Problem with DNS resolver

Unoptanio

Yesterday..... using the "pkg search unbound" command we discovered that my pfsense 2.7.2 had DNS unbound version 1.18.0_1.

Using the command "pkg install unbound-1.19.1" I installed the new update to version 1.19.1

I did a system reboot.

Throughout yesterday the log showed the two versions but I think it's normal, there are times that demonstrate the relevant version at that moment.

Using the command "cat /var/log/resolver.log | grep 'start'" I can see that only version 1.19.1 appears in today's logs

I had also disabled DHCP Registration in Unbound DNS because it caused the service to continually restart.

Thanks to you I discovered another interesting command "pkg upgrade" which checks if there are updates on all packages

The situation has improved, there are no longer continuous restarts of the unbound DNS service and we also have the latest version 1.19.1.
What can I do to resolve the problem that after the first start of pfsense the unbound DNS does not work (even if in the list of services the unbound DNS appears with a working green check box icon) and I have to restart the service manually?

fireodo

@Unoptanio said in Problem with DNS resolver:

I had also disabled DHCP Registration in Unbound DNS because it caused the service to continually restart.

So this was the real culprit ...

The situation has improved, there are no longer continuous restarts of the unbound DNS service and we also have the latest version 1.19.1.
What can I do to resolve the problem that after the first start of pfsense the unbound DNS does not work (even if in the list of services the unbound DNS appears with a working green check box icon) and I have to restart the service manually?

Maybe enable verbose logging to see if there is a hint in the log what is causing unbound not to start properly ...

Unoptanio

@fireodo

Where do you enable verbose logging?

fireodo

@Unoptanio said in Problem with DNS resolver:

Where do you enable verbose logging?

services_unbound_advanced.php

scroll down - "log level"

Gertjan

Don't worry about this one. The domain "mobile-webview.google.com" doesn't exist ....
I've tried several revolvers world wide : not found.

@Unoptanio said in Problem with DNS resolver:

Jun 7 06:25:03 filterdns 29751 failed to resolve host mobile-webview.google.com will retry later again.

You've set yourself "mobile-webview.google.com" as filterdns is trying its out most best to resolve it.
Not very useful.

This line can create 'huge' problems with DNS :

@Unoptanio said in Problem with DNS resolver:

Jun 7 07:00:02 filterdns 37407 Adding Action: pf table: Block_Facebook host: web.facebook.com

Read this : Aliases.

This is a typical case of :

Where "not useful" is an understatement.
When a typical *.facebook.com host name is resolved, it will return many, like a lot, of IP addresses.
The filterdns process is executed every xx seconds or so to update the relation 'host name' => IPs. If the list with IP changes, and it will change constantly, the firewall is reload, .... and process (like unbound) get restarted.
Do you see where this is going ?

Remove all your references to google or facebook in your aliases tables. If you need to filter these, use pfBlockerng.
Your unbound will say thank you to you.

Popolou

@Unoptanio said in Problem with DNS resolver:

Disable unbound listening on the WAN and see if it stays up.

stephenw10

Yeah the first thing I would do is remove those two failing hosts that don't exist.

Jun 7 06:41:46	filterdns	37407	failed to resolve host mobile-webview.google.com will retry later again.
Jun 7 06:41:46	filterdns	37407	failed to resolve host chat-dll.google.com will retry later again.

Unoptanio

@Popolou
Done

Unoptanio

@stephenw10
Done

Unoptanio

@stephenw10

Ok!. It seems like everything is working fine now.
I restarted the PC at 7:00 am.
After the reboot everything works fine.
Unbound DNS works.

In summary: steps to solve the problem

Disabled DHCP Registration in DNS Unbound (caused continuous restarts of the service)
Disable unbound listening on the WAN (caused the service to be restarted twice)
It is recommended to install the latest version of the Unbound DNS service

darcey

@Unoptanio said in Problem with DNS resolver:

In summary: steps to solve the problem

Disabled DHCP Registration in DNS Unbound (caused continuous restarts of the service)
Disable unbound listening on the WAN (caused the service to be restarted twice)
It is recommended to install the latest version of the Unbound DNS service

Good to hear you've sorted it.
Having unbound serve dns records for DHCP leases is known to cause restarts. I think many here disable it and create static leases for those hosts they do want to resolve.
I found explicitly selecting listening interfaces often caused problems with unbound not starting. I set it to 'all', relied on firewall default blocking to prevent access where it wasn't desired, no more unbound start-up issues.
I doubt the upgrade contributed to fixing the issues you were seeing. I reckon it came down solely to the listening interfaces selection!

johnpoz

@Unoptanio said in Problem with DNS resolver:

It is recommended to install the latest version of the Unbound DNS service

this should be taken care of by just upgrading pfsense - still not understanding how you had both on the system??

Unoptanio

@johnpoz

Initially I only had version 1.18.0_1 of the unbound DNS.
After updating to version 1.19.1, despite restarting the PC, the two versions were the same. The next day only version 1.19.1 remained.
In the meantime, other PC reboots were made

But isn't it just the log of versions at various times?

johnpoz

@Unoptanio said in Problem with DNS resolver:

After updating to version 1.19.1,

And how did you do that exactly? You updated pfsense, you updated packages on pfsense? You installed it on your own? I can not see a way that both would of been on the system at the same time??

You should never see this

There should only ever be 1 version installed.

Unoptanio

@johnpoz

I haven't updated pfsense.

I only updated the unbound DNS service which strangely was not the latest version

johnpoz

@Unoptanio said in Problem with DNS resolver:

I only updated the unbound DNS service

And how did you do that, you ran the package update from cmd line of pfsense - you manually iinstalled a package from outside pfsense repository?

What version of pfsense are you running exactly?

Pretty sure 2.7.2 came with 19.1, let me fire up my VM.. and check..

Unoptanio

@johnpoz

If I updated the unbound DNS service at 1.03.49 PM I think it is normal for it to display the old version which was in operation previously at 1.02.36 PM

try checking the version with the command:

pkg search unbound

with this command you only update the unbound DNS service to the version 1.19.1

 pkg install unbound-1.19.1

with this command check if there are any updated system packages available.

pkg upgrade

johnpoz

@Unoptanio yeah the log would show the version from before.. But pretty sure 2.7.2 should of came with 19.1??

Oh my bad, seems 2.7.2 shipped with 18, and pkg upgrade updates it

stephenw10

Mmm, I guess running 'pkg install' somehow left the old version present. Though the output from it looked like it just upgraded it anyway. Which is what I'd expect pkg to do.

In that situation you should really have used pkg upgrade unbound.

Unoptanio

@stephenw10
Does the old version need to be uninstalled somehow? or is that okay?