Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    DNS Resolver

    Scheduled Pinned Locked Moved 2.2 Snapshot Feedback and Problems - RETIRED
    186 Posts 44 Posters 136.5k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • R
      raab
      last edited by

      Not sure if it's been mentioned, on a dual wan setup when one WAN link fails over to the secondary WAN link, DNS lookups start to fail on client devices.

      When I set outgoing to WAN1 and WAN2 it works fine, rather than the default ALL:

      1 Reply Last reply Reply Quote 0
      • M
        markuhde
        last edited by

        THAT may have been the cause of the behaviour I saw that forced me to go back to dnsmasq.

        1 Reply Last reply Reply Quote 0
        • M
          markuhde
          last edited by

          @markuhde:

          THAT may have been the cause of the behaviour I saw that forced me to go back to dnsmasq.

          UPDATE - no that wasn't it, as I already had it set to only allow out over the two interfaces that exist. One of the interfaces is a PPPoE.

          1 Reply Last reply Reply Quote 0
          • W
            wagonza
            last edited by

            @irj972:

            Im not sure if this is a real issue or if its particular to my setup but I was having trouble starting DNS Resolver. To maximise my 10be throughput I use a high kern.ipc.maxsockbuf

            kern.ipc.maxsockbuf: 33554432

            Setting kern.ipc.maxsockbuf = 37748736 (36MB) allows Unbound to start, so adding a 4MB buffer to the optimise code section caters for this. As kern.ipc.maxsockbuf increases this buffer grows. Needing more than 32m points towards moving the service off onto its own box.

            Follow me on twitter http://twitter.com/wagonza
            http://www.thepackethub.co.za

            1 Reply Last reply Reply Quote 0
            • W
              wagonza
              last edited by

              @markuhde:

              @markuhde:

              THAT may have been the cause of the behaviour I saw that forced me to go back to dnsmasq.

              UPDATE - no that wasn't it, as I already had it set to only allow out over the two interfaces that exist. One of the interfaces is a PPPoE.

              So what happened in your setup then?

              Follow me on twitter http://twitter.com/wagonza
              http://www.thepackethub.co.za

              1 Reply Last reply Reply Quote 0
              • C
                cmb
                last edited by

                @wagonza:

                @markuhde:

                @markuhde:

                THAT may have been the cause of the behaviour I saw that forced me to go back to dnsmasq.

                UPDATE - no that wasn't it, as I already had it set to only allow out over the two interfaces that exist. One of the interfaces is a PPPoE.

                So what happened in your setup then?

                I'm guessing what happens in that circumstance is he has it doing recursion, which leaves all DNS traffic following the default route, and when the default route is unreachable then nothing will resolve. In that case, enabling default gateway switching is probably the best bet. Alternatively, forwarder mode would be an option as well, specifying at least one DNS server under System>General Setup for each WAN.

                1 Reply Last reply Reply Quote 0
                • R
                  raab
                  last edited by

                  edit: nvm

                  1 Reply Last reply Reply Quote 0
                  • M
                    markuhde
                    last edited by

                    @cmb:

                    @wagonza:

                    @markuhde:

                    @markuhde:

                    THAT may have been the cause of the behaviour I saw that forced me to go back to dnsmasq.

                    UPDATE - no that wasn't it, as I already had it set to only allow out over the two interfaces that exist. One of the interfaces is a PPPoE.

                    So what happened in your setup then?

                    I'm guessing what happens in that circumstance is he has it doing recursion, which leaves all DNS traffic following the default route, and when the default route is unreachable then nothing will resolve. In that case, enabling default gateway switching is probably the best bet. Alternatively, forwarder mode would be an option as well, specifying at least one DNS server under System>General Setup for each WAN.

                    Correct, but as far as I know it was the second WAN (the PPPoE one) going down (or changing IPs), not the primary WAN, that killed resolution. Also, why would it still answer queries from localhost but not from machines on the network?

                    1 Reply Last reply Reply Quote 0
                    • W
                      wagonza
                      last edited by

                      @markuhde:

                      Correct, but as far as I know it was the second WAN (the PPPoE one) going down (or changing IPs), not the primary WAN, that killed resolution. Also, why would it still answer queries from localhost but not from machines on the network?

                      Hmm that makes no sense if its doing recursion, your DNS traffic is going via the default route as Chris has mentioned. It would make sense if 'DNS Query Forwarding' and 'Allow DNS server list to be overridden by DHCP/PPP on WAN' was enabled, and the traffic to those DNS servers were going via the PPPoE connection. Any chance those were enabled at the time?

                      Follow me on twitter http://twitter.com/wagonza
                      http://www.thepackethub.co.za

                      1 Reply Last reply Reply Quote 0
                      • M
                        markuhde
                        last edited by

                        @wagonza:

                        @markuhde:

                        Correct, but as far as I know it was the second WAN (the PPPoE one) going down (or changing IPs), not the primary WAN, that killed resolution. Also, why would it still answer queries from localhost but not from machines on the network?

                        Hmm that makes no sense if its doing recursion, your DNS traffic is going via the default route as Chris has mentioned. It would make sense if 'DNS Query Forwarding' and 'Allow DNS server list to be overridden by DHCP/PPP on WAN' was enabled, and the traffic to those DNS servers were going via the PPPoE connection. Any chance those were enabled at the time?

                        Nope, and to clarify, it didn't just kill it while it was down (or IP changed) - it KILLED it, needed to restart the service to get it resolving again. I gave up for now, back to DNSmasq.

                        1 Reply Last reply Reply Quote 0
                        • R
                          raab
                          last edited by

                          Has anyone run namebench using unbound? It felt like DNS lookups were happening slower than what I'd seen with dnsmasq on 2.1.5 and Tomato USB so decided to give it a go, these were the results:

                          dnsmasq (2.2): https://dl.dropboxusercontent.com/u/90391152/pfsense/namebench_dnsmasq.html

                          unbound (recursive): https://dl.dropboxusercontent.com/u/90391152/pfsense/namebench_unbound_recursive.html

                          unbound (forward): https://dl.dropboxusercontent.com/u/90391152/pfsense/namebench_unbound_forward.html

                          Don't really know how to take these results other than dnsmasq appears to be the fastest, thoughts?

                          1 Reply Last reply Reply Quote 0
                          • W
                            wagonza
                            last edited by

                            @raab:

                            Has anyone run namebench using unbound? It felt like DNS lookups were happening slower than what I'd seen with dnsmasq on 2.1.5 and Tomato USB so decided to give it a go, these were the results:

                            dnsmasq (2.2): https://dl.dropboxusercontent.com/u/90391152/pfsense/namebench_dnsmasq.html

                            unbound (recursive): https://dl.dropboxusercontent.com/u/90391152/pfsense/namebench_unbound_recursive.html

                            unbound (forward): https://dl.dropboxusercontent.com/u/90391152/pfsense/namebench_unbound_forward.html

                            Don't really know how to take these results other than dnsmasq appears to be the fastest, thoughts?

                            Well thats expected you can't compare the two.

                            DNSMasq is a forwarder and Unbound is a resolver. There is a lot to consider including how your Unbound service is configured e.g. DNSSec enabled?
                            So Unbound performs the task of doing iterative queries as well as validating answers. DNSMasq does not and relies on another name server to do all the hard work of doing iterative queries etc.

                            Follow me on twitter http://twitter.com/wagonza
                            http://www.thepackethub.co.za

                            1 Reply Last reply Reply Quote 0
                            • W
                              wagonza
                              last edited by

                              @markuhde:

                              @wagonza:

                              @markuhde:

                              Correct, but as far as I know it was the second WAN (the PPPoE one) going down (or changing IPs), not the primary WAN, that killed resolution. Also, why would it still answer queries from localhost but not from machines on the network?

                              Hmm that makes no sense if its doing recursion, your DNS traffic is going via the default route as Chris has mentioned. It would make sense if 'DNS Query Forwarding' and 'Allow DNS server list to be overridden by DHCP/PPP on WAN' was enabled, and the traffic to those DNS servers were going via the PPPoE connection. Any chance those were enabled at the time?

                              Nope, and to clarify, it didn't just kill it while it was down (or IP changed) - it KILLED it, needed to restart the service to get it resolving again. I gave up for now, back to DNSmasq.

                              Ok thanks you gave me an idea of where the problem could be but I would need to test to confirm.

                              Follow me on twitter http://twitter.com/wagonza
                              http://www.thepackethub.co.za

                              1 Reply Last reply Reply Quote 0
                              • R
                                raab
                                last edited by

                                dnssec was disabled

                                Does the option under DNS resolver "Enable forwarding mode" not do the same thing as dnsmasq?

                                1 Reply Last reply Reply Quote 0
                                • Q
                                  q54e3w
                                  last edited by

                                  Couple of small issues I spotted it tuning up my Resolver in build dated December 28th.

                                  In Resolver>General Settings>Advanced, parameters which include double quotes require a space on the end of each line to enforce the carriage return, i.e

                                  local-data: "example1.com A 10.10.10.1"
local-data: "example2.com A 10.10.10.1"
local-data: "example3.com A 10.10.10.1"

                                  Save & Apply, migrate away and back to the General settings page and you will see they have been reduced to one line.

                                  Also, not sure if this is a real issue, on advance settings page, when increasing the Message Cache Size, the associated RRset cache size isn't set correctly in the unbound.con file - not quite sure if its being internally handled correctly though.

                                  1 Reply Last reply Reply Quote 0
                                  • P
                                    phil.davis
                                    last edited by

                                    I believe the double quotes carriage returns business has been fixed in later snapshots. Dec 28th was last year ;)

                                    As the Greek philosopher Isosceles used to say, "There are 3 sides to every triangle."
                                    If I helped you, then help someone else - buy someone a gift from the INF catalog http://secure.inf.org/gifts/usd/

                                    1 Reply Last reply Reply Quote 0
                                    • Q
                                      q54e3w
                                      last edited by

                                      thx for the info Phil, I'll upgrade as soon as get a clear moment.

                                      1 Reply Last reply Reply Quote 0
                                      • W
                                        wagonza
                                        last edited by

                                        @raab:

                                        dnssec was disabled

                                        Does the option under DNS resolver "Enable forwarding mode" not do the same thing as dnsmasq?

                                        Yes it does, Unbound then forwards all queries to the addresses defined and lets that server handle the recursion. However the other factors to consider are, for example, how the cache is tuned, prefetching enabled and other settings which are different or don't exist in dnsmasq.

                                        Thanks for the tests though I should attempt the same and see what I can come up with.

                                        Follow me on twitter http://twitter.com/wagonza
                                        http://www.thepackethub.co.za

                                        1 Reply Last reply Reply Quote 0
                                        • R
                                          raab
                                          last edited by

                                          Good to know, just want to make it clear that I'm not knocking unbound at all.

                                          I just wanted to see if there was any difference, granted I've done no tuning of unbound yet

                                          1 Reply Last reply Reply Quote 0
                                          • Q
                                            q54e3w
                                            last edited by

                                            Hi guys, Unbound has been working really well for me. I've been using unbound to filter some web sites using the advanced options of unbound which works really well. It it possible to apply these filters to only a subset of all my available subnets? For example, I'd like my VPN and wifi subnets to scrub adverts and tracking but for my 'clearnet' LAN subnet to ignore these filters.

                                            For example, i have redirects for Adverts configured as so….

                                            local-data: "www.google-analytics.com A 10.10.10.1"
                                            local-data: "click01.aditic.net A 10.10.10.1"

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.