Unbound Error

jconnors

I know this issue has been around for a bit but I've not seen a solid answer for it.

alt text

What is the work around here? This system is fully updated btw.

List of services running: alt text

Works great on a clean install, but this FW has been up for a bit.

Any thoughts?

Thank You.

KOM

This thread had a few suggestions, like disabling DNSSEC.

Were you running pfBlocker at some point?

jconnors

@kom No, we've never run anything of the sort on this machine. Pretty much any advice I've seen online I've tried and ruled out thus far.

The only way I've seen it work is with a fresh install and this is a core router, which I can't really do that with.

KOM

I just checked my config and I don't have any test folder with root.key inside. Take a look in /var/unbound/unbound.conf. Look at all the included files and check them for references to /test/root.key. It's got to be there somewhere.

You could also try the nuclear option:

disable resolver
enable forwarder
take a config.xml backup
manually edit it and remove everything between the <unbound></unbound> tags
install fresh, restore your config then disable forwarder and enable resolver

jconnors

I would love to enable Forwarder, but I can't..that error pops up preventing it from starting.

I'll check the rest here. Let you know what I find.

BBcan177

Try to run this command and see if that fixes it:

unbound-anchor -a /var/unbound/root.key

If not, In the /var/unbound/ folder, delete these four files and reboot:

unbound_control.key
unbound_control.pem
unbound_server.key
unbound_server.pem

stephenw10

You appear to have the DNS Forwarder (dnsmasq) running in the screenshot above. You cannot enabled the DNS Resolver at the same time unless one is not listening on port 53.

Steve

jconnors

@BBcan177

I had tried that previously and it didn't work. There is a upgrade/reboot planned for next Sunday

@stephenw10

In the screenshot it may have been running, but I assure you that when I tried the change, I did have it turned off.

stephenw10

Ok, so you're using the Forwarder just because the Resolver won't start currently?

Steve

jconnors

Correct. It works on the other FW's just fine, but this one, because it's the main, can't just be taken down when wanted. Too many other services behind it that can break and all teams need to be on board when a reboot is required in case those services really bork.