Periodic since 2.2 pages load blank, certs invalid
-
When only unbound can be used and DNS Sec is set to ON, and port 53 is blocked except to pfsense
-A DNS lookup from any computer to one of the domains causes unbound to stop resolving anything, all lookups fail
(persists until unbound service is restarted)[[/quote]
I can not confirm this, worked fine for me in this setup (with some service interruptions, 5-7times a day)
-
I'm not in a position to test this at the moment. Tonight.
-
When only unbound can be used and DNS Sec is set to ON, and port 53 is blocked except to pfsense
-A DNS lookup from any computer to one of the domains causes unbound to stop resolving anything, all lookups fail
(persists until unbound service is restarted)I can not confirm this, worked fine for me in this setup (with some service interruptions, 5-7times a day)
When you say interruptions, could those have been unbound not responding?
Someone did mention that one of the times I was unable to restart the service manually (as I was not available) it began working again after 45-50 minutes.Either way though, as soon as I overrode the DNS for those sites, it's never happened again.
I'm not in a position to test this at the moment. Tonight.
If you're going to test, try accessing and resolving
api-nyc01.exip.org
and
ns3.csof.net
-
A DNS lookup from any computer to one of the domains causes unbound to stop resolving anything
So I can test it properly, to what domains is this referring?
-
If you're going to test, try accessing and resolving
api-nyc01.exip.org
and
ns3.csof.net
What about it?
dig . ns
Pick a root server at random:
dig @e.root-servers.net ns3.csof.net
Get a list of gtld servers. Pick one at random:
dig @e.gtld-servers.net ns3.csof.net
Pertinent info:
;; AUTHORITY SECTION: csof.net. 172800 IN NS ns61.domaincontrol.com. csof.net. 172800 IN NS ns62.domaincontrol.com. ;; ADDITIONAL SECTION: ns61.domaincontrol.com. 172800 IN A 216.69.185.32 ns62.domaincontrol.com. 172800 IN A 208.109.255.32
Pick one of those:
dig @216.69.185.32 ns3.csof.net
;; QUESTION SECTION: ;ns3.csof.net. IN A ;; ANSWER SECTION: ns3.csof.net. 600 IN A *** 195.22.26.199 ***
Their name servers either want that name to resolve to 195.22.26.199 or are giving bogus information or are otherwise hacked. What, exactly, would you expect unbound to do to fix that?
-
Those domains aren't the problem.
The problem is what happens AFTER looking them up.
I can see there's some failure to communicate here.
Problem 1:
Without DNSSEC on and with other DNS servers allowed, a few minutes after looking up those domains, looking up google.com will return something in the 195.22.x range (persisting until I restarted unbound, or possibly 45 minutes to an hour)At this point I switched to DNSSEC and blocked all outgoing DNS except to the firewall.
Problem 2:
With DNSSEC enabled and only unbound able to resolve, a few minutes after looking up those domains, lookup up google.com will return nothing the result will be blank as if the domain didn't exist (persisting until I restarted unbound, or possibly 45 minutes to an hour)At this point, I put DNS overrides in for those domains setting them to 0.0.0.0 so they would not be able to be looked up at all.
At this point, the symptoms have stopped.
-
Ok I just let unbound look them up.
-
Start listening to these guys. There's something strange and it looks like it's in unbound.
$ dig @192.168.223.1 www.google.com ; <<>> DiG 9.8.3-P1 <<>> @192.168.223.1 www.google.com ; (1 server found) ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 53699 ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0 ;; QUESTION SECTION: ;www.google.com. IN A ;; Query time: 81 msec ;; SERVER: 192.168.223.1#53(192.168.223.1) ;; WHEN: Mon Feb 9 12:23:46 2015 ;; MSG SIZE rcvd: 32
-
After bouncing unbound:
$ dig @192.168.223.1 www.google.com ; <<>> DiG 9.8.3-P1 <<>> @192.168.223.1 www.google.com ; (1 server found) ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 54480 ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0 ;; QUESTION SECTION: ;www.google.com. IN A ;; ANSWER SECTION: www.google.com. 300 IN A 216.58.216.36 ;; Query time: 1333 msec ;; SERVER: 192.168.223.1#53(192.168.223.1) ;; WHEN: Mon Feb 9 12:26:36 2015 ;; MSG SIZE rcvd: 48
-
When only unbound can be used and DNS Sec is set to ON, and port 53 is blocked except to pfsense
-A DNS lookup from any computer to one of the domains causes unbound to stop resolving anything, all lookups fail
(persists until unbound service is restarted)I can not confirm this, worked fine for me in this setup (with some service interruptions, 5-7times a day)
When you say interruptions, could those have been unbound not responding?
Someone did mention that one of the times I was unable to restart the service manually (as I was not available) it began working again after 45-50 minutes.….
My thread is this here:
https://forum.pfsense.org/index.php?topic=88272
:-)
-
Start listening to these guys. There's something strange and it looks like it's in unbound.
I'm guessing it happened a few moments after doing a lookup on one of the domains I mentioned?
-
Yup.
Unbound starts returning SERVFAIL for random domains after querying at least one or both of those hostnames. I'm doing it one more time at unbound log level 5.
ETA: Ironically, I had to kill unbound to post this because:
$ dig forum.pfsense.org
; <<>> DiG 9.8.3-P1 <<>> forum.pfsense.org
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 30471
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0;; QUESTION SECTION:
;forum.pfsense.org. IN A;; Query time: 1781 msec
;; SERVER: 192.168.223.1#53(192.168.223.1)
;; WHEN: Mon Feb 9 17:46:41 2015
;; MSG SIZE rcvd: 35 -
Have you guys considered setting the advanced settings that prevent excessive replies and purge things when excessive replies and poisoning is possibly happening?
-
https://forum.pfsense.org/index.php?topic=88466.msg488411#msg488411
-
Yup.
Unbound starts returning SERVFAIL for random domains after querying at least one or both of those hostnames. I'm doing it one more time at unbound log level 5.
This sounds like the manifestation of the issue with DNSSEC enabled. At some point, you may want to try it again with DNSSEC disabled; you should then see all domains being resolved to a hostile IP, bad certs for https, etc. like reported in the beginning of this thread. Not sure if this would help with the diagnostics.
-
Yup.
Unbound starts returning SERVFAIL for random domains after querying at least one or both of those hostnames. I'm doing it one more time at unbound log level 5.
This sounds like the manifestation of the issue with DNSSEC enabled. At some point, you may want to try it again with DNSSEC disabled; you should then see all domains being resolved to a hostile IP, bad certs for https, etc. like reported in the beginning of this thread. Not sure if this would help with the diagnostics.
Yes, DNSSEC was the change I made that made it go from the bad domain resolutions to the failure to resolve at all.
I've had both issues and DNSSEC was the difference between which one I got.
-
Uncheck DNSSEC, Save, Apply…. There is most certainly something here....
$ dig ns3.csof.net ; <<>> DiG 9.8.3-P1 <<>> ns3.csof.net ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 1411 ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 5, ADDITIONAL: 3 ;; QUESTION SECTION: ;ns3.csof.net. IN A ;; ANSWER SECTION: ns3.csof.net. 600 IN A 195.22.26.199 ;; AUTHORITY SECTION: csof.net. 1792 IN NS ns62.domaincontrol.com. csof.net. 1792 IN NS ns61.domaincontrol.com. csof.net. 1792 IN NS ns4.csof.net. csof.net. 1792 IN NS ns2.csof.net. csof.net. 1792 IN NS ns1.csof.net. ;; ADDITIONAL SECTION: ns4.csof.net. 1792 IN A 54.72.8.183 ns2.csof.net. 1793 IN A 212.6.183.201 ns1.csof.net. 1792 IN A 54.77.72.254 ;; Query time: 29 msec ;; SERVER: 192.168.223.1#53(192.168.223.1) ;; WHEN: Mon Feb 9 18:48:25 2015 ;; MSG SIZE rcvd: 203 $ dig api-nyc01.exip.org ; <<>> DiG 9.8.3-P1 <<>> api-nyc01.exip.org ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 14360 ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0 ;; QUESTION SECTION: ;api-nyc01.exip.org. IN A ;; ANSWER SECTION: api-nyc01.exip.org. 10 IN A 195.22.26.248 ;; Query time: 206 msec ;; SERVER: 192.168.223.1#53(192.168.223.1) ;; WHEN: Mon Feb 9 18:48:35 2015 ;; MSG SIZE rcvd: 52 $ dig www.pfsense.org ; <<>> DiG 9.8.3-P1 <<>> www.pfsense.org ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 51593 ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 4, ADDITIONAL: 0 ;; QUESTION SECTION: ;www.pfsense.org. IN A ;; ANSWER SECTION: www.pfsense.org. 10 IN A 195.22.26.248 ;; AUTHORITY SECTION: org. 172779 IN NS ns1.csof.net. org. 172779 IN NS ns2.csof.net. org. 172779 IN NS ns3.csof.net. org. 172779 IN NS ns4.csof.net. ;; Query time: 159 msec ;; SERVER: 192.168.223.1#53(192.168.223.1) ;; WHEN: Mon Feb 9 18:48:39 2015 ;; MSG SIZE rcvd: 129
-
looks like unbound is allowing itself to get polluted by this nonsense:
gridbug:etc cjl$ dig @ns1.csof.net. com. ns ; <<>> DiG 9.8.3-P1 <<>> @ns1.csof.net. com. ns ; (1 server found) ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 31834 ;; flags: qr aa rd; QUERY: 1, ANSWER: 4, AUTHORITY: 0, ADDITIONAL: 4 ;; WARNING: recursion requested but not available ;; QUESTION SECTION: ;com. IN NS ;; ANSWER SECTION: com. 172800 IN NS ns1.csof.net. com. 172800 IN NS ns2.csof.net. com. 172800 IN NS ns3.csof.net. com. 172800 IN NS ns4.csof.net. ;; ADDITIONAL SECTION: ns1.csof.net. 100 IN A 54.77.72.254 ns2.csof.net. 100 IN A 212.6.183.201 ns3.csof.net. 100 IN A 195.22.26.199 ns4.csof.net. 100 IN A 54.72.8.183 ;; Query time: 163 msec ;; SERVER: 54.77.72.254#53(54.77.72.254) ;; WHEN: Mon Feb 9 18:58:46 2015 ;; MSG SIZE rcvd: 165 gridbug:etc cjl$ dig @ns1.csof.net. . ns ; <<>> DiG 9.8.3-P1 <<>> @ns1.csof.net. . ns ; (1 server found) ;; global options: +cmd ;; connection timed out; no servers could be reached gridbug:etc cjl$ dig @ns1.csof.net. net. ns ; <<>> DiG 9.8.3-P1 <<>> @ns1.csof.net. net. ns ; (1 server found) ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 23620 ;; flags: qr aa rd; QUERY: 1, ANSWER: 4, AUTHORITY: 0, ADDITIONAL: 4 ;; WARNING: recursion requested but not available ;; QUESTION SECTION: ;net. IN NS ;; ANSWER SECTION: net. 172800 IN NS ns1.csof.net. net. 172800 IN NS ns2.csof.net. net. 172800 IN NS ns3.csof.net. net. 172800 IN NS ns4.csof.net. ;; ADDITIONAL SECTION: ns1.csof.net. 100 IN A 54.77.72.254 ns2.csof.net. 100 IN A 212.6.183.201 ns3.csof.net. 100 IN A 195.22.26.199 ns4.csof.net. 100 IN A 54.72.8.183 ;; Query time: 161 msec ;; SERVER: 54.77.72.254#53(54.77.72.254) ;; WHEN: Mon Feb 9 18:59:19 2015 ;; MSG SIZE rcvd: 162 gridbug:etc cjl$ dig @ns1.csof.net. com. ns ; <<>> DiG 9.8.3-P1 <<>> @ns1.csof.net. com. ns ; (1 server found) ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 57675 ;; flags: qr aa rd; QUERY: 1, ANSWER: 4, AUTHORITY: 0, ADDITIONAL: 4 ;; WARNING: recursion requested but not available ;; QUESTION SECTION: ;com. IN NS ;; ANSWER SECTION: com. 172800 IN NS ns1.csof.net. com. 172800 IN NS ns2.csof.net. com. 172800 IN NS ns3.csof.net. com. 172800 IN NS ns4.csof.net. ;; ADDITIONAL SECTION: ns1.csof.net. 100 IN A 54.77.72.254 ns2.csof.net. 100 IN A 212.6.183.201 ns3.csof.net. 100 IN A 195.22.26.199 ns4.csof.net. 100 IN A 54.72.8.183 ;; Query time: 164 msec ;; SERVER: 54.77.72.254#53(54.77.72.254) ;; WHEN: Mon Feb 9 18:59:23 2015 ;; MSG SIZE rcvd: 165 gridbug:etc cjl$ dig @ns1.csof.net. org. ns ; <<>> DiG 9.8.3-P1 <<>> @ns1.csof.net. org. ns ; (1 server found) ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 20295 ;; flags: qr aa rd; QUERY: 1, ANSWER: 4, AUTHORITY: 0, ADDITIONAL: 4 ;; WARNING: recursion requested but not available ;; QUESTION SECTION: ;org. IN NS ;; ANSWER SECTION: org. 172800 IN NS ns1.csof.net. org. 172800 IN NS ns2.csof.net. org. 172800 IN NS ns3.csof.net. org. 172800 IN NS ns4.csof.net. ;; ADDITIONAL SECTION: ns1.csof.net. 100 IN A 54.77.72.254 ns2.csof.net. 100 IN A 212.6.183.201 ns3.csof.net. 100 IN A 195.22.26.199 ns4.csof.net. 100 IN A 54.72.8.183 ;; Query time: 162 msec ;; SERVER: 54.77.72.254#53(54.77.72.254) ;; WHEN: Mon Feb 9 18:59:27 2015 ;; MSG SIZE rcvd: 165 gridbug:etc cjl$ dig @ns1.csof.net. edu. ns ; <<>> DiG 9.8.3-P1 <<>> @ns1.csof.net. edu. ns ; (1 server found) ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 28770 ;; flags: qr aa rd; QUERY: 1, ANSWER: 4, AUTHORITY: 0, ADDITIONAL: 4 ;; WARNING: recursion requested but not available ;; QUESTION SECTION: ;edu. IN NS ;; ANSWER SECTION: edu. 172800 IN NS ns1.csof.net. edu. 172800 IN NS ns2.csof.net. edu. 172800 IN NS ns3.csof.net. edu. 172800 IN NS ns4.csof.net. ;; ADDITIONAL SECTION: ns1.csof.net. 100 IN A 54.77.72.254 ns2.csof.net. 100 IN A 212.6.183.201 ns3.csof.net. 100 IN A 195.22.26.199 ns4.csof.net. 100 IN A 54.72.8.183 ;; Query time: 161 msec ;; SERVER: 54.77.72.254#53(54.77.72.254) ;; WHEN: Mon Feb 9 18:59:31 2015 ;; MSG SIZE rcvd: 165 gridbug:etc cjl$ dig @ns1.csof.net. gov. ns ; <<>> DiG 9.8.3-P1 <<>> @ns1.csof.net. gov. ns ; (1 server found) ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 46880 ;; flags: qr aa rd; QUERY: 1, ANSWER: 4, AUTHORITY: 0, ADDITIONAL: 4 ;; WARNING: recursion requested but not available ;; QUESTION SECTION: ;gov. IN NS ;; ANSWER SECTION: gov. 172800 IN NS ns1.csof.net. gov. 172800 IN NS ns2.csof.net. gov. 172800 IN NS ns3.csof.net. gov. 172800 IN NS ns4.csof.net. ;; ADDITIONAL SECTION: ns1.csof.net. 100 IN A 54.77.72.254 ns2.csof.net. 100 IN A 212.6.183.201 ns3.csof.net. 100 IN A 195.22.26.199 ns4.csof.net. 100 IN A 54.72.8.183 ;; Query time: 162 msec ;; SERVER: 54.77.72.254#53(54.77.72.254) ;; WHEN: Mon Feb 9 18:59:34 2015 ;; MSG SIZE rcvd: 165 gridbug:etc cjl$ dig @ns1.csof.net. mil. ns ; <<>> DiG 9.8.3-P1 <<>> @ns1.csof.net. mil. ns ; (1 server found) ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 21791 ;; flags: qr aa rd; QUERY: 1, ANSWER: 4, AUTHORITY: 0, ADDITIONAL: 4 ;; WARNING: recursion requested but not available ;; QUESTION SECTION: ;mil. IN NS ;; ANSWER SECTION: mil. 172800 IN NS ns1.csof.net. mil. 172800 IN NS ns2.csof.net. mil. 172800 IN NS ns3.csof.net. mil. 172800 IN NS ns4.csof.net. ;; ADDITIONAL SECTION: ns1.csof.net. 100 IN A 54.77.72.254 ns2.csof.net. 100 IN A 212.6.183.201 ns3.csof.net. 100 IN A 195.22.26.199 ns4.csof.net. 100 IN A 54.72.8.183 ;; Query time: 160 msec ;; SERVER: 54.77.72.254#53(54.77.72.254) ;; WHEN: Mon Feb 9 18:59:40 2015 ;; MSG SIZE rcvd: 165 gridbug:etc cjl$ dig @ns1.csof.net. us. ns ; <<>> DiG 9.8.3-P1 <<>> @ns1.csof.net. us. ns ; (1 server found) ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 5930 ;; flags: qr aa rd; QUERY: 1, ANSWER: 4, AUTHORITY: 0, ADDITIONAL: 4 ;; WARNING: recursion requested but not available ;; QUESTION SECTION: ;us. IN NS ;; ANSWER SECTION: us. 172800 IN NS ns1.csof.net. us. 172800 IN NS ns2.csof.net. us. 172800 IN NS ns3.csof.net. us. 172800 IN NS ns4.csof.net. ;; ADDITIONAL SECTION: ns1.csof.net. 100 IN A 54.77.72.254 ns2.csof.net. 100 IN A 212.6.183.201 ns3.csof.net. 100 IN A 195.22.26.199 ns4.csof.net. 100 IN A 54.72.8.183 ;; Query time: 161 msec ;; SERVER: 54.77.72.254#53(54.77.72.254) ;; WHEN: Mon Feb 9 18:59:43 2015 ;; MSG SIZE rcvd: 164
-
Back to dnsmasq for me until someone says something.
-
I don't know which I should be.
Upset that unbound is doing this
Relieved that everything I was seeing can be reproduced