Dns stopped working this morning?

Achura_

Thanks for posting your stats & config.

Some of my stats, the average recursion time is bothering me (and shows the 'hiccups'):


total.num.queries=565
total.recursion.time.avg=30.053324
total.recursion.time.median=0.0239458

My config looks like this, 192.168.100.1 is the LAN side of pfsense:


#########################
# Unbound configuration #
#########################

###
# Server config
###
server:
num-threads: 1
msg-cache-slabs: 4
rrset-cache-slabs: 4
infra-cache-slabs: 4
key-cache-slabs: 4
msg-cache-size: 20m
rrset-cache-size: 40m
outgoing-range: 974
#so-rcvbuf: 4m
num-queries-per-thread: 1024
verbosity: 1
port: 53
do-ip4: yes
do-ip6: no
do-udp: yes
do-tcp: yes
do-daemonize: yes
statistics-interval: 0
extended-statistics: no
statistics-cumulative: no
# Interface IP(s) to bind to
interface: 192.168.100.1

chroot: ""
username: "unbound"
directory: "/usr/local/etc/unbound"
pidfile: "/var/run/unbound.pid"
root-hints: "root.hints"
harden-dnssec-stripped: yes
harden-referral-path: no
prefetch: yes
prefetch-key: yes
use-syslog: yes
module-config: "validator iterator"
unwanted-reply-threshold: 10000000
auto-trust-anchor-file: /usr/local/etc/unbound/root-trust-anchor
#### Access Control ####
# Local attached networks allowed to utilize service and any user added ACLs
access-control: 127.0.0.0/8 allow
access-control: 192.168.100.0/24 allow
#InterneClients
access-control: 192.168.100.0/24 allow

# For DNS Rebinding prevention
private-address: 10.0.0.0/8
private-address: 172.16.0.0/12
private-address: 192.168.0.0/16
private-address: 192.254.0.0/16
# private-address: fd00::/8
# private-address: fe80::/10
# Set private domains in case authorative name server returns a RFC1918 IP address

# Host entries
local-zone: "mein-netz.at" transparent
local-data-ptr: "127.0.0.1 localhost"
local-data: "localhost A 127.0.0.1"
local-data: "localhost.mein-netz.at A 127.0.0.1"
local-data-ptr: "192.168.100.1 fw.mein-netz.at"
local-data: "fw.mein-netz.at A 192.168.100.1"
local-data: "fw A 192.168.100.1"
local-data-ptr: "192.168.100.2 gk.mein-netz.at"
local-data: "gk.mein-netz.at IN A 192.168.100.2"
local-data: 'gk.mein-netz.at TXT "xxx"'
local-data-ptr: "192.168.100.3 tsp.mein-netz.at"
local-data: "tsp.mein-netz.at IN A 192.168.100.3"
local-data: 'tsp.mein-netz.at TXT "xxx"'
local-data-ptr: "192.168.100.49 DS-1.mein-netz.at"
local-data: "DS-1.mein-netz.at IN A 192.168.100.49"
local-data: 'DS-1.mein-netz.at TXT "xxx"'

# Domain overrides

###
# Remote Control Config
###
remote-control:
control-enable: yes
control-interface: 127.0.0.1
control-port: 953
server-key-file: "/usr/local/etc/unbound/unbound_server.key"
server-cert-file: "/usr/local/etc/unbound/unbound_server.pem"
control-key-file: "/usr/local/etc/unbound/unbound_control.key"
control-cert-file: "/usr/local/etc/unbound/unbound_control.pem"

I just did a diff of our respective configs, only IPs, IPv6, statistics and the static entries differ.
Maybe I'll go and update to the current snapshot, otherwise I'm all out of ideas/things to triee.

johnpoz

Yeah your clearly having some major issues there with an average of 30 seconds?

here are my stats
total.num.recursivereplies=179191
total.recursion.time.avg=1.002341
total.recursion.time.median=0.0679367

To be honest I don't see how it could be an issue with unbound though if your showing the queries go out, and just not getting responses back.

Do you mind actually posting up the pcap version of the capture vs text. So we can see if something misformed with the packet going on the wire??

So you say it works fine for a while and then just stops working?

BTW you are running 1.4.8 of unbound?

; <<>> DiG 9.7.3 <<>> @192.168.1.253 version.bind chaos txt
;; ANSWER SECTION:
version.bind. 0 CH TXT "unbound 1.4.8"

I show package version as
1.4.8_131

Achura_

Thanks again, johnpoz. Your stats look what I'd like to have! :)

I'm running the same version as you, both unbound and the unbound package.

I started the capture again, hopefully it will happen again tomorrow and I'll have more data.

johnpoz

So works for awhile, and then just stops - ie its working now.

You know since your behind a nat router, could it be some form of flood protection? Ie your "modem" sees a bunch of traffic outbound on 53 all at the same time or specific number within certain time frame all from the same IP (your routers wan IP) so it blocks that IP from sending any more traffic to that port?

I have seen this before with some routers and p2p causing a spike in DNS traffic, and then nothing works because user can no longer do dns.

Whats the specific "modem" you have so can lookup its manual to see if its got some kind of feature like that.

Are you running anything that would cause spikes in your dns traffic? I know for sure that p2p can cause a huge amount of PTR traffic, depending on the client.

Achura_

I don't do anything really DNS query heavy, no p2p. Browsing forums sometimes leads to a real storm of queries though (inline images, etc). Good idea to check for that!

At the moment I have a Thomson TWG 870 - and behold, there is a flood protection on the "Web Filter" subpage. I turned it off, crossing fingers now!

johnpoz

well been a few hours since your post – did that fix it?

Achura_

Couldn't really do much testing til now, but it seems that fixed it!

Many thanks!

johnpoz

Well thats is good news.. Looks like nothing wrong with unbound after all ;) heheh

Not a fan of most of these soho routers at all, to be honest if I were you I would really push to just get a standard cable modem.. Can't you just buy your own?

I just bought a SB6120 about a year ago when they came out - comcast had not updated mine in years, and was still docsis 2. And they were charging me rent on thing every month. So vs asking them to update it, I just bought my own and prob already paid for itself vs the per month rent.

I just had my son by one as well vs comcast providing it - they were going to charge him $7 a month rent.. WTF, you can just buy a SB6120 for like $70, less then a year its paid for itself, etc.

Why will they not let you put it into just bridge mode so its not doing nat, to be honest that makes no freaking sense - what does the ISP care if your box has the public IP or their device does??

Achura_

I'm definitely going to ask for the modem next week - the combo modem/gateway just sucks.

Unfortunately we can't just supply our own cable modems, the provider has to have access to the 'cable part' of it to configure their own settings which aren't changeable by us customers. That's life over the pond for you. ;)

And you were right, no problem with unbound at all! :D

johnpoz

Just because you buy the modem does not mean your provider does not have access to it.. Once you register it on their network they have access.. So do they charge you rent for the device?

Achura_

No, they don't charge anything extra at all.

wachaq

hi… i had a same problem before, try putting a dns ip at dns entry in DHCP server (pfsense). may be your LAN client lost auto dns during pc restarted, hope this help.

johnpoz

The issue was resolved quite some time ago, and it was flood type protection on his router in front of the pfsense box.. It helps to read a thread before posting in it ;)