Problem with DNS resolver

[Unoptanio]

@fireodo

[2.7.2-RELEASE][admin@xxxxxxxxxxxx]/root: pkg install unbound-1.19.1
Updating pfSense-core repository catalogue...
Fetching meta.conf: 0%
Fetching packagesite.pkg: 0%
pfSense-core repository is up to date.
Updating pfSense repository catalogue...
Fetching meta.conf: 0%
Fetching packagesite.pkg: 0%
pfSense repository is up to date.
All repositories are up to date.
The following 1 package(s) will be affected (of 0 checked):

Installed packages to be UPGRADED:
unbound: 1.18.0_1 -> 1.19.1 [pfSense]

[2.7.2-RELEASE][admin@Axxxxxxxxx]/root: pkg search unbound
unbound-1.19.1                 Validating, recursive, and caching DNS resolver

[fireodo]

@Unoptanio said in Problem with DNS resolver:

unbound: 1.18.0_1 -> 1.19.1 [pfSense]

Lets see if your trouble is gone

[Unoptanio]

@fireodo

In your opinion, why didn't I have the latest version before? I also have all the patches installed

What version of pfsense is Unbound 1.18.0_1 from?

[fireodo]

@Unoptanio said in Problem with DNS resolver:

@fireodo

In your opinion, why didn't I have the latest version before? I also have all the patches installed

There are updates that are not shown on the GUI and not with Patches - they are shown only on the CLI.

[darcey]

@fireodo My 2.7.2CE install is also currently on unbound-1.18.0_1

[2.7.2-RELEASE][root@fw.local.lan]/root: pkg search unbound
unbound-1.19.1                 Validating, recursive, and caching DNS resolver
[2.7.2-RELEASE][root@fw.local.lan]/root: pkg info | grep unbound
unbound-1.18.0_1               Validating, recursive, and caching DNS resolver

When might it pull in the updated package, other than explicit upgrade via the cmdline?

[fireodo]

@Unoptanio said in Problem with DNS resolver:

What version of pfsense is Unbound 1.18.0_1 from?

I guess 2.7.1 (not shure)

I have a script (see attachment - change .zip to .php) that looks via cronjob if there are some updates. (The script is from @Gertjan if I remember well) pkg_check.zip
The cronjob looks loke this:

/usr/bin/nice -n20 /usr/local/bin/php -q /root/bin/pkg_check.php | logger

Edit: In my case the location of the script is in /root/bin (directory I have created) - put the script in your case where you wish ...

Tanti auguri :-)

[Unoptanio]

@fireodo
So is it a bug in 2.7.2 that doesn't update unbound DNS?

[fireodo]

@Unoptanio said in Problem with DNS resolver:

So is it a bug in 2.7.2 that doesn't update unbound DNS?

No thats not a bug - if some changes where needed in unbound that occure AFTER release of 2.7.2 thats the only way to handle it - as far as I know!

PS.: Is unbound still restarting?

[Unoptanio]

@fireodo

during my lunch break in about two hours I will reboot the system

[fireodo]

@Unoptanio said in Problem with DNS resolver:

during my lunch break in about two hours I will reboot the system

[fireodo]

@darcey said in Problem with DNS resolver:

When might it pull in the updated package, other than explicit upgrade via the cmdline?

See my answer with the script inside - this kind of upgrade you have to do manually.

[darcey]

@fireodo Thanks, I'd completely forgotten about this. It seems on my system, unbound and curl have updates available.
Still I think I am going to leave it as is as things are running very smoothly for me of late.

[fireodo]

@darcey said in Problem with DNS resolver:

Still I think I am going to leave it as is as things are running very smoothly for me of late.

Never change a running system ... old wisdom
(curl has a security issue so I recommend to upgrade)

[Unoptanio]

@fireodo

After restart system

[Gertjan]

@Unoptanio

That's unbound in permanent restart mode !
You can stop that now, as the test succeeded.

To stop the testing :
Uncheck :

Save, and Apply.

( I'm trying a new solution to a 10+ year old question )

[fireodo]

@Unoptanio said in Problem with DNS resolver:

After restart system

Do you have the register dhcp-leases in dns resolver (as gertjan indicates) on?

[Unoptanio]

@Gertjan

Done now at 2.18pm

Now I try to disable DHCP Registration

[stephenw10]

Run pkg upgrade to check if there are any updated system packages available.

We build newer versions of packages if they are available with fixes for specific issues that users may be hitting. They are then available to upgrade to but these are not expected or required upgrades.

In the instance that upgrades are required for security issues we would usually either issues an announcement or a point release of pfSense depending on the severity.

I would not expect the Unbound version to be the issue here. But it also doesn't hurt to update it and it's an easy test.

Steve

[Unoptanio]

@stephenw10 said in Problem with DNS resolver:

pkg upgrade

[2.7.2-RELEASE][admin@xxxxx]/root: pkg upgrade
Updating pfSense-core repository catalogue...
Fetching meta.conf:   0%
Fetching packagesite.pkg:   0%
pfSense-core repository is up to date.
Updating pfSense repository catalogue...
Fetching meta.conf:   0%
Fetching packagesite.pkg:   0%
pfSense repository is up to date.
All repositories are up to date.
Checking for upgrades (3 candidates): 100%      3 B   0.0kB/s    00:01
Processing candidates (3 candidates): 100%      3 B   0.0kB/s    00:01
The following 1 package(s) will be affected (of 0 checked):

Installed packages to be UPGRADED:
        curl: 8.4.0 -> 8.6.0 [pfSense]

Number of packages to be upgraded: 1

1 MiB to be downloaded.

Proceed with this action? [y/N]:

[stephenw10]

Yup, you can upgrade curl. But not upgrading it should not be an issue.