DNS Resolver sudden stop and filterdns PID 48934

[ramikilany]

I have the latest version of pfSense (2.5.0-RELEASE (amd64) ), after the last update I had some issues in the DNS Resolver. Some times it stops suddenly and i need to start the service, and some time the clients can not resolve the external DNS (pfSense DNS) so the packets will stops in the pfSense firewall and does not pass to the internet.

• In System Log > DNS Resolver I found these logs: Mar 2 09:19:18 filterdns 48934 failed to resolve host pt1 will retry later again. Same for other clients
• In Diagnostics > DNS Lookup when I lookup for google.com it took a lot of time and return this message:
  Name server Query time
  127.0.0.1 No response
  8.8.8.8 50 msec
  4.2.2.2 56 msec
  where the local IP must return a time range
• And sometime the following message appear in the main page:
  [02-Mar-2021 09:14:55 Asia/Beirut] PHP Fatal error: Uncaught Error: Class 'Net_IPv6' not found in /etc/inc/util.inc:680
  Stack trace:
  #0 /etc/inc/util.inc(657): is_ipaddrv6('portal.fb.com')
  #1 /usr/local/www/pfblockerng/www/index.php(59): is_ipaddr('portal.fb.com')
  #2 {main}
  thrown in /etc/inc/util.inc on line 680

Best Regards.

[fbon1]

@ramikilany

I have the same problem with the latest version of pfSense (2.5.0-RELEASE (amd64) )

Unbound crashes periodically => I updated the unbound service with the command line : pkg upgrade -fy unbound

the problem seems to be persistent

I am using a captive portal with the pfBlockerNG-devel service to filter dns requests

my stack trace in the main page:

Stack trace:
#0 /etc/inc/util.inc(657): is_ipaddrv6('www.statcounter...')
#1 /usr/local/www/pfblockerng/www/index.php(59): is_ipaddr('www.statcounter...')
#2 {main}
thrown in /etc/inc/util.inc on line 680

best regards.

[Gertjan]

@fbon1
Do you see like @ramikilany this line

PHP Fatal error: Uncaught Error: Class 'Net_IPv6' not found in /etc/inc/util.inc:680

which indicates that core file are missing.
They should be here : /usr/local/share/pear/Net/
Like "IPv6.php"'.

[fbon1]

@gertjan

yes :

[02-Mar-2021 08:59:09 Europe/Paris] PHP Fatal error: Uncaught Error: Class 'Net_IPv6' not found in /etc/inc/util.inc:680
Stack trace:
#0 /etc/inc/util.inc(657): is_ipaddrv6('pagead2.googles...')
#1 /usr/local/www/pfblockerng/www/index.php(59): is_ipaddr('pagead2.googles...')
#2 {main}
thrown in /etc/inc/util.inc on line 680
[02-Mar-2021 08:59:10 Europe/Paris] PHP Fatal error: Uncaught Error: Class 'Net_IPv6' not found in /etc/inc/util.inc:680
Stack trace:
#0 /etc/inc/util.inc(657): is_ipaddrv6('www.statcounter...')
#1 /usr/local/www/pfblockerng/www/index.php(59): is_ipaddr('www.statcounter...')
#2 {main}
thrown in /etc/inc/util.inc on line 680

[ramikilany]

@gertjan yes I see this message.

What is the solution for this problem in your opinion?

[Gertjan]

As said :

@gertjan said in DNS Resolver sudden stop and filterdns PID 48934:

They should be here : /usr/local/share/pear/Net/
Like "IPv6.php"'.

is this the case ?

I have :

[2.5.0-RELEASE][admin@pfsense.me.net]/usr/local/share/pear/Net: ls -al
total 140
drwxr-xr-x   2 root  wheel    512 Feb 23 09:59 .
drwxr-xr-x  19 root  wheel    512 Feb 23 09:59 ..
-rw-r--r--   1 root  wheel  26707 Feb  6 13:23 IPv6.php
-rw-r--r--   1 root  wheel  47492 Feb  6 13:22 SMTP.php
-rw-r--r--   1 root  wheel  20217 Feb  6 13:22 Socket.php
-rw-r--r--   1 root  wheel  35169 Feb  6 13:22 URL2.php

What is your pfSense version ?
What is your pfB version ? (the latest, version 3.0.0_13, dates from last night).

[ramikilany]

@gertjan In my own case if have the posted issue

here is some lines:

#0 /etc/inc/util.inc(657): is_ipaddrv6('portal.fb.com')
#1 /usr/local/www/pfblockerng/www/index.php(59): is_ipaddr('portal.fb.com')

the problem as shown is in 2 folder (I think) /etc/inc/ with the file util.inc and in /usr/local/www/pfblockerng/www/ with the file index.php

about your directory here is my pfSense folder and file

login-to-view

what we must do in the folder that you mention?

• pfSense Version 2.5.0-RELEASE (amd64)
  built on Tue Feb 16 08:56:29 EST 2021
  FreeBSD 12.2-STABLE

• pfBlockerNG-devel 3.0.0_13

[thegenius21]

login-to-view

there seems an update ...seen this when i reinstalled pfb.

[Gertjan]

@ramikilany said in DNS Resolver sudden stop and filterdns PID 48934:

what we must do in the folder that you mention?

Exactly these four files.
As you showed - as I showed.

So this message :

Class 'Net_IPv6' not found in /etc/inc/util.inc:680

has nothing to do with the file "IPv6.php" missing.

Btw : the error happens like this : your browser, #2 {main}, opens a page :
#1 /usr/local/www/pfblockerng/www/index.php - on line 59 it finds "is_ipaddr('www.statcounter...')"

The function is_ipaddr() is defined in the file
#0 /etc/inc/util.inc
where, on line 680, it finds :

return Net_IPv6::checkIPv6($ipaddr);

and this function call / class can't be found.
Hence the error :

PHP Fatal error: Uncaught Error: Class 'Net_IPv6' not found in /etc/inc/util.inc:680

Or, in the file /usr/local/share/pear/Net/IPv6.php, the class "Net_IPv6" IS defined (line 135).

I understood that PHP could not find the file /usr/local/share/pear/Net/IPv6.php what would explain the situation.
But, the files are there :/

[ramikilany]

@gertjan Could be the files are corrupted?

I restarted the pfSense with the option Reboot with Filesystem Check and every thing is good and no error was found while rebooting.

Still have the sudden stop of the DNS unbound, tried the pkg upgrade -fy unbound and testing the problem if it persist.

[ramikilany]

@thegenius21 I did it now and testing if the problem still exist. thank you dear.

[Gertjan]

@ramikilany said in DNS Resolver sudden stop and filterdns PID 48934:

Could be the files are corrupted?

Well, its open source.
Compare the source with what your have ^^

Or execute :

md5 < IPv6.php

I got

2a7701126aae53348b3a1ddd17f745e4

The file size is ok, though.

[ramikilany]

@gertjan 2a7701126aae53348b3a1ddd17f745e4

same as yours, this message happens directly after the pfblockerng latest update, btw i have the same setup in the cloud (proxmox vm) and all works well. the only difference between them is the vm image has Hardware Checksum Offloading and others checked in the Advanced Networking, too annoying problem :(

[Gertjan]

@ramikilany

There might be a way to get rid of the errors.

This file : /usr/local/www/pfblockerng/www/index.php is probably the start of the PHP section that builds the web page that users see when they try to visit a DNSBL blocked page.

I see mow the issue. That is, when I visit https://pfsense.me.net/pfblockerng/www/ manually it hit the error right away.

I advise you all to disable that web server that shows the DNS blocked page as it is rather useless, and very soon it won't work anyway.
( because of the MITM concepts, TLS, how https works, your browser won't show that page any more, etc etc )

So :

login-to-view

and done.

[ramikilany]

@gertjan I did what you said and also restarted the firewall same Crash report

Crash report begins. Anonymous machine information:

amd64
12.2-STABLE
FreeBSD 12.2-STABLE d48fb226319(devel-12) pfSense

Crash report details:

PHP Errors:
[02-Mar-2021 14:13:18 Asia/Beirut] PHP Fatal error: Uncaught Error: Class 'Net_IPv6' not found in /etc/inc/util.inc:680
Stack trace:
#0 /etc/inc/util.inc(657): is_ipaddrv6('pagead2.googles...')
#1 /usr/local/www/pfblockerng/www/index.php(59): is_ipaddr('pagead2.googles...')
#2 {main}
thrown in /etc/inc/util.inc on line 680

No FreeBSD crash data found.

Could we do something else?

[ramikilany]

and in your opinion what is the solution of the following log entry in the DNS Resolver

filterdns 37490 (PID) failed to resolve host xxx will retry later again.

[Gertjan]

@ramikilany said in DNS Resolver sudden stop and filterdns PID 48934:

failed to resolve

When unbound fails, it stops. Resolving stops. For your LAN based device and any process on pfSense itself. filterdns is just one of such processes.

[ramikilany]

@gertjan after a while the message does not appear again, till now it is the solution.

already thank you for your patience and for this great solution.

Thumbs Up.

[ramikilany]

@gertjan how may I troubleshoot the failure of the unbound service? To know how to fix this issue if you cloud help me again.

[Gertjan]

@ramikilany said in DNS Resolver sudden stop and filterdns PID 48934:

how may I troubleshoot the failure of the unbound service?

The issue at the top isn't a unbound issue but a pfBlockerNG issue.
Something (some one) is hitting the PFB "block page". Who is it ? (hint : look in the logs ....)
De activate this page as stated above.
Or de active DNSBL - dooes that help ?

Btw : you are not using unbound in the default mode, you forward to Google & co.
That complicates things.

Unbound uist run in resolver mode for pfBlockerNG to work.

This one :

@ramikilany said in DNS Resolver sudden stop and filterdns PID 48934:

filterdns 48934 failed to resolve host pt1 will retry later again

is also not real an error.
"pt1" isn't valid hos name.