Problem with DNS resolver

Gertjan

Execute

cat /var/log/resolver.log | grep 'start'

and take note : unbound can't handle DNS requests when its in the process of stopping and restarting.

Obvious solutions :
(very silly) : make less DNS requests.
or
make unbound restart less often.

Unoptanio

@Gertjan

Hello,

i have enabled: "Serve Expired"

I did a reboot and it works now

To date, the problem has not recurred

darcey

@Unoptanio Another thing, that might interrupt DNS, is having unbound resolve dynamic DHCP client hostnames.
AIUI this results in unbound restarts in order to reread the leases file. I set mine to only resolve static leases.

stephenw10

@Unoptanio said in Problem with DNS resolver:

i have enabled: "Serve Expired"

I did a reboot and it works now

Hmm, well that seems odd. Not sure how that setting would have any effect of Unbound starting.

johnpoz

@stephenw10 said in Problem with DNS resolver:

Not sure how that setting would have any effect of Unbound starting.

It wouldn't, and on a restart there wouldn't be anything in the cache to serve up anyway.

Unoptanio

@Gertjan said in Problem with DNS resolver:

cat /var/log/resolver.log | grep 'start'

Today the problem recurred

Shell Output - cat /var/log/resolver.log | grep 'start'

fireodo

@Unoptanio said in Problem with DNS resolver:

@Gertjan said in Problem with DNS resolver:

cat /var/log/resolver.log | grep 'start'

Today the problem recurred

You say in your signature that you use 2.7.2 CE but your unbound is (according your screenshot) 1.18.0 - thats not consistent IMHO

Here (also 2.7.2.CE):

Jun 6 03:05:11	unbound	62796	[62796:0] info: service stopped (unbound 1.19.1).
Jun 5 03:05:17	unbound	62796	[62796:0] info: start of service (unbound 1.19.1).

Unoptanio

@fireodo

fireodo

@Unoptanio said in Problem with DNS resolver:

@fireodo

Do at the CLI:

pkg search unbound

what do you get?

Try:

pkg install unbound-1.19.1

darcey

@Unoptanio Two things to try. Disable resolution of DHCP leases and Openvpn client hostnames. Also, increase the loglevel, which might give you more clues. One other thing, leave listening/outgoing interfaces as 'all'.
Obviously not suggesting these as solutions but as a means to getting to the cause/culprit.

Unoptanio

@fireodo

pkg search unbound

unbound-1.19.1 Validating, recursive, and caching DNS resolver

fireodo

@Unoptanio said in Problem with DNS resolver:

@fireodo
pkg search unbound
unbound-1.19.1 Validating, recursive, and caching DNS resolver

Now do:

pkg install unbound-1.19.1

Unoptanio

@fireodo

[2.7.2-RELEASE][admin@xxxxxxxxxxxx]/root: pkg install unbound-1.19.1
Updating pfSense-core repository catalogue...
Fetching meta.conf: 0%
Fetching packagesite.pkg: 0%
pfSense-core repository is up to date.
Updating pfSense repository catalogue...
Fetching meta.conf: 0%
Fetching packagesite.pkg: 0%
pfSense repository is up to date.
All repositories are up to date.
The following 1 package(s) will be affected (of 0 checked):

Installed packages to be UPGRADED:
unbound: 1.18.0_1 -> 1.19.1 [pfSense]


[2.7.2-RELEASE][admin@Axxxxxxxxx]/root: pkg search unbound
unbound-1.19.1                 Validating, recursive, and caching DNS resolver

fireodo

@Unoptanio said in Problem with DNS resolver:

unbound: 1.18.0_1 -> 1.19.1 [pfSense]

Lets see if your trouble is gone

Unoptanio

@fireodo

In your opinion, why didn't I have the latest version before? I also have all the patches installed

What version of pfsense is Unbound 1.18.0_1 from?

fireodo

@Unoptanio said in Problem with DNS resolver:

@fireodo

In your opinion, why didn't I have the latest version before? I also have all the patches installed

There are updates that are not shown on the GUI and not with Patches - they are shown only on the CLI.

darcey

@fireodo My 2.7.2CE install is also currently on unbound-1.18.0_1

[2.7.2-RELEASE][root@fw.local.lan]/root: pkg search unbound
unbound-1.19.1                 Validating, recursive, and caching DNS resolver
[2.7.2-RELEASE][root@fw.local.lan]/root: pkg info | grep unbound
unbound-1.18.0_1               Validating, recursive, and caching DNS resolver

When might it pull in the updated package, other than explicit upgrade via the cmdline?

fireodo

@Unoptanio said in Problem with DNS resolver:

What version of pfsense is Unbound 1.18.0_1 from?

I guess 2.7.1 (not shure)

I have a script (see attachment - change .zip to .php) that looks via cronjob if there are some updates. (The script is from @Gertjan if I remember well) pkg_check.zip
The cronjob looks loke this:

/usr/bin/nice -n20 /usr/local/bin/php -q /root/bin/pkg_check.php | logger

Edit: In my case the location of the script is in /root/bin (directory I have created) - put the script in your case where you wish ...

Tanti auguri :-)

Unoptanio

@fireodo
So is it a bug in 2.7.2 that doesn't update unbound DNS?

fireodo

@Unoptanio said in Problem with DNS resolver:

So is it a bug in 2.7.2 that doesn't update unbound DNS?

No thats not a bug - if some changes where needed in unbound that occure AFTER release of 2.7.2 thats the only way to handle it - as far as I know!

PS.: Is unbound still restarting?