Unbound service getting restarted every 10 seconds due to rc.newwanipv6 script
-
not sure with i386 ;D But unbound restarts every 15min so you can't use it for real in 2.3.4. Maybe its corrected, but…
pfadmin
-
Update: yes, IPv4 DNS resolution suffers just as well as IPv6. Web browsing is extremely slow and suffering of recurring 'hiccups' (having to reload pages due to DNS errors).
Update 2: found a bug report which could be related to this: https://redmine.pfsense.org/issues/7145
~~Thanks guys. But, how "normal" would this be? "Normal" as in purposefully developed to accomplish this or "normal" as in "a known software bug"? :-\
Unbound it is not restarting every 15 minutes, but every 15 seconds.~~
Update 3: according to the bug report regarding this problem being fixed in version 2.4 and according to the expected roadmap for this particular version I am basically f**ed! :'(
-
Update 3: according to the bug report regarding this problem being fixed in version 2.4 and according to the expected roadmap for this particular version I am basically f**ed! :'(
Much of the 'fix' for this issue was some upstream modifications to dhcp6c to enable it to give proper responses, the fixes were carried out on FreeBSD 11.0 sources, I know as I did them. There are quite substantial differences in the sources for FreeBSD 10.3 and FreeBSD 11.0 dhcp6c client - apart from just this fix, plus a fair amount of code changes required for pfSense itself. As I am just a contributor to the project I have no idea if the pfSense team intend to back-port the changes to FreeBSD 10.3 and pfSense 2.3.*, however I do know I will not be doing any work on earlier versions.
Nothing goes on forever, it''s maybe time to update the hardware I'm afraid to say.
-
Thank you, marjohn56!
The problem is that I sold around ten of those Netgate boxes in the past few years to a few customers and I'll have to explain them that we are stuck with IPv4 now. I understand pfSense's move, but I still have that kind of loneliness or betrayal feeling of being 'let go' by a vendor. Pretty much like many other opportunities I had while dealing with Microsoft (which I also resell) and Apple (which I am a customer) when they change or discontinue something without providing a feasible short term alternative to preserve the investment that has already been made.
Anyways, thanks again for your honest and thorough explanation.
Best regards!
-
May I ask how old the offending units are?
-
Yes. The last was sold between 2014-2015.
-
I don't suppose you have a gold subscription on any of these devices?
-
Absolutely not.
-
So if I understand correctly, you are re-selling A!ix units you purchased after loading pfSense onto them., and you have never purchased a gold subscription either?
If this is the case, and I apologize if I have misunderstood, but pfSense/Netgate have not sold you anything, vendor does not apply.
I think you can see where this is going. :)
-
So the problem is with the DHCP6C client is it not? So don't use it.. If you want to rollout ipv6 why does your firewall need to be dhcp to get its IPv6 address? If your isp will not give you static prefix, then use HE and get a /48.. Rollout IPv6..
-
So the problem is with the DHCP6C client is it not? So don't use it.. If you want to rollout ipv6 why does your firewall need to be dhcp to get its IPv6 address? If your isp will not give you static prefix, then use HE and get a /48.. Rollout IPv6..
It's not only the client, there's a bunch of changes in pfSense 2.4 itself that handle those changes in dhcp6c. It's also not his ISP, but those of the customers he has sold the units to.
-
I have been running ipv6 and unbound for long time.. Never had any problems with unbound restarting, even back on 2.3.x - but I have been running HE.. pretty much since day one.. I tried using isp but not a fan of track and having my prefix change at the drop of a hat, etc.
Just thought throw out a possible solution to get up and running on ipv6 if there is a problem when its dhcp.
-
A bit late to the game - but have you looked at using the DNS Forwarder (dnsmasq) instead of DNS Resolver (unbound)? I've been using the DNS Forwarder for quite a few years as it's substantially faster, and I haven't had any issues with IPv6.
All you need to do is Disable the DNS Resolver Service, and then Enable the DNS Forwarder Service (you have to disable first due to port collisions).
If you want to benchmark/test, you could always set the DNS Forwarder Service to a different port, and then send dig commands at that ip/port combo.
-
It's worth giving HE a try. Their service is rock solid and it's free. Not to mention they have added lots more endpoints.
-
@marjohn56:
So if I understand correctly, you are re-selling A!ix units you purchased after loading pfSense onto them., and you have never purchased a gold subscription either?
If this is the case, and I apologize if I have misunderstood, but pfSense/Netgate have not sold you anything, vendor does not apply.
I think you can see where this is going. :)
I agree with @marjohn56, this has nothing to do with Netgate.
The problem is that I sold around ten of those Netgate boxes in the past few years to a few customers and I'll have to explain them that we are stuck with IPv4 now. I understand pfSense's move, but I still have that kind of loneliness or betrayal feeling of being 'let go' by a vendor. Pretty much like many other opportunities I had while dealing with Microsoft (which I also resell) and Apple (which I am a customer) when they change or discontinue something without providing a feasible short term alternative to preserve the investment that has already been made.
I understand your frustration however we are not to blame and we certainly didn't "let go" anyone. Alix is a very old platform and along with all of the i386 architecture, it's no longer supported starting from pfSense 2.4. We spent at least a year talking about the upcoming 64 bit requirement, just like we announced the AES-NI requirement earlier this year for future pfSense 2.5. Lastly, Alix boxes we sold were named VK-2D13. Those went EOS in 2014 and EOL in 2015. Once 2.4 is released, security releases for 2.3 will be available for another year. I'm sorry you ended up in this situation, I understand it's frustrating however we did everything we were supposed to do.
-
Hmm, I have a similar WAN setup here (in the UK) and do not see an issue. Though my box has more than 256MB of RAM. I don't see what looks like a RAM issue there though.
Can we get any more detail on who your ISP is and what the exact settings your using on WAN are?
I have seen similar things happen with Unbound failing to start before it is restarted and ending up with a bad or missing PID.
Steve
