Navigation

    Netgate Discussion Forum
    • Register
    • Login
    • Search
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search

    DNS Resolver (unbound) / Can't change config

    DHCP and DNS
    29
    61
    57510
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • S
      svaldes last edited by

      Hi, I can change the configuration of the DNS Resolver settings, we can add Host Overrides, but no change General DNS Resolver Options. After change something when I save I get this error:

      The following input errors were detected:
      The generated config file cannot be parsed by unbound. Please correct the following errors:
      /var/unbound/test/root.key: No such file or directory
      [1473785216] unbound-checkconf[7939:0] fatal error: auto-trust-anchor-file: "/var/unbound/test/root.key" does not exist in chrootdir /var/unbound

      I have this problem on others pfSenses too. All of them and this one included are in version 2.3.2-RELEASE but they were upgraded from previous versions. I have tried to disable DNS Resolver but when I re-enable the settings persist and still can't make any change.

      The DNS Resolver is working, but now I need to add another interface and I can't.

      1 Reply Last reply Reply Quote 0
      • F
        fscms last edited by

        Hi,

        i'am getting exactly the same error, when i make some change and save this error appear and config stay unchanged.

        tanks

        1 Reply Last reply Reply Quote 0
        • F
          fscms last edited by

          Hi, svaldes

          try to reboot the PFsense, work with me, the error dissapear.

          1 Reply Last reply Reply Quote 0
          • F
            Fabio72 last edited by

            same error for me

            The following input errors were detected:
            
                The generated config file cannot be parsed by unbound. Please correct the following errors:
                /var/unbound/test/unbound_server.key: No such file or directory
                [1484640674] unbound-checkconf[16694:0] fatal error: server-key-file: "/var/unbound/test/unbound_server.key" does not exist
            
            Version 	2.3.2-RELEASE-p1 (amd64)
            built on Tue Sep 27 12:13:07 CDT 2016
            FreeBSD 10.3-RELEASE-p9
            
            ##########################
            # Unbound Configuration
            ##########################
            
            ##
            # Server configuration
            ##
            server:
            
            chroot: /var/unbound
            username: "unbound"
            directory: "/var/unbound"
            pidfile: "/var/run/unbound.pid"
            use-syslog: yes
            port: 53
            verbosity: 1
            hide-identity: yes
            hide-version: yes
            harden-glue: yes
            do-ip4: yes
            do-ip6: yes
            do-udp: yes
            do-tcp: yes
            do-daemonize: yes
            module-config: "validator iterator"
            unwanted-reply-threshold: 0
            num-queries-per-thread: 4096
            jostle-timeout: 200
            infra-host-ttl: 900
            infra-cache-numhosts: 10000
            outgoing-num-tcp: 10
            incoming-num-tcp: 10
            edns-buffer-size: 4096
            cache-max-ttl: 86400
            cache-min-ttl: 0
            harden-dnssec-stripped: yes
            msg-cache-size: 4m
            rrset-cache-size: 8m
            
            num-threads: 4
            msg-cache-slabs: 4
            rrset-cache-slabs: 4
            infra-cache-slabs: 4
            key-cache-slabs: 4
            outgoing-range: 4096
            #so-rcvbuf: 4m
            auto-trust-anchor-file: /var/unbound/root.key
            prefetch: no
            prefetch-key: no
            use-caps-for-id: no
            # Statistics
            # Unbound Statistics
            statistics-interval: 0
            extended-statistics: yes
            statistics-cumulative: yes
            
            # Interface IP(s) to bind to
            interface: 0.0.0.0
            interface: ::0
            interface-automatic: yes
            
            # Outgoing interfaces to be used
            
            # DNS Rebinding
            # For DNS Rebinding prevention
            private-address: 10.0.0.0/8
            private-address: 172.16.0.0/12
            private-address: 169.254.0.0/16
            private-address: 192.168.0.0/16
            private-address: fd00::/8
            private-address: fe80::/10
            
            # Access lists
            include: /var/unbound/access_lists.conf
            
            # Static host entries
            include: /var/unbound/host_entries.conf
            
            # dhcp lease entries
            include: /var/unbound/dhcpleases_entries.conf
            
            # Domain overrides
            include: /var/unbound/domainoverrides.conf
            
            # Unbound custom options
            server:include: /var/unbound/pfb_dnsbl.conf
            
            ###
            # Remote Control Config
            ###
            include: /var/unbound/remotecontrol.conf
            
            
            1 Reply Last reply Reply Quote 0
            • johnpoz
              johnpoz LAYER 8 Global Moderator last edited by

              I would guess this is your problem

              server:include: /var/unbound/pfb_dnsbl.conf

              No mention that your running pfblocker…

              An intelligent man is sometimes forced to be drunk to spend time with his fools
              If you get confused: Listen to the Music Play
              Please don't Chat/PM me for help, unless mod related
              2440 2.4.5p1 | 2x 3100 2.4.4p3 | 2x 3100 22.01 | 4860 22.05

              1 Reply Last reply Reply Quote 0
              • F
                Fabio72 last edited by

                So it's a pfblocker issue?
                May I open a discussion on pfblocker thread?

                1 Reply Last reply Reply Quote 0
                • johnpoz
                  johnpoz LAYER 8 Global Moderator last edited by

                  Well I am not sure that is the issue, but that would be my educated guess… Why don't you remove it and see if that fixes your problem.  If so then yes you could start a thread on the packages section.

                  For starters you could look to see what is being loaded from that conf file.. Since your conf doesn't point to that key file that is saying is not there, etc.

                  your says
                  auto-trust-anchor-file: /var/unbound/root.key

                  Error says
                  /var/unbound/test/unbound_server.key" does not exist

                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                  If you get confused: Listen to the Music Play
                  Please don't Chat/PM me for help, unless mod related
                  2440 2.4.5p1 | 2x 3100 2.4.4p3 | 2x 3100 22.01 | 4860 22.05

                  1 Reply Last reply Reply Quote 0
                  • F
                    Fabio72 last edited by

                    The file /var/unbound/pfb_dnsbl.conf only contains a logn list of local-data/local-zone entries

                    And I cannot save settings also if I remove the pfblocker include (using the gui)

                    1 Reply Last reply Reply Quote 0
                    • johnpoz
                      johnpoz LAYER 8 Global Moderator last edited by

                      well look into any included conf files.. since fro the conf posted there is no reference to that file.

                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                      If you get confused: Listen to the Music Play
                      Please don't Chat/PM me for help, unless mod related
                      2440 2.4.5p1 | 2x 3100 2.4.4p3 | 2x 3100 22.01 | 4860 22.05

                      1 Reply Last reply Reply Quote 0
                      • F
                        Fabio72 last edited by

                        [2.3.2-RELEASE][admin@pfSense.arda]/var/unbound: grep -R -i unbound_server.key *
                        remotecontrol.conf:	server-key-file: "/var/unbound/unbound_server.key"
                        
                        

                        Where else can I search? Is unbound chrooted?

                        [2.3.2-RELEASE][admin@pfSense.arda]/etc/inc: grep -R /unbound_server.key *
                        unbound.inc:	server-key-file: "{$g['unbound_chroot_path']}{$cfgsubdir}/unbound_server.key"
                        [2.3.2-RELEASE][admin@pfSense.arda]/etc/inc: 
                        
                        [2.3.2-RELEASE][admin@pfSense.arda]/etc/inc: grep -R /test *
                        unbound.inc:	$cfgsubdir = "/test";
                        [2.3.2-RELEASE][admin@pfSense.arda]/etc/inc: 
                        
                        

                        content of /etc/inc/unbound.inc

                        function test_unbound_config($unboundcfg, &$output) {
                                global $g;
                        
                                $cfgsubdir = "/test";
                                unbound_generate_config($unboundcfg, $cfgsubdir);
                                unbound_remote_control_setup($cfgsubdir);
                                do_as_unbound_user("unbound-anchor", $cfgsubdir);
                        
                                $cfgdir = "{$g['unbound_chroot_path']}{$cfgsubdir}";
                        
                                $rv = 0;
                                exec("/usr/local/sbin/unbound-checkconf {$cfgdir}/unbound.conf 2>&1", $output, $rv);
                                rmdir_recursive($cfgdir);
                        
                                return $rv;
                        }
                        
                        
                        1 Reply Last reply Reply Quote 0
                        • D
                          doktornotor Banned last edited by

                          Just disable DNSSEC if you cannot get it working. Are you using some kind of RAM disks or nanobsd?

                          1 Reply Last reply Reply Quote 0
                          • F
                            Fabio72 last edited by

                            I cannot disable DNSSEC for the same error. I'm using the full 64bit release without ramdisk.
                            DNS resolver works but I cannot make any change. Reload works.

                            1 Reply Last reply Reply Quote 0
                            • D
                              doktornotor Banned last edited by

                              Have you tried to reboot as suggested above? Also, no idea why did you use this thread since you definitely do NOT have the same error.

                              Anyway.

                              
                              mkdir /var/unbound/test/
                              cp -ax /var/unbound/*.{key,pem} /var/unbound/test/
                              
                              

                              and try again.

                              1 Reply Last reply Reply Quote 0
                              • F
                                Fabio72 last edited by

                                Works only once: every time  /var/unbound/test/ is deleted and I have to create again before saving settings

                                1 Reply Last reply Reply Quote 0
                                • D
                                  doktornotor Banned last edited by

                                  No idea what kind of legacy configuration crap have you imported on all of your boxes across some upgrades, sorry. You can try with 2.3.3 but I sincerely doubt it'd change anything. Other that that

                                  • wipe /var/unbound altogether
                                  • switch to DNS forwarder
                                  • make a config backup, wipe everything between <unbound>…</unbound> tags, restore the config (will force a reboot)
                                  • reconfigure the resolver from from scratch
                                  1 Reply Last reply Reply Quote 0
                                  • V
                                    voxeljorz last edited by

                                    @Fabio72:

                                    Works only once: every time  /var/unbound/test/ is deleted and I have to create again before saving settings

                                    Same here too.

                                    _The following input errors were detected:

                                    The generated config file cannot be parsed by unbound. Please correct the following errors:
                                        /var/unbound/test/unbound_server.key: No such file or directory
                                        [1484738643] unbound-checkconf[70766:0] fatal error: server-key-file: "/var/unbound/test/unbound_server.key" does not exist_

                                    I have to execute this everytime there are changes to be made:
                                    _  mkdir /var/unbound/test/
                                      cp -ax /var/unbound/*.{key,pem} /var/unbound/test/_

                                    I am also getting this error on DNS Resolver log: (a lot of them)
                                      notice: remote address is 192.168.2.245 port 53134
                                      notice: sendmsg failed: No buffer space available

                                    1 Reply Last reply Reply Quote 0
                                    • johnpoz
                                      johnpoz LAYER 8 Global Moderator last edited by

                                      Not sure where this /test dir is coming from.. I look on my /var/unbound dir and I don't see any test dir..

                                      I can change my unbound conf without any issues.

                                      Are you running 2.3.3 or 2.4 of pfsense??


                                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                                      If you get confused: Listen to the Music Play
                                      Please don't Chat/PM me for help, unless mod related
                                      2440 2.4.5p1 | 2x 3100 2.4.4p3 | 2x 3100 22.01 | 4860 22.05

                                      1 Reply Last reply Reply Quote 0
                                      • V
                                        voxeljorz last edited by

                                        I am currently using 2.3.2-RELEASE-p1

                                        1 Reply Last reply Reply Quote 0
                                        • johnpoz
                                          johnpoz LAYER 8 Global Moderator last edited by

                                          So from the code it looks like that sub dir is created but then removed after the test

                                          
                                          function test_unbound_config($unboundcfg, &$output) {
                                          	global $g;
                                          	$cfgsubdir = "/test";
                                          	unbound_generate_config($unboundcfg, $cfgsubdir);
                                          	unbound_remote_control_setup($cfgsubdir);
                                          	do_as_unbound_user("unbound-anchor", $cfgsubdir);
                                          	$cfgdir = "{$g['unbound_chroot_path']}{$cfgsubdir}";
                                          	$rv = 0;
                                          	exec("/usr/local/sbin/unbound-checkconf {$cfgdir}/unbound.conf 2>&1", $output, $rv);
                                          	rmdir_recursive($cfgdir);
                                          	return $rv;
                                          }
                                          
                                          

                                          rmdir_recursive($cfgdir);

                                          So something is failing here?  Just not sure what..

                                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                                          If you get confused: Listen to the Music Play
                                          Please don't Chat/PM me for help, unless mod related
                                          2440 2.4.5p1 | 2x 3100 2.4.4p3 | 2x 3100 22.01 | 4860 22.05

                                          1 Reply Last reply Reply Quote 0
                                          • Veldkornet
                                            Veldkornet last edited by

                                            I'm also having this problem. Setup pfSense from scratch on 2.3.3_p1.

                                            The below does indeed work once off, so I need to run it every time I change the configuration.

                                            mkdir /var/unbound/test/
                                            cp -ax /var/unbound/*.{key,pem} /var/unbound/test/
                                            

                                            Is there a bug logged for it already?

                                            1 Reply Last reply Reply Quote 0
                                            • F
                                              Fabio72 last edited by

                                              For me the problem is gone away and I did nothing (neither reboot).
                                              After updating to 2.3.3-p1 everything is still working.

                                              But now is happening again on another site with a fresh new installation of a 2.3.3-p1  ???

                                              1 Reply Last reply Reply Quote 0
                                              • F
                                                Fabio72 last edited by

                                                Ok, now I have the problem again.
                                                Sometimes happens and usually a reboot fixes it.

                                                1 Reply Last reply Reply Quote 0
                                                • M
                                                  matsan last edited by

                                                  Just want to chime in here. Starting to see this on my pfsense running 2.3.3-RELEASE-p1 (amd64)
                                                  Configuration created from scratch so no "old crap" should be there. The workaround with mkdir and cp works.
                                                  Reboot doesn't solve this.

                                                  1 Reply Last reply Reply Quote 0
                                                  • M
                                                    maguilu last edited by

                                                    So to Recap:

                                                    • Reboots - DO NOT WORK

                                                    • mkdir Test and cp config - Works once per saved change

                                                    • move to forwarder, wipe unbound directory and return to resolver - ? ? ? ? ?

                                                      Anymore suggestions

                                                      This is the message I get when making any changes

                                                      The following input errors were detected:
                                                      The generated config file cannot be parsed by unbound. Please correct the following errors:
                                                      /var/unbound/test/root.key: No such file or directory
                                                      [1494245590] unbound-checkconf[4967:0] fatal error: auto-trust-anchor-file: "/var/unbound/test/root.key" does not exist in chrootdir /var/unbound
                                                      

                                                      I am running:

                                                      2.3.4-RELEASE (amd64) 
                                                      built on Wed May 03 15:13:29 CDT 2017 
                                                      FreeBSD 10.3-RELEASE-p19 
                                                      
                                                      The system is on the latest version.
                                                      

                                                      HELP!!!

                                                    1 Reply Last reply Reply Quote 0
                                                    • M
                                                      maguilu last edited by

                                                      Let me add to my previous, DNS is resolving all local addresses and appears to be working correctly.
                                                      But even if I attempt to make changes directly to the dhcp.conf, hostentries.conf or dhcpleases_entries.conf the changes to not persist after a process restart.

                                                      So this unbound config validator issue I more spread than I thought and more annoying than willing to deal with.

                                                      1 Reply Last reply Reply Quote 0
                                                      • C
                                                        chris4916 last edited by

                                                        I'm facing this problem too, although not been able to clearly determine when and what triggers this.
                                                        Depending on DNS configuration (but what?), I get this same error message.
                                                        As far as I remember, occurred with all 2.3.x version (currently running 2.3.4)

                                                        I'm also facing problem with, if I'm not wrong, DNS stopping from time to time when DHCP registration is activated.

                                                        Weird  :(

                                                        Jah Olela Wembo: Les mots se muent en maux quand ils indisposent, agressent ou blessent.

                                                        1 Reply Last reply Reply Quote 0
                                                        • C
                                                          CuteBoi last edited by

                                                          Created redmine ticket:

                                                          https://redmine.pfsense.org/issues/7600

                                                          Running this command lets me do it before each save:

                                                          echo 'mkdir /var/unbound/test; /usr/local/sbin/unbound-control-setup -d /var/unbound/test' | /usr/bin/su -m unbound
                                                          
                                                          1 Reply Last reply Reply Quote 0
                                                          • jimp
                                                            jimp Rebel Alliance Developer Netgate last edited by

                                                            This is not a general problem that happens out of the box or with anything I have readily available. Something specific to your setups is causing this, but it's not clear yet what that is.

                                                            There must be some missing detail to reliably replicate it. Please compare other system settings and setup details, like what platform/architecture is in use (e.g. NanoBSD or full), if you have /var and /tmp in RAM disks, and anything else about the setup that might be different or unusual, especially any packages you have installed.

                                                            Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

                                                            Need help fast? Netgate Global Support!

                                                            Do not Chat/PM for help!

                                                            1 Reply Last reply Reply Quote 0
                                                            • N
                                                              n3by last edited by

                                                              I remember few days ago after clean install of 2.3.4, and right after I restored 2.3.2 config, unbound was down and did not wanted to start up until I deleted the line added by pfblocker…```
                                                              server:include: /var/unbound/pfb_dnsbl.conf

                                                              
                                                              Today I found unbound dead… and I blame wan lose connection that also triggered unbound death.
                                                              https://forum.pfsense.org/index.php?topic=131242.msg723850#msg723850
                                                              1 Reply Last reply Reply Quote 0
                                                              • Y
                                                                yarick123 last edited by

                                                                I have also just faced this problem on my 2.3.5-RELEASE-p1 (i386) nanobsd (2g). Interesting is, that adding Host Overrides does not trigger the problem, although it changes and saves DNS Resolver configuration.

                                                                1 Reply Last reply Reply Quote 0
                                                                • S
                                                                  shlazzer last edited by

                                                                  Just ran into this on 2.3.4-RELEASE (amd64)

                                                                  Haven't had a chance to try any of the suggestions earlier in the thread, but this is a relatively new box that hasn't been around long enough to have legacy configs. Has always been on a 2.3.x release.

                                                                  A confirmed solution would be really helpful.

                                                                  1 Reply Last reply Reply Quote 0
                                                                  • Y
                                                                    yarick123 last edited by

                                                                    @Veldkornet:

                                                                    …
                                                                    The below does indeed work once off, so I need to run it every time I change the configuration.

                                                                    mkdir /var/unbound/test/
                                                                    cp -ax /var/unbound/*.{key,pem} /var/unbound/test/
                                                                    

                                                                    Is there a bug logged for it already?

                                                                    works for me.

                                                                    1 Reply Last reply Reply Quote 0
                                                                    • C
                                                                      compdoc last edited by

                                                                      This just happened to me, although my error was "/var/unbound/test/root.key" does not exist. I tried creating the test directory and copying the root.key there, but there was no change. I still couldn't save the settings for DNS Resolver.

                                                                      However, I seemed to fix it by running the command: unbound-control-setup

                                                                      I'd be interested to hear if this helped anyone else.

                                                                      1 Reply Last reply Reply Quote 0
                                                                      • Gertjan
                                                                        Gertjan last edited by

                                                                        This issue is known, as the thread implies.
                                                                        But 2.3.5 is old and fading out : 32 hardware is hard to find these days - some devices are kept artificially alive, mostly in museums.
                                                                        Consider the issue as closed.

                                                                        No "help me" PM's please. Use the forum.

                                                                        C 1 Reply Last reply Reply Quote 0
                                                                        • C
                                                                          compdoc @Gertjan last edited by

                                                                          I am running 64 bit, 2.4.4-RELEASE-p1

                                                                          1 Reply Last reply Reply Quote 0
                                                                          • Gertjan
                                                                            Gertjan last edited by

                                                                            In that case, the issue is totally new - not related to what happened as described 2 years ago - with old pfSense versions.

                                                                            Maybe some left-overs from an ancient install ?
                                                                            Did you install 2.4.4-P1 from scratch, or did you upgrade from an older version ?

                                                                            No "help me" PM's please. Use the forum.

                                                                            1 Reply Last reply Reply Quote 0
                                                                            • Z
                                                                              zimt last edited by

                                                                              very same issue here, brand new hardware, latest version 2.4.4 from scratch, no import of former config

                                                                              1 Reply Last reply Reply Quote 0
                                                                              • johnpoz
                                                                                johnpoz LAYER 8 Global Moderator last edited by

                                                                                Same issue? From a thread from 2 years ago... Please post your exact error your seeing.. What else your running other than clean out of the box pfsense.

                                                                                An intelligent man is sometimes forced to be drunk to spend time with his fools
                                                                                If you get confused: Listen to the Music Play
                                                                                Please don't Chat/PM me for help, unless mod related
                                                                                2440 2.4.5p1 | 2x 3100 2.4.4p3 | 2x 3100 22.01 | 4860 22.05

                                                                                1 Reply Last reply Reply Quote 0
                                                                                • Z
                                                                                  zimt last edited by

                                                                                  When I try to change any settings in unbound I get this error message, can't even disable it :

                                                                                  The following input errors were detected:
                                                                                  The generated config file cannot be parsed by unbound. Please correct the following errors:
                                                                                  /var/unbound/test/root.key: No such file or directory
                                                                                  [1550262886] unbound-checkconf[60539:0] fatal error: auto-trust-anchor-file: "/var/unbound/test/root.key" does not exist in chrootdir /var/unbound
                                                                                  

                                                                                  My install worked fine for maybe two weeks, this issue just appeared. Not sure what this is related to.
                                                                                  I did disable pfb_dnsbl and pfb_filter but that didn't solve the issue. Also all the other tricks mentioned in this thread didn't work for me. Didn't try to reboot yet, hopefully tonight...

                                                                                  Here are all the services running:

                                                                                  Service 	Description 	
                                                                                  avahi 	Avahi mDNS/DNS-SD daemon 	
                                                                                  dhcpd 	DHCP Service 	
                                                                                  dpinger 	Gateway Monitoring Daemon 	
                                                                                  ntopng 	ntopng Network Traffic Monitor 	
                                                                                  ntpd 	NTP clock sync 	
                                                                                  openvpn 	OpenVPN server: home 	
                                                                                  pfb_dnsbl 	pfBlockerNG DNSBL service 	
                                                                                  pfb_filter 	pfBlockerNG firewall filter service 	
                                                                                  radvd 	Router Advertisement Daemon 	
                                                                                  snort 	Snort IDS/IPS Daemon 	
                                                                                  sshd 	Secure Shell Daemon 	
                                                                                  syslogd 	System Logger Daemon 	
                                                                                  telegraf 	Telegraf daemon 	
                                                                                  unbound 	DNS Resolver
                                                                                  
                                                                                  BBcan177 1 Reply Last reply Reply Quote 0
                                                                                  • johnpoz
                                                                                    johnpoz LAYER 8 Global Moderator last edited by johnpoz

                                                                                    @zimt said in DNS Resolver (unbound) / Can't change config:

                                                                                    I did disable pfb_dnsbl and pfb_filter

                                                                                    So its not a clean install, you have atleast that package installed. What else? I see avahi, ntop, snort --> So clearly its not related to a problem from 2 years ago.

                                                                                    I would suggest you open a thread in the pfblocker section and yell for @BBcan177 because more likely then not its related to your unbound problem.

                                                                                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                                                                                    If you get confused: Listen to the Music Play
                                                                                    Please don't Chat/PM me for help, unless mod related
                                                                                    2440 2.4.5p1 | 2x 3100 2.4.4p3 | 2x 3100 22.01 | 4860 22.05

                                                                                    1 Reply Last reply Reply Quote 0
                                                                                    • First post
                                                                                      Last post