Netgate 2100 dns resolver reconfiguration takes very long

n300

Hi there,

it seems to me that every tiny change of DNS related configurations triggers a full restart of unbound. That takes up 2 minutes where complete DNS resolution (internal and external) isn't working. Some of my services are not amused about that.

Is there a tweakable to fix that, or is this behavior works as designed?
I can understand that it's mandatory to restart service for bigger changes in configuration. But absolutely not, if I only want to create a DNS-Record or add a DHCP-Reservation.

Firmware: 22.01-RELEASE (arm64)
My Unbound is running in Forward-Mode (Resolver-Mode isn't working with my ISP) to official DNS-Resolvers and used as internally LAN-DNS-Resolver.
Static-DHCP Clients will be registered automatically. Dynamic-DHCP Clients not.
pfBlockerNG is enabled in quite basic configuration
Tried both modes, Python Modul und default Mode. Can't see any different behaviour.

Are there any suggestions?

SteveITS

@n300 2 minutes seems absurdly long. Do the logs show anything useful?

To be clear are you suing DNS Resolver and forwarding, or using DNS Forwarder?

n300

@steveits

Hi Steve,

No interesting things in unbound log. OK its only about 1 min. But that's also much to long if I only add a dns alias.
There is only a time hole in log.

concerning your question about forwarding:
I only use the server "DNS Resolver". DNS-Forwarder is disabled.
But in DNS Resolver DNS Query Forwarding is enabled.

Otherwise I'm unable to resolve anything outside my LAN.

SteveITS

@n300 Is Internet active at that time?
https://redmine.pfsense.org/issues/12985 looks to be in the upcoming 22.05.

n300

@steveits

WAN port was up as far I can see.

I think it's unbound related, because also internal DNS resolving from all my clients/servers isn't possible while applying changes.

keyser

@n300 said in Netgate 2100 dns resolver reconfiguration takes very long:

@steveits

WAN port was up as far I can see.

I think it's unbound related, because also internal DNS resolving from all my clients/servers isn't possible while applying changes.

pfBlockerNG with a bunch of DNSBL feeds active causes this because of the huge block lists that is added to unbound - optionally via python integration. The SG-2100 CPU is not exactly powerfull, so it takes quite a while to load large feeds on that platform.

n300

@keyser Ok. But if I disable pfblockerNG (not uninstalling it), it's not significantly faster? I also don't have many subscriptions. Only the basic/default Blacklist is enabled.