DNS Resolver Status, no data?

johnpoz

Why would you be running a proxy if not using it? Makes ZERO sense to run a proxy if not having clients use it.

When browser asks proxy for www.whatever.com - proxy is what looks up www.whatever.com no the client wanting to go to www.whatever.com

Your current infra has bunch of shit blocked with those expired and RTO... Dump its cache, then do some queries direct to pfsense and then look at the infra cache..

We are trying to get some info that unbound is actually working!

You sure you didn't put in a dns redirect and sending your dns queries to pfsense to your AD?

KOM

You're getting off-track here. I run a proxy for my non-admin users. I''m the admin. No proxy for me.

johnpoz

You have shown no info at all that unbound is even working... When you show proxy running... Then I assumed that is what the VAST majority of stuff would be using to get to the net and could explain not seeing large infra cache, etc.

Do my test.. with the dump and explicit queries to pfsense running unbound so we can get some valid info in your infra cache... But RTO of bajillion tells me your not talking to anything..

Here I now looking in my cache for www.whatever.com with the lookup command

2001:500:856e::30       rto 351 msec, ttl 680, ping 7 var 86 rtt 351, tA 0, tAAAA 0, tother 0, EDNS 0 probed.
192.31.80.30            not in infra cache.
2001:503:83eb::30       rto 351 msec, ttl 747, ping 7 var 86 rtt 351, tA 0, tAAAA 0, tother 0, EDNS 0 probed.
192.26.92.30            not in infra cache.
2001:503:a83e::2:30     not in infra cache.
192.5.6.30              rto 545 msec, ttl 688, ping 29 var 129 rtt 545, tA 0, tAAAA 0, tother 0, EDNS 0 probed.
2001:503:d2d::30        not in infra cache.
192.52.178.30           not in infra cache.
2001:502:1ca1::30       not in infra cache.
192.12.94.30            rto 279 msec, ttl 496, ping 7 var 68 rtt 279, tA 0, tAAAA 0, tother 0, EDNS 0 probed.
2001:501:b1f9::30       not in infra cache.
192.55.83.30            not in infra cache.
2001:503:39c1::30       not in infra cache.
192.43.172.30           not in infra cache.
2001:503:231d::2:30     rto 464 msec, ttl 747, ping 20 var 111 rtt 464, tA 0, tAAAA 0, tother 0, EDNS 0 probed.
192.33.14.30            rto 333 msec, ttl 680, ping 5 var 82 rtt 333, tA 0, tAAAA 0, tother 0, EDNS 0 probed.
2001:503:d414::30       rto 347 msec, ttl 406, ping 7 var 85 rtt 347, tA 0, tAAAA 0, tother 0, EDNS 0 probed.
192.35.51.30            not in infra cache.
2001:500:d937::30       rto 342 msec, ttl 495, ping 6 var 84 rtt 342, tA 0, tAAAA 0, tother 0, EDNS 0 probed.
192.41.162.30           not in infra cache.
2001:502:7094::30       rto 374 msec, ttl 806, ping 10 var 91 rtt 374, tA 0, tAAAA 0, tother 0, EDNS 0 probed.
192.48.79.30            not in infra cache.
2001:502:8cc::30        rto 369 msec, ttl 712, ping 9 var 90 rtt 369, tA 0, tAAAA 0, tother 0, EDNS 0 probed.
192.54.112.30           not in infra cache.
2001:503:eea3::30       rto 325 msec, ttl 680, ping 13 var 78 rtt 325, tA 0, tAAAA 0, tother 0, EDNS 0 probed.
192.42.93.30            rto 320 msec, ttl 688, ping 4 var 79 rtt 320, tA 0, tAAAA 0, tother 0, EDNS 0 probed.
[2.4.4-RELEASE][admin@sg4860.local.lan]/root:

You can see that unbound has been talking to root servers.

KOM

@johnpoz said in DNS Resolver Status, no data?:

I cleared the cache and then used the same nslookup session I had going to 10.10.4.1 to resolve www.whatever.com

[2.4.4-RELEASE][admin@pfsense.???.local]/root: unbound-control -c /var/unbound/unbound.conf flush_infra all
ok
[2.4.4-RELEASE][admin@pfsense.???.local]/root: unbound-control -c /var/unbound/unbound.conf dump_infra
[2.4.4-RELEASE][admin@pfsense.???.local]/root: unbound-control -c /var/unbound/unbound.conf dump_infra
[2.4.4-RELEASE][admin@pfsense.???.local]/root: unbound-control -c /var/unbound/unbound.conf dump_infra
[2.4.4-RELEASE][admin@pfsense.???.local]/root: unbound-control -c /var/unbound/unbound.conf dump_infra
[2.4.4-RELEASE][admin@pfsense.???.local]/root: unbound-control -c /var/unbound/unbound.conf dump_infra
192.203.230.10 . ttl 896 ping 1 var 74 rtt 297 rto 297 tA 0 tAAAA 0 tother 0 ednsknown 1 edns 0 delay 0 lame dnssec 0 rec 0 A 0 other 0
192.112.36.4 . ttl 896 ping 4 var 79 rtt 320 rto 320 tA 0 tAAAA 0 tother 0 ednsknown 1 edns 0 delay 0 lame dnssec 0 rec 0 A 0 other 0
198.57.151.238 whatever.com. ttl 896 ping 21 var 73 rtt 313 rto 313 tA 0 tAAAA 0 tother 0 ednsknown 1 edns 0 delay 0 lame dnssec 0 rec 0 A 0 other 0
193.0.14.129 . ttl 896 ping 15 var 66 rtt 279 rto 279 tA 0 tAAAA 0 tother 0 ednsknown 1 edns 0 delay 0 lame dnssec 0 rec 0 A 0 other 0
199.9.14.201 . ttl 896 ping 9 var 89 rtt 365 rto 365 tA 0 tAAAA 0 tother 0 ednsknown 1 edns 0 delay 0 lame dnssec 0 rec 0 A 0 other 0
192.52.178.30 com. ttl 896 ping 3 var 77 rtt 311 rto 311 tA 0 tAAAA 0 tother 0 ednsknown 1 edns 0 delay 0 lame dnssec 0 rec 0 A 0 other 0
192.36.148.17 . ttl 896 ping 3 var 78 rtt 315 rto 315 tA 0 tAAAA 0 tother 0 ednsknown 1 edns 0 delay 0 lame dnssec 0 rec 0 A 0 other 0
192.58.128.30 . ttl 896 ping 27 var 124 rtt 523 rto 523 tA 0 tAAAA 0 tother 0 ednsknown 1 edns 0 delay 0 lame dnssec 0 rec 0 A 0 other 0

KOM

@jimp, any insight into what's going on here?

jimp

We just show what unbound dumps out. If it's empty, then it's empty in unbound. That could be for any number of reasons, all up to unbound. If you have something like pfBlockerNG and DNSBL active that could contribute to any differences you see. Also keep in mind if you have DHCP registration active for the DNS resolver, unbound will restart for each lease change that triggers a hostname update.

KOM

This post is deleted!

johnpoz

Well that output looks normal... That is your infra cache for that domain, in what would be used to look it up... So you should see the full cache output in the gui then.

As jimp stated all that gui is showing you is the output of the command dump_infra

KOM

Yes, I get that. What I don't get is how this list is empty, then 5 minute later it's full, then 5 minutes later it's empty. Does it really flush that frequently?

jimp

When you talk to the roots in resolver mode there isn't much reason to keep around data for dozens of authoritative servers you may not talk to again for who knows how long.

If you have the DNS Resolver in forwarding mode, it will show your forwarders there for much longer.

But again, unbound could be clearing that for any other reason, like a restart

johnpoz

The infra cache entries should stay their for the length of the ttl..

Yeah if your unbound is restarting then the cache is going to be dumped.

If you have it registering dhcp leases and you have lots of clients getting leases all the time then yeah it could be restarting every few minutes. Which makes the cache pretty useless to be honest ;)

KOM

I've already checked that Unbound is not restarting frequently. In fact, it hasn't restarted since its last boot 49 days ago in late January.

johnpoz

Well something is dumping the infra cache then.. You have any crons setup? Do you have pfblocker installed?

If unbound is up and running and being asked there would always be plenty of info in that cache.. Hmmm did you mess with the number of entries int he advanced tab?

Did you change the
TTL for Host Cache Entries
Setting from its default 15 min to say 1 min or something?

RonpfS

@kom said in DNS Resolver Status, no data?:

I've already checked that Unbound is not restarting frequently. In fact, it hasn't restarted since its last boot 49 days ago in late January.

Sometimes (after reboot or WAN toggle) Unbound doesn't log anything to Status / System Logs / System / DNS Resolver.

Restarting Unbound from Status / Services tab will get it to log.

KOM

Right, I odn't have time to chase this anymore. I put Resolver into forwarding mode and that's that.

johnpoz

You weren't doing dnssec anyway so doesn't matter. Can not 2 secons to look to see if you this setup you got from 4 years ago didn't adjust the infra ttl to 1 minute..

KOM

TTL for Host Cache Entries was set to 15 minutes. I definitely haven't touched that one. Wasn't even aware of it. It's entirely possible, and likely, that I was underestimating the time before the flush.

johnpoz

That is not a flush, that is the max time a TTL can be set before it will timeout, etc. That is not a dump of the cache.

Let me state this again... If your resolve was working the info in the infra cache is beyond noise to someone that doesn't understand what any of it means.

You have no need to look down that rabbit hole if your not trying to troubleshoot a specific issue... Was resolver working? How many queries does it get in normally, if yours has been up for 49 days and your total number of queries was

total.num.queries=7233

Nobody is even asking pfsense anything...

Here I restarted unbound what yesterday and have
total.num.queries=19015
total.num.queries_ip_ratelimited=0
total.num.cachehits=16215
total.num.cachemiss=2800

And I only have a couple of boxes on my home network... As I brought up before you have pretty much everything using your proxy and or AD dns.. So what your doing on pfsense prob has zero to do with anything. You should prob turn it off and see who complains, since your having pfsense ask your AD for its own dns anyway. And from the entries you did have in your cache couldn't even talk to outside dns.

BTW: I have been doing dns for years and years, for some very large networks.. And also its just hobby of mine I love the way it works and how it does what it does so fast and efficient.. And I can tell you have never had need to look into such info.. Can not recall when I ever dumped the infra cache other to see if there there were huge amounts of timeouts and such.. Even if you manage dns for a huge network, you most likely would never have need to view that info like that... You might use the lookup command we did to see what your resolver is using.. But raw full dump of the infra - no its eye candy in the menu to impress new users that don't really understand dns anyway ;) My take on why they put it in..

If they wanted to put up some useful/interesting eyecandy they would do like the total number of queries, percent cache hit,

This info would be more interesting that the raw infra_dump

num.query.type.A=7801
num.query.type.SOA=15
num.query.type.PTR=9895
num.query.type.TXT=21
num.query.type.AAAA=1388
num.query.type.SRV=246
num.query.class.IN=19366

num.answer.rcode.NXDOMAIN=10067

That NXdomain means something is asking quite a bit actual for something that doesn't exist and gets returned NX.. So should prob look into that..

edit: Ok found it ;)

Mar 14 13:40:56 	unbound 	5708:1 	info: 10.0.8.3 HNA00050.snipped.internal.com. A IN NXDOMAIN 0.000000 1 121

Had unbound log queries and replies.. My shitty ass work laptop connected to my vpn to home is bombing nonsense down to my pfsense dns ;)

Just noise.. But should prob spend some time making sure my work laptop doesn't do that...

edit: Ok that corrected, simple acl to deny nonlocal from my laptops vpn IP... That way doesn't keep telling my Laptop NX for stuff it should be able to lookup from the local dns..

MoonKnight

Hi,

This is probably normal when using TLS over DNS? :)

0_1552667022964_5c0d7063-e541-42f9-afac-e01cb02f0d3f-image.png

provels

@ciscox That's what I see when I use the Resolver as Forwarder.