DNS resolver failed to resolve some addresses
-
Hello there,
I enabled the unbound recursive resolver,
it works fine but some domain names are not resolved, for example wikipedia.org and all its subdomains.I'm sure it's not a big deal but I'm a bit stuck.
When I run a dig from the terminal for wikipedia.org I get a timeout during the process,
In summary 99+% name resolutions seem to work, but some failsAny help would be appreciated
-
@martinez where does it fail? Is it timeout? To which name servers?
-
@johnpoz yes I got a timeout, for example ns1.wikimedia.org, I can lookup not working adresses from my computer, but seems all of
A dig command from pfsense for wikipedia.org
; <<>> DiG 9.20.6 <<>> wikipedia.org +trace ;; global options: +cmd ... ;; Received 525 bytes from 127.0.0.1#53(127.0.0.1) in 1 ms org. 172800 IN NS a0.org.afilias-nst.info. org. 172800 IN NS a2.org.afilias-nst.info. org. 172800 IN NS b0.org.afilias-nst.org. org. 172800 IN NS b2.org.afilias-nst.org. org. 172800 IN NS c0.org.afilias-nst.info. org. 172800 IN NS d0.org.afilias-nst.org. org. 86400 IN DS 26974 8 2 4FEDE294C53F438A158C41D39489CD78A86BEB0D8A0AEAFF14745C0D 16E1DE32 org. 86400 IN RRSIG DS 8 1 86400 ;; Received 821 bytes from 2801:1b8:10::b#53(b.root-servers.net) in 14 ms ;; communications error to 199.19.57.1#53: timed out ;; communications error to 199.19.57.1#53: timed out ;; communications error to 199.19.57.1#53: timed out ;; communications error to 199.19.54.1#53: timed out wikipedia.org. 3600 IN NS ns1.wikimedia.org. wikipedia.org. 3600 IN NS ns2.wikimedia.org. wikipedia.org. 3600 IN NS ns0.wikimedia.org. ... ;; Received 655 bytes from 2001:500:40::1#53(a2.org.afilias-nst.info) in 13 ms ;; communications error to 208.80.154.238#53: timed out ;; communications error to 208.80.153.231#53: timed out ;; communications error to 198.35.27.27#53: timed out ;; no servers could be reachedIt seems the problem occurs for name servers that have an IPv4 address but not an IPv6 address, From pfsense, I can ping public WAN IPv4 addresses.
-
@martinez if you can not talk to NSs via IPv4 your going to have lots and lots of issues.
There are many many domains that only have IPv4 name servers.
If you can ping those IPs via ipv4.. say for example that 199.19.57.1 answers ping for me. If you can ping that from a client on your network but unbound is having a hard time talking to it.. Does it work if you do a directed dig to it?
$ dig @199.19.57.1 wikipedia.org ns ; <<>> DiG 9.16.50 <<>> @199.19.57.1 wikipedia.org ns ; (1 server found) ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 27849 ;; flags: qr rd; QUERY: 1, ANSWER: 0, AUTHORITY: 3, ADDITIONAL: 4 ;; WARNING: recursion requested but not available ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 1232 ;; QUESTION SECTION: ;wikipedia.org. IN NS ;; AUTHORITY SECTION: wikipedia.org. 3600 IN NS ns0.wikimedia.org. wikipedia.org. 3600 IN NS ns1.wikimedia.org. wikipedia.org. 3600 IN NS ns2.wikimedia.org. ;; ADDITIONAL SECTION: ns0.wikimedia.org. 3600 IN A 208.80.154.238 ns1.wikimedia.org. 3600 IN A 208.80.153.231 ns2.wikimedia.org. 3600 IN A 198.35.27.27 ;; Query time: 194 msec ;; SERVER: 199.19.57.1#53(199.19.57.1) ;; WHEN: Sat Oct 11 10:23:57 Central Daylight Time 2025 ;; MSG SIZE rcvd: 154Be it either a client behind pfsense doing the query, or pfsense itself doing the query
-
@johnpoz No it's not working, with directed dig, got same message
;; communications error to 199.19.57.1#53: timed out ;; communications error to 199.19.57.1#53: timed out ;; communications error to 199.19.57.1#53: timed out
I temporarily set up another unbound on local network and it's works fine (in case there is dns isp filtering on ipv4, but that doesn't seem to be the case.)
On the resolver configuration page I only selected the WAN interface
/var/unbound/unbound.conf# Outgoing interfaces to be used outgoing-interface: 10.153.43.214and to be sure of routing
ping -S 10.153.43.214 199.19.57.1 PING 199.19.57.1 (199.19.57.1) from 10.153.43.214: 56 data bytes 64 bytes from 199.19.57.1: icmp_seq=0 ttl=53 time=243.655 ms 64 bytes from 199.19.57.1: icmp_seq=1 ttl=53 time=243.858 msping from this address is ok, but dig always gives a timeout
-
@martinez I always set my unbound to use loopback as its outgoing.. If you can not talk to ipv4 with unbound bound to your interface?
So your pfsense behind a nat.,. its wan IP is 10.153? Or you bound it to the lan interface for some strange reason??
I bind to the localhost, because it should just use your normal routing that way. But try binding it to all.
If bound to localhost, when system starts or if you have issues with your wan for example unbound can start and bind to the interface even if wan is not yet up, etc.
-
@johnpoz It's good to know for the loopback (I will find out more).
Yes, (unfortunately) I am behind a NAT from the access provider and the address 10.153 bound to my WAN interface.
I set the binding to All and rebooted, then localhost, with both configurations the problem remained unchanged
-
@martinez well what I would do is sniff on your wan interface while you doing a IPv4 query, say your trace.. If you see the query go out, and nothing back then problem is upstream of pfsense.. If you never see the query leave your wan with correct IP then problem is related to something on your side.
-
@johnpoz I just ran the test, and... I only get outgoing DNS traffic in IPv6 (with the ipv6 in alias below)
So I'm wondering if the problem somewhere :
Since I didn't receive IPv6 with DHCP, I used "virtual IP" to assign a public address on the WAN interface. However, I have outgoing DNS traffic with IPv6 defined as an alias, but no outgoing traffic with 10.153.
However, if I use a resolver internal to the LAN, I do get SNAT and outgoing traffic (and the correct responses).
I feel like I'm not doing this correctly ?
-
@martinez turn off your ipv6....
You need to turn off your IPv6 to validate ipv4 is working - if you can not talk to ipv4 dns, much of the internet is not going to work for you.
When you do a dns query to ipv4 address from behind pfsense it works.. But from pfsense it does not? Is it not sending anything at all? Is it sending it with wrong address?
Show a sniff on your wan with IPv6 off and from a client doing an dns query to some IPv4.. Then do the same query from pfsense cmd line. Unbound should be able to query to IPv4 addresses, if clients can talk to IPv4 out on the internet. If not then you have something major messed up.. Did you turn off IPv4 in unbound or something? With an option?
Do you have anything setup in the unbound (resolver) options box?
-
That's exactly it: clients can communicate with IPv4 and make requests to external DNS servers, while unbound can't.
I followed your procedure, with IPv6 disabled, and when I run a request from pfsense (with the DNS resolver pointing to unbound 127.0.0.1), I get nothing at all.
In the unbound configuration, I have no special, no "custom" options.
This is interesting:
- If I check "forward" in the resolver and specify a resolver that belongs to the LAN, the DNS resolution works.
- If I change the address to a resolver located on the Internet (i.e., outgoing through the WAN interface), it doesn't work.
I launched a
traceroutefrom the firewall (in case it behaves differently than with forwarded packets) on one of the external DNS that I tested and no route problems -
@martinez since you are forwarding, did you disable DNSSEC?
-
Yes, I just checked it's disabled. I must have disabled it since the troubleshooting began. I haven't touched it since.
