DNS Resolver Status, no data?
-
Here is from cmd line
All the web gui does it take the output of that and present it..
No unbound is not going to wipe that data on any sort of schedule.. This the data it uses to know which NS are best to talk to, etc.
Take a look to see how many actual queries have happened since unbound restarted
total.num.queries=287
total.num.queries_ip_ratelimited=0
total.num.cachehits=218
total.num.cachemiss=69Use
unbound-control -c /var/unbound/unbound.conf stats_noresetLook through for total, etc. How many queries happened, etc. since unbound restarted. If 0 then no nothing going to be in the stats for the infa.
-
You have something wrong if your not seeing data and actually using the resolver... After it does one query.. It will store that info.
I think pfSense might be doing something wrong. I am definitely using Resolver. I can resolve via Diagnostics - DNS Lookup. The stats page seems to be randomly full or empty.
Resolver log shows:
Jan 23 21:36:20 unbound 78590:0 info: start of service (unbound 1.8.1). Jan 23 21:36:20 unbound 78590:0 notice: init module 0: iterator
and those are the latest updates.
Interestingly, a manual nslookup shows the answering DNS server to be one of my AD DCs. Back when I first installed pfSense (2.1.x), I had it configured for DNS Forwarder, and I put my AD DNS into General Settings - DNS Servers. Later on, I disabled Forwarder and ran Resolver instead. Resolver is definitely NOT in forwarder mode. And yet it's still sending request to my DC.
-
If your an AD shop your clients should directly be asking your AD dns anyway... Have it forward to pfsense if you want.. But might as well just have your AD resolve, etc.
Do the command I asked before - lets see how many queries have been asked of unbound.
-
unbound-control -c /var/unbound/unbound.conf dump_infra
returns blank, and my stats page is back to No Data. So bizarre.
-
and lets see this
[2.4.4-RELEASE][admin@sg4860.local.lan]/root: unbound-control -c /var/unbound/unbound.conf stats_noreset | grep total.num total.num.queries=336 total.num.queries_ip_ratelimited=0 total.num.cachehits=251 total.num.cachemiss=85 total.num.prefetch=0 total.num.zero_ttl=0 total.num.recursivereplies=85 [2.4.4-RELEASE][admin@sg4860.local.lan]/root:
How many queries so mine went from 200 something to 336 in the couple of minutes.
-
total.num.queries=7233 total.num.queries_ip_ratelimited=0 total.num.cachehits=6981 total.num.cachemiss=252 total.num.prefetch=4892 total.num.zero_ttl=4748 total.num.recursivereplies=252
and Stats is still blank.
-
@kom No idea if this means anything, but I had a 10 minute time drift between my VM and Real Life. Looks like NTP to pool.ntp.org wasn't quite working for me. Corrected and now seems to be working. Coincidence?
-
Lets see whats in the infra cache.. ask unbound who it would ask for specific domain... For example just did microsoft.
[2.4.4-RELEASE][admin@sg4860.local.lan]/root: unbound-control -c /var/unbound/unbound.conf lookup www.microsoft.com The following name servers are used for lookup of www.microsoft.com. ;rrset 84738 13 0 2 0 com. 84738 IN NS d.gtld-servers.net. com. 84738 IN NS c.gtld-servers.net. com. 84738 IN NS a.gtld-servers.net. com. 84738 IN NS k.gtld-servers.net. com. 84738 IN NS e.gtld-servers.net. com. 84738 IN NS m.gtld-servers.net. com. 84738 IN NS i.gtld-servers.net. com. 84738 IN NS b.gtld-servers.net. com. 84738 IN NS f.gtld-servers.net. com. 84738 IN NS l.gtld-servers.net. com. 84738 IN NS j.gtld-servers.net. com. 84738 IN NS h.gtld-servers.net. com. 84738 IN NS g.gtld-servers.net. ;rrset 84738 1 1 11 5 com. 84738 IN DS 30909 8 2 E2D3C916F6DEEAC73294E8268FB5885044A833FC5459588F4A9184CFC41A5766 com. 84738 IN RRSIG DS 8 1 86400 20190326170000 20190313160000 16749 . OMtKk6RTDzvphZVSK+udXiB77g87GGNMnV5R/8cczdZapo1xVuawqufRPh/u8p3zJIvdGgjOPt7YCSXlrwE0jDWT8R4qtsGlrClDIy3fy39cN1ORFZGhpV7dmyAWpi7pFnpWaI0X5tMoiUu4spmCSS08DzqedVIhcAxiDFLtso05Upi2RpIMaMD7eU4YWsCHpkzxmmBYPNbyWb0ryxEpyzXgrb40Dq9hlUAZna6SUsQ81rsFMxH6G7GCuFhMvreZOX6D77ML0hgLhbbEnNlS+7EjyghZtBy+I3JTzI0onWgbaIpJbH+LbFI9XmcRUFDsV5FzGRkvi+a9U+uEuKuhlg== ;{id = 16749} ;rrset 84738 1 0 1 0 g.gtld-servers.net. 171138 IN A 192.42.93.30 ;rrset 84738 1 0 1 0 g.gtld-servers.net. 171138 IN AAAA 2001:503:eea3::30 ;rrset 84738 1 0 1 0 h.gtld-servers.net. 171138 IN A 192.54.112.30 ;rrset 84738 1 0 1 0 h.gtld-servers.net. 171138 IN AAAA 2001:502:8cc::30 ;rrset 84738 1 0 1 0 j.gtld-servers.net. 171138 IN A 192.48.79.30 ;rrset 84738 1 0 1 0 j.gtld-servers.net. 171138 IN AAAA 2001:502:7094::30 ;rrset 84738 1 0 1 0 l.gtld-servers.net. 171138 IN A 192.41.162.30 ;rrset 84738 1 0 1 0 l.gtld-servers.net. 171138 IN AAAA 2001:500:d937::30 ;rrset 84738 1 0 1 0 f.gtld-servers.net. 171138 IN A 192.35.51.30 ;rrset 84738 1 0 1 0 f.gtld-servers.net. 171138 IN AAAA 2001:503:d414::30 ;rrset 84738 1 0 1 0 b.gtld-servers.net. 171138 IN A 192.33.14.30 ;rrset 84738 1 0 1 0 b.gtld-servers.net. 171138 IN AAAA 2001:503:231d::2:30 ;rrset 84738 1 0 1 0 i.gtld-servers.net. 171138 IN A 192.43.172.30 ;rrset 84738 1 0 1 0 i.gtld-servers.net. 171138 IN AAAA 2001:503:39c1::30 ;rrset 84738 1 0 1 0 m.gtld-servers.net. 171138 IN A 192.55.83.30 ;rrset 84738 1 0 1 0 m.gtld-servers.net. 171138 IN AAAA 2001:501:b1f9::30 ;rrset 84738 1 0 1 0 e.gtld-servers.net. 171138 IN A 192.12.94.30 ;rrset 84738 1 0 1 0 e.gtld-servers.net. 171138 IN AAAA 2001:502:1ca1::30 ;rrset 84738 1 0 1 0 k.gtld-servers.net. 171138 IN A 192.52.178.30 ;rrset 84738 1 0 1 0 k.gtld-servers.net. 171138 IN AAAA 2001:503:d2d::30 ;rrset 84738 1 0 1 0 a.gtld-servers.net. 171138 IN A 192.5.6.30 ;rrset 84738 1 0 1 0 a.gtld-servers.net. 171138 IN AAAA 2001:503:a83e::2:30 ;rrset 84738 1 0 1 0 c.gtld-servers.net. 171138 IN A 192.26.92.30 ;rrset 84738 1 0 1 0 c.gtld-servers.net. 171138 IN AAAA 2001:503:83eb::30 ;rrset 84738 1 0 1 0 d.gtld-servers.net. 171138 IN A 192.31.80.30 ;rrset 84738 1 0 1 0 d.gtld-servers.net. 171138 IN AAAA 2001:500:856e::30 Delegation with 13 names, of which 0 can be examined to query further addresses. It provides 26 IP addresses. 2001:500:856e::30 rto 321 msec, ttl 256, ping 13 var 77 rtt 321, tA 0, tAAAA 0, tother 0, EDNS 0 probed. 192.31.80.30 rto 355 msec, ttl 652, ping 7 var 87 rtt 355, tA 0, tAAAA 0, tother 0, EDNS 0 probed. 2001:503:83eb::30 not in infra cache. 192.26.92.30 rto 330 msec, ttl 298, ping 14 var 79 rtt 330, tA 0, tAAAA 0, tother 0, EDNS 0 probed. 2001:503:a83e::2:30 rto 330 msec, ttl 716, ping 14 var 79 rtt 330, tA 0, tAAAA 0, tother 0, EDNS 0 probed. 192.5.6.30 rto 651 msec, ttl 267, ping 55 var 149 rtt 651, tA 0, tAAAA 0, tother 0, EDNS 0 probed. 2001:503:d2d::30 not in infra cache. 192.52.178.30 rto 347 msec, ttl 143, ping 7 var 85 rtt 347, tA 0, tAAAA 0, tother 0, EDNS 0 probed. 2001:502:1ca1::30 not in infra cache. 192.12.94.30 rto 315 msec, ttl 298, ping 3 var 78 rtt 315, tA 0, tAAAA 0, tother 0, EDNS 0 probed. 2001:501:b1f9::30 rto 285 msec, ttl 267, ping 17 var 67 rtt 285, tA 0, tAAAA 0, tother 0, EDNS 0 probed. 192.55.83.30 not in infra cache. 2001:503:39c1::30 not in infra cache. 192.43.172.30 rto 301 msec, ttl 878, ping 1 var 75 rtt 301, tA 0, tAAAA 0, tother 0, EDNS 0 probed. 2001:503:231d::2:30 rto 473 msec, ttl 652, ping 21 var 113 rtt 473, tA 0, tAAAA 0, tother 0, EDNS 0 probed. 192.33.14.30 not in infra cache. 2001:503:d414::30 not in infra cache. 192.35.51.30 not in infra cache. 2001:500:d937::30 not in infra cache. 192.41.162.30 rto 342 msec, ttl 603, ping 6 var 84 rtt 342, tA 0, tAAAA 0, tother 0, EDNS 0 probed. 2001:502:7094::30 rto 361 msec, ttl 268, ping 17 var 86 rtt 361, tA 0, tAAAA 0, tother 0, EDNS 0 probed. 192.48.79.30 rto 297 msec, ttl 595, ping 1 var 74 rtt 297, tA 0, tAAAA 0, tother 0, EDNS 0 probed. 2001:502:8cc::30 rto 374 msec, ttl 268, ping 10 var 91 rtt 374, tA 0, tAAAA 0, tother 0, EDNS 0 probed. 192.54.112.30 rto 302 msec, ttl 716, ping 2 var 75 rtt 302, tA 0, tAAAA 0, tother 0, EDNS 0 probed. 2001:503:eea3::30 rto 325 msec, ttl 255, ping 13 var 78 rtt 325, tA 0, tAAAA 0, tother 0, EDNS 0 probed. 192.42.93.30 rto 333 msec, ttl 652, ping 5 var 82 rtt 333, tA 0, tAAAA 0, tother 0, EDNS 0 probed. [2.4.4-RELEASE][admin@sg4860.local.lan]/root:
-
@johnpoz My output is similar to yours.
I suspect I've managed to confuse things by having DNS listed in General Setup - DNS Servers even though I'm using Resolver. There is no reason why it should return results from my AD DCs. The General Setup servers should be completely ignored when running with Resolver.
The time on my pfSense VM is correct.
-
ignored by who? Sure resolver will ignore them, but not pfsense.
So it shows such entries
Delegation with 13 names, of which 0 can be examined to query further addresses. It provides 26 IP addresses. 2001:500:856e::30 rto 321 msec, ttl 256, ping 13 var 77 rtt 321, tA 0, tAAAA 0, tother 0, EDNS 0 probed. 192.31.80.30 rto 355 msec, ttl 652, ping 7 var 87 rtt 355, tA 0, tAAAA 0, tother 0, EDNS 0 probed. 2001:503:83eb::30 not in infra cache. 192.26.92.30 rto 330 msec, ttl 298, ping 14 var 79 rtt 330, tA 0, tAAAA 0, tother 0, EDNS 0 probed. 2001:503:a83e::2:30 rto 330 msec, ttl 716, ping 14 var 79 rtt 330, tA 0, tAAAA 0, tother 0, EDNS 0 probed. 192.5.6.30 rto 651 msec, ttl 267, ping 55 var 149 rtt 651, tA 0, tAAAA 0, tother 0, EDNS 0 probed.
That have data in them... Then your infra cache is there and being used... Why your not seeing the info your gui is cosmetic, and or browser problem, etc..
Your on 2.4.4p2?
-
Delegation with 13 names, of which 0 can be examined to query further addresses. It provides 26 IP addresses. 2001:501:b1f9::30 not in infra cache. 192.55.83.30 expired, rto 43388736 msec, tA 0 tAAAA 0 tother 0. 2001:503:d414::30 not in infra cache. 192.35.51.30 expired, rto 43388736 msec, tA 0 tAAAA 0 tother 0. 2001:502:8cc::30 not in infra cache. 192.54.112.30 expired, rto 43388736 msec, tA 0 tAAAA 0 tother 0. 2001:503:39c1::30 not in infra cache. 192.43.172.30 expired, rto 43388736 msec, tA 0 tAAAA 0 tother 0. 2001:502:1ca1::30 not in infra cache.
You learn something new every day. I thought that those DNS were ignored unless Forwarder was in use, or Resolver in forward mode. The info even says that. It doesn't say anything about pfSense using it internally for whatever reason.
Yes, latest version.
-
@kom said in DNS Resolver Status, no data?:
192.55.83.30 expired, rto 43388736 msec, tA 0 tAAAA 0 tother 0.
Dude that is expired... RTO was it could NEVER talk to it.. All of yours is like that... Looks to me your resolver Not WORKING AT ALL!!
Do the command for some domain you talk to all the time from a client on your network asking pfsense for dns.
Look in your system widget what does it show for dns?
If you have more than loopback there - then yes its possible pfsense could ask any of those NS for dns.
-
I had turned off the DNS Servers dealie long ago to save on vertical space in the browser. It's showing me that my AD DCs are my DNS.
At this point, I fully admit that I have no idea what's going on or why. So even when you are using Resolver, if you include any servers in General Settings then it's going to silently forward instead?
-
NO!! Pfsense (itself) will use what you have listed in the general setup... But if a client asks resolver on pfsense running listening on port 53, then that will either resolve or forward.
But if you do not have loopback listed - then when pfsense needs to check if update, or look for packages, etc. its going to ask those name servers. When you go to the dns lookup menu... its going to ask what is set for in the general tab or gets from dhcp on your wan, etc.
Out of the box pfsense should only ask itself.. which should be the resolver in resolver mode, with dnssec enabled.
Your settings show that your not even doing dnssec.. And from what you showed... Id doubt your resolver can even talk to atleast not the NS for MS, etc.
From a client on your network do a query to pfsense lan IP... Do you get an answer?
Here is 2 example of specifically asking pfsense (resolver) for query of a fqdn
On your client when you do nslookup it comes back with your pfsense as the NS, see how mine says sg4860.local.lan - 192.168.9.253.. That is pfsense lan IP.
See when do a dig, I specifically called out my pfsense lan IP and it answered.
-
These DNS settings were mostly inherited form my original 2.1.x installation 4+ years ago. I have no idea what the current default settings are nowadays.
And yes, I can run nslookup, point it to pfsense and resolver some unknown host:
Replaced real hosts/domains with ???
PS C:\Users\KOM> nslookup Default Server: ???.???.local Address: 10.10.0.1 > server 10.10.4.1 Default Server: wpad.???.???.local Address: 10.10.4.1 > www.boogers.com Server: wpad.???.???.local Address: 10.10.4.1 Non-authoritative answer: Name: www.boogers.com Address: 91.195.240.126
-
So you sure dns forwarder is not running and you have a race condition..
So your pfsense is called wpad?
So unbound is specifically bound to 53?
[2.4.4-RELEASE][admin@sg4860.local.lan]/root: sockstat | grep :53 unbound unbound 33324 3 udp4 192.168.9.253:53 *:* unbound unbound 33324 4 tcp4 192.168.9.253:53 *:* unbound unbound 33324 5 udp4 192.168.2.253:53 *:* unbound unbound 33324 6 tcp4 192.168.2.253:53 *:* unbound unbound 33324 7 udp4 192.168.4.253:53 *:* unbound unbound 33324 8 tcp4 192.168.4.253:53 *:* unbound unbound 33324 9 udp4 192.168.6.253:53 *:* unbound unbound 33324 10 tcp4 192.168.6.253:53 *:* unbound unbound 33324 11 udp4 192.168.7.253:53 *:* unbound unbound 33324 15 tcp4 192.168.7.253:53 *:* unbound unbound 33324 16 udp4 192.168.3.253:53 *:* unbound unbound 33324 17 tcp4 192.168.3.253:53 *:* unbound unbound 33324 18 udp6 2001:470:snipped::253:53 *:* unbound unbound 33324 19 tcp6 2001:470:snipped::253:53 *:* unbound unbound 33324 20 udp4 127.0.0.1:53 *:* unbound unbound 33324 21 tcp4 127.0.0.1:53 *:* unbound unbound 33324 22 udp6 ::1:53 *:* unbound unbound 33324 23 tcp6 ::1:53 *:*
And now that you asked it for boogers.com
What is the output of the lookup command www.boogers.com
You should see valid info in the infra cache for what ns it talked to look that domain. if they have RTO a bajillion... and say expired... Then it did not talk to them.
Here is mine just asked for boogers as well
[2.4.4-RELEASE][admin@sg4860.local.lan]/root: unbound-control -c /var/unbound/unbound.conf lookup www.boogers.com The following name servers are used for lookup of www.boogers.com. ;rrset 86309 2 0 2 0 boogers.com. 172709 IN NS ns1.sedoparking.com. boogers.com. 172709 IN NS ns2.sedoparking.com. ;rrset 3509 1 0 8 0 ns2.sedoparking.com. 3509 IN A 91.195.240.8 ;rrset 3509 1 0 8 0 ns1.sedoparking.com. 3509 IN A 91.195.241.8 Delegation with 2 names, of which 2 can be examined to query further addresses. It provides 2 IP addresses. 91.195.241.8 not in infra cache. 91.195.240.8 not in infra cache. [2.4.4-RELEASE][admin@sg4860.local.lan]/root:
-
So your pfsense is called wpad?
It's called pfsense.???.local, wpad.???.local and wpad.???.???.local.
[2.4.4-RELEASE][admin@pfsense.???.local]/root: sockstat | grep :53 squid squid 1410 35 tcp4 WAN_IP:53787 40.101.128.194:443 squid squid 1410 62 tcp4 10.10.4.1:3128 10.10.10.166:53898 squid squid 1410 110 tcp4 WAN_IP:53670 52.96.50.130:443 squid squid 1410 148 tcp4 10.10.4.1:3128 10.10.10.141:53913 squid squid 1410 210 tcp4 10.10.4.1:3128 10.10.10.21:53204 squid squid 1410 223 tcp4 WAN_IP:53727 40.101.128.194:443 squid squid 1410 225 tcp4 10.10.4.1:3128 10.10.10.101:53794 unbound unbound 78590 4 udp4 *:53 *:* unbound unbound 78590 5 tcp4 *:53 *:* unbound unbound 78590 6 udp4 *:53 *:* unbound unbound 78590 7 tcp4 *:53 *:*
What is the output of the lookup command www.boogers.com
[2.4.4-RELEASE][admin@pfsense.???.local]/root: unbound-control -c /var/unbound/unbound.conf lookup www.boogers.com The following name servers are used for lookup of www.boogers.com. ;rrset 85356 2 0 2 0 boogers.com. 171756 IN NS ns1.sedoparking.com. boogers.com. 171756 IN NS ns2.sedoparking.com. ;rrset 85356 1 0 1 0 ns2.sedoparking.com. 171756 IN A 209.200.165.74 ;rrset 85356 1 0 1 0 ns1.sedoparking.com. 171756 IN A 209.200.164.69 Delegation with 2 names, of which 2 can be examined to query further addresses. It provides 2 IP addresses. 209.200.164.69 expired, rto 48821432 msec, tA 0 tAAAA 0 tother 0. 209.200.165.74 expired, rto 48821432 msec, tA 0 tAAAA 0 tother 0.
-
@kom said in DNS Resolver Status, no data?:
squid squid 1410 35 tcp4 WAN_IP:53787 40.101.128.194:443
squid squid 1410 62 tcp4 10.10.4.1:3128 10.10.10.166:53898
squid squid 1410 110 tcp4 WAN_IP:53670 52.96.50.130:443
squid squid 1410 148 tcp4 10.10.4.1:3128 10.10.10.141:53913
squid squid 1410 210 tcp4 10.10.4.1:3128 10.10.10.21:53204
squid squid 1410 223 tcp4 WAN_IP:53727 40.101.128.194:443
squid squid 1410 225 tcp4 10.10.4.1:3128 10.10.10.101:53794Dude your running squid.. So all your queries are done by the proxy.. And proxy would use what?? Prob what is in general setup of psfense.
This is broken!!
209.200.164.69 expired, rto 48821432 msec, tA 0 tAAAA 0 tother 0.
209.200.165.74 expired, rto 48821432 msec, tA 0 tAAAA 0 tother 0.Flush your infra cache, then do some queries direct to pfsense... Then look in your infra_cache you can flush with.
flush_infra allDo quite a few queries for different things..
You just flushed the cache, so it can answer stuff from its cache... So you need to ask for stuff that is not in the cache
[2.4.4-RELEASE][admin@sg4860.local.lan]/root: unbound-control -c /var/unbound/unbound.conf flush_infra all ok [2.4.4-RELEASE][admin@sg4860.local.lan]/root: unbound-control -c /var/unbound/unbound.conf dump_infra [2.4.4-RELEASE][admin@sg4860.local.lan]/root: unbound-control -c /var/unbound/unbound.conf dump_infra [2.4.4-RELEASE][admin@sg4860.local.lan]/root: unbound-control -c /var/unbound/unbound.conf dump_infra [2.4.4-RELEASE][admin@sg4860.local.lan]/root: unbound-control -c /var/unbound/unbound.conf dump_infra [2.4.4-RELEASE][admin@sg4860.local.lan]/root: unbound-control -c /var/unbound/unbound.conf dump_infra 2001:503:231d::2:30 net. ttl 892 ping 21 var 112 rtt 469 rto 469 tA 0 tAAAA 0 tother 0 ednsknown 1 edns 0 delay 0 lame dnssec 0 rec 0 A 0 other 0 2001:503:d414::30 com. ttl 896 ping 7 var 85 rtt 347 rto 347 tA 0 tAAAA 0 tother 0 ednsknown 1 edns 0 delay 0 lame dnssec 0 rec 0 A 0 other 0 95.101.36.128 akadns.net. ttl 883 ping 1 var 73 rtt 293 rto 293 tA 0 tAAAA 0 tother 0 ednsknown 1 edns 0 delay 0 lame dnssec 0 rec 0 A 0 other 0 84.53.139.129 akadns.net. ttl 883 ping 1 var 74 rtt 297 rto 297 tA 0 tAAAA 0 tother 0 ednsknown 1 edns 0 delay 0 lame dnssec 0 rec 0 A 0 other 0 95.100.173.129 akadns.net. ttl 883 ping 4 var 80 rtt 324 rto 324 tA 0 tAAAA 0 tother 0 ednsknown 1 edns 0 delay 0 lame dnssec 0 rec 0 A 0 other 0 95.100.174.65 lastpass.com. ttl 883 ping 4 var 79 rtt 320 rto 320 tA 0 tAAAA 0 tother 0 ednsknown 1 edns 0 delay 0 lame dnssec 0 rec 0 A 0 other 0
You see it took me bit for stuff started showing up.
-
Why would squid be doing the lookups? It's not listening on 53. And I'm not going through the proxy personally (explicit mode, not transparent) so squid is out of the loop.
-
Why would you be running a proxy if not using it? Makes ZERO sense to run a proxy if not having clients use it.
When browser asks proxy for www.whatever.com - proxy is what looks up www.whatever.com no the client wanting to go to www.whatever.com
Your current infra has bunch of shit blocked with those expired and RTO... Dump its cache, then do some queries direct to pfsense and then look at the infra cache..
We are trying to get some info that unbound is actually working!
You sure you didn't put in a dns redirect and sending your dns queries to pfsense to your AD?
-
You're getting off-track here. I run a proxy for my non-admin users. I''m the admin. No proxy for me.
-
You have shown no info at all that unbound is even working... When you show proxy running... Then I assumed that is what the VAST majority of stuff would be using to get to the net and could explain not seeing large infra cache, etc.
Do my test.. with the dump and explicit queries to pfsense running unbound so we can get some valid info in your infra cache... But RTO of bajillion tells me your not talking to anything..
Here I now looking in my cache for www.whatever.com with the lookup command
2001:500:856e::30 rto 351 msec, ttl 680, ping 7 var 86 rtt 351, tA 0, tAAAA 0, tother 0, EDNS 0 probed. 192.31.80.30 not in infra cache. 2001:503:83eb::30 rto 351 msec, ttl 747, ping 7 var 86 rtt 351, tA 0, tAAAA 0, tother 0, EDNS 0 probed. 192.26.92.30 not in infra cache. 2001:503:a83e::2:30 not in infra cache. 192.5.6.30 rto 545 msec, ttl 688, ping 29 var 129 rtt 545, tA 0, tAAAA 0, tother 0, EDNS 0 probed. 2001:503:d2d::30 not in infra cache. 192.52.178.30 not in infra cache. 2001:502:1ca1::30 not in infra cache. 192.12.94.30 rto 279 msec, ttl 496, ping 7 var 68 rtt 279, tA 0, tAAAA 0, tother 0, EDNS 0 probed. 2001:501:b1f9::30 not in infra cache. 192.55.83.30 not in infra cache. 2001:503:39c1::30 not in infra cache. 192.43.172.30 not in infra cache. 2001:503:231d::2:30 rto 464 msec, ttl 747, ping 20 var 111 rtt 464, tA 0, tAAAA 0, tother 0, EDNS 0 probed. 192.33.14.30 rto 333 msec, ttl 680, ping 5 var 82 rtt 333, tA 0, tAAAA 0, tother 0, EDNS 0 probed. 2001:503:d414::30 rto 347 msec, ttl 406, ping 7 var 85 rtt 347, tA 0, tAAAA 0, tother 0, EDNS 0 probed. 192.35.51.30 not in infra cache. 2001:500:d937::30 rto 342 msec, ttl 495, ping 6 var 84 rtt 342, tA 0, tAAAA 0, tother 0, EDNS 0 probed. 192.41.162.30 not in infra cache. 2001:502:7094::30 rto 374 msec, ttl 806, ping 10 var 91 rtt 374, tA 0, tAAAA 0, tother 0, EDNS 0 probed. 192.48.79.30 not in infra cache. 2001:502:8cc::30 rto 369 msec, ttl 712, ping 9 var 90 rtt 369, tA 0, tAAAA 0, tother 0, EDNS 0 probed. 192.54.112.30 not in infra cache. 2001:503:eea3::30 rto 325 msec, ttl 680, ping 13 var 78 rtt 325, tA 0, tAAAA 0, tother 0, EDNS 0 probed. 192.42.93.30 rto 320 msec, ttl 688, ping 4 var 79 rtt 320, tA 0, tAAAA 0, tother 0, EDNS 0 probed. [2.4.4-RELEASE][admin@sg4860.local.lan]/root:
You can see that unbound has been talking to root servers.
-
@johnpoz said in DNS Resolver Status, no data?:
I cleared the cache and then used the same nslookup session I had going to 10.10.4.1 to resolve www.whatever.com
[2.4.4-RELEASE][admin@pfsense.???.local]/root: unbound-control -c /var/unbound/unbound.conf flush_infra all ok [2.4.4-RELEASE][admin@pfsense.???.local]/root: unbound-control -c /var/unbound/unbound.conf dump_infra [2.4.4-RELEASE][admin@pfsense.???.local]/root: unbound-control -c /var/unbound/unbound.conf dump_infra [2.4.4-RELEASE][admin@pfsense.???.local]/root: unbound-control -c /var/unbound/unbound.conf dump_infra [2.4.4-RELEASE][admin@pfsense.???.local]/root: unbound-control -c /var/unbound/unbound.conf dump_infra [2.4.4-RELEASE][admin@pfsense.???.local]/root: unbound-control -c /var/unbound/unbound.conf dump_infra 192.203.230.10 . ttl 896 ping 1 var 74 rtt 297 rto 297 tA 0 tAAAA 0 tother 0 ednsknown 1 edns 0 delay 0 lame dnssec 0 rec 0 A 0 other 0 192.112.36.4 . ttl 896 ping 4 var 79 rtt 320 rto 320 tA 0 tAAAA 0 tother 0 ednsknown 1 edns 0 delay 0 lame dnssec 0 rec 0 A 0 other 0 198.57.151.238 whatever.com. ttl 896 ping 21 var 73 rtt 313 rto 313 tA 0 tAAAA 0 tother 0 ednsknown 1 edns 0 delay 0 lame dnssec 0 rec 0 A 0 other 0 193.0.14.129 . ttl 896 ping 15 var 66 rtt 279 rto 279 tA 0 tAAAA 0 tother 0 ednsknown 1 edns 0 delay 0 lame dnssec 0 rec 0 A 0 other 0 199.9.14.201 . ttl 896 ping 9 var 89 rtt 365 rto 365 tA 0 tAAAA 0 tother 0 ednsknown 1 edns 0 delay 0 lame dnssec 0 rec 0 A 0 other 0 192.52.178.30 com. ttl 896 ping 3 var 77 rtt 311 rto 311 tA 0 tAAAA 0 tother 0 ednsknown 1 edns 0 delay 0 lame dnssec 0 rec 0 A 0 other 0 192.36.148.17 . ttl 896 ping 3 var 78 rtt 315 rto 315 tA 0 tAAAA 0 tother 0 ednsknown 1 edns 0 delay 0 lame dnssec 0 rec 0 A 0 other 0 192.58.128.30 . ttl 896 ping 27 var 124 rtt 523 rto 523 tA 0 tAAAA 0 tother 0 ednsknown 1 edns 0 delay 0 lame dnssec 0 rec 0 A 0 other 0
-
@jimp, any insight into what's going on here?
-
We just show what unbound dumps out. If it's empty, then it's empty in unbound. That could be for any number of reasons, all up to unbound. If you have something like pfBlockerNG and DNSBL active that could contribute to any differences you see. Also keep in mind if you have DHCP registration active for the DNS resolver, unbound will restart for each lease change that triggers a hostname update.
-
This post is deleted! -
Well that output looks normal... That is your infra cache for that domain, in what would be used to look it up... So you should see the full cache output in the gui then.
As jimp stated all that gui is showing you is the output of the command dump_infra
-
Yes, I get that. What I don't get is how this list is empty, then 5 minute later it's full, then 5 minutes later it's empty. Does it really flush that frequently?
-
When you talk to the roots in resolver mode there isn't much reason to keep around data for dozens of authoritative servers you may not talk to again for who knows how long.
If you have the DNS Resolver in forwarding mode, it will show your forwarders there for much longer.
But again, unbound could be clearing that for any other reason, like a restart
-
The infra cache entries should stay their for the length of the ttl..
Yeah if your unbound is restarting then the cache is going to be dumped.
If you have it registering dhcp leases and you have lots of clients getting leases all the time then yeah it could be restarting every few minutes. Which makes the cache pretty useless to be honest ;)
-
I've already checked that Unbound is not restarting frequently. In fact, it hasn't restarted since its last boot 49 days ago in late January.
-
Well something is dumping the infra cache then.. You have any crons setup? Do you have pfblocker installed?
If unbound is up and running and being asked there would always be plenty of info in that cache.. Hmmm did you mess with the number of entries int he advanced tab?
Did you change the
TTL for Host Cache Entries
Setting from its default 15 min to say 1 min or something? -
@kom said in DNS Resolver Status, no data?:
I've already checked that Unbound is not restarting frequently. In fact, it hasn't restarted since its last boot 49 days ago in late January.
Sometimes (after reboot or WAN toggle) Unbound doesn't log anything to Status / System Logs / System / DNS Resolver.
Restarting Unbound from Status / Services tab will get it to log.
-
Right, I odn't have time to chase this anymore. I put Resolver into forwarding mode and that's that.
-
You weren't doing dnssec anyway so doesn't matter. Can not 2 secons to look to see if you this setup you got from 4 years ago didn't adjust the infra ttl to 1 minute..
-
TTL for Host Cache Entries was set to 15 minutes. I definitely haven't touched that one. Wasn't even aware of it. It's entirely possible, and likely, that I was underestimating the time before the flush.
-
That is not a flush, that is the max time a TTL can be set before it will timeout, etc. That is not a dump of the cache.
Let me state this again... If your resolve was working the info in the infra cache is beyond noise to someone that doesn't understand what any of it means.
You have no need to look down that rabbit hole if your not trying to troubleshoot a specific issue... Was resolver working? How many queries does it get in normally, if yours has been up for 49 days and your total number of queries was
total.num.queries=7233
Nobody is even asking pfsense anything...
Here I restarted unbound what yesterday and have
total.num.queries=19015
total.num.queries_ip_ratelimited=0
total.num.cachehits=16215
total.num.cachemiss=2800And I only have a couple of boxes on my home network... As I brought up before you have pretty much everything using your proxy and or AD dns.. So what your doing on pfsense prob has zero to do with anything. You should prob turn it off and see who complains, since your having pfsense ask your AD for its own dns anyway. And from the entries you did have in your cache couldn't even talk to outside dns.
BTW: I have been doing dns for years and years, for some very large networks.. And also its just hobby of mine I love the way it works and how it does what it does so fast and efficient.. And I can tell you have never had need to look into such info.. Can not recall when I ever dumped the infra cache other to see if there there were huge amounts of timeouts and such.. Even if you manage dns for a huge network, you most likely would never have need to view that info like that... You might use the lookup command we did to see what your resolver is using.. But raw full dump of the infra - no its eye candy in the menu to impress new users that don't really understand dns anyway ;) My take on why they put it in..
If they wanted to put up some useful/interesting eyecandy they would do like the total number of queries, percent cache hit,
This info would be more interesting that the raw infra_dump
num.query.type.A=7801
num.query.type.SOA=15
num.query.type.PTR=9895
num.query.type.TXT=21
num.query.type.AAAA=1388
num.query.type.SRV=246
num.query.class.IN=19366num.answer.rcode.NXDOMAIN=10067
That NXdomain means something is asking quite a bit actual for something that doesn't exist and gets returned NX.. So should prob look into that..
edit: Ok found it ;)
Mar 14 13:40:56 unbound 5708:1 info: 10.0.8.3 HNA00050.snipped.internal.com. A IN NXDOMAIN 0.000000 1 121
Had unbound log queries and replies.. My shitty ass work laptop connected to my vpn to home is bombing nonsense down to my pfsense dns ;)
Just noise.. But should prob spend some time making sure my work laptop doesn't do that...
edit: Ok that corrected, simple acl to deny nonlocal from my laptops vpn IP... That way doesn't keep telling my Laptop NX for stuff it should be able to lookup from the local dns..
-
Hi,
This is probably normal when using TLS over DNS? :)
-
@ciscox That's what I see when I use the Resolver as Forwarder.
-
This post is deleted!