• Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login
Netgate Discussion Forum
  • Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login

DNS Resolver (unbound) / Can't change config

Scheduled Pinned Locked Moved DHCP and DNS
61 Posts 29 Posters 70.1k Views
Loading More Posts
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • S
    svaldes
    last edited by Sep 13, 2016, 5:08 PM Sep 13, 2016, 4:50 PM

    Hi, I can change the configuration of the DNS Resolver settings, we can add Host Overrides, but no change General DNS Resolver Options. After change something when I save I get this error:

    The following input errors were detected:
    The generated config file cannot be parsed by unbound. Please correct the following errors:
    /var/unbound/test/root.key: No such file or directory
    [1473785216] unbound-checkconf[7939:0] fatal error: auto-trust-anchor-file: "/var/unbound/test/root.key" does not exist in chrootdir /var/unbound

    I have this problem on others pfSenses too. All of them and this one included are in version 2.3.2-RELEASE but they were upgraded from previous versions. I have tried to disable DNS Resolver but when I re-enable the settings persist and still can't make any change.

    The DNS Resolver is working, but now I need to add another interface and I can't.

    1 Reply Last reply Reply Quote 0
    • F
      fscms
      last edited by Sep 28, 2016, 9:07 PM

      Hi,

      i'am getting exactly the same error, when i make some change and save this error appear and config stay unchanged.

      tanks

      1 Reply Last reply Reply Quote 0
      • F
        fscms
        last edited by Sep 30, 2016, 8:58 AM

        Hi, svaldes

        try to reboot the PFsense, work with me, the error dissapear.

        1 Reply Last reply Reply Quote 0
        • F
          Fabio72
          last edited by Jan 17, 2017, 8:35 AM Jan 17, 2017, 8:15 AM

          same error for me

          The following input errors were detected:
          
              The generated config file cannot be parsed by unbound. Please correct the following errors:
              /var/unbound/test/unbound_server.key: No such file or directory
              [1484640674] unbound-checkconf[16694:0] fatal error: server-key-file: "/var/unbound/test/unbound_server.key" does not exist
          
          Version 	2.3.2-RELEASE-p1 (amd64)
          built on Tue Sep 27 12:13:07 CDT 2016
          FreeBSD 10.3-RELEASE-p9
          
          ##########################
          # Unbound Configuration
          ##########################
          
          ##
          # Server configuration
          ##
          server:
          
          chroot: /var/unbound
          username: "unbound"
          directory: "/var/unbound"
          pidfile: "/var/run/unbound.pid"
          use-syslog: yes
          port: 53
          verbosity: 1
          hide-identity: yes
          hide-version: yes
          harden-glue: yes
          do-ip4: yes
          do-ip6: yes
          do-udp: yes
          do-tcp: yes
          do-daemonize: yes
          module-config: "validator iterator"
          unwanted-reply-threshold: 0
          num-queries-per-thread: 4096
          jostle-timeout: 200
          infra-host-ttl: 900
          infra-cache-numhosts: 10000
          outgoing-num-tcp: 10
          incoming-num-tcp: 10
          edns-buffer-size: 4096
          cache-max-ttl: 86400
          cache-min-ttl: 0
          harden-dnssec-stripped: yes
          msg-cache-size: 4m
          rrset-cache-size: 8m
          
          num-threads: 4
          msg-cache-slabs: 4
          rrset-cache-slabs: 4
          infra-cache-slabs: 4
          key-cache-slabs: 4
          outgoing-range: 4096
          #so-rcvbuf: 4m
          auto-trust-anchor-file: /var/unbound/root.key
          prefetch: no
          prefetch-key: no
          use-caps-for-id: no
          # Statistics
          # Unbound Statistics
          statistics-interval: 0
          extended-statistics: yes
          statistics-cumulative: yes
          
          # Interface IP(s) to bind to
          interface: 0.0.0.0
          interface: ::0
          interface-automatic: yes
          
          # Outgoing interfaces to be used
          
          # DNS Rebinding
          # For DNS Rebinding prevention
          private-address: 10.0.0.0/8
          private-address: 172.16.0.0/12
          private-address: 169.254.0.0/16
          private-address: 192.168.0.0/16
          private-address: fd00::/8
          private-address: fe80::/10
          
          # Access lists
          include: /var/unbound/access_lists.conf
          
          # Static host entries
          include: /var/unbound/host_entries.conf
          
          # dhcp lease entries
          include: /var/unbound/dhcpleases_entries.conf
          
          # Domain overrides
          include: /var/unbound/domainoverrides.conf
          
          # Unbound custom options
          server:include: /var/unbound/pfb_dnsbl.conf
          
          ###
          # Remote Control Config
          ###
          include: /var/unbound/remotecontrol.conf
          
          
          1 Reply Last reply Reply Quote 0
          • J
            johnpoz LAYER 8 Global Moderator
            last edited by Jan 17, 2017, 12:00 PM

            I would guess this is your problem

            server:include: /var/unbound/pfb_dnsbl.conf

            No mention that your running pfblocker…

            An intelligent man is sometimes forced to be drunk to spend time with his fools
            If you get confused: Listen to the Music Play
            Please don't Chat/PM me for help, unless mod related
            SG-4860 24.11 | Lab VMs 2.8, 24.11

            1 Reply Last reply Reply Quote 0
            • F
              Fabio72
              last edited by Jan 17, 2017, 2:09 PM Jan 17, 2017, 2:02 PM

              So it's a pfblocker issue?
              May I open a discussion on pfblocker thread?

              1 Reply Last reply Reply Quote 0
              • J
                johnpoz LAYER 8 Global Moderator
                last edited by Jan 17, 2017, 2:12 PM

                Well I am not sure that is the issue, but that would be my educated guess… Why don't you remove it and see if that fixes your problem.  If so then yes you could start a thread on the packages section.

                For starters you could look to see what is being loaded from that conf file.. Since your conf doesn't point to that key file that is saying is not there, etc.

                your says
                auto-trust-anchor-file: /var/unbound/root.key

                Error says
                /var/unbound/test/unbound_server.key" does not exist

                An intelligent man is sometimes forced to be drunk to spend time with his fools
                If you get confused: Listen to the Music Play
                Please don't Chat/PM me for help, unless mod related
                SG-4860 24.11 | Lab VMs 2.8, 24.11

                1 Reply Last reply Reply Quote 0
                • F
                  Fabio72
                  last edited by Jan 17, 2017, 3:56 PM

                  The file /var/unbound/pfb_dnsbl.conf only contains a logn list of local-data/local-zone entries

                  And I cannot save settings also if I remove the pfblocker include (using the gui)

                  1 Reply Last reply Reply Quote 0
                  • J
                    johnpoz LAYER 8 Global Moderator
                    last edited by Jan 17, 2017, 4:09 PM

                    well look into any included conf files.. since fro the conf posted there is no reference to that file.

                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                    If you get confused: Listen to the Music Play
                    Please don't Chat/PM me for help, unless mod related
                    SG-4860 24.11 | Lab VMs 2.8, 24.11

                    1 Reply Last reply Reply Quote 0
                    • F
                      Fabio72
                      last edited by Jan 17, 2017, 4:36 PM

                      [2.3.2-RELEASE][admin@pfSense.arda]/var/unbound: grep -R -i unbound_server.key *
                      remotecontrol.conf:	server-key-file: "/var/unbound/unbound_server.key"
                      
                      

                      Where else can I search? Is unbound chrooted?

                      [2.3.2-RELEASE][admin@pfSense.arda]/etc/inc: grep -R /unbound_server.key *
                      unbound.inc:	server-key-file: "{$g['unbound_chroot_path']}{$cfgsubdir}/unbound_server.key"
                      [2.3.2-RELEASE][admin@pfSense.arda]/etc/inc: 
                      
                      [2.3.2-RELEASE][admin@pfSense.arda]/etc/inc: grep -R /test *
                      unbound.inc:	$cfgsubdir = "/test";
                      [2.3.2-RELEASE][admin@pfSense.arda]/etc/inc: 
                      
                      

                      content of /etc/inc/unbound.inc

                      function test_unbound_config($unboundcfg, &$output) {
                              global $g;
                      
                              $cfgsubdir = "/test";
                              unbound_generate_config($unboundcfg, $cfgsubdir);
                              unbound_remote_control_setup($cfgsubdir);
                              do_as_unbound_user("unbound-anchor", $cfgsubdir);
                      
                              $cfgdir = "{$g['unbound_chroot_path']}{$cfgsubdir}";
                      
                              $rv = 0;
                              exec("/usr/local/sbin/unbound-checkconf {$cfgdir}/unbound.conf 2>&1", $output, $rv);
                              rmdir_recursive($cfgdir);
                      
                              return $rv;
                      }
                      
                      
                      1 Reply Last reply Reply Quote 0
                      • D
                        doktornotor Banned
                        last edited by Jan 17, 2017, 5:33 PM

                        Just disable DNSSEC if you cannot get it working. Are you using some kind of RAM disks or nanobsd?

                        1 Reply Last reply Reply Quote 0
                        • F
                          Fabio72
                          last edited by Jan 17, 2017, 8:37 PM

                          I cannot disable DNSSEC for the same error. I'm using the full 64bit release without ramdisk.
                          DNS resolver works but I cannot make any change. Reload works.

                          1 Reply Last reply Reply Quote 0
                          • D
                            doktornotor Banned
                            last edited by Jan 17, 2017, 8:56 PM Jan 17, 2017, 8:49 PM

                            Have you tried to reboot as suggested above? Also, no idea why did you use this thread since you definitely do NOT have the same error.

                            Anyway.

                            
                            mkdir /var/unbound/test/
                            cp -ax /var/unbound/*.{key,pem} /var/unbound/test/
                            
                            

                            and try again.

                            1 Reply Last reply Reply Quote 0
                            • F
                              Fabio72
                              last edited by Jan 18, 2017, 10:38 AM

                              Works only once: every time  /var/unbound/test/ is deleted and I have to create again before saving settings

                              1 Reply Last reply Reply Quote 0
                              • D
                                doktornotor Banned
                                last edited by Jan 18, 2017, 11:29 AM Jan 18, 2017, 11:25 AM

                                No idea what kind of legacy configuration crap have you imported on all of your boxes across some upgrades, sorry. You can try with 2.3.3 but I sincerely doubt it'd change anything. Other that that

                                • wipe /var/unbound altogether
                                • switch to DNS forwarder
                                • make a config backup, wipe everything between <unbound>…</unbound> tags, restore the config (will force a reboot)
                                • reconfigure the resolver from from scratch
                                1 Reply Last reply Reply Quote 0
                                • V
                                  voxeljorz
                                  last edited by Jan 18, 2017, 11:27 AM

                                  @Fabio72:

                                  Works only once: every time  /var/unbound/test/ is deleted and I have to create again before saving settings

                                  Same here too.

                                  _The following input errors were detected:

                                  The generated config file cannot be parsed by unbound. Please correct the following errors:
                                      /var/unbound/test/unbound_server.key: No such file or directory
                                      [1484738643] unbound-checkconf[70766:0] fatal error: server-key-file: "/var/unbound/test/unbound_server.key" does not exist_

                                  I have to execute this everytime there are changes to be made:
                                  _  mkdir /var/unbound/test/
                                    cp -ax /var/unbound/*.{key,pem} /var/unbound/test/_

                                  I am also getting this error on DNS Resolver log: (a lot of them)
                                    notice: remote address is 192.168.2.245 port 53134
                                    notice: sendmsg failed: No buffer space available

                                  1 Reply Last reply Reply Quote 0
                                  • J
                                    johnpoz LAYER 8 Global Moderator
                                    last edited by Jan 18, 2017, 12:21 PM

                                    Not sure where this /test dir is coming from.. I look on my /var/unbound dir and I don't see any test dir..

                                    I can change my unbound conf without any issues.

                                    Are you running 2.3.3 or 2.4 of pfsense??

                                    unbounddir.png
                                    unbounddir.png_thumb

                                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                                    If you get confused: Listen to the Music Play
                                    Please don't Chat/PM me for help, unless mod related
                                    SG-4860 24.11 | Lab VMs 2.8, 24.11

                                    1 Reply Last reply Reply Quote 0
                                    • V
                                      voxeljorz
                                      last edited by Jan 18, 2017, 12:25 PM

                                      I am currently using 2.3.2-RELEASE-p1

                                      1 Reply Last reply Reply Quote 0
                                      • J
                                        johnpoz LAYER 8 Global Moderator
                                        last edited by Jan 18, 2017, 12:37 PM

                                        So from the code it looks like that sub dir is created but then removed after the test

                                        
                                        function test_unbound_config($unboundcfg, &$output) {
                                        	global $g;
                                        	$cfgsubdir = "/test";
                                        	unbound_generate_config($unboundcfg, $cfgsubdir);
                                        	unbound_remote_control_setup($cfgsubdir);
                                        	do_as_unbound_user("unbound-anchor", $cfgsubdir);
                                        	$cfgdir = "{$g['unbound_chroot_path']}{$cfgsubdir}";
                                        	$rv = 0;
                                        	exec("/usr/local/sbin/unbound-checkconf {$cfgdir}/unbound.conf 2>&1", $output, $rv);
                                        	rmdir_recursive($cfgdir);
                                        	return $rv;
                                        }
                                        
                                        

                                        rmdir_recursive($cfgdir);

                                        So something is failing here?  Just not sure what..

                                        An intelligent man is sometimes forced to be drunk to spend time with his fools
                                        If you get confused: Listen to the Music Play
                                        Please don't Chat/PM me for help, unless mod related
                                        SG-4860 24.11 | Lab VMs 2.8, 24.11

                                        1 Reply Last reply Reply Quote 0
                                        • VeldkornetV
                                          Veldkornet
                                          last edited by Mar 23, 2017, 7:19 AM

                                          I'm also having this problem. Setup pfSense from scratch on 2.3.3_p1.

                                          The below does indeed work once off, so I need to run it every time I change the configuration.

                                          mkdir /var/unbound/test/
                                          cp -ax /var/unbound/*.{key,pem} /var/unbound/test/
                                          

                                          Is there a bug logged for it already?

                                          1 Reply Last reply Reply Quote 0
                                          • First post
                                            Last post
                                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.
                                            This community forum collects and processes your personal information.
                                            consent.not_received