• Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login
Netgate Discussion Forum
  • Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login

DNS Resolver and queries

Scheduled Pinned Locked Moved DHCP and DNS
unbounddnsproblems
11 Posts 2 Posters 2.0k Views
Loading More Posts
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • G
    Gertjan @fgalvan
    last edited by Apr 20, 2021, 7:08 AM

    Use the default DNS settings, as that works fine.

    You've added these :

    @fgalvan said in DNS Resolver and queries:

    212.166.132.104
    212.166.210.80

    so ... easy,
    a) as you do not need them, and
    b) you're in trouble now.

    I propose : remove them.

    Bonus : for even better performance, remove this check :

    8aa9d8e4-cfa1-41cd-a202-859e846c12a4-image.png

    No "help me" PM's please. Use the forum, the community will thank you.
    Edit : and where are the logs ??

    1 Reply Last reply Reply Quote 0
    • F
      fgalvan
      last edited by Apr 20, 2021, 7:32 AM

      I've testing it in all ways, by the way, right now no more Permission denied message in DNS Resolver logs. I think it was because I deleted all unbound folder (with shell) and pFsense create again.

      Sometime when a I lose the connection I do nslookup and I get a SERVFAIL from 127.0.0.1 and try next DNS server and its sometimes resolve and other I got a no response from DNS.

      Test:

      [2.4.5-RELEASE][admin@fw1.mondotvcanarias.lan]/root: nslookup 20minutos.es
      ;; Got SERVFAIL reply from 127.0.0.1, trying next server
      Server: 212.166.132.104
      Address: 212.166.132.104#53

      Non-authoritative answer:
      Name: 20minutos.es
      Address: 13.32.128.129
      Name: 20minutos.es
      Address: 13.32.128.5
      Name: 20minutos.es
      Address: 13.32.128.2
      Name: 20minutos.es
      Address: 13.32.128.43

      1 Reply Last reply Reply Quote 0
      • G
        Gertjan
        last edited by Gertjan Apr 20, 2021, 8:52 AM Apr 20, 2021, 8:48 AM

        @fgalvan said in DNS Resolver and queries:

        Sometime when a I lose the connection I do nslookup and I get a SERVFAIL from 127.0.0.1 and try next DNS server and its sometimes resolve and other I got a no response from DNS.

        That's why I gave you the Bonus.
        It's not much of an effort, and pays of right away.
        As many times discussed on the forum.

        The thing is : every time a DHCP lease treated or renew, unbound get 'restarted'.

        Check out the Resolver logs yourself : you'll find answers there of the question you're about to formulate (the answers nearly always always in the logs, that's why they exist).

        @fgalvan said in DNS Resolver and queries:

        ;; Got SERVFAIL reply from 127.0.0.1, trying next server

        That means that at the moment of the request, unbound wasn't running == serving port 53 on 127.0.0.1
        Is it running ?

        I mean, don't look at the GUI.
        Run

        ps ax | grep 'unbound'
        

        No "help me" PM's please. Use the forum, the community will thank you.
        Edit : and where are the logs ??

        F 1 Reply Last reply Apr 20, 2021, 9:23 AM Reply Quote 0
        • F
          fgalvan @Gertjan
          last edited by Apr 20, 2021, 9:23 AM

          @gertjan Done that you recommend me, even bonus, but now I'm getting the message:

          ** server can't find 20minutos.es: SERVFAIL

          and now it seems is not working anymore

          Thank you!!

          G 1 Reply Last reply Apr 20, 2021, 9:59 AM Reply Quote 0
          • G
            Gertjan @fgalvan
            last edited by Gertjan Apr 20, 2021, 10:09 AM Apr 20, 2021, 9:59 AM

            @fgalvan said in DNS Resolver and queries:

            and now it seems is not working anymore

            Why didn't you check ?

            @gertjan said in DNS Resolver and queries:

            I mean, don't look at the GUI.
            Run
            ps ax | grep 'unbound'

            Btw :
            Unchecking "Register DHCP leases in the DNS Resolver" just STOPS restarting unbound every xxxx seconds.

            Edit :
            You have pfSense packages installed ?
            I wait until you come back with replies, but it might be possible that unbound doesn't run at all, and if started, it fails.
            Can you show the unbound (== resolver) logs ?

            Just to be sure : goto default and set all these to All :

            e6a969e8-85c4-4058-a64b-a95f3f4b3fa2-image.png

            @fgalvan said in DNS Resolver and queries:

            I think it was because I deleted all unbound folder (with shell) and pFsense create again.

            The unbound dir is special. It has many special file systems mounted in it.

            Type

            df
            

            Look at what is says ...

            Btw : my df' shows :

            Filesystem                  1K-blocks    Used     Avail Capacity  Mounted on
            /dev/ufsid/54ca20c41b3d50b0 298695208 6805008 267994584     2%    /
            devfs                               1       1         0   100%    /dev
            /dev/md0                         3484     180      3028     6%    /var/run
            /lib                        298695208 6805008 267994584     2%    /var/unbound/lib
            /var/log/pfblockerng        298695208 6805008 267994584     2%    /var/unbound/var/log/pfblockerng
            /usr/local/share/GeoIP      298695208 6805008 267994584     2%    /var/unbound/usr/local/share/GeoIP
            /usr/local/bin              298695208 6805008 267994584     2%    /var/unbound/usr/local/bin
            /usr/local/lib              298695208 6805008 267994584     2%    /var/unbound/usr/local/lib
            devfs                               1       1         0   100%    /var/dhcpd/dev
            devfs                               1       1         0   100%    /var/unbound/dev
            devfs                               1       1         0   100%    /var/unbound/dev
            

            The unbound dir :

            drwxr-xr-x   7 unbound  unbound  1024 Apr 20 12:07 unbound
            

            Just to be sure, take the 5 minutes tour -> and re install. You'll be sure all is ok afterwards.

            No "help me" PM's please. Use the forum, the community will thank you.
            Edit : and where are the logs ??

            1 Reply Last reply Reply Quote 0
            • F
              fgalvan
              last edited by Apr 21, 2021, 7:42 AM

              Hi @Gertjan, now it's working I don't need a reinstall, just left the configuration as you said to me, but I don't understand a thing, why doing a nslookup from shell in pfsense is not resolving?

              [2.4.5-RELEASE][admin@fw1.mondotvcanarias.lan]/root: nslookup 20minutos.es
              Server: 127.0.0.1
              Address: 127.0.0.1#53

              ** server can't find 20minutos.es: SERVFAIL

              But using other DNS server is working

              [2.4.5-RELEASE][admin@fw1.mondotvcanarias.lan]/root: nslookup 20minutos.es 1.1.1.1
              Server: 1.1.1.1
              Address: 1.1.1.1#53

              Non-authoritative answer:
              Name: 20minutos.es
              Address: 13.32.128.5
              Name: 20minutos.es
              Address: 13.32.128.43
              Name: 20minutos.es
              Address: 13.32.128.129
              Name: 20minutos.es
              Address: 13.32.128.2

              Using a roots servers is special for pfsense or something like this?

              Sorry for all of this, I'm new in pfsense and networking in general.

              Thank you so so much!!

              1 Reply Last reply Reply Quote 0
              • G
                Gertjan
                last edited by Apr 21, 2021, 9:35 AM

                This is not good :

                @fgalvan said in DNS Resolver and queries:

                Address: 127.0.0.1#53
                ** server can't find 20minutos.es: SERVFAIL

                normally, unbound should be running, and listening to "All" interfaces, and that includes espcially 127.0.0.1 (localhost).

                [2.5.1-RELEASE][admin@pfsense.my-pfsense.net]/conf/acme: sockstat -4  | grep 'unbound'
                unbound  unbound    79355 5  udp4   *:53                  *:*
                unbound  unbound    79355 6  tcp4   *:53                  *:*
                unbound  unbound    79355 7  tcp4   127.0.0.1:953         *:*
                

                This command shows that there is a process called 'unbound' listening on All interface. All includes 127.0.0.1.
                Unbound also listens on port 953 - only for 127.0.0.1

                Do you have the same thing ?

                nslookup 20minutos.es
                net.c:536: probing sendmsg() with IPV6_TCLASS=b8 failed: No route to host
                Server:         127.0.0.1
                Address:        127.0.0.1#53
                
                Non-authoritative answer:
                Name:   20minutos.es
                Address: 99.86.242.36
                Name:   20minutos.es
                Address: 99.86.242.76
                Name:   20minutos.es
                Address: 99.86.242.13
                Name:   20minutos.es
                Address: 99.86.242.94
                

                The line that shows net.c:536: probing sendmsg() with IPV6_TCLASS=b8 failed: No route to host is a know recent issue : See https://forum.netgate.com/topic/162791/dns-randomly-stops-working/13

                No "help me" PM's please. Use the forum, the community will thank you.
                Edit : and where are the logs ??

                1 Reply Last reply Reply Quote 0
                • F
                  fgalvan
                  last edited by Apr 21, 2021, 9:50 AM

                  I get this:

                  [2.4.5-RELEASE][admin@fw1.mondotvcanarias.lan]/root: sockstat -4 | grep 'unbound'
                  unbound unbound 48018 4 udp4 *:53 :
                  unbound unbound 48018 5 tcp4 *:53 :
                  unbound unbound 48018 6 tcp4 127.0.0.1:953 :

                  but when a I go with nslookup, I get this:

                  [2.4.5-RELEASE][admin@fw1.mondotvcanarias.lan]/root: nslookup 20minutos.es
                  Server: 127.0.0.1
                  Address: 127.0.0.1#53

                  ** server can't find 20minutos.es: SERVFAIL

                  My config now is:

                  Network interfaces --> ALL
                  Outgoing Network interfaces --> WAN

                  And I have,
                  DNS forwarding mode enable, Could it be the reason? Probably I could disable it

                  Thank you

                  G 1 Reply Last reply Apr 21, 2021, 10:06 AM Reply Quote 0
                  • G
                    Gertjan @fgalvan
                    last edited by Apr 21, 2021, 10:06 AM

                    @fgalvan said in DNS Resolver and queries:

                    DNS forwarding mode enable, Could it be the reason? Probably I could disable it

                    Are you forwarding ? ( To where/who ?? )
                    To the servers 212.166.132 etc you removed earlier ?
                    ( ohho)
                    Yes, please, use the default settings, and that is not 'forwarding'.
                    I guess you've nailed it now.

                    No "help me" PM's please. Use the forum, the community will thank you.
                    Edit : and where are the logs ??

                    F 1 Reply Last reply Apr 26, 2021, 7:57 AM Reply Quote 0
                    • F
                      fgalvan @Gertjan
                      last edited by Apr 26, 2021, 7:57 AM

                      @gertjan Yesterday, I could change that, now it seems it's working how it should be. Thank you so much for your help.

                      1 Reply Last reply Reply Quote 0
                      11 out of 11
                      • First post
                        11/11
                        Last post
                      Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.
                        This community forum collects and processes your personal information.
                        consent.not_received