Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    DNS Resolver (Unbound) Stops Working After Internet Outage – Requires Manual Restart

    Scheduled Pinned Locked Moved General pfSense Questions
    8 Posts 3 Posters 443 Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • M
      milindhvijay
      last edited by

      Hi,

      I am experiencing an issue where the DNS resolver (Unbound) on pfSense stops working after an internet outage. This happens both during long outages and when there are multiple shorter disruptions in a short period of time. To get it working again, I have to manually restart the DNS resolver every time.

      Sometimes, DNS resolution works directly on pfSense, but not on client devices. However, in other instances, DNS resolution fails even on pfSense itself. This inconsistency makes it difficult to pinpoint the exact problem.

      I’ve seen similar issues reported on Reddit and other forums over the years, and I've tried several suggested solutions without success. Any insights or troubleshooting steps would be greatly appreciated.

      1 Reply Last reply Reply Quote 0
      • stephenw10S
        stephenw10 Netgate Administrator
        last edited by

        Does the service stop?

        Do you see anything logged?

        How are you testing?

        How is Unbound configured? Anything custom?

        What pfSense version are you running.

        Steve

        M 1 Reply Last reply Reply Quote 0
        • M
          milindhvijay @stephenw10
          last edited by

          @stephenw10

          1. No the service does not stop.

          2. Nothing out of ordinary.

          3. I use "dig" and it gives no A/AAAA records (blank), also webpages don't load. Firefox show this error: "Hmm. We’re having trouble finding that site."

          4. No custom options used.

          2c3b06e0-84a6-438c-bb50-5b11aa3e79a0-Screenshot 2024-10-26 at 22-02-27 Gaia.home - Services DNS Resolver General Settings.png

          857754ae-cc01-4fbd-8cab-35601707b05f-Screenshot 2024-10-26 at 22-02-09 Gaia.home - Services DNS Resolver Advanced Settings.png

          1. pfSense CE 2.7.2
          1 Reply Last reply Reply Quote 0
          • stephenw10S
            stephenw10 Netgate Administrator
            last edited by

            Hmm, so it responds no answer, NXDOMAIN? Rather than no response?

            Try turning up the logging to level 3 so you can see what it;s doing when you query it in the failed state.

            M 1 Reply Last reply Reply Quote 0
            • M
              milindhvijay @stephenw10
              last edited by

              @stephenw10 My uplinks went down yesterday for 15 minutes but DNS resolution was working when it came back. These are the log (level 1) messages when it happened:

              d13a8a1f-2566-4b24-b24d-7ec563984b04-IMG_2359.PNG

              d14db693-b149-4174-aeb7-bfd67ffc8569-IMG_2358.PNG

              777db857-a8c9-47e6-8e74-4a0b50037d71-IMG_2357.PNG

              9220e141-aad7-4c67-9ba9-ca74c56ee509-IMG_2356.PNG

              GertjanG 1 Reply Last reply Reply Quote 0
              • stephenw10S
                stephenw10 Netgate Administrator
                last edited by

                Nothing unexpected there. If you turn up the logs and wait for it to fail again the logs should show how it's failing at least.

                Can you trigger the failure on demand?

                M 1 Reply Last reply Reply Quote 0
                • M
                  milindhvijay @stephenw10
                  last edited by

                  @stephenw10 I can try by disconnecting the upstream router but I don't know how long it would take, maybe in 30 minutes, maybe hours.

                  1 Reply Last reply Reply Quote 0
                  • GertjanG
                    Gertjan @milindhvijay
                    last edited by

                    @milindhvijay

                    A test, and you need the console or SSH to execute it :

                    On the main menu, use option 8.

                    Then :

                    dig @127.0.0.1 google.com
                    

                    This test executes a dns request on port 53, 127.0.0.1. Unbound should be listening on that port.

                    Another test :

                    sockstat -4 | grep 'unbound'
                    

                    This shows you on which interfaces unbound is listening.
                    I see :

                    unbound  unbound    83642 5   udp4   *:53                  *:*
                    unbound  unbound    83642 6   tcp4   *:53                  *:*
                    

                    which means : unbound listens on every (like "all") interfaces, for IPv4 and IPv6, on port '53' (of course), using TCP and UDP.

                    This means that this :

                    dig @192.168.1.1 google.com
                    

                    should0 give an answer = the IPv4 of Google

                    Btw : I presume your LAN IPv4 is 192.168.1.1 - take yours if yours is different.

                    This :

                    dig @192.168.1.1 google.com AAAA
                    

                    should give the IPv6 is you have a working IPv6 setup.

                    No "help me" PM's please. Use the forum, the community will thank you.
                    Edit : and where are the logs ??

                    1 Reply Last reply Reply Quote 0
                    • First post
                      Last post
                    Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.