Unbound seems to be restarting frequently
-
I had this problem a few days ago as well. I am using the current 2.2.1 release as well.
What fixed the problem was to check the following in the DNS Resolver: Advanced settings:- Hide Identity
- Hide Version
Any ideas as to why this would work?
Also i noticed that after I did this I was no longer getting strange messages in my DHCP log complaining about incorrect length of DHCP headers (UDP I think).It wouldn't change anything, that's a coincidence. Hide identity and hide version have no impact on a typical running resolver and are very simple options that wouldn't cause any issues. Something else changed around the same time that fixed the issue. The DHCP log complaints are probably a good lead, if you start having issues again, start a new thread describing the issue and include those logs.
-
Here's another thread: https://forum.pfsense.org/index.php?topic=88240.0 of the same exact issue.
-
I have the same issue. Is it somehow related to static dhcp mappings or DNS overrides? That's the only non-standard thing I'm doing.
Not only do I get frequent restarts, but also all kinds of errors several times per day. Such as "DNS_PROBE_FINISHED_NXDOMAIN" and timeouts.
As it is, DNS Resolver is not usable - is it OK to use Forwarder instead of Resolver? Not entirely sure what the difference is, really.
-
is it OK to use Forwarder instead of Resolver?
Forwarder (dnsmasq) is fine to use. It is just a program that forwards DNS requests from clients to the specified upstream DNS server/s, gives the replies back to the clients and caches the replies so it can respond quicker when asked for the resolution of the same name again. The upstream DNS server/s do the real resolution process - so you rely on those to "do the right thing" for you.
Resolver (unbound) can be put in forwarding mode, in which case it does similar stuff to Forwarder (surprise!). In resolver mode it resolves names by going to the DNS root servers and following the chain, asking ".com" then "company.com" then "xyz.company.com" all the way down until it finally gets the name resolution from the DNS server that is really the one for that name.
-
I see.
I use pfSense as a DNS server though, so I can resolve statically mapped DHCP clients on the LAN. If it can't resolve locally, it goes to 8.8.8.8.
Can DNS Forwarder do the same?
-
Yes
-
When I upgraded to the current 2.2 release from the previous version I switched to using unbound but I've been finding that it stops working ever now and then - suddenly nothing on the network resolves. Manually restarting unbound fixes this … until the next time. I've just switched back to dnsmasq on my work system and rebooted in the hope that this will fix it.
I'm seeing this both on my work system and on my home firewall too. Looking at the status display it seems that unbound is still working - it doesn't show up as stopped, it just doesn't work. Sorry if these notes aren't very helpful but there does seem to be an issue here.
edmund
Thank you for posting that. It is very helpful to me. ;D
I was running 2.2 x64 on a dell 780 and 620 for a few months without issue. After adding a LAN gateway and creating an asymmetric routing issue that was resolved with forum help I moved to two check point U10s with 2.2 i386 6 days ago so I could use the third nic to implement the gateway correctly. Since then I have had to restart Unbound DNS Resolver every couple of days or so. As you said "it doesn't show up as stopped, it just doesn't work".
I am now Select Harden Glue and Harden DNSSEC data!!! We will see if this fixes my issue..Selecting Harden Glue and Harden DNSSEC data did solve my issue with 2.2. No problems since March 27th
I see.
I use pfSense as a DNS server though, so I can resolve statically mapped DHCP clients on the LAN. If it can't resolve locally, it goes to 8.8.8.8.
Can DNS Forwarder do the same?
I do the same thing. I have the Envisalink alarm board with a DHCP Static address. It would go offline when it couldn't resolve. Now no more issues.
-
No issues because you moved to forwarder instead of resolver, or because of Harden Glue?
-
More info : https://forum.pfsense.org/index.php?topic=88240.msg513735#msg513735
-
No issues because you moved to forwarder instead of resolver, or because of Harden Glue?
Using Resolver with Harden Glue.
For me setting Services ->DNS Resolver -> Advanced settings -> Harden Glue & Harden DNSSEC data … checked
Solved both the issues with just not resolving and the repeated stopping and starting fits. The stopping and starting fits would come and go.
Last entry would show started but would not resolve until re-started.
Now no issues... -
Most if not all of the problems people are having is caused by bad settings.
I get this alot with people where they don't read or follow directions or advice fully and go their own way with part of the setup and then blame the hardware/software/instructions when things don't work as they should. Pretty much this entire thread at this point is totally just people shooting themselves in the foot. Unbound is fine.
-
Most if not all of the problems people are having is caused by bad settings.
I get this alot with people where they don't read or follow directions or advice fully and go their own way with part of the setup and then blame the hardware/software/instructions when things don't work as they should. Pretty much this entire thread at this point is totally just people shooting themselves in the foot. Unbound is fine.
I disagree. I have followed the direction meticulously and studied the problem deeply. Forwarder is fine, Unbound is not.
-
You only think you have followed directions. At some point you will discover some little something you have either changed or not done correctly.
-
You only think you have followed directions. At some point you will discover some little something you have either changed or not done correctly.
Nope, the problems are real.
-
So why is it not broken for me at a dozen places? Does it just like me better than you?
-
So why is it not broken for me at a dozen places? Does it just like me better than you?
Oh come on, you're not really that dense, are you? A number of people are reporting this problem here and elsewhere.
The fact that some, not all, experience issues is due to differences in hardware, how pfSense is used, etc.
This is the nature of many bugs, of course, and if you don't agree with this, you're either dense or just trolling. Which is it?
-
So why is it not broken for me at a dozen places? Does it just like me better than you?
Why is it that if it's not a problem for you then you will defend it all the way until you become offensive to others? It's obvious, based on the logs, that there is a problem. This is very true to most of your posts. Instead of trying to help others, you choose to be sarcastic and offensive.
-
You can click that smite button til you are blue in the face. It won't change the fact that if you set unbound up correctly it works fine and if you don't it doesn't.
There are alot of settings that affect unbound. Setting up dnsmasq is easier. I'll say that much.
I also had problems with unbound when I first started playing with it but after changing a few of the advanced setting and fixing my stupid settings I had entered into general setup, all problems disappeared.
Maybe it only works for dense people?
BTW - Why is it offensive to you that I think that more than likely bad setting cause most of the problems with unbound?
My definition of a problem is "DNS doesn't work". Not - "Ohhhhh I see that DNS restarts sometimes".
If my computers were not resolving websites and the web was acting flakey for me I'd be right along with the rest complaining.
However, fact is, its working fine. Since I have no special magic happening here, I have to believe this is a setting problem.
-
You can click that smite button til you are blue in the face. It won't change the fact that if you set unbound up correctly it works fine and if you don't it doesn't.
There are alot of settings that affect unbound. Setting up dnsmasq is easier. I'll say that much.
I also had problems with unbound when I first started playing with it but after changing a few of the advanced setting and fixing my stupid settings I had entered into general setup, all problems disappeared.
Maybe it only works for dense people?
Maybe. My secondary pfSense install has problems too once a few wireless clients connect -> restart and intermittent resolve errors.
Funny thing, considering this is a stock forwarding setup according to docs - no advanced settings, no nothing.
No wonder so many people are seeing this, clearly there are bugs…
-
BTW - I see alot of people doing alot of really silly things with pfsense and the one thing all those people have in common it they all think their way should be fine and its got to be that pfsense is brrrrrroooooooked.
Anyway - Hope you figure it out.
