Slow DNS after 22.05
-
I installed BIND on my 3100 given the issues I'm still having with Unbound, expecting it to be able to behave as a resolver on my network.
However, devices using DHCP are issued with the IP addresses of DNS servers set in the "general settings" rather than the IP address of the 3100 itself as happens when you use the native DNS Resolver (Unbound). This means any locally set DNS records (and I only have one that I use) are ignored as all devices are going out to Google's DNS.
Appreciate this might be considered slightly off-topic, but based on my reading, BIND should offer a viable alternative to Unbound as a resolver.
-
@istacey said in Slow DNS after 22.05:
BIND should offer a viable alternative to Unbound as a resolver.
Like unbound, bind doesn't need "8.8.8.8". Both are resolvers.
8.8.8.8 is a DNS resolver where you can forward to.If you wan to deal with 8.8.8.8 because you have to give them your private DNS requests, use the forwarder (dnsmasq), you won't be needing any local resolver.
-
@gertjan I don't want 8.8.8.8 issued via DHCP to devices, but it is and I can't see how/where this is set. Switching back to Unbound goes back to what I'd expected/wanted, that is DHCP issuing 192.168.1.2 as the DNS server).
I can't see how I stop a BIND setup doing this.
-
@istacey said in Slow DNS after 22.05:
I can't see how I stop a BIND setup doing this.
Bind has nothing to do with the DNS server IP, send by the DHCP server to a client that requests a lease.
See for example here : a DHCP request and answer :If your LAN clients receives "8.8.8.8" as a DNS server IP during the lease negotiation, check your DHCP server settings.
The DHCP server doesn't know what '8.8.8.8' is unless you've instructed it. -
@gertjan Yes, my fault! I'd left DNS servers configured in the General Settings. Removed these now and DHCP is issuing my firewall address as DNS... but now I need to work out how to make BIND work properly because that's left nothing resolving!
-
@istacey Had you tried the DNS Forwarder feature instead of Resolver?
-
@steveits I'm using the forwarder only because the Unbound resolver is unreliable. But the forwarder doesn't give me the things I need so I wanted something the resolver.
-
@istacey said in Slow DNS after 22.05:
But the forwarder doesn't give me the things I need
What is that exactly?
-
Problems with my unbound DNS resolver stopping to resolve certain domains randomly seems to be reduced or even solved by setting Unbound EDNS Buffer Size to
4096 - Unbound default in advanced settings.
Need more testing but currently it looks promising. -
@vbjp what was it before, 4096 is the unbound default is it not, that is what mine says.
And if I look at my 2.6 VM, which I would not have touched shows automatic based on mtu.. I prob edit my main system long time I ago to 4096.. Which per the doc's is the max udp size default.
If that that is a problem, then that would explain why I have never seen any of these issues others have reported, as well as I my setting of not doing IPv6 for dns. Which I also think came up as being problematic for this version of unbound at least.
-
@johnpoz
Never changed any setting for that also 2.6 an 22.01 worked without any problems. Problem started with 22.05 update.
Did not check what it was in previous versions but in 22.05 that setting was set to "Automatic value based on active interface MTUs"
And I think it cased all the problems in 22.05 with DNS resolution intermittent failures, mostly it failed to resolve co.jp domains while I rarely saw problems with .com domains like amazon.com haven't seen failing, while Amazon.co.jp failed at least few times a day.
I also had ipv6 disabled in custom options as per some suggestions in this thread but it didn't solve my problem. -
@vbjp if I had to guess something about fallback to tcp in this version of unbound, and if your udp size is set lower its quite possible you are switching over to tcp more often, etc.
IPv6 is quite likely to switch over to tcp more often, especially if there is a lower mtu setting for the udp size, which IPv6 does normally have a lower mtu of like 1280 or something, etc. etc..
It will be good when the unbound version updates on pfsense to see if the issues people are seeing go away.
-
@johnpoz my isp uses pppoe (in Japan lots of ISPs still doing this stuff) and require lower than standard MTU on wan maybe related..
-
@vbjp could be.. I rarely see any tcp queries being done..
So if I look at my stats..
total.num.queries=62685And then look at how many outbound tcp queries were done compared..
num.query.tcpout=48That is just not even a blip.. This is with my unbound being up for bit over 3.5 days.. since its last restart.
-
G Gertjan referenced this topic on
-
S scottlindner referenced this topic on
-
S scottlindner referenced this topic on
-
I've just updated to 23.01-RELEASE (arm) and the problem I threw into this lengthy debate appears to have gone away now.
