Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Frequent DNS timeouts

    Scheduled Pinned Locked Moved pfBlockerNG
    86 Posts 11 Posters 36.6k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • O
      oopohj5Oo8shieZe1ree
      last edited by

      On my pfSense 23.01 and pfBlockerNG 3.2 network I have frequent yet seemingly random DNS timeouts. They are most notable in web browsers when accessing a domain that hasn't been accessed recently. The browser hangs doing DNS resolution and sometimes fails outright. This happens on multiple devices, operating systems, browsers, and applications.

      A few days ago I deleted my pfBlockerNG configuration and reinstalled. Using the setup wizard I created the default configuration and left it as is. I'm still experiencing DNS timeouts.

      I'm at a loss for how to troubleshoot this. Any suggestions would be very welcome.

      (Note: for my personal browser I've disabled custom DNS resolution to ensure the browser is going through pfSense and not a third-party DNS provider. This doesn't seem to help though.)

      johnpozJ S T 3 Replies Last reply Reply Quote 0
      • johnpozJ
        johnpoz LAYER 8 Global Moderator @oopohj5Oo8shieZe1ree
        last edited by

        @oopohj5oo8shieze1ree if I had to guess I would guess unbound is restarting a lot, when it restarts yeah dns isn't going to work.

        Look in your log - is unbound restarting?

        An intelligent man is sometimes forced to be drunk to spend time with his fools
        If you get confused: Listen to the Music Play
        Please don't Chat/PM me for help, unless mod related
        SG-4860 24.11 | Lab VMs 2.7.2, 24.11

        O 1 Reply Last reply Reply Quote 0
        • S
          SteveITS Galactic Empire @oopohj5Oo8shieZe1ree
          last edited by

          @oopohj5oo8shieze1ree Also if you are forwarding, ensure DNSSEC is unchecked.

          Pre-2.7.2/23.09: Only install packages for your version, or risk breaking it. Select your branch in System/Update/Update Settings.
          When upgrading, allow 10-15 minutes to restart, or more depending on packages and device speed.
          Upvote πŸ‘ helpful posts!

          O 1 Reply Last reply Reply Quote 0
          • O
            oopohj5Oo8shieZe1ree @johnpoz
            last edited by

            @johnpoz I've looked in the general log file, pfBlockerNG log files, and the DNS resolver log file and I don't see unbound restarting.

            I did notice a couple of these:

            debug: outnettcp got tcp error -1 
            

            And occasionally:

            /rc.linkup: The command '/usr/local/sbin/unbound -c /var/unbound/unbound.conf' returned exit code '1', the output was '[1677281515] unbound[36369:0] error: bind: address already in use [1677281515] unbound[36369:0] fatal error: could not open ports' 
            
            1 Reply Last reply Reply Quote 0
            • O
              oopohj5Oo8shieZe1ree @SteveITS
              last edited by

              @steveits I'm not exactly sure what you mean by forwarding.

              In the DNS resolver settings both DNSSEC and DNS Query Forwarding are turned on. But I'm not running the DNS Forwarding service.

              Should I disable DNSSEC in the DNS Resolver settings, and is that safe to do so?

              S 1 Reply Last reply Reply Quote 0
              • S
                SteveITS Galactic Empire @oopohj5Oo8shieZe1ree
                last edited by

                @oopohj5oo8shieze1ree said in Frequent DNS timeouts:

                both DNSSEC and DNS Query Forwarding are turned on

                Yep that's it. 23.01 seems more sensitive/has problems in that configuration. Uncheck the DNSSEC option. you're already trusting the DNS servers to which you forward.

                For instance per https://support.quad9.net/hc/en-us/articles/4433380601229-Setup-pfSense-and-DNS-over-TLS
                "DNSSEC is already enforced by Quad9, and enabling DNSSEC at the forwarder level can cause false DNSSEC failures"

                Pre-2.7.2/23.09: Only install packages for your version, or risk breaking it. Select your branch in System/Update/Update Settings.
                When upgrading, allow 10-15 minutes to restart, or more depending on packages and device speed.
                Upvote πŸ‘ helpful posts!

                O 1 Reply Last reply Reply Quote 0
                • O
                  oopohj5Oo8shieZe1ree @SteveITS
                  last edited by

                  @steveits Thanks for the help.

                  I also read the pfSense documentation and came to the same conclusion. I've disabled DNSSEC. I'll report back after a couple of days whether or not my issue has been resolved.

                  S 1 Reply Last reply Reply Quote 0
                  • S
                    SteveITS Galactic Empire @oopohj5Oo8shieZe1ree
                    last edited by

                    @oopohj5oo8shieze1ree Here’s hoping. It did for me and several others so far, despite not being a problem in prior versions.

                    Pre-2.7.2/23.09: Only install packages for your version, or risk breaking it. Select your branch in System/Update/Update Settings.
                    When upgrading, allow 10-15 minutes to restart, or more depending on packages and device speed.
                    Upvote πŸ‘ helpful posts!

                    1 Reply Last reply Reply Quote 0
                    • O
                      oopohj5Oo8shieZe1ree
                      last edited by

                      Unfortunately disabling DNSSEC has not fixed my issue. I'm still getting DNS timeouts from time to time :(

                      S 2 Replies Last reply Reply Quote 0
                      • S
                        SteveITS Galactic Empire @oopohj5Oo8shieZe1ree
                        last edited by

                        @oopohj5oo8shieze1ree There was a post today that 'Disabling "Use SSL/TLS for outgoing DNS Queries to Forwarding Servers"' helped that person.

                        https://forum.netgate.com/post/1090876

                        Pre-2.7.2/23.09: Only install packages for your version, or risk breaking it. Select your branch in System/Update/Update Settings.
                        When upgrading, allow 10-15 minutes to restart, or more depending on packages and device speed.
                        Upvote πŸ‘ helpful posts!

                        O 1 Reply Last reply Reply Quote 0
                        • S
                          SteveITS Galactic Empire @oopohj5Oo8shieZe1ree
                          last edited by

                          Also there's a fix for Unbound not correctly binding to "All" interfaces on IPv6.

                          https://forum.netgate.com/topic/176989/problems-with-pfsense-ipv6-dns-function-does-it-exist/36

                          Pre-2.7.2/23.09: Only install packages for your version, or risk breaking it. Select your branch in System/Update/Update Settings.
                          When upgrading, allow 10-15 minutes to restart, or more depending on packages and device speed.
                          Upvote πŸ‘ helpful posts!

                          1 Reply Last reply Reply Quote 0
                          • O
                            oopohj5Oo8shieZe1ree @SteveITS
                            last edited by

                            @steveits Thanks for pointing me to the other threads.

                            I'm thinking of just giving up on using forwarding. I need to figure out if my ISP limits access to DNS servers when not forwarding.

                            1 Reply Last reply Reply Quote 0
                            • O
                              oopohj5Oo8shieZe1ree
                              last edited by

                              After turning off DNS forwarding, resolution was nearly instantaneous for a couple of days. But the random timeouts have returned.

                              I don't see anything in the logs to indicate something is failing.

                              Can someone point me to a DNS debugging guide or something that will help me figure out what the root cause is here.

                              Thank you.

                              S 1 Reply Last reply Reply Quote 0
                              • S
                                SteveITS Galactic Empire @oopohj5Oo8shieZe1ree
                                last edited by

                                @oopohj5oo8shieze1ree There are a few here:
                                https://docs.netgate.com/pfsense/en/latest/troubleshooting/index.html#dns

                                Also take a look through https://forum.netgate.com/category/19/dhcp-and-dns as there are other posts for 23.01.

                                Pre-2.7.2/23.09: Only install packages for your version, or risk breaking it. Select your branch in System/Update/Update Settings.
                                When upgrading, allow 10-15 minutes to restart, or more depending on packages and device speed.
                                Upvote πŸ‘ helpful posts!

                                O 1 Reply Last reply Reply Quote 1
                                • T
                                  thundergate @oopohj5Oo8shieZe1ree
                                  last edited by

                                  @oopohj5oo8shieze1ree

                                  Hi. Do have nearly the same issues.

                                  But for me I don't use and DNS forwarding or anything else. Just pfSense Unbound in combination with pfBlockerNG.

                                  Don't have any DNS fails at all. But looks like name resolution does hang after some amount of time. After that it looks like it is cached again and resolution works fine.
                                  But I do have this issues nearly every day.

                                  Something like a cleared unbound cache - what's not the case.

                                  GertjanG 1 Reply Last reply Reply Quote 0
                                  • GertjanG
                                    Gertjan @thundergate
                                    last edited by

                                    @thundergate said in Frequent DNS timeouts:

                                    cleared unbound cache

                                    This can only happens when the resolver -unbound is told to stop, or restart, which is a controlled stop, to be started right afterwards.
                                    It can take several seconds to do so.
                                    The cache will be lost, but subsequent DNS resolving won't take long, typical is a fraction of a second.

                                    If unbound restarts happen very often, you can start to 'feel' the absence of the DNS sub system.

                                    So, ask your pfSense how often it restarts :

                                    grep "Restart" /var/log/resolver.log
                                    

                                    If it's just couple of times a day (lesser == better) : this is not your issue.

                                    No "help me" PM's please. Use the forum, the community will thank you.
                                    Edit : and where are the logs ??

                                    1 Reply Last reply Reply Quote 0
                                    • O
                                      oopohj5Oo8shieZe1ree @SteveITS
                                      last edited by

                                      @steveits After switching from forwarding to normal resolving I let things sit for a bit to see what would happen. It looks like unbound is restarting a lot:

                                      Mar 15 08:01:04 netgate unbound[20724]: [20724:0] notice: Restart of unbound 1.17.1.
                                      Mar 15 08:08:33 netgate unbound[20724]: [20724:0] notice: Restart of unbound 1.17.1.
                                      Mar 15 08:12:20 netgate unbound[20724]: [20724:0] notice: Restart of unbound 1.17.1.
                                      Mar 15 08:12:45 netgate unbound[20724]: [20724:0] notice: Restart of unbound 1.17.1.
                                      Mar 15 08:13:39 netgate unbound[20724]: [20724:0] notice: Restart of unbound 1.17.1.
                                      Mar 15 08:29:45 netgate unbound[20724]: [20724:0] notice: Restart of unbound 1.17.1.
                                      Mar 15 08:34:44 netgate unbound[20724]: [20724:0] notice: Restart of unbound 1.17.1.
                                      Mar 15 08:35:41 netgate unbound[20724]: [20724:0] notice: Restart of unbound 1.17.1.
                                      Mar 15 08:42:09 netgate unbound[20724]: [20724:0] notice: Restart of unbound 1.17.1.
                                      Mar 15 08:42:34 netgate unbound[20724]: [20724:0] notice: Restart of unbound 1.17.1.
                                      Mar 15 08:49:47 netgate unbound[20724]: [20724:0] notice: Restart of unbound 1.17.1.
                                      Mar 15 08:52:13 netgate unbound[20724]: [20724:0] notice: Restart of unbound 1.17.1.
                                      

                                      Is there a known workaround for this?

                                      S T 2 Replies Last reply Reply Quote 0
                                      • S
                                        SteveITS Galactic Empire @oopohj5Oo8shieZe1ree
                                        last edited by

                                        @oopohj5oo8shieze1ree The most common cause for restarts is having DHCP set to register DHCP leases in DNS, which triggers a restart after each and every DHCP lease. Options are to not do that, or to make the lease long enough that it renews in "days" not "hours." (renewal is 1/2 of the lease duration)

                                        Pre-2.7.2/23.09: Only install packages for your version, or risk breaking it. Select your branch in System/Update/Update Settings.
                                        When upgrading, allow 10-15 minutes to restart, or more depending on packages and device speed.
                                        Upvote πŸ‘ helpful posts!

                                        1 Reply Last reply Reply Quote 0
                                        • O
                                          oopohj5Oo8shieZe1ree
                                          last edited by

                                          @steveits I believe I have that turned off (in Services -> DHCP Server -> Dynamic DNS ->
                                          Enable registration of DHCP client names in DNS). However, it does appear to be registering DHCP host names with the DNS server regardless of this setting.

                                          I've increased the lease time and will report back.

                                          Thank you.

                                          johnpozJ 1 Reply Last reply Reply Quote 0
                                          • johnpozJ
                                            johnpoz LAYER 8 Global Moderator @oopohj5Oo8shieZe1ree
                                            last edited by

                                            @oopohj5oo8shieze1ree unbound starting that often is going to be problematic that is for sure..

                                            An intelligent man is sometimes forced to be drunk to spend time with his fools
                                            If you get confused: Listen to the Music Play
                                            Please don't Chat/PM me for help, unless mod related
                                            SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.