Unbound notice: sendto failed: Permission denied

Raffi_ · Jan 12, 2018, 4:09 PM

I'm running 2.4.2-RELEASE-p1 (amd64)
I get ton of messages below in my resolver log if I enable Register DHCP leases in the DNS Resolver and Register DHCP static mappings in the DNS Resolver.

Jan 12 10:22:34 unbound 63108:3 notice: remote address is xxx.xx.xx.xx port 53
Jan 12 10:22:52 unbound 63108:3 notice: sendto failed: Permission denied

Name resolution seems to be working fine, although I could swear it's a bit slower now. I'm sure this is nothing to worry about, but I would like to understand what it's about. Also, having these constantly in the log hide actual events I would like to see. Should I just lower the verbosity? Would that make any difference?

EDIT: I cleared my proxy cache because I was getting a cache related error from squid for a specific site. After that, name resolution completely failed. I unchecked both Register DHCP and static options until that proves to be stable. I had to reboot pfsense because resolver didn't seem to even respond to an attempt at stopping the service, so restarting resolver alone was not an option.

Thanks,
Raffi

dragoangel · Jan 18, 2018, 11:25 AM

I have same log entries in logs, but all seems works fine, I can't say clearly about performance because I have Windows DNS that actually give DNS to client and take it from pfSense and have many cache entries.

albertop · Aug 4, 2018, 4:18 PM

I have the same issue running 2.4.3-RELEASE-p1

Aug 3 09:17:39 unbound 31135:3 notice: remote address is XXX.XXX.XXX.XXX port 53
Aug 3 09:17:39 unbound 31135:3 notice: sendto failed: Permission denied

The IPs in the errors are 216.239.32.10, 216.239.34.10, 216.239.36.10 and 216.239.38.10

When these errors are shown in the unbound log, my network (which is only pointing to pfsense's IP as DNS) cannot longer resolve google.com (although it can resolve other domain names).

Only a reboot fixes the issue so far.

Derelict · Aug 4, 2018, 6:06 PM

Running snort or suricata? Is it blocking those addresses for some reason?

albertop · Aug 5, 2018, 4:11 AM

@derelict good point, will check logs next time this happens. I am running Snort.

mrsunfire · May 5, 2019, 4:43 PM

I have that same problem today.

"notice: sendto failed: Permission denied". Suricata is blocking these adresses because of "ET DNS Query to a *.pw domain - Likely Hostile". But why? What happened?

Derelict · May 5, 2019, 5:35 PM

You'll have to see what suricata complained about and make it not do that. It's likely only doing what it was told to do.