Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Unbound 1.8.1 only single thread processing DNS requests

    Scheduled Pinned Locked Moved DHCP and DNS
    17 Posts 9 Posters 3.1k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • GertjanG
      Gertjan
      last edited by Gertjan

      Yep : see https://www.netgate.com/blog/pfsense-2-4-4-release-p1-now-available.html => Notable Bug Fixes => Updated Unbound to 1.8.1 to address issues with memory leaks, especially in DNS over TLS support.

      See also the identical ( !! ) thread just a little bit further down in the same forum "DHCP DNS" for an free bonus.

      No "help me" PM's please. Use the forum, the community will thank you.
      Edit : and where are the logs ??

      1 Reply Last reply Reply Quote 0
      • T
        tibere86 @imcdona
        last edited by

        @imcdona On a side note, how do you access the Unbound stats? What command needs to be entered at the terminal?

        imcdonaI 1 Reply Last reply Reply Quote 0
        • imcdonaI
          imcdona @tibere86
          last edited by

          @tibere86 said in Unbound 1.8.1 only single thread processing DNS requests:

          Looks like this bug was fixed in Unbound 1.8.2 released today.

          @gertjan said in Unbound 1.8.1 only single thread processing DNS requests:

          Yep : see https://www.netgate.com/blog/pfsense-2-4-4-release-p1-now-available.html => Notable Bug Fixes => Updated Unbound to 1.8.1 to address issues with memory leaks, especially in DNS over TLS support.
          See also the identical ( !! ) thread just a little bit further down in the same forum "DHCP DNS" for an free bonus.

          Wrong. They fixed the TLS memory issues. Unbound is still only processing requests from a single thread. The temporary fix is to add:

          server:
          so-reuseport: no
          
          lohphatL T 2 Replies Last reply Reply Quote 0
          • imcdonaI
            imcdona @tibere86
            last edited by

            @tibere86 said in Unbound 1.8.1 only single thread processing DNS requests:

            @imcdona On a side note, how do you access the Unbound stats? What command needs to be entered at the terminal?

            Run the following

            unbound-control -c /var/unbound/unbound.conf stats_noreset
            

            or for a list of other options run

            unbound-control -c /var/unbound/unbound.conf
            

            such as

            unbound-control -c /var/unbound/unbound.conf dump_requestlist
            
            T 1 Reply Last reply Reply Quote 2
            • B
              bbrendon
              last edited by bbrendon

              Is there a bug open in redmine for this?
              Is it considered a bug? Is the workaround required in 1.8.2?

              And also, is there a 1.8.2 we can manually install?

              jimpJ 1 Reply Last reply Reply Quote 0
              • T
                tibere86 @imcdona
                last edited by

                @imcdona Thanks!

                1 Reply Last reply Reply Quote 0
                • jimpJ
                  jimp Rebel Alliance Developer Netgate @bbrendon
                  last edited by

                  @bbrendon said in Unbound 1.8.1 only single thread processing DNS requests:

                  Is there a bug open in redmine for this?

                  Not yet

                  Is it considered a bug?

                  Unbound considers it a problem with the default configuration on FreeBSD, so I'm not quite sure they consider it a bug.

                  Is the workaround required in 1.8.2?

                  No, since the default configuration changed. The workaround would still be safe to have, but it wouldn't make a difference since the default is 'no'.

                  And also, is there a 1.8.2 we can manually install?

                  No, it isn't even in FreeBSD ports yet, and since you can work around it with a simple config change, it probably wouldn't warrant an OOB update like the memory leak did.

                  Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

                  Need help fast? Netgate Global Support!

                  Do not Chat/PM for help!

                  1 Reply Last reply Reply Quote 2
                  • lohphatL
                    lohphat @imcdona
                    last edited by

                    @imcdona Add those lines where?

                    SG-3100 24.11-RELEASE (arm) | Avahi (2.2_6) | ntopng (5.6.0_1) | openvpn-client-export (1.9.5) | pfBlockerNG-devel (3.2.1_20) | System_Patches (2.2.20_1)

                    1 Reply Last reply Reply Quote 0
                    • johnpozJ
                      johnpoz LAYER 8 Global Moderator
                      last edited by

                      In the custom options box.

                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                      If you get confused: Listen to the Music Play
                      Please don't Chat/PM me for help, unless mod related
                      SG-4860 24.11 | Lab VMs 2.8, 24.11

                      lohphatL 1 Reply Last reply Reply Quote 0
                      • T
                        TheNarc @imcdona
                        last edited by

                        @imcdona From what I can tell, the default value of so-reuseport is no, and that it would need to be set to yes to use multiple threads? But also, I've found information suggesting that FreeBSD's setsockopt implementation didn't support the option at all until version 12 (https://nlnetlabs.nl/pipermail/unbound-users/2018-November/011134.html). Of course, I won't argue with experimental evidence to the contrary, I'm just a bit confused.

                        1 Reply Last reply Reply Quote 0
                        • lohphatL
                          lohphat @johnpoz
                          last edited by lohphat

                          @johnpoz I tried that but didn't notice a change in behavior. I've seen other threads where unbound was crashing and restarting, could that be the cause of sluggish or timed-out DNS queries?

                          I've also noted that when PfBlockerNG-devel is enabled it places the line into the custom settings box but combines the lines. I was wondering if this is an issue? Are both formats allowed or is PfBlocerNG-devel not adding a line after "server:" where it should?

                          server:
                          so-reuseport: no
                          server:include: /var/unbound/pfb_dnsbl.*conf
                          

                          SG-3100 24.11-RELEASE (arm) | Avahi (2.2_6) | ntopng (5.6.0_1) | openvpn-client-export (1.9.5) | pfBlockerNG-devel (3.2.1_20) | System_Patches (2.2.20_1)

                          1 Reply Last reply Reply Quote 0
                          • RonpfSR
                            RonpfS
                            last edited by

                            You wont see change in behaviour, but when you reload/restart unbound, you will see different stats indicating that it's now multi-threaded .

                            Both

                            server:
                            so-reuseport: no
                            
                            server: so-reuseport: no
                            

                            are fine

                            2.4.5-RELEASE-p1 (amd64)
                            Intel Core2 Quad CPU Q8400 @ 2.66GHz 8GB
                            Backup 0.5_5, Bandwidthd 0.7.4_4, Cron 0.3.7_5, pfBlockerNG-devel 3.0.0_16, Status_Traffic_Totals 2.3.1_1, System_Patches 1.2_5

                            lohphatL 1 Reply Last reply Reply Quote 1
                            • lohphatL
                              lohphat @RonpfS
                              last edited by

                              @ronpfs Is the missing white-space after "server:" also permitted?

                              server:include: /var/unbound/pfb_dnsbl.*conf
                              

                              SG-3100 24.11-RELEASE (arm) | Avahi (2.2_6) | ntopng (5.6.0_1) | openvpn-client-export (1.9.5) | pfBlockerNG-devel (3.2.1_20) | System_Patches (2.2.20_1)

                              RonpfSR 1 Reply Last reply Reply Quote 0
                              • RonpfSR
                                RonpfS @lohphat
                                last edited by RonpfS

                                @lohphat said in Unbound 1.8.1 only single thread processing DNS requests:

                                Is the missing white-space after "server:" also permitted?

                                That's what I have in my settings :

                                server:qname-minimisation: yes
                                server:so-reuseport: no
                                server:include: /var/unbound/pfb_dnsbl.*conf
                                

                                2.4.5-RELEASE-p1 (amd64)
                                Intel Core2 Quad CPU Q8400 @ 2.66GHz 8GB
                                Backup 0.5_5, Bandwidthd 0.7.4_4, Cron 0.3.7_5, pfBlockerNG-devel 3.0.0_16, Status_Traffic_Totals 2.3.1_1, System_Patches 1.2_5

                                1 Reply Last reply Reply Quote 0
                                • johnpozJ
                                  johnpoz LAYER 8 Global Moderator
                                  last edited by johnpoz

                                  @ronpfs said in Unbound 1.8.1 only single thread processing DNS requests:

                                  server:qname-minimisation: yes

                                  This is now possible in the gui, no need for it custom just check the box in the gui.
                                  0_1547111928757_qname.png

                                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                                  If you get confused: Listen to the Music Play
                                  Please don't Chat/PM me for help, unless mod related
                                  SG-4860 24.11 | Lab VMs 2.8, 24.11

                                  1 Reply Last reply Reply Quote 1
                                  • First post
                                    Last post
                                  Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.