Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Frequent unbound restarts

    Scheduled Pinned Locked Moved DHCP and DNS
    98 Posts 25 Posters 37.8k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • GertjanG
      Gertjan
      last edited by

      bind check the config file it's using, and parses them when it detect it was 'touched' by some other process.
      What I do know is this : it won't ditch the cache when this happens.
      It can also unbind and bind to new interfaces, when they come and leave.

      But I can't tell if it would be better.
      bind is huge. Setup has to been done manually, even if you use a GUI like pfSense uses.
      bind needs users to look at the manual (huge also) for sure , otherwise DNS becomes a mess.

      I don't bother, practically all my devices on my trusted LAN's have static MAC leases, for IPv4 and IPv6, so 'my' unbound doesn't restarts very often (less then ones a day, probably even less frequent).

      No "help me" PM's please. Use the forum, the community will thank you.
      Edit : and where are the logs ??

      1 Reply Last reply Reply Quote 0
      • O
        Orbixx
        last edited by

        I have this problem after adding pfBlockerNG with a significantly large DNSBL list. Will try the following to reduce/eliminate impact:

        • Reduce pfBlockerNG lists to a more reasonable size
        • Add more static IP leases where reasonable
        • Increase lease time
        1 Reply Last reply Reply Quote 0
        • lawrencedolL
          lawrencedol
          last edited by lawrencedol

          [Post deleted. My problem is not related to this.]

          1 Reply Last reply Reply Quote 2
          • stephenw10S
            stephenw10 Netgate Administrator
            last edited by

            If you are getting disruption to VoIP calls that's clearly not directly DNS related. It may in fact be nothing to do with Unbound at all and in fact is just a symptom of something else that also causes Unbound to take far longer to reload.
            Have you been seeing this before 2.4.5 or just since upgrading? If it's only in 2.4.5 you are probably hitting this:
            https://redmine.pfsense.org/issues/10414

            Try opening top -aSH and also pinging the firewall and then go to Status > Filter Reload in the gui and reload the filter.
            If you see pings spike and processes shoot up to the top of the top table, pfctl, sshd, dpinger etc, then you almist certainly are hitting that.

            Steve

            lawrencedolL 1 Reply Last reply Reply Quote 0
            • lawrencedolL
              lawrencedol @stephenw10
              last edited by

              @stephenw10

              Appreciate the feedback, thanks. I guess I am still digging on my issue because my son just confirmed to me that my specific problem is not yet resolved.

              1 Reply Last reply Reply Quote 0
              • stephenw10S
                stephenw10 Netgate Administrator
                last edited by

                I'm assuming you are running this at home and don't have a massive number of dhcp clients?

                There are thousands of users in the same situation, including me, who are not hitting this. It think it's likely Unbound reloading causing disruption is in fact a symptom of something else rather than a cause.

                Steve

                lawrencedolL 1 Reply Last reply Reply Quote 0
                • lawrencedolL
                  lawrencedol @stephenw10
                  last edited by lawrencedol

                  This post is deleted!
                  1 Reply Last reply Reply Quote 0
                  • stephenw10S
                    stephenw10 Netgate Administrator
                    last edited by

                    Check the cron table, install the Cron package to make it easy. What is running at those intervals?

                    Steve

                    lawrencedolL 1 Reply Last reply Reply Quote 0
                    • lawrencedolL
                      lawrencedol @stephenw10
                      last edited by lawrencedol

                      This post is deleted!
                      1 Reply Last reply Reply Quote 0
                      • J
                        jasonArloUser
                        last edited by jasonArloUser

                        I have turned off DHCP DNS registration for guest users and so on and I have static DHCP leases for all my known devices but I still have the internet go offline once per day. The fact remains: this is a bug in PfSense that the lease script is calling HUP. It needs to be changed to reload the only the local cache as described above.

                        GertjanG 1 Reply Last reply Reply Quote 1
                        • stephenw10S
                          stephenw10 Netgate Administrator
                          last edited by

                          This is the open big covering this issue: https://redmine.pfsense.org/issues/5413

                          There is an open pull request there. dhcpleases is a binary though so would need to be compiled and swapped out to test.

                          Steve

                          1 Reply Last reply Reply Quote 0
                          • GertjanG
                            Gertjan @jasonArloUser
                            last edited by Gertjan

                            @jasonArloUser said in Frequent unbound restarts:

                            I have turned off DHCP DNS registration for guest users and so on and I have static DHCP leases for all my known devices but I still have the internet go offline once per day. The fact remains: this is a bug in PfSense that the lease script is calling HUP. It needs to be changed to reload the only the local cache as described above.

                            If you remove the check, as shown here :

                            367802de-af7a-416e-8317-15c8071403fb-image.png

                            then process 'dhcpleases' - example :

                            2930  -  Ss       0:00.01 /usr/local/sbin/dhcpleases -l /var/dhcpd/var/db/dhcpd.leases -d your-local-domain.tld -p /var/run/unbound.pid -u /var/unbound/dhcpleases_entries.conf -h /etc/hosts
                            

                            will not run : unbound will not get restarted by a new DHCP lease.

                            If (your) unbound is restarting to often, some other process is responsible for this.

                            Btw : my 'unbound' process restated 5 days ago - and I guess it was me doing so changing a setting.

                            @stephenw10 said in Frequent unbound restarts:

                            This is the open big covering this issue: https://redmine.pfsense.org/issues/5413
                            There is an open pull request there. dhcpleases is a binary though so would need to be compiled and swapped out to tes

                            Unbelievable that this issue still exists after 4 years. One might ask : is it really an issue, as circumventing it is rather easy to do ?
                            Also, unbound is a rather small resolver that handles the job very well.
                            It 'unbound' that has to be rewritten by the authors so it can reread dynamic its config files if one changes - as the alternative does : bind (named).
                            But bind has also it's disadvantage. It's huge. And hard to administer it when you hide the option (hunderds) behind a GUI like interface like pfSense.

                            No "help me" PM's please. Use the forum, the community will thank you.
                            Edit : and where are the logs ??

                            1 Reply Last reply Reply Quote 0
                            • stephenw10S
                              stephenw10 Netgate Administrator
                              last edited by

                              I have never hit it myself but clearly some people do. Switching to reload instead of restart does seem like the obvious option here. The fact it hasn't happened yet may imply I'm missing something though. 😉

                              Steve

                              L R 2 Replies Last reply Reply Quote 0
                              • L
                                lucas_nz @stephenw10
                                last edited by

                                @stephenw10 It's particularly noticeable if you are using pfBlockerNG - which adds large lists of sites to the unbound config (to provide DNS based blocking) and thus the reload can take some seconds (the restart wasn't noticeable before I implemented pfBlockerNG). This was a major issue for me until I unticked DHCP registration option. But having DHCP registration disabled is a bit lame.

                                Luke

                                GertjanG 1 Reply Last reply Reply Quote 0
                                • stephenw10S
                                  stephenw10 Netgate Administrator
                                  last edited by

                                  I imagine there is a threshold where the latency for the different processes becomes critical. I run pfBlocker and have dhcp leases enabled and never have an issue. I seemingly have not that limit yet.

                                  1 Reply Last reply Reply Quote 0
                                  • R
                                    RichMawdsley @stephenw10
                                    last edited by

                                    @stephenw10 said in Frequent unbound restarts:

                                    I have never hit it myself but clearly some people do. Switching to reload instead of restart does seem like the obvious option here. The fact it hasn't happened yet may imply I'm missing something though. 😉

                                    Steve

                                    This is what I don't understand either. This seems like a reaaally simple thing to fix.. and yes, I say FIX because this is absolutely a ridiculous flaw.

                                    1 Reply Last reply Reply Quote 1
                                    • GertjanG
                                      Gertjan @lucas_nz
                                      last edited by Gertjan

                                      @lucas_nz said in Frequent unbound restarts:

                                      But having DHCP registration disabled is a bit lame.

                                      Shutting down that option is half the work.
                                      This one stays on :

                                      18f9d88a-5f59-4777-b5bd-aae0e65a2ba0-image.png

                                      and you add all your devices to the "DHCP Static Mappings for this Interface" list.

                                      @stephenw10 said in Frequent unbound restarts:

                                      I run pfBlocker and have dhcp leases enabled and never have an issue.

                                      I bet you didn't select "all the feeds" neither ;)

                                      edit : https://redmine.pfsense.org/issues/5413

                                      No "help me" PM's please. Use the forum, the community will thank you.
                                      Edit : and where are the logs ??

                                      1 Reply Last reply Reply Quote 0
                                      • stephenw10S
                                        stephenw10 Netgate Administrator
                                        last edited by

                                        @Gertjan said in Frequent unbound restarts:

                                        I bet you didn't select "all the feeds" neither ;)

                                        Indeed I did not. 😉

                                        1 Reply Last reply Reply Quote 0
                                        • J
                                          jt
                                          last edited by

                                          anyone knows if this has been fixed in the latest update 2.4.5-p1?

                                          GertjanG 1 Reply Last reply Reply Quote 0
                                          • GertjanG
                                            Gertjan @jt
                                            last edited by

                                            @jt said in Frequent unbound restarts:

                                            anyone knows if this has been fixed in the latest update 2.4.5-p1?

                                            Everybody knows.
                                            See here - just above. - just above.

                                            Again : as soon as [nllabs.n](https://nlnetlabs.nl/projects/unbound/about/ (the authors) rewrites unbound to implement something that could be the solution, this wont't happen.

                                            As such, it's not a (pfSense) bug. At most, one could say that unbound is good, but not perfect.

                                            The easy work around is : declare static MAC DHCP leases for all the devices that you need to address 'by name' - these devices often hosts services to be accessed from your LAN.

                                            No "help me" PM's please. Use the forum, the community will thank you.
                                            Edit : and where are the logs ??

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.