Unbound TCP buffer settings not sticky
-
#########################
Unbound configuration
#########################
Server config
server:
chroot: ""
username: "unbound"
directory: "/usr/pbi/unbound-amd64/etc/unbound"
pidfile: "/var/run/unbound.pid"
harden-referral-path: no
prefetch: no
prefetch-key: no
use-syslog: yes
port: 53
verbosity: 0
do-ip4: yes
do-ip6: yes
do-udp: yes
do-tcp: yes
do-daemonize: yes
module-config: "validator iterator"
unwanted-reply-threshold: 5000000
num-queries-per-thread: 512
jostle-timeout: 200
infra-host-ttl: 900
prefetch: no
prefetch-key: no
infra-cache-numhosts: 15000
outgoing-num-tcp: 10
incoming-num-tcp: 10
edns-buffer-size: 4096
statistics-interval: 0
extended-statistics: no
statistics-cumulative: no
cache-max-ttl: 86400
cache-min-ttl: 0
harden-dnssec-stripped: yes
hide-identity: yes
hide-version: yes
harden-glue: yes
num-threads: 4
msg-cache-slabs: 4
rrset-cache-slabs: 4
infra-cache-slabs: 4
key-cache-slabs: 4
msg-cache-size: 10m
rrset-cache-size: 20m
outgoing-range: 8192
#so-rcvbuf: 4m
#so-sndbuf: 4mInterface IP(s) to bind to
interface: 192.168.1.1
Interfaces to query from
outgoing-interface: 192.168.1.1
auto-trust-anchor-file: /usr/pbi/unbound-amd64/etc/unbound/root-trust-anchor
Access Control
Local attached networks allowed to utilize service and any user added ACLs
access-control: 127.0.0.0/8 allow
access-control: ::1 allow
access-control: 192.168.1.0/27 allowFor DNS Rebinding prevention
private-address: 10.0.0.0/8
private-address: 172.16.0.0/12
private-address: 192.168.0.0/16
private-address: 169.254.0.0/16
private-address: fd00::/8
private-address: fe80::/10Set private domains in case authorative name server returns a RFC1918 IP address
Host entries
local-zone: "lan" transparent
local-data-ptr: "127.0.0.1 localhost"
local-data: "localhost A 127.0.0.1"
local-data: "localhost.lan A 127.0.0.1"
local-data-ptr: "::1 localhost"
local-data: "localhost AAAA ::1"
local-data: "localhost.lan AAAA ::1"
local-data-ptr: "192.168.1.1 peanuts.lan"
local-data: "peanuts.lan A 192.168.1.1"
local-data: "peanuts A 192.168.1.1"DHCP Reservations
/etc/hosts entries
Domain overrides
#forward-zone:
#name: "."
#forward-addr: 75.75.75.75
#forward-addr: 75.75.76.76Unbound Custom options
msg-cache-slabs: 1
rrset-cache-slabs: 1
infra-cache-slabs: 1
key-cache-slabs: 1
outgoing-range: 950
val-clean-additional: yes
harden-glue: yes
do-not-query-localhost: yes
do-ip6: no
use-caps-for-id: no
hide-identity: yes
hide-version: yesRemote Control Config
remote-control:
control-enable: yes
control-interface: 127.0.0.1
control-port: 953
server-key-file: "/usr/pbi/unbound-amd64/etc/unbound/unbound_server.key"
server-cert-file: "/usr/pbi/unbound-amd64/etc/unbound/unbound_server.pem"
control-key-file: "/usr/pbi/unbound-amd64/etc/unbound/unbound_control.key"
control-cert-file: "/usr/pbi/unbound-amd64/etc/unbound/unbound_control.pem"thats how my file looks like when its working. Some of those options are doubled because they weren't there before or i didn't want to manually change the values every time the package was updated. If i put them in the custom options window, then it will overwrite the default value to what ever i wanted since the custom options are read last
thats the output in the status tab when its running. or do you want the config file?
-
#########################
Unbound configuration
#########################
snip
thats how my file looks like when its working. Some of those options are doubled because they weren't there before or i didn't want to manually change the values every time the package was updated. If i put them in the custom options window, then it will overwrite the default value to what ever i wanted since the custom options are read last
Check my update attachement. I think it is because the custom options are getting put in after the server: clause has been finished because the forward-zones clause has started. Can you test it out to see if it works properly with my changes?
-
sure just need a minute
-
#########################
Unbound configuration
#########################
snip
thats how my file looks like when its working. Some of those options are doubled because they weren't there before or i didn't want to manually change the values every time the package was updated. If i put them in the custom options window, then it will overwrite the default value to what ever i wanted since the custom options are read last
Check my update attachement. I think it is because the custom options are getting put in after the server: clause has been finished because the forward-zones clause has started. Can you test it out to see if it works properly with my changes?
yeah that did fix it.
it looks like
Unbound Custom options
msg-cache-slabs: 1
rrset-cache-slabs: 1
infra-cache-slabs: 1
key-cache-slabs: 1
val-clean-additional: yes
harden-glue: yes
do-not-query-localhost: yes
do-ip6: no
use-caps-for-id: no
hide-identity: yes
hide-version: yes
forward-zone:
name: "."
forward-addr: 75.75.75.75
forward-addr: 75.75.76.76 -
So all the options work correctly now?
-
I've never had an issue with forward zones taking. Bryan, where did you get the syntax document? Is it for the unbound package or unbound stand-alone, two different animals. And your work begs another question. Do the custom options override the GUI settings or cause unbound to not start?
Guess I'll have to do some testing myself. Looks like forward zones no longer make it from the GUI to the config file. If so, the GUI notes below the custom options box is in need of editing to clarify the syntax required.
-
-
Yes that was a mistake. Thanks @bryan.paradis. Fix pushed.
-
I stand corrected, the old syntax is still putting forward zones in the config file. Options are pushed way down with the recent expansion of reserve leases and hostnames. Thanks for clarifying the syntax bryan.
-
I've never had an issue with forward zones taking. Bryan, where did you get the syntax document? Is it for the unbound package or unbound stand-alone, two different animals. And your work begs another question. Do the custom options override the GUI settings or cause unbound to not start?
Guess I'll have to do some testing myself. Looks like forward zones no longer make it from the GUI to the config file. If so, the GUI notes below the custom options box is in need of editing to clarify the syntax required.
Forward zones would take but the custom options are being put in the forward zones clause area and not in the server clause area causing errors if you add any.
I stand corrected, the old syntax is still putting forward zones in the config file. Options are pushed way down with the recent expansion of reserve leases and hostnames. Thanks for clarifying the syntax bryan.
GUI generates a config file in unbound.inc out of what you fill out which is then what unbound uses. Just like the standalone.
Yes that was a mistake. Thanks @bryan.paradis. Fix pushed.
:) Your welcome
-
Thanks for clarifying Bryan. Wagonza, either it's not installing correctly or the unbound fix broke the service. When I install the package it always fails the first time and shows installed but won't run. Reboot and reinstall pkg, then unbound starts but doesn't resolve 100%. Hit'n'miss on the queries. Some webpages load, via google links all connections would fail. Had to point router to backup Unbound service on another box.
When I finally get it to install it shows in GUI as 1.4.21_3 just as it does in the available packages list. When I uninstall it the script reports it's uninstalling 1.4.21_1. Leaving remnants behind? Also notice watchdog leaves unbound in it's list and fills the log. Maybe its normal the uninstall wouldn't remove a watchdog entry.
And I'm still not clear when it can't install the unbound pkg from pfsense server that it doesn't use a cached copy of the package from local drive like the pkg installer says it will do. When unbound acts up its very hard to fix PfSense since all web updates are reliant on it. I'm going to look into putting unbound on an embedded linux box and forget it as a PfSense package at least until such time as it gets a thorough looking over.
On the bright side, outgoing-num-tcp & incoming-num-tcp GUI entries are now sticky.
-
Interesting…looks like you may have remnants of an old package lying around which might be the cause of your problems.
The fact that Watchdog still has it in its list is a good indicator of this.Sorry you have had problems with the package its been kind(er) to others.
Its going into 2.2 as a replacement for DNSMasq so no longer will it be a package. Might be a better experience for you then. -
Just noting that I reinstalled unbound multiple times on multiple boxes without any problems whatsoever after the latest batch of commits… So yeah, you probably have some state junk leftovers on your box.
-
States get reset on reboot, no? Don't think it's states unless only a state reset will do. So I should console ipkg list then ipkg remove package.name? Or is more cleanup needed?
-
Check your config.xml for multiple entries for Unbound.
Look between <installedpackages>xml tags.</installedpackages> -
./conf.default/config.xml or ./cf/conf/config.xml?
-
The latter one.
-
./conf.default/config.xml or ./cf/conf/config.xml?
Same thing /conf is a link of /cf/conf
mark62 are you running pfsense 2.1 that has been upgraded? Likely you need to manually clean out unbound.
Uninstall unbound
Turn on rw
Find / -name *unbound*
Delete everything you can find
/conf/config.XML clear out all everything to do with unbound. Backup first maybe.
Once you are sure you have killed everything reinstall.
If you have problems with internet try adding a DNS to resolv.conf -
./conf.default/config.xml or ./cf/conf/config.xml?
Same thing /conf is a link of /cf/conf
Yeah but /conf.default is not the same thing thats used, as an example, for reverting to factory defaults.
-
./conf.default/config.xml or ./cf/conf/config.xml?
Same thing /conf is a link of /cf/conf
Yeah but /conf.default is not the same thing thats used for factory defaults.
Haha whoops Justin woke UP didn't notice default