Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Unbound DNS Resolver not starting

    Scheduled Pinned Locked Moved DHCP and DNS
    24 Posts 4 Posters 1.4k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • fireodoF
      fireodo @KKIT
      last edited by

      @KKIT said in Unbound DNS Resolver not starting:

      tail: /var/log/resolver/log: No such file or directory

      tail -f /var/log/resolver.log

      Kettop Mi4300YL CPU: i5-4300Y @ 1.60GHz RAM: 8GB Ethernet Ports: 4
      SSD: SanDisk pSSD-S2 16GB (ZFS) WiFi: WLE200NX
      pfsense 2.8.0 CE
      Packages: Apcupsd, Cron, Iftop, Iperf, LCDproc, Nmap, pfBlockerNG, RRD_Summary, Shellcmd, Snort, Speedtest, System_Patches.

      K 1 Reply Last reply Reply Quote 1
      • K
        KKIT @patient0
        last edited by

        @patient0 said in Unbound DNS Resolver not starting:

        unbound 38035 0.0 4.3 210648 175800 - Is 16:11 0:47.64 /usr/local/sbin/unbound -c /var/unbound/unbound.conf

        I get this when putting in line 2

        Screenshot 2024-06-19 at 14.38.36.png

        patient0P GertjanG 2 Replies Last reply Reply Quote 0
        • patient0P
          patient0 @KKIT
          last edited by

          @KKIT I'm sorry I wasn't clear: you enter only the first line ps aux | fgrep -i unbound and the other lines are the result of that command in my case.

          1 Reply Last reply Reply Quote 1
          • GertjanG
            Gertjan @KKIT
            last edited by

            @KKIT

            Nooooo.
            Never - ever use the GUI Diagnostics > Command Prompt
            GUI command line is ... bad, or worse.
            Use SSH.

            No "help me" PM's please. Use the forum, the community will thank you.
            Edit : and where are the logs ??

            K 1 Reply Last reply Reply Quote 1
            • K
              KKIT @fireodo
              last edited by

              @fireodo said in Unbound DNS Resolver not starting:

              @KKIT said in Unbound DNS Resolver not starting:

              tail: /var/log/resolver/log: No such file or directory

              tail -f /var/log/resolver.log

              I did and nothing changes in the log when I try to adjust anything
              Screenshot 2024-06-19 at 14.40.54.png

              GertjanG 1 Reply Last reply Reply Quote 0
              • K
                KKIT @Gertjan
                last edited by

                @Gertjan

                Thanks, I get this:

                root 64053 0.0 0.0 13412 3064 - S 14:46 0:00.00 sh -c ps aux | fgrep -i unbound 2>&1
                root 64286 0.0 0.0 12840 2532 - S 14:46 0:00.00 fgrep -i unbound

                patient0P 1 Reply Last reply Reply Quote 0
                • GertjanG
                  Gertjan @KKIT
                  last edited by

                  @KKIT said in Unbound DNS Resolver not starting:

                  I did and nothing changes in the log when I try to adjust anything

                  With :

                  a0aafba5-973a-4879-8856-a9609d19fba6-image.png

                  you will only see the start and stop lines.
                  When a stop arrives, unbound will log about 30 "info" lines, the ones you've showed above.

                  Btw : when you change edit whatever do something with the 3 unbound (revolver) settings pages, unbound won't get restarted. So no log lines.
                  Only when you click on Apply on the top of any resolver settings page, unbound will get stopped, a new config file gets created, and unbound gets started. Then you see the the stop announcement, dump of the info and the the restart line.

                  With a log level of 3, 4 or a whopping 5 you will see much more.
                  Remember to reset to "1" when you're done (and apply ^^), as with level 5 unbound will log huge quantities.

                  No "help me" PM's please. Use the forum, the community will thank you.
                  Edit : and where are the logs ??

                  K 1 Reply Last reply Reply Quote 1
                  • patient0P
                    patient0 @KKIT
                    last edited by

                    @KKIT said in Unbound DNS Resolver not starting:

                    @Gertjan

                    Thanks, I get this:

                    root 64053 0.0 0.0 13412 3064 - S 14:46 0:00.00 sh -c ps aux | fgrep -i unbound 2>&1
                    root 64286 0.0 0.0 12840 2532 - S 14:46 0:00.00 fgrep -i unbound

                    Ok, that means no Unbound instance is running at that time. Next I'd set the LogLevel to > 1.

                    Do you have a fairly standard Unbound config? Running as a resolver or forwarder? Nothing else listening to port 53?

                    K 1 Reply Last reply Reply Quote 1
                    • K
                      KKIT @Gertjan
                      last edited by

                      @Gertjan

                      Unfortunately absolutely nothing happens when I set it to 5, I am still connected via SSH and within the logfile with tail, I also made sure to apply the settings as well as manually start the service under the "Services" section, nothing :(

                      1 Reply Last reply Reply Quote 0
                      • K
                        KKIT @patient0
                        last edited by

                        @patient0

                        I set the log level to 5 and still nothing, only the second node is listening on port 53 and the resolver is running as expected. No custom configuration on unbound and no DNS forwarder active.

                        GertjanG 1 Reply Last reply Reply Quote 0
                        • GertjanG
                          Gertjan @KKIT
                          last edited by

                          @KKIT

                          I've just :

                          tail -f /var/log/resolver.log
                          

                          and then :

                          29de1c31-75cb-4359-9403-ef44292c37b8-image.png

                          and then

                          8b64784e-97d2-4534-83e0-9a7bce03cd4a-image.png

                          and oh boy .... the tail command had a hard time keeping up with the pace. tens of lines a second, impossible to follow.

                          Btw : I've no HA setup, just one box, and about 5 PC connected and some other stuff.
                          I know that every device in my network uses my 'pfSense' as a DNS source, not some 1.1.1.1 or 8.8.8.8 or other data collector.

                          If your unbound doesn't log anything on level 5 : isn't that a sign that LAN devices uses another device, and not (this !) pfSense, to do DNS requests ?

                          Another trick : GUI this time ^^

                          7ed086bc-70b0-449c-a549-a6b27281d516-image.png

                          Set interface to your LAN interface, or any other LAN type interface.
                          Set the port to '53' (DNS, recall)
                          And hit Start.

                          Now you should see "destination port 53".

                          Add the IP of your pfSense, so now you'll see what LAN devices want to talk to your pfSense for DNS needs :

                          f38a44cd-06a0-415b-b2ea-8b2bec8506f6-image.png

                          Btw : I presume the default 192.168.1.1
                          if there is no ore little DNS traffic, its normal that unbound doesn't 'log' ^^

                          No "help me" PM's please. Use the forum, the community will thank you.
                          Edit : and where are the logs ??

                          K 1 Reply Last reply Reply Quote 1
                          • K
                            KKIT @Gertjan
                            last edited by

                            @Gertjan
                            I appreciate the input, but I think we are looking at the wrong end here. The Unbound service is not running at all, as confirmed above. Additionally, the node is currently in maintenance mode, I already tried putting it back into production but I wouldn't accept any requests. At this point I assume that either pfBlocker messed it up or I improperly shut the service down. I will go for a reinstall and see from there. THanks so far, really appreciate it and will keep you guys updated!

                            K 1 Reply Last reply Reply Quote 0
                            • K
                              KKIT @KKIT
                              last edited by

                              @KKIT

                              So I wanted to give a followup on this issue, I dug a little deeper and looking at this post:
                              https://forum.netgate.com/topic/154372/unbound-dns-resolver-will-not-start/3

                              I am pretty sure it has something to do with pfBLockerNG messing up my config file. I checked the directory of the config file and see that there are two with one having a ".error" added to it:

                              Screenshot 2024-06-20 at 14.19.06.png

                              Trying to reload unbound via shell shows this error:
                              unbound-control[85585:0] error: connect: Connection refused for 127.0.0.1 port 953

                              Unfortunately I lost my backups after the reinstall so my question is if I can transfer the unbound.conf from my functioning pfSense (Node B) to make it work again?

                              GertjanG 1 Reply Last reply Reply Quote 0
                              • GertjanG
                                Gertjan @KKIT
                                last edited by Gertjan

                                @KKIT said in Unbound DNS Resolver not starting:

                                I am pretty sure it has something to do with pfBLockerNG messing up my config file.

                                Easy to test.
                                Remove pfBlockerng from your pfSEnse, and get a copy from the unbound config file.
                                /var/unbound/unbound.conf

                                Install pfBlockerng, activate it, give it some DNSBL feeds and get a copy again from the unbound config file.

                                Compare the two copies.

                                You'll find a single difference, at the end :
                                If you use Python mode :

                                # Python Module
                                python:
                                python-script: pfb_unbound.py
                                

                                IMHO : this small python script file is very well tested by now.

                                Not python mode :
                                It "includes" a (one) 'master DNSBL' file ... forget about that file, as I switched to python mode (after years asking for it).

                                So, no, sorry, dead end.

                                pfBlockerng can restart unbound ones in a while (you decide how often).
                                But pfBlockerng isn't the only one doing so, other, network events for example, can also restart many services.

                                Edit :

                                Your unbound. conf file is rather big = 4k.
                                Mine is just over 2k.
                                Can you show it ?

                                No "help me" PM's please. Use the forum, the community will thank you.
                                Edit : and where are the logs ??

                                K 1 Reply Last reply Reply Quote 0
                                • K
                                  KKIT @Gertjan
                                  last edited by KKIT

                                  @Gertjan

                                  Sure

                                  ##########################

                                  Unbound Configuration

                                  ##########################

                                  Server configuration

                                  server:

                                  chroot: /var/unbound
                                  username: "unbound"
                                  directory: "/var/unbound"
                                  pidfile: "/var/run/unbound.pid"
                                  use-syslog: yes
                                  port: 53
                                  verbosity: 1
                                  hide-identity: yes
                                  hide-version: yes
                                  harden-glue: yes
                                  do-ip4: yes
                                  do-ip6: yes
                                  do-udp: yes
                                  do-tcp: yes
                                  do-daemonize: yes
                                  module-config: "iterator"
                                  unwanted-reply-threshold: 0
                                  num-queries-per-thread: 512
                                  jostle-timeout: 200
                                  infra-keep-probing: yes
                                  infra-host-ttl: 900
                                  infra-cache-numhosts: 10000
                                  outgoing-num-tcp: 10
                                  incoming-num-tcp: 10
                                  edns-buffer-size: 1432
                                  cache-max-ttl: 86400
                                  cache-min-ttl: 0
                                  harden-dnssec-stripped: no
                                  msg-cache-size: 4m
                                  rrset-cache-size: 8m

                                  num-threads: 4
                                  msg-cache-slabs: 4
                                  rrset-cache-slabs: 4
                                  infra-cache-slabs: 4
                                  key-cache-slabs: 4
                                  outgoing-range: 4096
                                  #so-rcvbuf: 4m

                                  prefetch: yes
                                  prefetch-key: yes
                                  use-caps-for-id: no
                                  serve-expired: no
                                  sock-queue-timeout: 0
                                  aggressive-nsec: no

                                  Statistics

                                  Unbound Statistics

                                  statistics-interval: 0
                                  extended-statistics: yes
                                  statistics-cumulative: yes

                                  TLS Configuration

                                  tls-cert-bundle: "/etc/ssl/cert.pem"

                                  Interface IP addresses to bind to

                                  interface: WAN NODE B
                                  interface: 172.16.71.2
                                  interface: 2001:0db8:85a3:0000:0000:8a2e:0370:7334
                                  interface: 172.16.1.2
                                  interface: 10.0.20.2
                                  interface: 10.0.30.2
                                  interface: 10.0.90.2
                                  interface: 10.0.91.2
                                  interface: 10.0.31.2
                                  interface: 172.16.71.1
                                  interface: WAN NODE A
                                  interface: 10.0.20.1
                                  interface: 10.0.30.1
                                  interface: 10.0.90.1
                                  interface: 10.172.17.1
                                  interface: 10.0.91.1
                                  interface: NETWORK A
                                  interface: NETWORK B
                                  interface: NETWORK C
                                  interface: 10.0.40.1
                                  interface: NETWORK D
                                  interface: NETWORK E
                                  interface: 10.0.31.1
                                  interface: NETWORK F
                                  interface: 127.0.0.1
                                  interface: ::1

                                  Outgoing interfaces to be used

                                  outgoing-interface: WAN NODE B
                                  outgoing-interface: 172.16.71.2
                                  outgoing-interface: xxx
                                  outgoing-interface: 172.16.1.2
                                  outgoing-interface: 10.0.20.2
                                  outgoing-interface: 10.0.30.2
                                  outgoing-interface: 10.0.90.2
                                  outgoing-interface: 10.0.91.2
                                  outgoing-interface: 10.0.31.2
                                  outgoing-interface: 172.16.71.1
                                  outgoing-interface: WAN NODE A
                                  outgoing-interface: 10.0.20.1
                                  outgoing-interface: 10.0.30.1
                                  outgoing-interface: 10.0.90.1
                                  outgoing-interface: 10.172.17.1
                                  outgoing-interface: 10.0.91.1
                                  outgoing-interface: NETWORK A
                                  outgoing-interface: NETWORK B
                                  outgoing-interface: NETWORK C
                                  outgoing-interface: 10.0.40.1
                                  outgoing-interface: NETWORK D
                                  outgoing-interface: NETWORK E
                                  outgoing-interface: 10.0.31.1
                                  outgoing-interface: NETWORK F
                                  outgoing-interface: 127.0.0.1
                                  outgoing-interface: ::1

                                  DNS Rebinding

                                  For DNS Rebinding prevention

                                  private-address: 127.0.0.0/8
                                  private-address: 10.0.0.0/8
                                  private-address: ::ffff:a00:0/104
                                  private-address: 172.16.0.0/12
                                  private-address: ::ffff:ac10:0/108
                                  private-address: 169.254.0.0/16
                                  private-address: ::ffff:a9fe:0/112
                                  private-address: 192.168.0.0/16
                                  private-address: ::ffff:c0a8:0/112
                                  private-address: fd00::/8
                                  private-address: fe80::/10

                                  Access lists

                                  include: /var/unbound/access_lists.conf

                                  Static host entries

                                  include: /var/unbound/host_entries.conf

                                  dhcp lease entries

                                  include: /var/unbound/dhcpleases_entries.conf

                                  Domain overrides

                                  include: /var/unbound/domainoverrides.conf

                                  Forwarding

                                  forward-zone:
                                  name: "."
                                  forward-tls-upstream: yes
                                  forward-addr: ::1@853
                                  forward-addr: 1.1.1.1@853#one.one.one.one
                                  forward-addr: 1.0.0.1@853#one.one.one.one
                                  forward-addr: 8.8.8.8@853#dns.google
                                  forward-addr: 8.8.4.4@853#dns.google

                                  Remote Control Config

                                  include: /var/unbound/remotecontrol.conf

                                  GertjanG 1 Reply Last reply Reply Quote 0
                                  • GertjanG
                                    Gertjan @KKIT
                                    last edited by

                                    @KKIT

                                    Worth trying for a while : instead of detailing all interface roles, go for the simple :

                                    c11c6bf4-02d0-492b-83ad-75b36a60fe8e-image.png

                                    No "help me" PM's please. Use the forum, the community will thank you.
                                    Edit : and where are the logs ??

                                    K 1 Reply Last reply Reply Quote 0
                                    • K
                                      KKIT @Gertjan
                                      last edited by

                                      @Gertjan

                                      Unbelievable, it worked. I can't wrap my head around why that would be the case though. Thank you so much for taking the time man

                                      1 Reply Last reply Reply Quote 0
                                      • First post
                                        Last post
                                      Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.