Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Unbound errors after 24.11 update

    Scheduled Pinned Locked Moved
    DHCP and DNS
    3
    12
    149
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • Raffi_R
      Raffi_
      last edited by

      Hi, I haven't been on here for some time, but I'm still around.

      I recently updated to 24.11 and noticed that unbound has been running into trouble after some time (screen shot). I assume it has to do with the timing of pfblockerNG updates.

      When I get these errors, restarting unbound fixes it until it fails again. I have already tried uninstalling and reinstalling pfblockerNG. That did not help. I had to enable forwarding mode for the time being to avoid DNS queries failing and/or being very delayed.

      I haven't found info on this exact issue in the bug tracker or on here. Let me know if you need anything else.
      Thanks.
      unbound errors.png

      GertjanG 1 Reply Last reply Reply Quote 0
      • GertjanG
        Gertjan @Raffi_
        last edited by Gertjan

        @Raffi_ said in Unbound errors after 24.11 update:

        reinstalling pfblockerNG

        What pfBlockerng version ?

        Run this :

        [24.11-RELEASE][root@pfSense.bhf.tld]/root: md5sum /var/unbound/pfb_unbound.py
8089faa1c4ab9886995f36970811f6ea  /var/unbound/pfb_unbound.py

        Do you also have 8089faa1c4ab9886995f36970811f6ea ?
        That tells me that your /var/unbound/pfb_unbound.py is the same as my file.

        /var/unbound/pfb_unbound.py gets called by unbound to do the DNSBL filtering.
        Your unbound sends something (probably DNS request bits) that your /var/unbound/pfb_unbound.py and it can not handle it. Not sure if a 0xc0 is a valid ASCI char.

        Any chance you've set up a host name somewhere with BOM encoding or some other host names name with UTF8 / UTF16 (characters with accents).

        Btw : yeah, if /var/unbound/pfb_unbound.py fails, it probably takes unbound with it. That's bad for DNS business.

        No "help me" PM's please. Use the forum, the community will thank you.
        Edit : and where are the logs ??

        S Raffi_R 2 Replies Last reply Reply Quote 1
        • S
          sgw @Gertjan
          last edited by

          I have the same pfb_unbound.py but not the same error messages.
          But I also notice DNS queries to fail ... and the succeed after pressing F5 in the browser a few times, for example.

          Disabling DNSBL now for a basic A/B-test.

          Raffi_R 1 Reply Last reply Reply Quote 0
          • Raffi_R
            Raffi_ @Gertjan
            last edited by

            @Gertjan Thanks for the response!

            What pfBlockerng version ?

            dcc1ca14-417a-48d3-8d6e-27a2d1a607f4-image.png

            Run this :

            [24.11-RELEASE][root@pfSense.bhf.tld]/root: md5sum /var/unbound/pfb_unbound.py
8089faa1c4ab9886995f36970811f6ea  /var/unbound/pfb_unbound.py

            Do you also have 8089faa1c4ab9886995f36970811f6ea ?
            That tells me that your /var/unbound/pfb_unbound.py is the same as my file.

            f1ea4381f1359cf1b68581eb37b25697 /var/unbound/pfb_unbound.py
            That's what I got when running that command.

            /var/unbound/pfb_unbound.py gets called by unbound to do the DNSBL filtering.
            Your unbound sends something (probably DNS request bits) that your /var/unbound/pfb_unbound.py and it can not handle it. Not sure if a 0xc0 is a valid ASCI char.

            Any chance you've set up a host name somewhere with BOM encoding or some other host names name with UTF8 / UTF16 (characters with accents).

            Pretty sure not much changed on the network or settings other than the change to 24.11. I wouldn't even know how to get accent characters on my hosts to be honest.

            Btw : yeah, if /var/unbound/pfb_unbound.py fails, it probably takes unbound with it. That's bad for DNS business.

            GertjanG 1 Reply Last reply Reply Quote 0
            • Raffi_R
              Raffi_ @sgw
              last edited by

              @sgw said in Unbound errors after 24.11 update:

              I have the same pfb_unbound.py but not the same error messages.
              But I also notice DNS queries to fail ... and the succeed after pressing F5 in the browser a few times, for example.

              Disabling DNSBL now for a basic A/B-test.

              Thanks for the tip. Yes, that sounds like a similar issues to mine. I'm sure if I refreshed enough times it would eventually work also. I was thinking about disabling DNSBL, but I really rather not since it is still working to protect the office. I opted to enable forwarding mode and use a cloud flare public DNS. This made it so my DNS works and I get to keep pfblocker protection at least.

              S 1 Reply Last reply Reply Quote 0
              • GertjanG
                Gertjan @Raffi_
                last edited by

                @Raffi_ said in Unbound errors after 24.11 update:

                f1ea4381f1359cf1b68581eb37b25697 /var/unbound/pfb_unbound.py

                Probably ok.
                You are using version "16", I'm using the devel version :

                0d66d251-9f40-4298-a42c-8b8471c5cec0-image.png

                Btw :
                0743fdd1-0321-49a3-8cda-9d65ed101950-image.png

                IMHO : a host name is being parsed and it contain none valid characters.
                Be ware : probably not you typing the host name, but it culd be any device on you LAN asking to resolve something that contains invalid chars.
                or, at least, the python scripts goes bananas.
                It should be more reislient, I agree.

                Also : fist time I see this kind of failure message on the forum. Must be something really something unique.
                ...wait ... (Let's search for it)

                UnicodeDecodeError

                No "help me" PM's please. Use the forum, the community will thank you.
                Edit : and where are the logs ??

                Raffi_R 1 Reply Last reply Reply Quote 1
                • S
                  sgw @Raffi_
                  last edited by

                  @Raffi_ I still see these DNS issues even with pfblockerNG disabled.

                  My unbound does not forward DNS queries, it is set to resolve queries directly.

                  Raffi_R 1 Reply Last reply Reply Quote 0
                  • Raffi_R
                    Raffi_ @sgw
                    last edited by Raffi_

                    @sgw said in Unbound errors after 24.11 update:

                    @Raffi_ I still see these DNS issues even with pfblockerNG disabled.

                    My unbound does not forward DNS queries, it is set to resolve queries directly.

                    Interesting, what does your unbound log say? Is the error message similar to mine?
                    If so, you can try my temporary solution. Enter a public DNS of your choice in the general settings, and then enable forwarding mode in DNS resolver. This will still use the Unbound resolver by default, but it if fails, it will fallback to using the public DNS entries, at least that's my understanding of the description in the general settings.

                    S 1 Reply Last reply Reply Quote 0
                    • S
                      sgw @Raffi_
                      last edited by

                      @Raffi_ I tried something different to research this in more detail:

                      even when pfblockerNG is disabled, unbound can still have that python-module enabled.
                      I disabled that now in the settings of the "DNS resolver" (=unbound) and restarted it.

                      This lead to:

                      2024-12-16 17:31:05.867565+01:00	unbound	46083	[46083:0] info: [pfBlockerNG]: pfb_unbound.py script exiting

                      I will see if things change now. Right now I have to do other work, but I will report back.

                      1 Reply Last reply Reply Quote 1
                      • Raffi_R
                        Raffi_ @Gertjan
                        last edited by

                        @Gertjan said in Unbound errors after 24.11 update:

                        @Raffi_ said in Unbound errors after 24.11 update:

                        f1ea4381f1359cf1b68581eb37b25697 /var/unbound/pfb_unbound.py

                        Probably ok.
                        You are using version "16", I'm using the devel version :

                        Thank you for this, maybe I will try the devel version. For the longest time I was using the devel version since it was the latest. A few months ago I went to using non devel version since it seems like devel version is the actual development version and I figured non devel would be more stable.

                        0d66d251-9f40-4298-a42c-8b8471c5cec0-image.png

                        Btw :
                        0743fdd1-0321-49a3-8cda-9d65ed101950-image.png

                        IMHO : a host name is being parsed and it contain none valid characters.
                        Be ware : probably not you typing the host name, but it culd be any device on you LAN asking to resolve something that contains invalid chars.
                        or, at least, the python scripts goes bananas.
                        It should be more reislient, I agree.

                        That is possible. I don't have insight into every device on the network even though it's a fairly small network. Maybe I will try looking into that.

                        Also : fist time I see this kind of failure message on the forum. Must be something really something unique.
                        ...wait ... (Let's search for it)

                        UnicodeDecodeError

                        Thanks for that search, it didn't seem to bring up much.

                        GertjanG 1 Reply Last reply Reply Quote 0
                        • GertjanG
                          Gertjan @Raffi_
                          last edited by

                          @Raffi_ said in Unbound errors after 24.11 update:

                          Maybe I will try looking into that.

                          You could raise the debug level if unbound to

                          78891b81-b130-4f47-8014-6556597e324d-image.png

                          so the offending host name leaves a trace in the unbound logs.
                          Be ware : make your log file(s) big enough as this will log a huge quantity of lines.
                          Don't forget to set the log level back as soon as the issue is solved/ known.

                          No "help me" PM's please. Use the forum, the community will thank you.
                          Edit : and where are the logs ??

                          Raffi_R 1 Reply Last reply Reply Quote 1
                          • Raffi_R
                            Raffi_ @Gertjan
                            last edited by

                            @Gertjan Thanks, good idea. I will try increasing the log level. Unfortunately pfblockerNG-devel did not solve the issue.

                            1 Reply Last reply Reply Quote 0
                            • First post
                              Last post