I believe its an installed package that would show up in the Firewall drop down:
@Gertjan said in DNS_PROBE_FINISHED_NXDOMAIN sporadically for anywhere from 30secs to 10min. works flawlessly at all other times:
To see unbound (DNS) activity, I use this :
I don't seem to have a var folder under /var/unbound/ Is this an issue with being on 2.7.0 and not 2.7.2? i would love to try to update but I'm running into a roadblock there as well:
After posting this I will go back to this thread and see if there's any other suggestions to try besides what I already have: https://forum.netgate.com/topic/184670/issue-with-going-from-2-7-0-to-2-7-2/9
edit: there didn't appear to be anything more I hadn't tried besides installing 2.7.2 from scratch and restoring the backup, which i'm not currently prepared to do@Gertjan said in DNS_PROBE_FINISHED_NXDOMAIN sporadically for anywhere from 30secs to 10min. works flawlessly at all other times:
This is what I'm using :
Differences I see are:-
I have All selected under Outgoing Network Interface, I've changed that to LocalHost to match yours but i don't really understand this setting
-
I have System Domain Local Zone Type set to Transparent and not static like you. I don't understand this option and can switch it if the above doesn't fix anything
-
I disabled DNSSEC per @johnpoz suggestion in the first post
-
I don't have Python Module enabled (should I?)
-
i have a different SSL cert but I assume that's just a personal one you created
I also don't understand what the domain overrides at the end are, should I trash them?
Again thanks for everything. anything to attempt is appreciated
-
-
@Gertjan said in DNS_PROBE_FINISHED_NXDOMAIN sporadically for anywhere from 30secs to 10min. works flawlessly at all other times:
Don't worry about 8.8.8.8 etc, they will get over it ;)
sorry missed this part:
I removed those 4 other dns after that first post as well, are they also still showing up in the logs? -
@RickyBaker said in DNS_PROBE_FINISHED_NXDOMAIN sporadically for anywhere from 30secs to 10min. works flawlessly at all other times:
I have All selected under Outgoing Network Interface, I've changed that to LocalHost to match yours but i don't really understand this settingAll is default (I guess). The local DNS guru explained me somewhere that Localhost was 'better'.
I have System Domain Local Zone Type set to Transparent and not static like you. I don't understand this option and can switch it if the above doesn't fix anythingI can read this (as an explanation). You probably have to translate. I've chosen 'static' for my use, but there is really no important differences with transparent.
I disabled DNSSEC per @johnpoz suggestion in the first postDNSSEC can be sued without issues if you do not Forward. You don't, so you an use it.
Disabling it won't hurt, though.I don't have Python Module enabled (should I?)You can. DNSSEC, if activated, uses Python. And pfBlockerng - but you don't use pfBlockerng .
It's activated by default.i have a different SSL cert but I assume that's just a personal one you createdPick one you've listed. Certs are not used by default.
I also don't understand what the domain overrides at the end are, should I trash them?
These are added by the pfSense admin = you. Not Netgate.
But I know why these (your) domains are listed : it will disable registration checking of some known adobe (photoshop, to name it) software ^^
If you don't have the cracked Photoshop installed on one of your PCs, you can remove them all.
