Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    21.02(and p1) - Unbound DNS Lookup Fails for random domains

    Scheduled Pinned Locked Moved DHCP and DNS
    14 Posts 3 Posters 794 Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • GertjanG
      Gertjan @HH77
      last edited by Gertjan

      Default unbound settings for me :

      [2.5.0-RELEASE][admin@me.net]/boot/kernel: host torproject.org 127.0.0.1
Using domain server:
Name: 127.0.0.1
Address: 127.0.0.1#53
Aliases:

torproject.org has address 116.202.120.165
torproject.org has address 116.202.120.166
torproject.org has address 95.216.163.36
torproject.org has IPv6 address 2a01:4f8:fff0:4f:266:37ff:fe2c:5d19
torproject.org has IPv6 address 2a01:4f9:c010:19eb::1
torproject.org has IPv6 address 2a01:4f8:fff0:4f:266:37ff:feae:3bbc
torproject.org mail is handled by 10 eugeni.torproject.org.

      Check the domain name yourself https://zonemaster.net/result/364ca0e0ed9a27db this one is very messy.

      edit : the upstream DNS servers for unbound are the 13 root DNS internet servers.
      If they can't find stuff, consider the domain name 'bad'.

      No "help me" PM's please. Use the forum, the community will thank you.
      Edit : and where are the logs ??

      H 1 Reply Last reply Reply Quote 0
      • H
        HH77 @Gertjan
        last edited by

        @gertjan

        I know the domain is good. I can resolve when I point to Google to OpenDNS. It is local unbound service that is failing. I am looking at the logs and they are giving me nothing.

        1 Reply Last reply Reply Quote 0
        • H
          HH77
          last edited by

          Here is my unbound config. Does anyone see anything off?

          GertjanG 1 Reply Last reply Reply Quote 0
          • GertjanG
            Gertjan @HH77
            last edited by Gertjan

            @hh77 said in 21.02(and p1) - Unbound DNS Lookup Fails for random domains:

            Here is my unbound config. Does anyone see anything off?

            It's unreadable.
            It's here : /var/unbound/unbound.conf

            @hh77 said in 21.02(and p1) - Unbound DNS Lookup Fails for random domains:

            I know the domain is good

            Count the notices and warnings. If you know who the domain owner is, have him repair the issues.

            No "help me" PM's please. Use the forum, the community will thank you.
            Edit : and where are the logs ??

            H 1 Reply Last reply Reply Quote 0
            • H
              HH77 @Gertjan
              last edited by

              @gertjan ok here is my config. what is crazy is I have been using pfsense for almost 5 years and this is the first time i have run into this issue

              ##########################
# Unbound Configuration
##########################

##
# Server configuration
##
server:

chroot: /var/unbound
username: "unbound"
directory: "/var/unbound"
pidfile: "/var/run/unbound.pid"
use-syslog: yes
port: 53
verbosity: 1
hide-identity: yes
hide-version: yes
harden-glue: yes
do-ip4: yes
do-ip6: yes
do-udp: yes
do-tcp: yes
do-daemonize: yes
module-config: "validator iterator"
unwanted-reply-threshold: 0
num-queries-per-thread: 4096
jostle-timeout: 200
infra-host-ttl: 900
infra-cache-numhosts: 10000
outgoing-num-tcp: 10
incoming-num-tcp: 10
edns-buffer-size: 1232
cache-max-ttl: 86400
cache-min-ttl: 0
harden-dnssec-stripped: yes
msg-cache-size: 4m
rrset-cache-size: 8m

num-threads: 2
msg-cache-slabs: 2
rrset-cache-slabs: 2
infra-cache-slabs: 2
key-cache-slabs: 2
outgoing-range: 4096
#so-rcvbuf: 4m
auto-trust-anchor-file: /var/unbound/root.key
prefetch: no
prefetch-key: no
use-caps-for-id: no
serve-expired: no
aggressive-nsec: no
# Statistics
# Unbound Statistics
statistics-interval: 0
extended-statistics: yes
statistics-cumulative: yes

# TLS Configuration
tls-cert-bundle: "/etc/ssl/cert.pem"

# Interface IP(s) to bind to
interface-automatic: yes
interface: 0.0.0.0
interface: ::0

# Outgoing interfaces to be used

# DNS Rebinding
# For DNS Rebinding prevention
private-address: 127.0.0.0/8
private-address: 10.0.0.0/8
private-address: ::ffff:a00:0/104
private-address: 172.16.0.0/12
private-address: ::ffff:ac10:0/108
private-address: 169.254.0.0/16
private-address: ::ffff:a9fe:0/112
private-address: 192.168.0.0/16
private-address: ::ffff:c0a8:0/112
private-address: fd00::/8
private-address: fe80::/10
# Set private domains in case authoritative name server returns a Private IP address



# Access lists
include: /var/unbound/access_lists.conf

# Static host entries
include: /var/unbound/host_entries.conf

# dhcp lease entries
include: /var/unbound/dhcpleases_entries.conf

# OpenVPN client entries
include: /var/unbound/openvpn.*.conf

# Domain overrides
include: /var/unbound/domainoverrides.conf
# Forwarding
forward-zone:
	name: "."
	forward-addr: 208.67.220.220


# Unbound custom options
server:include: /var/unbound/pfb_dnsbl.*conf
              GertjanG 1 Reply Last reply Reply Quote 0
              • GertjanG
                Gertjan @HH77
                last edited by

                @hh77 said in 21.02(and p1) - Unbound DNS Lookup Fails for random domains:

                forward-zone:
                name: "."
                forward-addr: 208.67.220.220

                "208.67.220.220" == OpenDNS.
                They are strict.
                You could probably test with them, using their GUI, if they do resolve your domain, using your choice of lists.
                I can image that domain name "torproject" could be listed ^^

                Do you have to forward to them ?
                As said above, default pfSense resolver settings work fine. When debugging, you should not include third parties, that you don't control, into your setup.

                No "help me" PM's please. Use the forum, the community will thank you.
                Edit : and where are the logs ??

                H 1 Reply Last reply Reply Quote 0
                • H
                  HH77 @Gertjan
                  last edited by

                  @gertjan I tried with no resolvers and DNS would not resolve anything.

                  1 Reply Last reply Reply Quote 0
                  • H
                    HH77
                    last edited by

                    Ok Now I am pretty sure something is wrong. I ran dig utility to resolve one of the name servers for the torproject, but I got a server fail

                    [21.02-RELEASE][admin@home.tncoffee.net]/root: dig ns1.torproject.org

; <<>> DiG 9.16.11 <<>> ns1.torproject.org
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 49081
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;ns1.torproject.org.		IN	A

;; Query time: 118 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Tue Mar 02 04:52:41 MST 2021
;; MSG SIZE  rcvd: 47

                    I ran a packet capture and I am seeing the correct replies from upstream.

                    Imgur

                    So pfsense is receiving the correct replies but is not processing them to the clients.

                    GertjanG 1 Reply Last reply Reply Quote 0
                    • GertjanG
                      Gertjan @HH77
                      last edited by

                      Use the detailed mode :

                      ; <<>> DiG 9.16.11 <<>> ns1.torproject.org +trace
;; global options: +cmd
.                       72790   IN      NS      d.root-servers.net.
.                       72790   IN      NS      a.root-servers.net.
.                       72790   IN      NS      m.root-servers.net.
.                       72790   IN      NS      e.root-servers.net.
.                       72790   IN      NS      l.root-servers.net.
.                       72790   IN      NS      j.root-servers.net.
.                       72790   IN      NS      i.root-servers.net.
.                       72790   IN      NS      g.root-servers.net.
.                       72790   IN      NS      h.root-servers.net.
.                       72790   IN      NS      b.root-servers.net.
.                       72790   IN      NS      f.root-servers.net.
.                       72790   IN      NS      k.root-servers.net.
.                       72790   IN      NS      c.root-servers.net.
.                       72790   IN      RRSIG   NS 8 0 518400 20210315050000 20210302040000 42351 . X/QC4PBDzMgKPoiLj97sFNXfqknEFs0zF6lNeS2q4NZgANYt3RGNtoL8 jVxrwRic5I6K6s/olltVaOiFuFX3jPzzHmW7zGLpglRx4MF9CBkwl2pc 9HAojP82TH511mDRJLVxjdK+ZtWITw5T0qGw6FuhZkXIjnVvmgrlba8t sMmQH8jN8ypL/hyNRTh+jeqes6Gf+pkXKkDeA6M35lv4X8KElv/TxUI6 ewD6RtofgZQ949kSgx1237WN2UwTc4oavBg+XrASRX7vbR8zyKvccdGT X4VJk+yMQaFfQPsuJdRc2Q7x22WjQIvlNkdb2MGCu5EgEiRQrfroTQS4 WIeOvg==
;; Received 525 bytes from 127.0.0.1#53(127.0.0.1) in 1 ms

org.                    172800  IN      NS      a0.org.afilias-nst.info.
org.                    172800  IN      NS      a2.org.afilias-nst.info.
org.                    172800  IN      NS      b0.org.afilias-nst.org.
org.                    172800  IN      NS      b2.org.afilias-nst.org.
org.                    172800  IN      NS      c0.org.afilias-nst.info.
org.                    172800  IN      NS      d0.org.afilias-nst.org.
org.                    86400   IN      DS      26974 8 2 4FEDE294C53F438A158C41D39489CD78A86BEB0D8A0AEAFF14745C0D 16E1DE32
org.                    86400   IN      RRSIG   DS 8 1 86400 20210315050000 20210302040000 42351 . ZGfBMXVbsZER+UuyapgV05tUKFHMhrQUOC4hfLAyUUbW9ahWtInfk2Mq s/3QVWIckLJYBs/YLLQwXojZhZ0vOzhkCfgFFg94VUSHXTdqxEHZYHy4 KOLLdnmlTIdsxaD/6ncVUgbZvARFUbvmaX4JrnPYobLJ0wMTKQr3MjBo cuN0x9gGeqsQWT0/F37c2reFEVJSRj8xCuiNTh7Y9/c6w5Rw/YWCo+Tq MNdf0a5adLS++cbV/txQ3st4yxDFm/n32qCZn5YVUh6bJNRUE9lAALsR IBXC5BK7ZOYqaldkiJq4BCXB+Q6J0vFh1L9BUYDPeYjYWjS8XrcHoU0a XBTWUw==
;; Received 784 bytes from 199.7.91.13#53(d.root-servers.net) in 41 ms

torproject.org.         86400   IN      NS      ns4.torproject.org.
torproject.org.         86400   IN      NS      ns1.torproject.org.
torproject.org.         86400   IN      NS      ns3.torproject.org.
torproject.org.         86400   IN      NS      ns5.torproject.org.
torproject.org.         86400   IN      DS      28486 8 2 CEFD14514B18D5E31073BC9EA463C7852DE236742E23A4AB327E446C 608A76B9
torproject.org.         86400   IN      RRSIG   DS 8 2 86400 20210322153104 20210301143104 27558 org. Sf/gLk8MGdlB8m1jY869rdG1wSWZSfeu0+lnmjpoBGhY4ysKFEHZMvSZ stoQK1wF1dlHR2ap2NOCxCV7AbXJ64pETDCph+Qt9xjB4ryl5ziDu3mq 7qvRDE/IHp1oDClMG+TOZVMibtjFN7uOEZb99cH5YjgDaDJSW3crAHzy 0ns=
;; Received 474 bytes from 2001:500:b::1#53(c0.org.afilias-nst.info) in 313 ms

ns1.torproject.org.     86400   IN      A       38.229.72.12
ns1.torproject.org.     86400   IN      RRSIG   A 8 3 86400 20210408121210 20210227111550 55143 torproject.org. DeZeudOFY4u8Sci0GzYbnLBjeT4Ygr3LNB8s6dAs7/WFVgNrlk6eAGi1 FQ/C/QpmJ23RdyK8uRVqEokOpbL763oyrhjXPIZv5Zk9468+PxnXtXc8 S/XrI8+naVEz0lDDrRGYKLD+uRrPFonMbyguLwTZy2/UMB5aChg4sJkc u8aq+FVA0x0JkfyjVkZa50LtC7tCs5TE5ewM64YyXUdw9DTZTFbOCEK4 H9ZIa3gCGuxt8fUVfum3PZ5LpqabuTYb
torproject.org.         86400   IN      NS      nsp.dnsnode.net.
torproject.org.         86400   IN      NS      ns3.torproject.org.
torproject.org.         86400   IN      NS      ns4.torproject.org.
torproject.org.         86400   IN      NS      ns5.torproject.org.
torproject.org.         86400   IN      NS      ns1.torproject.org.
torproject.org.         86400   IN      RRSIG   NS 8 2 86400 20210406005215 20210225004545 55143 torproject.org. ww0k4m71ys7aIzd9vNGmmQ//XAYWbM6I5/x2b1qL9Ng+o8HdV9x+2pDr BY03a15BiIp+CG40Cyv3f3lcbZQgj+okvXQyaoIXO8LyTHSXSDWQpxkO btVXHiFQCHkwOjLWFwlMLMOPdYd4rPZQeJMAx2SSnqnUArwY3+2RzVIs 0X8pFquqj9hfF5UT9AO04dBY+HnvCHiHKHRlVp5dTlcGHTiMBTrTeDKj dHsBQtSMYdIiNdt0EZcmBO57JU2SBIRV
;; Received 2224 bytes from 89.45.235.22#53(ns5.torproject.org) in 61 ms

                      I've got an answer :

                      ns1.torproject.org.     86400   IN      A       38.229.72.12

                      For my PC's (clients) the answer is identical :

                      C:\Users\gwkro>nslookup ns1.torproject.org
Serveur :   pfsense.me.net
Address:  2001:470:1f13:5d8:2::1

Réponse ne faisant pas autorité :
Nom :    ns1.torproject.org
Address:  38.229.72.12

                      No "help me" PM's please. Use the forum, the community will thank you.
                      Edit : and where are the logs ??

                      johnpozJ 1 Reply Last reply Reply Quote 0
                      • johnpozJ
                        johnpoz LAYER 8 Global Moderator @Gertjan
                        last edited by

                        If I had to guess your problem is you blocking it

                        # Unbound custom options
server:include: /var/unbound/pfb_dnsbl.*conf

                        Turn off pfblocker - does it resolve then.

                        I also have no problems resolving that.

                        $ dig torproject.org

; <<>> DiG 9.16.12 <<>> torproject.org
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 63899
;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;torproject.org.                        IN      A

;; ANSWER SECTION:
torproject.org.         3600    IN      A       116.202.120.166
torproject.org.         3600    IN      A       116.202.120.165
torproject.org.         3600    IN      A       95.216.163.36

;; Query time: 501 msec
;; SERVER: 192.168.3.10#53(192.168.3.10)
;; WHEN: Tue Mar 02 06:41:34 Central Standard Time 2021
;; MSG SIZE  rcvd: 91

                        An intelligent man is sometimes forced to be drunk to spend time with his fools
                        If you get confused: Listen to the Music Play
                        Please don't Chat/PM me for help, unless mod related
                        SG-4860 24.11 | Lab VMs 2.8, 24.11

                        H 1 Reply Last reply Reply Quote 0
                        • H
                          HH77 @johnpoz
                          last edited by

                          @johnpoz I turned it off and still failing to resolve. is there a way I can do a debug?

                          GertjanG H 2 Replies Last reply Reply Quote 0
                          • GertjanG
                            Gertjan @HH77
                            last edited by Gertjan

                            @hh77 said in 21.02(and p1) - Unbound DNS Lookup Fails for random domains:

                            I turned it off and still failing to resolve.

                            Normal.
                            pfSense resolves and caches DNS answers. That part has been 'turned off' and the cache has been wiped.

                            But your own device ?
                            If it is a windows device :

                            ipconfig /flushdns

                            Other OS's have comparable commands.

                            And restart also your browser, as they might cache also.

                            edit :

                            @hh77 said in 21.02(and p1) - Unbound DNS Lookup Fails for random domains:

                            I can do a debug

                            Dono.
                            If your a windows user, after typing 'nslookup' you can type

                            set debug

                            Then

                            torproject.org

                            and sit back 😊

                            No "help me" PM's please. Use the forum, the community will thank you.
                            Edit : and where are the logs ??

                            1 Reply Last reply Reply Quote 0
                            • H
                              HH77 @HH77
                              last edited by

                              @hh77 yup that resolved it. Allowing the unbound to use the root DNS servers did the trick. What is weird that I have always enabled the query upstream server option and not had an issue. I am not going to dwell on it. I glad I got this issue resolved. Now on to others!

                              1 Reply Last reply Reply Quote 0
                              • First post
                                Last post
                              Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.