DNS Resolve Domain Overrides do not work after pfsense restart



  • So every single time I reboot my pfsense boxes (I have two and they are connected via a site-to-site openvpn connection with domain overrides setup with each other), the domain overrides stop working until I manually restart the DNS resolver service. Is this possibly because the DNS resolver boots up almost always first than when the openvpn client-server connection is established? That's the only I can think of but I highly doubt that's the case. But yeah, it's easily reproducible and I think is a bug.

    What do you guys think?



  • Nobody? :(


  • LAYER 8 Global Moderator

    Well if your trying to bind to an interface (your vpn connection) and this interface does not exist or is not up yet... How would unbound bind to it?

    Not sure how that would be considered a bug?

    How do you have unbound setup.. Are selecting all interfaces? Specific interfaces for listen/outgoing?



  • @johnpoz said in DNS Resolve Domain Overrides do not work after pfsense restart:

    Well if your trying to bind to an interface (your vpn connection) and this interface does not exist or is not up yet... How would unbound bind to it?

    Not sure how that would be considered a bug?

    I understand that part but when the VPN connection is already up, why do I need to restart unbound so that it can bind to it? Why can't it bind automatically when the interface becomes up just like what it does with the local interfaces?

    How do you have unbound setup.. Are selecting all interfaces? Specific interfaces for listen/outgoing?

    Unbound listens on these interfaces:
    OPENVPN ipv4/ipv6
    1 LAN interface ipv4/ipv6
    3 VLAN sub-interfaces ipv4/ipv6
    Localhost

    And outgoing:
    WAN ipv4/ipv6
    OPENVPN ipv4/ipv6


  • LAYER 8 Global Moderator

    No it can not just restart on its own if it failed to bind... What does the log say.. It will tell you what it binds to when it starts...

    Try ALL, vs specific - does that fix your issue?



  • @johnpoz said in DNS Resolve Domain Overrides do not work after pfsense restart:

    No it can not just restart on its own if it failed to bind... What does the log say.. It will tell you what it binds to when it starts...

    Try ALL, vs specific - does that fix your issue?

    I see. Can you put set unbound to be dependent on the openvpn connection before trying to bind to it? Or maybe put a delay? I'm sure I'm not the first who has this problem, right?

    I don't want unbound to listen on the WAN interface and I also don't want it to use the other LAN interfaces to query for requests. How would specifying ALL fix the issue though?


  • LAYER 8 Global Moderator

    Just because it listens doesn't mean its reachable - you would have to allow for access via a firewall rule.

    It's possible users have not run into this because the default is ALL, so how unbound does it binding in that fashion "could" allow for additional interfaces to be used as they come online..

    I would suggest it for atleast test of your scenario. But sure you could create a script to restart unbound after your interface has had enough time to come online.



  • @johnpoz said in DNS Resolve Domain Overrides do not work after pfsense restart:

    Just because it listens doesn't mean its reachable - you would have to allow for access via a firewall rule.

    It's possible users have not run into this because the default is ALL, so how unbound does it binding in that fashion "could" allow for additional interfaces to be used as they come online..

    I would suggest it for atleast test of your scenario. But sure you could create a script to restart unbound after your interface has had enough time to come online.

    I see. So only the network interfaces should be set to all, correct? The outgoing interfaces can remain as they are?


  • LAYER 8 Global Moderator

    Yeah try that and see if it fixes your problem - since your problem is that "clients" can not query you on your vpn interface.

    Other solution could be to use the unbound normal interface IP as your dns... say the lan side IP vs the vpn interface IP.

    edit... Oh wait this is unbound trying to query down the vpn connection as outgoing to hit your domain override right.. Set your outgoing to localhost and remove the vpn.... It should just be able to route then normally..

    I have my outgoing interface as localhost, and unbound works just fine..



  • @johnpoz said in DNS Resolve Domain Overrides do not work after pfsense restart:

    Yeah try that and see if it fixes your problem - since your problem is that "clients" can not query you on your vpn interface.

    Other solution could be to use the unbound normal interface IP as your dns... say the lan side IP vs the vpn interface IP.

    edit... Oh wait this is unbound trying to query down the vpn connection as outgoing to hit your domain override right.. Set your outgoing to localhost and remove the vpn.... It should just be able to route then normally..

    I have my outgoing interface as localhost, and unbound works just fine..

    Ok, I just did your suggestion and I guess I would need to monitor if I'll still encounter the issue. But I don't understand though, isn't the VPN connection supposed to be an outgoing interface because the domain override on one side is using the VPN interface IP of the other side "through that VPN connection"? Same reason why you need the WAN connection as an outgoing interface, right?

    EDIT: Removing the VPN connection as outgoing totally made the domain override not work, as I've expected. I had to put it back and kept the localhost as outgoing too but I can't get my head around as to why you need localhost to be an outgoing interface.


  • LAYER 8 Global Moderator

    if you use localhost as outgoing it will be natted to interface it uses to get to where your going..

    What IP do you have set in your domain override... What is the dest... I can for sure fire this up as sim on a couple of VM pfsenses..

    Does yoru domain override point to the pfsense on the other side IP or dns internal to the other site?

    Don't point your override to vpn IP, it should just be say your pfsense lan IP on the other end.



  • @johnpoz said in DNS Resolve Domain Overrides do not work after pfsense restart:

    if you use localhost as outgoing it will be natted to interface it uses to get to where your going..

    So then that goes without saying that you also don't need to specify the WAN as an outgoing interface for unbound as long as you have localhost because pfsense will know how to route the DNS request properly out of the correct interface based on the routing table? And is it generally a good idea to include localhost to the outgoing interface?

    What IP do you have set in your domain override... What is the dest... I can for sure fire this up as sim on a couple of VM pfsenses..

    Does yoru domain override point to the pfsense on the other side IP or dns internal to the other site?

    Don't point your override to vpn IP, it should just be say your pfsense lan IP on the other end.

    Correct, my domain override is pointing to the vpn interface on the other side of the tunnel. But yes, I can easily change it to the pfsense LAN IP. How is this different though? The VPN IP and the LAN IP on the other side will approximately be up at the same time anyway (when the tunnel is up)?



  • @johnpoz

    Did you have time to check on this?


  • LAYER 8 Global Moderator

    Oh dude my bad... I forgot all about this thread.. I should have some time today and hope to sim this.

    Dont point to the vpn IP... and yeah you should use local host as your outgoing.



  • @johnpoz said in DNS Resolve Domain Overrides do not work after pfsense restart:

    Oh dude my bad... I forgot all about this thread.. I should have some time today and hope to sim this.

    Dont point to the vpn IP... and yeah you should use local host as your outgoing.

    No worries, I figured to just follow-up :)

    What's the difference between using the VPN IP vs. the LAN IP though?

    And if I use localhost as the sole outgoing interface, does that mean I can remove the WAN interface from the list as well? What's the advantage of using localhost?


  • LAYER 8 Global Moderator

    If you just use localhost, then it will nat to the interface it needs to use to get somewhere... Be it your wan IP to talk to public servers.. Or your vpn interface IP to talk down your vpn..

    On the listening end, if when unbound starts and the vpn is not up - how could it bind to that IP? It might work with any.. But why point to the vpn IP as destination in your domain overide... This IP could change, and your route doesn't point to vpn tunnel network, it points to the remote lan network, etc.

    If you do these 2 things you shouldn't have any issues - as long as the tunnel is actually up when you try and query.



  • @johnpoz said in DNS Resolve Domain Overrides do not work after pfsense restart:

    If you just use localhost, then it will nat to the interface it needs to use to get somewhere... Be it your wan IP to talk to public servers.. Or your vpn interface IP to talk down your vpn..

    And when unbound nats to the interface it needs to use, that's a good thing? Why not use the interfaces directly? Sorry, I'm still not getting the point. I mean I know both of these work but I'm curious about the differences.

    On the listening end, if when unbound starts and the vpn is not up - how could it bind to that IP? It might work with any.. But why point to the vpn IP as destination in your domain overide... This IP could change, and your route doesn't point to vpn tunnel network, it points to the remote lan network, etc.

    If you do these 2 things you shouldn't have any issues - as long as the tunnel is actually up when you try and query.

    Right but won't it be the same thing? When unbound starts and vpn is not up, then how can it bind to the lan IP on the other side of the tunnel too? If you think of it, the vpn IP will always go up first compared to the lan IP on the other side of the tunnel.

    Also, my site-to-site vpn IP network uses static IP's so those won't change.


  • LAYER 8 Global Moderator

    dude if you tell unbound to use interface X, and interface X is not UP when unbound starts - then you have issue... If you tell unbound to use loopback.. Which is going to be UP!! then doesn't matter if the other interface goes up down, up down, etc.. As long as its up - you will be able to use it for outbound query.

    Same thing for when unbound starts... The LAN IP should always be up.. .But will your site2site be up when unbound starts and wants to bind to your vpn IP??

    You don't bind to a remote IP..

    edit: Ok got baseline setup sim your setup.
    started.png

    So I will fire up a s2s vpn between these 2 vms (2.4.4p2) over their wan networks (192.168.3/24) and then create domain overrides pointing to the other domain sitea or b, and create some records in there and validate the can be queried after reboot of them, etc.

    But I will use what I think is correct way to do this and that is use localhost for outbound, and override pointing to the lan IP in my test setup that would be 192.168.9.65 for sitea, and 2.65 for site b.

    edit2: ok up and running
    using this guide
    https://docs.netgate.com/pfsense/en/latest/book/openvpn/site-to-site-example-configuration-shared-key.html
    vpnup.png



  • I'm having this issue as well; though no domain overwrite. Just a simple OpenVPN connection; I need the interface for some firewall rules.

    I was able to test choosing different interfaces, including all, specific and localhost.

    Basically to get mine working after a reboot; (restarting the service doesn't appear to work) I have to assign the default gateway to WAN and then back to OPENVPN interface


  • LAYER 8 Global Moderator

    @burny02 said in DNS Resolve Domain Overrides do not work after pfsense restart:

    ult gateway to WAN and then back to OPENVPN

    That is has ZERO to do with this sort of setup... Your default gateway should NEVER be your openvpn interface..

    Please create your own thread with your own details of what you think is a problem... Using some vpn service has nothing to do with a site2site setup and dns overrides.

    I have to run for work -- but using localhost doesn't seem to work for going down the vpn... But if set it to all it works... When set it to localhost get servfail...

    $ dig @192.168.9.65 test.siteb.lan
    
    ; <<>> DiG 9.14.1 <<>> @192.168.9.65 test.siteb.lan
    ; (1 server found)
    ;; global options: +cmd
    ;; Got answer:
    ;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 49807
    ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1
    
    ;; OPT PSEUDOSECTION:
    ; EDNS: version: 0, flags:; udp: 4096
    ;; QUESTION SECTION:
    ;test.siteb.lan.                        IN      A
    
    ;; Query time: 2 msec
    ;; SERVER: 192.168.9.65#53(192.168.9.65)
    ;; WHEN: Mon Apr 29 09:06:17 Central Daylight Time 2019
    ;; MSG SIZE  rcvd: 43
    

    But if set to any as outgoing then works..

    $ dig @192.168.9.65 test.siteb.lan                                     
                                                                           
    ; <<>> DiG 9.14.1 <<>> @192.168.9.65 test.siteb.lan                    
    ; (1 server found)                                                     
    ;; global options: +cmd                                                
    ;; Got answer:                                                         
    ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 31728              
    ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1   
                                                                           
    ;; OPT PSEUDOSECTION:                                                  
    ; EDNS: version: 0, flags:; udp: 4096                                  
    ;; QUESTION SECTION:                                                   
    ;test.siteb.lan.                        IN      A                      
                                                                           
    ;; ANSWER SECTION:                                                     
    test.siteb.lan.         3600    IN      A       192.168.2.222          
                                                                           
    ;; Query time: 5 msec                                                  
    ;; SERVER: 192.168.9.65#53(192.168.9.65)                               
    ;; WHEN: Mon Apr 29 09:05:06 Central Daylight Time 2019                
    ;; MSG SIZE  rcvd: 59                                                  
    

    But now that have this test best setup... Can see what is going on... And figure out best configuration for this...

    Did you actually create an interface for your openvpn? The guide I linked does have you assign and interface to your openvpn s2s..



  • @johnpoz said in DNS Resolve Domain Overrides do not work after pfsense restart:

    dude if you tell unbound to use interface X, and interface X is not UP when unbound starts - then you have issue... If you tell unbound to use loopback.. Which is going to be UP!! then doesn't matter if the other interface goes up down, up down, etc.. As long as its up - you will be able to use it for outbound query.

    Ok, this makes sense.

    Same thing for when unbound starts... The LAN IP should always be up.. .But will your site2site be up when unbound starts and wants to bind to your vpn IP??

    You don't bind to a remote IP..

    I thought you wanted me to point my override to the "LAN IP on the other side of the tunnel" which is also a remote IP? So in your setup, you point the siteA override to 192.168.2.65 and siteB override to 192.168.9.65. So how will those LAN IP "be always up" if they're remote IP's when unbound starts? Sorry if I misunderstood anything you've said but this is what I thought you meant.

    edit: Ok got baseline setup sim your setup.
    started.png

    So I will fire up a s2s vpn between these 2 vms (2.4.4p2) over their wan networks (192.168.3/24) and then create domain overrides pointing to the other domain sitea or b, and create some records in there and validate the can be queried after reboot of them, etc.

    But I will use what I think is correct way to do this and that is use localhost for outbound, and override pointing to the lan IP in my test setup that would be 192.168.9.65 for sitea, and 2.65 for site b.

    edit2: ok up and running
    using this guide
    https://docs.netgate.com/pfsense/en/latest/book/openvpn/site-to-site-example-configuration-shared-key.html
    vpnup.png

    Thanks for setting this up to get to the bottom of this. I really appreciate it!

    @johnpoz said in DNS Resolve Domain Overrides do not work after pfsense restart:

    @burny02 said in DNS Resolve Domain Overrides do not work after pfsense restart:

    ult gateway to WAN and then back to OPENVPN

    That is has ZERO to do with this sort of setup... Your default gateway should NEVER be your openvpn interface..

    Please create your own thread with your own details of what you think is a problem... Using some vpn service has nothing to do with a site2site setup and dns overrides.

    I have to run for work -- but using localhost doesn't seem to work for going down the vpn... But if set it to all it works... When set it to localhost get servfail...

    $ dig @192.168.9.65 test.siteb.lan
    
    ; <<>> DiG 9.14.1 <<>> @192.168.9.65 test.siteb.lan
    ; (1 server found)
    ;; global options: +cmd
    ;; Got answer:
    ;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 49807
    ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1
    
    ;; OPT PSEUDOSECTION:
    ; EDNS: version: 0, flags:; udp: 4096
    ;; QUESTION SECTION:
    ;test.siteb.lan.                        IN      A
    
    ;; Query time: 2 msec
    ;; SERVER: 192.168.9.65#53(192.168.9.65)
    ;; WHEN: Mon Apr 29 09:06:17 Central Daylight Time 2019
    ;; MSG SIZE  rcvd: 43
    

    But if set to any as outgoing then works..

    $ dig @192.168.9.65 test.siteb.lan                                     
                                                                           
    ; <<>> DiG 9.14.1 <<>> @192.168.9.65 test.siteb.lan                    
    ; (1 server found)                                                     
    ;; global options: +cmd                                                
    ;; Got answer:                                                         
    ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 31728              
    ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1   
                                                                           
    ;; OPT PSEUDOSECTION:                                                  
    ; EDNS: version: 0, flags:; udp: 4096                                  
    ;; QUESTION SECTION:                                                   
    ;test.siteb.lan.                        IN      A                      
                                                                           
    ;; ANSWER SECTION:                                                     
    test.siteb.lan.         3600    IN      A       192.168.2.222          
                                                                           
    ;; Query time: 5 msec                                                  
    ;; SERVER: 192.168.9.65#53(192.168.9.65)                               
    ;; WHEN: Mon Apr 29 09:05:06 Central Daylight Time 2019                
    ;; MSG SIZE  rcvd: 59                                                  
    

    But now that have this test best setup... Can see what is going on... And figure out best configuration for this...

    Did you actually create an interface for your openvpn? The guide I linked does have you assign and interface to your openvpn s2s..

    So for now, do you recommend setting outgoing interface to All?

    Yes, I did create an interface for my s2s VPN so that I can assign a gateway for it in case I need to route special traffic to one site or the other. The guide you've linked to does not instruct us to add an openvpn interface. It tells you to create a rule in the OpenVPN tab that is created automatically when you establish the s2s openvpn connection. What I'm saying is to explicitly add the openvpn interface as an opt interface in Interfaces -> Assignments so you will end up with this in the Rules tab:

    56d74df1-7458-4c6b-a693-a0fd4d7db742-image.png

    The OpenVPN tab there is the one that gets automatically created. The OPENVPN tab is the one I manually add under Interfaces so that I can use it as a gateway. This is a common setup with s2s openvpn in pfsense.


  • LAYER 8 Global Moderator

    Why would you need/want to policy route something down your s2s connection... If the remote networks at either site change, then you would just update your vpn setup to reflect the netblocks at each site, etc.

    When I get some free time again I will look to why it wasn't working with localhost as outgoing for down the tunnel.. My guess is something is not being natted in that case..

    I had not had chance to reboot anything or take the vpnoffline, etc. But I got the queries working using all as outgoing..

    But all should work for the outgoing.. even during a reboot or bounce in the vpn, etc... But your override should point IP on the other end of the tunnel, not the actual tunnel IP or tunnel interface IP, etc.

    When you create this actual interface, ie your OPT.. your not giving it an IP are you?

    edit:
    yeah just a nat thing... So changed over to hybrid nat, created a outbound for 127/8 to use the openvpn interface... I never assigned this to opt..

    And working now just using localhost as outgoing interface, where listen is only lan and localhost on both pf boxes.

    Apr 29 10:37:12 	unbound 	51768:0 	info: 10.3.100.1 test.siteb.lan. A IN
    Apr 29 10:37:12 	unbound 	51768:0 	info: 10.3.100.1 test.siteb.lan. A IN NOERROR 0.000000 1 59 
    

    I setup logging on siteb, and see that my query came from the tunnel IP of pf1

    so let me reboot these vms, and should just be up and working as soon as they finish booting.

    edit2: Yup working just fine... rebooted both of them...

    $ dig @192.168.9.65 test.siteb.lan
    
    ; <<>> DiG 9.14.1 <<>> @192.168.9.65 test.siteb.lan
    ; (1 server found)
    ;; global options: +cmd
    ;; Got answer:
    ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 2172
    ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
    
    ;; OPT PSEUDOSECTION:
    ; EDNS: version: 0, flags:; udp: 4096
    ;; QUESTION SECTION:
    ;test.siteb.lan.                        IN      A
    
    ;; ANSWER SECTION:
    test.siteb.lan.         3600    IN      A       192.168.2.222
    
    ;; Query time: 3 msec
    ;; SERVER: 192.168.9.65#53(192.168.9.65)
    ;; WHEN: Mon Apr 29 10:44:16 Central Daylight Time 2019
    ;; MSG SIZE  rcvd: 59
    

    So that would be how I would suggest you set it up... Since now unbound is never going to have to bind to anything to use it for query or listen on a vpn interface that may or may not be up when unbound starts or restarts.

    Here is outbound nat example.

    outboundnat.png

    So as long as your vpn is up.. And unbound is running on both sides you should be fine to resolve the remote domain.



  • @johnpoz said in DNS Resolve Domain Overrides do not work after pfsense restart:

    Why would you need/want to policy route something down your s2s connection... If the remote networks at either site change, then you would just update your vpn setup to reflect the netblocks at each site, etc.

    One of the reasons for this s2s openvpn is because one side of the tunnel has a public static WAN IP and the other is behind a CGNAT (dynamic private IP). So effectively, the network with the public static IP is acting as a proxy for incoming requests to whatever service I host on both networks. There are also special traffic that I need to route from the CGNAT network to the public IP network, hence I use policy routing.

    Again, my remote networks don't change. I use the 10.0.0.0/30 network for my tunnel.

    When I get some free time again I will look to why it wasn't working with localhost as outgoing for down the tunnel.. My guess is something is not being natted in that case..

    I had not had chance to reboot anything or take the vpnoffline, etc. But I got the queries working using all as outgoing..

    But all should work for the outgoing.. even during a reboot or bounce in the vpn, etc... But your override should point IP on the other end of the tunnel, not the actual tunnel IP or tunnel interface IP, etc.

    Right. But my question still stands. If you point your override to a lan IP that is on the other side of the tunnel (a remote IP), how will unbound bind to it if the vpn is not yet up? You said that unbpund should bind to an interface that is always up.

    When you create this actual interface, ie your OPT.. your not giving it an IP are you?

    No, I'm not and you can't anyway. A note is there saying:

    This interface type does not support manual address configuration on this page.

    edit:
    yeah just a nat thing... So changed over to hybrid nat, created a outbound for 127/8 to use the openvpn interface... I never assigned this to opt..

    Ok, this makes sense. I forgot about specifying an outbound nat rule for when the source IP is localhost and the packet exits through the openvpn interface.

    And working now just using localhost as outgoing interface, where listen is only lan and localhost on both pf boxes.

    Apr 29 10:37:12 	unbound 	51768:0 	info: 10.3.100.1 test.siteb.lan. A IN
    Apr 29 10:37:12 	unbound 	51768:0 	info: 10.3.100.1 test.siteb.lan. A IN NOERROR 0.000000 1 59 
    

    I setup logging on siteb, and see that my query came from the tunnel IP of pf1

    so let me reboot these vms, and should just be up and working as soon as they finish booting.

    Great!!


  • LAYER 8 Global Moderator

    @kevindd992002 said in DNS Resolve Domain Overrides do not work after pfsense restart:

    If you point your override to a lan IP that is on the other side of the tunnel (a remote IP), how will unbound bind to it if the vpn is not yet

    Your not Binding to anything.. its just the IP your pointing your domain override too...

    Its the other sides unbound that needs to bind to something to LISTEN on for queries.. when unbound starts up on that side B, and the vpn is not up... How does it bind to listen... But have to assume if pfsense is up and running that the LAN ip is up.. So then unbound can bind and listen to this interface..



  • @johnpoz said in DNS Resolve Domain Overrides do not work after pfsense restart:

    @kevindd992002 said in DNS Resolve Domain Overrides do not work after pfsense restart:

    If you point your override to a lan IP that is on the other side of the tunnel (a remote IP), how will unbound bind to it if the vpn is not yet

    Your not Binding to anything.. its just the IP your pointing your domain override too...

    Its the other sides unbound that needs to bind to something to LISTEN on for queries.. when unbound starts up on that side B, and the vpn is not up... How does it bind to listen... But have to assume if pfsense is up and running that the LAN ip is up.. So then unbound can bind and listen to this interface..

    Gotcha!! I understand what you mean now. Thanks.


  • LAYER 8 Global Moderator

    Ok think we can call this solved then ;) Going to leave my vms... I can use these to lab almost anything ;)

    Proof is in the pudding though.. Let us know how it works out after your next reboot..



  • So far so good until I noticed that the unbound service of one of my pfsense boxes is down, just this morning. I'm not really sure what happened but this is what I saw in the system logs:

    May 7 07:36:24 	unbound 	29511:0 	fatal error: Could not read config file: /unbound.conf. Maybe try unbound -dd, it stays on the commandline to see more errors, or unbound-checkconf
    

    Is there a reason for this?

    Also, there are a lot of restarts during normal unbound operation like so:

    ay 7 05:12:20 	unbound 	29511:0 	info: start of service (unbound 1.8.1).
    May 7 05:12:20 	unbound 	29511:0 	info: service stopped (unbound 1.8.1).
    May 7 05:12:20 	unbound 	29511:0 	info: server stats for thread 0: 0 queries, 0 answers from cache, 0 recursions, 0 prefetch, 0 rejected by ip ratelimiting
    May 7 05:12:20 	unbound 	29511:0 	info: server stats for thread 0: requestlist max 0 avg 0 exceeded 0 jostled 0
    May 7 05:12:20 	unbound 	29511:0 	info: server stats for thread 1: 0 queries, 0 answers from cache, 0 recursions, 0 prefetch, 0 rejected by ip ratelimiting
    May 7 05:12:20 	unbound 	29511:0 	info: server stats for thread 1: requestlist max 0 avg 0 exceeded 0 jostled 0
    May 7 05:12:20 	unbound 	29511:0 	info: server stats for thread 2: 0 queries, 0 answers from cache, 0 recursions, 0 prefetch, 0 rejected by ip ratelimiting
    May 7 05:12:20 	unbound 	29511:0 	info: server stats for thread 2: requestlist max 0 avg 0 exceeded 0 jostled 0
    May 7 05:12:20 	unbound 	29511:0 	info: server stats for thread 3: 0 queries, 0 answers from cache, 0 recursions, 0 prefetch, 0 rejected by ip ratelimiting
    May 7 05:12:20 	unbound 	29511:0 	info: server stats for thread 3: requestlist max 0 avg 0 exceeded 0 jostled 0
    May 7 05:12:20 	unbound 	29511:0 	notice: Restart of unbound 1.8.1.
    

    Is this also normal?


  • LAYER 8 Global Moderator

    Restart of unbound... Do you have it register dhcp? Do you have pfblocker?



  • @johnpoz

    Yes, I have these settings:

    33401b59-03cc-4e1a-83d6-103e0616fecb-image.png

    And no, I don't have pfblocker.


  • LAYER 8 Global Moderator

    well yes register dhcp will restart unbound.



  • @johnpoz said in DNS Resolve Domain Overrides do not work after pfsense restart:

    well yes register dhcp will restart unbound.

    Ok. Any ideas why the service stopped suddenly though? This is the first time, in many years, that I had unbound stopped without me doing anything.


  • LAYER 8 Global Moderator

    because there was a new dhcp lease/renew or a vpn client.. If you have it register clients (other than static) then yes unbound will be stopped and restarted now and then.

    If you don't want that to happen then don't have dhcp clients registered.. I don't really get why you need to do that - how many clients you have? Just setup reservations for those that you "need" to be able to resolve name of.



  • @johnpoz said in DNS Resolve Domain Overrides do not work after pfsense restart:

    because there was a new dhcp lease/renew or a vpn client.. If you have it register clients (other than static) then yes unbound will be stopped and restarted now and then.

    If you don't want that to happen then don't have dhcp clients registered.. I don't really get why you need to do that - how many clients you have? Just setup reservations for those that you "need" to be able to resolve name of.

    I understand but this time it stopped indefinitely (since this morning) until I went it and saw that the service is stopped. I've had those settings since a few years ago and never had the service stopped. I understand that it restarts if you have dhcp register enabled, but it shouldn't stay stopped.

    This is the error in question:

    May 7 07:36:24 	unbound 	29511:0 	fatal error: Could not read config file: /unbound.conf. Maybe try unbound -dd, it stays on the commandline to see more errors, or unbound-checkconf
    

    unbound-checkconf resulted to:

    unbound-checkconf: no errors in /usr/local/etc/unbound/unbound.conf


  • LAYER 8 Global Moderator

    @kevindd992002 said in DNS Resolve Domain Overrides do not work after pfsense restart:

    fatal error: Could not read config file: /unbound.conf.

    did you have pfblocker installed at one time? Where you playing with it?

    Your disk full? Disk errors?

    Did a vpn user vpn at that time? Maybe the command is wrong to restart it when that happens? If you see it happening more up your log level in unbound.



  • @johnpoz said in DNS Resolve Domain Overrides do not work after pfsense restart:

    @kevindd992002 said in DNS Resolve Domain Overrides do not work after pfsense restart:

    fatal error: Could not read config file: /unbound.conf.

    did you have pfblocker installed at one time? Where you playing with it?

    Your disk full? Disk errors?

    Did a vpn user vpn at that time? Maybe the command is wrong to restart it when that happens? If you see it happening more up your log level in unbound.

    No, never.

    I don't see my disk being full anytime soon:

    f9c3e3af-af5e-49c8-a37a-931b2fc1babb-image.png

    My VPN is only set for s2s VPN. Ok, hopefully this does not repeat.



  • It happened again today. I'm turning logging up to level 2, is that enough?

    Also, is there a way for pfsense to notify when a service goes down?



  • @johnpoz

    So I'm not sure if this issue was caused by my change of the Outgoing Network Interfaces to Localhost as per your suggestion but please check my issue stated here.

    I thought this was isolated to one of my Windows 10 machines so I posted in the tenforums website. But it looks like it's happening to two Win10 machines that I tested now. It's not always happening but it does frequently, mostly after restarts. Here are some tests I've done with both my machines and they have the same exact results:

    1dd0f89c-a082-4868-a8b1-d3c1b09f2f69-image.png

    42a680a0-2936-42b7-8ee6-494562268d5c-image.png

    One machine was after a restart and the other is after resuming from sleep.

    In example 1, I've ping'ed google and it already had a resolved IP (probably because of the machine's cache) but did not respond properly. In example 2, I wasn't able to resolve yahoo during the first ping but it did during the second ping, although it wasn't also responding. Both servers started to respond properly at the same time.

    Any ideas here? I could only think of pfsense causing this because it is experienced by more than one machine.


  • LAYER 8 Global Moderator

    @kevindd992002 said in DNS Resolve Domain Overrides do not work after pfsense restart:

    but it does frequently, mostly after restarts

    Looks more like just connectivity issue then dns related problem.

    In your first you have an ip but it just not get a response.. So where was the communication breakdown, did you ping even make it to pfsense, and that is where the ball got dropped, or did not even make it to pfsense..

    The 2nd one is odder since looks like you could not resolve, but then you did - so would seem to say you could talk to pfsense and get an answer to your dns query.. But then your pings take a while to get answered?

    Windows has always been know to have issues with coming out of standby and network connectivity, or even taking a while for the network stack to fully start.



  • @johnpoz said in DNS Resolve Domain Overrides do not work after pfsense restart:

    @kevindd992002 said in DNS Resolve Domain Overrides do not work after pfsense restart:

    but it does frequently, mostly after restarts

    Looks more like just connectivity issue then dns related problem.

    In your first you have an ip but it just not get a response.. So where was the communication breakdown, did you ping even make it to pfsense, and that is where the ball got dropped, or did not even make it to pfsense..

    The 2nd one is odder since looks like you could not resolve, but then you did - so would seem to say you could talk to pfsense and get an answer to your dns query.. But then your pings take a while to get answered?

    Windows has always been know to have issues with coming out of standby and network connectivity, or even taking a while for the network stack to fully start.

    I should've done a tracert to make sure. Well, before these two tests I did an nslookup which points to pfsense by default. And it also fails there, which made me think it's a DNS issue in the first place. But then the first test in the screenshot above doesn't really point to a DNS issue because if it was then I would get responses right away.


  • LAYER 8 Global Moderator

    But where did you get the IP from in your ping if after a "restart" there would be no cache at all.

    Are these clients wireless?


Log in to reply