Unbound binds only to localhost after cold boot/power outage — pfSense CE 2.9.0

jsokorp

I am seeing what appears to be the same issue as Redmine #13707 on pfSense CE 2.9.0-RELEASE.

This has happened repeatedly after power outages/cold boots.

DNS Resolver shows as running, but LAN clients cannot resolve anything. The pfSense GUI hostname also fails because LAN DNS is unavailable.

During the most recent failure:

sockstat -4 -l | grep ':53'
unbound unbound 67000 3 udp4 127.0.0.1:53 *:*
unbound unbound 67000 4 tcp4 127.0.0.1:53 *:*

/var/unbound/unbound.conf contained:

interface: 127.0.0.1
interface: ::1

However, DNS Resolver → Network Interfaces was explicitly configured for:

* LAN — 192.168.10.1
* OPT1 — 192.168.50.1
* Localhost

Unbound itself appeared healthy:

unbound-control -c /var/unbound/unbound.conf status
version: 1.25.2
threads: 4
modules: 2 [ validator iterator ]
unbound is running

There were no obvious Unbound startup errors in /var/log/resolver.log

I then went to Services → DNS Resolver and clicked Save / Apply without changing the interface selections.

Immediately afterward /var/unbound/unbound.conf was regenerated as:

interface: 192.168.10.1
interface: 192.168.50.1
interface: 127.0.0.1
interface: ::1

sockstat then showed Unbound listening on all of those IPv4 addresses, and LAN DNS immediately worked again.

This suggests that during the boot sequence pfSense is generating the Unbound configuration before the explicitly selected interfaces are available, while regenerating the same configuration later works correctly.

I have now changed Network Interfaces to All as a workaround, as discussed in Redmine #13707.

Relevant configuration:

pfSense CE 2.9.0-RELEASE
Unbound 1.25.2
Resolver mode, not forwarding mode
DNSSEC enabled
Outgoing Network Interfaces: All
Access Lists: empty
Auto-added access control enabled

Is #13707 still considered applicable to current 2.9.0 releases, and is there any additional boot-time diagnostic information I can collect the next time this occurs that would help identify why the selected interfaces are omitted from the generated Unbound configuration?

jsokorp

Meant to post this in DHCP but not allowed