• Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login
Netgate Discussion Forum
  • Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login

Unbound TCP buffer settings not sticky

Scheduled Pinned Locked Moved pfSense Packages
85 Posts 5 Posters 23.7k Views
Loading More Posts
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • M
    markn62
    last edited by Mar 4, 2014, 7:28 PM

    Thanks Bryan for the explaination.  I have 8GB ram serving ~200 PC users.  An outgoing range of 900 on a single thread works fine on a stand-alone Unbound service in a 2G P4 box w/ 2G ram.  The GUI doesn't allow setting the outgoing range but does so automatically at the 8192 number, as I recall.  Setting a custom outgoing range in the Unbound Options causes the service to not start, or at least it did.  This was my original concern when I first tried the Unbound package last year using my script from the P4, unbound has limited tuning as a package.

    If it's automatic then perhaps I shouldn't be concerned.  I'll plan an early AM restart of Unbound without a separate watchdog service active and see if the wheels stay on.  The only other post-upgrade change made was incoming/outgoing buffers from 10 to 0 now that they reflect in the XML.

    1 Reply Last reply Reply Quote 0
    • W
      wagonza
      last edited by Mar 4, 2014, 7:40 PM Mar 4, 2014, 7:33 PM

      @Markn62 follow @bryan.paradis' advice. You can try reduce the number of buffers it uses and other resources.
      The outgoing-range is a bit high and that value is automatically calculated based on Unbound docs.
      So possibly the maths is wrong….

      ermm nope for some reason it has the value 8192 hard coded o_0.

      Will fix that

      Follow me on twitter http://twitter.com/wagonza
      http://www.thepackethub.co.za

      1 Reply Last reply Reply Quote 0
      • B
        bryan.paradis
        last edited by Mar 4, 2014, 7:37 PM

        @markn62:

        Thanks Bryan for the explaination.  I have 8GB ram serving ~200 PC users.  An outgoing range of 900 on a single thread works fine on a stand-alone Unbound service in a 2G P4 box w/ 2G ram.  The GUI doesn't allow setting the outgoing range but does so automatically at the 8192 number, as I recall.  Setting a custom outgoing range in the Unbound Options causes the service to not start, or at least it did.  This was my original concern when I first tried the Unbound package last year using my script from the P4, unbound has limited tuning as a package.

        If it's automatic then perhaps I shouldn't be concerned.  I'll plan an early AM restart of Unbound without a separate watchdog service active and see if the wheels stay on.  The only other post-upgrade change made was incoming/outgoing buffers from 10 to 0 now that they reflect in the XML.

        Unbound works well for others with 8192 default.
        Unbound not working for you.
        Try running without changing outgoing.

        If that works having dupliccate of that setting in the conf file may be the issue. Remedy d be to edit the. Inc

        1 Reply Last reply Reply Quote 0
        • W
          wagonza
          last edited by Mar 4, 2014, 7:47 PM

          Mark - i need to go through a few things again and will update the package. So look for an update sometime to tomorrow.

          There was a problem where Unbound wasnt compiled with Libevent and the value of 8192 would not work for those environments.
          Afair it was fixed about 3 versions ago.

          Ill also add the outgoing-range to the advanced section - pop me a message with any other options you would want to see in the GUI.

          Follow me on twitter http://twitter.com/wagonza
          http://www.thepackethub.co.za

          1 Reply Last reply Reply Quote 0
          • B
            bryan.paradis
            last edited by Mar 4, 2014, 9:38 PM

            @wagonza:

            Mark - i need to go through a few things again and will update the package. So look for an update sometime to tomorrow.

            There was a problem where Unbound wasnt compiled with Libevent and the value of 8192 would not work for those environments.
            Afair it was fixed about 3 versions ago.

            Ill also add the outgoing-range to the advanced section - pop me a message with any other options you would want to see in the GUI.

            It might be the duplicate lines in the configuration from the hardcoded + custom ones.

            Mark you should pastebin your resolver.log so we can have a look. It should have all the unbound error information.

            1 Reply Last reply Reply Quote 0
            • B
              bryan.paradis
              last edited by Mar 4, 2014, 10:28 PM

              Could you give us the output of

              
              limits
              
              
              1 Reply Last reply Reply Quote 0
              • M
                markn62
                last edited by Mar 4, 2014, 11:38 PM

                @wagonza:

                Mark - i need to go through a few things again and will update the package. So look for an update sometime to tomorrow.

                Ill also add the outgoing-range to the advanced section - pop me a message with any other options you would want to see in the GUI.

                Wogonza,
                The following are some of the customs I've needed in other non-pkg'd unbound services.  Outgoing has been addressed.  PfSense appears to calculate threads and slabs based on the number of cores detected, but some may want to only use one core in a multi-core.  Not sure how Unbound pkg currently determines num-queries-per-thread.  This may be a good candidate for options detuning.  I don't see how ip6 can be set to no.  Unbound doesn't seem to take it from elsewhere that IPv6 has been disabled. So either it should or needs to be added to custom.  The do-tcp:no is now handled by a value of zero in outgoing-num-tcp and incoming-num-tcp.  Private address I believe is handled in the GUI by the third tab "ACL", doing this from memory best I can.  And forwards are already in custom.  So-rcv/sndbuf is rem'd out in the script and no GUI entry for them.  Not sure why they get put in the script and not used.

                So the asterisk items I offer for your consideration as the most needed ones.

                *outgoing-range:

                num-threads:
                msg-cache-slabs:
                rrset-cache-slabs:
                infra-cache-slabs:
                key-cache-slabs:
                *num-queries-per-thread:

                *do-ip4:
                *do-ip6:
                *do-udp:
                *do-tcp:

                private-address:

                forward-zone:
                name:
                forward-addr:

                *so-rcvbuf:
                *so-sndbuf:

                1 Reply Last reply Reply Quote 0
                • M
                  markn62
                  last edited by Mar 4, 2014, 11:49 PM

                  @bryan.paradis:

                  Mark you should pastebin your resolver.log so we can have a look. It should have all the unbound error information.

                  Bryan, The resolver.log only has a few lines of DnsForwarder outputs in it currently. From what I've seen the SNMP log, already pastebinned, has everything the resolver file had in it.  Otherwise, I'll have to get this to you after I try restarting Unbound.  This may be after Wagonza updates the package unless it's needed sooner.

                  1 Reply Last reply Reply Quote 0
                  • M
                    markn62
                    last edited by Mar 5, 2014, 12:01 AM

                    @bryan.paradis:

                    Could you give us the output of limits

                    Bryan, were you asking this of me?  I tried logging into PfSense with WinScp, no go.  Tried logging on as root instead of admin using same password and also no go.  Using SCP port 22.  Ftp and Tftp didn't help.  Finally copy/pasted from SSH session.

                    Limits reports;

                    Resource limits (current):
                      cputime              infinity secs
                      filesize            infinity kB
                      datasize            33554432 kB
                      stacksize              524288 kB
                      coredumpsize        infinity kB
                      memoryuse            infinity kB
                      memorylocked        infinity kB
                      maxprocesses            5547
                      openfiles              11095
                      sbsize              infinity bytes
                      vmemoryuse          infinity kB
                      pseudo-terminals    infinity
                      swapuse              infinity kB

                    1 Reply Last reply Reply Quote 0
                    • B
                      bryan.paradis
                      last edited by Mar 5, 2014, 12:46 AM Mar 5, 2014, 12:40 AM

                      @markn62:

                      @bryan.paradis:

                      Mark you should pastebin your resolver.log so we can have a look. It should have all the unbound error information.

                      Bryan, The resolver.log only has a few lines of DnsForwarder outputs in it currently. From what I've seen the SNMP log, already pastebinned, has everything the resolver file had in it.  Otherwise, I'll have to get this to you after I try restarting Unbound.  This may be after Wagonza updates the package unless it's needed sooner.

                      I get stuff like this in my resolver.log after unbound is installed. Looks about the same so I suppose you are right but I was getting parse errors and other things when my service wouldn't start.

                      Mar 4 22:12:59	unbound: [24172:0] info: service stopped (unbound 1.4.21).
                      Mar 4 22:12:59	unbound: [24172:0] info: server stats for thread 0: 0 queries, 0 answers from cache, 0 recursions, 0 prefetch
                      Mar 4 22:12:59	unbound: [24172:0] info: server stats for thread 0: requestlist max 0 avg 0 exceeded 0 jostled 0
                      Mar 4 22:16:22	unbound: [44092:0] notice: init module 0: iterator
                      Mar 4 22:16:22	unbound: [44092:0] info: start of service (unbound 1.4.21).
                      Mar 4 22:18:20	unbound: [44092:0] info: service stopped (unbound 1.4.21).
                      Mar 4 22:18:20	unbound: [44092:0] info: server stats for thread 0: 0 queries, 0 answers from cache, 0 recursions, 0 prefetch
                      Mar 4 22:18:20	unbound: [44092:0] info: server stats for thread 0: requestlist max 0 avg 0 exceeded 0 jostled 0
                      Mar 4 22:18:26	unbound: [88348:0] notice: init module 0: iterator
                      Mar 4 22:18:26	unbound: [88348:0] info: start of service (unbound 1.4.21).
                      Mar 4 22:19:10	unbound: [88348:0] info: service stopped (unbound 1.4.21).
                      Mar 4 22:19:10	unbound: [88348:0] info: server stats for thread 0: 0 queries, 0 answers from cache, 0 recursions, 0 prefetch
                      Mar 4 22:19:10	unbound: [88348:0] info: server stats for thread 0: requestlist max 0 avg 0 exceeded 0 jostled 0
                      Mar 4 22:19:13	unbound: [12458:0] notice: init module 0: iterator
                      Mar 4 22:19:13	unbound: [12458:0] info: start of service (unbound 1.4.21).
                      Mar 4 22:19:13	unbound: [12458:0] info: 192.168.55.3 pfsense.localdomain. A IN
                      Mar 4 22:19:13	unbound: [12458:0] info: 192.168.55.3 pfsense.localdomain.dev.localdomain. A IN
                      Mar 4 22:19:17	unbound: [12458:0] info: 192.168.55.3 0.pfsense.pool.ntp.org. AAAA IN
                      Mar 4 22:19:54	unbound: [12458:0] info: service stopped (unbound 1.4.21).
                      Mar 4 22:19:54	unbound: [12458:0] info: server stats for thread 0: 3 queries, 0 answers from cache, 3 recursions, 0 prefetch
                      Mar 4 22:19:54	unbound: [12458:0] info: server stats for thread 0: requestlist max 0 avg 0 exceeded 0 jostled 0
                      Mar 4 22:19:54	unbound: [12458:0] info: average recursion processing time 0.241851 sec
                      Mar 4 22:19:54	unbound: [12458:0] info: histogram of recursion processing times
                      Mar 4 22:19:54	unbound: [12458:0] info: [25%]=0 median[50%]=0 [75%]=0
                      Mar 4 22:19:54	unbound: [12458:0] info: lower(secs) upper(secs) recursions
                      Mar 4 22:19:54	unbound: [12458:0] info: 0.065536 0.131072 1
                      Mar 4 22:19:54	unbound: [12458:0] info: 0.131072 0.262144 1
                      Mar 4 22:19:54	unbound: [12458:0] info: 0.262144 0.524288 1
                      Mar 4 22:20:01	unbound: [44628:0] notice: init module 0: iterator
                      Mar 4 22:20:01	unbound: [44628:0] info: start of service (unbound 1.4.21).
                      Mar 4 22:24:02	unbound: [44628:0] info: service stopped (unbound 1.4.21).
                      Mar 4 22:24:02	unbound: [44628:0] info: server stats for thread 0: 0 queries, 0 answers from cache, 0 recursions, 0 prefetch
                      Mar 4 22:24:02	unbound: [44628:0] info: server stats for thread 0: requestlist max 0 avg 0 exceeded 0 jostled 0
                      Mar 4 22:24:08	unbound: [15496:0] notice: init module 0: iterator
                      Mar 4 22:24:08	unbound: [15496:0] info: start of service (unbound 1.4.21).
                      

                      @markn62:

                      @bryan.paradis:

                      Could you give us the output of limits

                      Bryan, were you asking this of me?  I tried logging into PfSense with WinScp, no go.  Tried logging on as root instead of admin using same password and also no go.  Using SCP port 22.  Ftp and Tftp didn't help.

                      Winscp should just work the same as SSH. Just use defaults and root then password.

                      @markn62:

                      Finally copy/pasted from SSH session.

                      Limits reports;

                      Resource limits (current):
                        cputime              infinity secs
                        filesize            infinity kB
                        datasize            33554432 kB
                        stacksize              524288 kB
                        coredumpsize        infinity kB
                        memoryuse            infinity kB
                        memorylocked        infinity kB
                        maxprocesses            5547
                        openfiles              11095
                        sbsize              infinity bytes
                        vmemoryuse          infinity kB
                        pseudo-terminals    infinity
                        swapuse              infinity kB

                      Yes exactly just ssh in and run the command. As you can see unbound is adjusting your openfiles. What is the output of this

                      sysctl -a | grep file
                      

                      I can't reproduce unbound wanting to increase openfiles. Either way it looks like it is normal if it thinks it is going to run out. Are you willing to paste your whole unbound.conf? Guess it is probably not there still?

                      Can you also give us an full output of:

                      ps aux
                      
                      1 Reply Last reply Reply Quote 0
                      • M
                        markn62
                        last edited by Mar 5, 2014, 4:25 PM Mar 5, 2014, 4:23 PM

                        @bryan.paradis:

                        Yes exactly just ssh in and run the command. As you can see unbound is adjusting your openfiles. What is the output of this
                        sysctl -a | grep file

                        I can't reproduce unbound wanting to increase open files. Either way it looks like it is normal if it thinks it is going to run out. Are you willing to paste your whole unbound.conf? Guess it is probably not there still?

                        Can you also give us an full output of:
                        ps aux

                        @Bryan
                        SysCtl
                        http://pastebin.com/embed_js.php?i=DczvR9Eq

                        PsAux
                        http://pastebin.com/embed_js.php?i=sumekXMa

                        1 Reply Last reply Reply Quote 0
                        • M
                          markn62
                          last edited by Mar 6, 2014, 5:24 PM

                          I uninstalled/reinstalled the Unbound pkg last night at 9PM PST.  Not sure if Wagonza's changes were a part of the pkg download. The PfSense server downloaded ver _21 again.  Launched this morning after disabling the forwarder and all seems well except I couldn't log into forum.pfsense.org.  I have in the DNS forwarder host overrides;
                          pfsense.com=66.219.34.171
                          files.pfsense.org=66.111.2.167

                          If you recall adding hostnames was recommended earlier in this thread as a way to recover Unbound from the PfSense server when Unbound won't start.

                          So I thought well maybe I need to add;
                          pfsense.org=192.207.126.26

                          I entered into the forwarder then disabled unbound then enabled the forwarder to populate the changes so Unbound could pick it up from the revised hosts file.  Then I reversed the services never having both services enabled at the same time.  It's at this time Unbound refused to start again and I had to revert back to the forwarder pointing to another Win box running Unbound.

                          Is this strike 3?

                          1 Reply Last reply Reply Quote 0
                          • B
                            bryan.paradis
                            last edited by Mar 6, 2014, 5:27 PM

                            @markn62:

                            I uninstalled/reinstalled the Unbound pkg last night at 9PM PST.  Not sure if Wagonza's changes were a part of the pkg download. The PfSense server downloaded ver _21 again.  Launched this morning after disabling the forwarder and all seems well except I couldn't log into forum.pfsense.org.  I have in the DNS forwarder host overrides;
                            pfsense.com=66.219.34.171
                            files.pfsense.org=66.111.2.167

                            If you recall adding hostnames was recommended earlier in this thread as a way to recover Unbound from the PfSense server when Unbound won't start.

                            So I thought well maybe I need to add;
                            pfsense.org=192.207.126.26

                            I entered into the forwarder then disabled unbound then enabled the forwarder to populate the changes so Unbound could pick it up from the revised hosts file.  Then I reversed the services never having both services enabled at the same time.  It's at this time Unbound refused to start again and I had to revert back to the forwarder pointing to another Win box running Unbound.

                            Is this strike 3?

                            Why would you start the forwarder again? There has not be something telling us why unbound is not starting. You gave us zero information. ps aux while trying to start unbound? resolver.log? What does it say when you try to start unbound manually? Are you sure DNS Forwarder is off before trying to restart unbound?

                            1 Reply Last reply Reply Quote 0
                            • M
                              markn62
                              last edited by Mar 6, 2014, 5:51 PM

                              As I mentioned, I started the Forwarder again to populate the hosts that Unbound recognizes.  Restarting Unbound didn't pick up the host override entered in the Forwarder.  The PfSense docs I read said that Unbound gets it's overrides from the Forwarder entries.  Once Unbound quit I had to hurriedly get the system back online.  No time to collect ps.aux or logs.  I'll schedule this again for 4AM instead of 7AM when I can tolerate more downtime and get what you ask for and when I can reboot the router to perhaps clear port 53 in the event a disabled Forwarder doesn't release the port as it should.  I underlined so you don't misunderstand that I know this was why Unbound didn't start.  I don't know at this time.

                              I did say this was an online system right? I won't bother posting again unless I can fully document the results.
                              Sorry for the bother…

                              1 Reply Last reply Reply Quote 0
                              • D
                                doktornotor Banned
                                last edited by Mar 6, 2014, 5:57 PM

                                @markn62:

                                As I mentioned, I started the Forwarder again to populate the hosts that Unbound recognizes.  Restarting Unbound didn't pick up the host override entered in the Forwarder.

                                No such thing needed. Frankly, with all your issues noone's able to reproduce, I'd recommend to flatten and rebuild the box from scratch.

                                1 Reply Last reply Reply Quote 0
                                • B
                                  bryan.paradis
                                  last edited by Mar 6, 2014, 6:18 PM Mar 6, 2014, 6:07 PM

                                  @markn62:

                                  As I mentioned, I started the Forwarder again to populate the hosts that Unbound recognizes.  Restarting Unbound didn't pick up the host override entered in the Forwarder.  The PfSense docs I read said that Unbound gets it's overrides from the Forwarder entries.

                                  You do not need to turn on the DNS Forwarder service to get the host overrides to populate. Unbound reads them from the config.xml everytime you cause the unbound.conf to be generated.

                                  1. Add overrides
                                  2. Press save & apply changes
                                  3. Go to services unbound -> save config and it will regenerate config and restart
                                  4. Check unbound status tab to see your host overrides as local data records

                                  I mean maybe wagonza can make it regen config on service restart would seem clearer. It has nothing to do with starting dnsmasq it just it shares the page with DNS Forwarder and is read by unbound. Below what I saw following steps above.

                                  # DNSMasq Host overrides
                                  local-data-ptr: "192.168.55.7 test.fudzilla.com"
                                  local-data: "test.fudzilla.com IN A 192.168.55.7"
                                  
                                  

                                  Pertinent code: Everything in hosts file has a function here and unbound does it when it generates its conf. no need for dnsmasq to be running.

                                  function read_hosts() {
                                  
                                  	// Open /etc/hosts and extract the only dhcpleases info
                                  	$etc_hosts = array();
                                  	foreach (file('/etc/hosts') as $line) {
                                  		$d = preg_split('/\s/', $line, -1, PREG_SPLIT_NO_EMPTY);
                                  		if (empty($d) || substr(reset($d), 0, 1) == "#")
                                  			continue;
                                  		if ($d[3] == "#") {
                                  			$ip = array_shift($d);
                                  			$fqdn = array_shift($d);
                                  			$name = array_shift($d);
                                  			if ($fqdn != "empty") {
                                  				if ($name != "empty")
                                  					array_push($etc_hosts, array(ipaddr => "$ip", fqdn => "$fqdn", name => "$name"));
                                  				else
                                  					array_push($etc_hosts, array(ipaddr => "$ip", fqdn => "$fqdn"));
                                  			}
                                  		}
                                  	}
                                  	return $etc_hosts;
                                  }
                                  
                                  /*
                                   * Setup /etc/hosts entries by overriding with local-data
                                   */
                                  function unbound_add_host_entries() {
                                  	global $config;
                                  
                                  	/* XXX: break this out into a separate config file and make use of include */
                                  	$unboundcfg = $config['installedpackages']['unbound']['config'][0];
                                  	$syscfg = $config['system'];
                                  	$dnsmasqcfg = $config['dnsmasq'];
                                  
                                  	$unbound_entries = "local-zone: \"{$syscfg['domain']}\" transparent\n";
                                  	// IPv4 entries
                                  	$unbound_entries .= "local-data-ptr: \"127.0.0.1 localhost\"\n";
                                  	$unbound_entries .= "local-data: \"localhost A 127.0.0.1\"\n";
                                  	$unbound_entries .= "local-data: \"localhost.{$syscfg['domain']} A 127.0.0.1\"\n";
                                  	// IPv6 entries
                                  	if(function_exists("is_ipaddrv6")) {
                                  		$unbound_entries .= "local-data-ptr: \"::1 localhost\"\n";
                                  		$unbound_entries .= "local-data: \"localhost AAAA ::1\"\n";
                                  		$unbound_entries .= "local-data: \"localhost.{$syscfg['domain']} AAAA ::1\"\n";
                                  	}
                                  
                                  	$added_item_v4 = array();
                                  	$added_item_v6 = array();
                                  	if ($config['interfaces']['lan']) {
                                  		$current_host = $syscfg['hostname'].".".$syscfg['domain'];
                                  		$cfgip = get_interface_ip("lan");
                                  		if (is_ipaddr($cfgip)) {
                                  			$unbound_entries .= "local-data-ptr: \"{$cfgip} {$current_host}\"\n";
                                  			$unbound_entries .= "local-data: \"{$current_host} A {$cfgip}\"\n";
                                  			$unbound_entries .= "local-data: \"{$syscfg['hostname']} A {$cfgip}\"\n";
                                  			$added_item_v4[$current_host] = true;
                                  		}
                                  		$cfgip6 = get_interface_ipv6("lan");
                                  		if (is_ipaddrv6($cfgip6)) {
                                  			$unbound_entries .= "local-data-ptr: \"{$cfgip6} {$current_host}\"\n";
                                  			$unbound_entries .= "local-data: \"{$current_host} AAAA {$cfgip6}\"\n";
                                  			$unbound_entries .= "local-data: \"{$syscfg['hostname']} AAAA {$cfgip6}\"\n";
                                  			$added_item_v6[$current_host] = true;
                                  		}
                                  	} else {
                                  		$sysiflist = get_configured_interface_list();
                                  		foreach ($sysiflist as $sysif) {
                                  			if (!interface_has_gateway($sysif)) {
                                  				$current_host = $syscfg['hostname'].".".$syscfg['domain'];
                                  				$cfgip = get_interface_ip($sysif);
                                  				if (is_ipaddr($cfgip)) {
                                  					$unbound_entries .= "local-data-ptr: \"{$cfgip} {$current_host}\"\n";
                                  					$unbound_entries .= "local-data: \"{$current_host} A {$cfgip}\"\n";
                                  					$unbound_entries .= "local-data: \"{$syscfg['hostname']} A {$cfgip}\"\n";
                                  					$added_item_v4[$current_host] = true;
                                  				}
                                  				$cfgip6 = get_interface_ipv6($sysif);
                                  				if (is_ipaddr($cfgip6)) {
                                  					$unbound_entries .= "local-data-ptr: \"{$cfgip6} {$current_host}\"\n";
                                  					$unbound_entries .= "local-data: \"{$current_host} AAAA {$cfgip6}\"\n";
                                  					$unbound_entries .= "local-data: \"{$syscfg['hostname']} AAAA {$cfgip6}\"\n";
                                  					$added_item_v6[$current_host] = true;
                                  				}
                                  				if (is_ipaddr($cfgip) || is_ipaddr($cfgip6))
                                  					break;
                                  			}
                                  		}
                                  	}
                                  
                                  	// DNSMasq entries static host entries
                                  	if (isset($dnsmasqcfg['hosts'])) {
                                  		$hosts = $dnsmasqcfg['hosts'];
                                  		$host_entries = "# DNSMasq Host overrides\n";
                                  		$added_item = array();
                                  		foreach ($hosts as $host) {
                                  			$current_host = ($host['host'] != "") ? $host['host'].".".$host['domain'] : $host['domain'];
                                  			if (function_exists("is_ipaddrv6") && is_ipaddrv6($host['ip'])) {
                                  				if (!$added_item_v6[$current_host]) {
                                  					$host_entries .= "local-data-ptr: \"{$host['ip']} {$current_host}\"\n";
                                  					$host_entries .= "local-data: \"{$current_host} IN AAAA {$host['ip']}\"\n";
                                  					$added_item_v6[$current_host] = true;
                                  				}
                                  				if ($host['aliases']['item'] && is_array($host['aliases']['item']))
                                  					foreach ($host['aliases']['item'] as $alias) {
                                  						$current_alias = ($alias['host'] != "") ? $alias['host'].".".$alias['domain'] : $alias['domain'];
                                  						if (!$added_item_v6[$current_alias]) {
                                  							$host_entries .= "local-data: \"{$current_alias} IN AAAA {$host['ip']}\"\n";
                                  							$added_item_v6[$current_alias] = true;
                                  							if ((!$added_item[$current_alias]) && (!empty($alias['description'])) && ($unboundcfg['txtsupport'] == 'on')) {
                                  								$host_entries .= "local-data: '{$current_alias} TXT \"".addslashes($alias['description'])."\"'\n";
                                  								$added_item[$current_alias] = true;
                                  							}
                                  						}
                                  					}
                                  			} else {
                                  				if (!$added_item_v4[$current_host]) {
                                  					$host_entries .= "local-data-ptr: \"{$host['ip']} {$current_host}\"\n";
                                  					$host_entries .= "local-data: \"{$current_host} IN A {$host['ip']}\"\n";
                                  					$added_item_v4[$current_host] = true;
                                  				}
                                  				if ($host['aliases']['item'] && is_array($host['aliases']['item']))
                                  					foreach ($host['aliases']['item'] as $alias) {
                                  						$current_alias = ($alias['host'] != "") ? $alias['host'].".".$alias['domain'] : $alias['domain'];
                                  						if (!$added_item_v4[$current_alias]) {
                                  							$host_entries .= "local-data: \"{$current_alias} IN A {$host['ip']}\"\n";
                                  							$added_item_v4[$current_alias] = true;
                                  							if ((!$added_item[$current_alias]) && (!empty($alias['description'])) && ($unboundcfg['txtsupport'] == 'on')) {
                                  								$host_entries .= "local-data: '{$current_alias} TXT \"".addslashes($alias['description'])."\"'\n";
                                  								$added_item[$current_alias] = true;
                                  							}
                                  						}
                                  					}
                                  			}
                                  			if ((!$added_item[$current_host]) && (!empty($host['descr'])) && ($unboundcfg['txtsupport'] == 'on')) {
                                  				$host_entries .= "local-data: '{$current_host} TXT \"".addslashes($host['descr'])."\"'\n";
                                  				$added_item[$current_host] = true;
                                  			}
                                  		}
                                  		$unbound_entries .= $host_entries;
                                  	}
                                  
                                  	// Static DHCP entries
                                  	$host_entries = "# DHCP Reservations\n";
                                  	if (isset($unboundcfg['regdhcpstatic']) && is_array($config['dhcpd'])) {
                                  		foreach ($config['dhcpd'] as $dhcpif => $dhcpifconf)
                                  			if(is_array($dhcpifconf['staticmap']) && isset($dhcpifconf['enable']))
                                  				foreach ($dhcpifconf['staticmap'] as $host)
                                  					if ($host['ipaddr'] && $host['hostname']) {
                                  						$current_host = $host['hostname'].".".$syscfg['domain'];
                                  						if (!$added_item_v4[$current_host]) {
                                  							$host_entries .= "local-data-ptr: \"{$host['ipaddr']} {$current_host}\"\n";
                                  							$host_entries .= "local-data: \"{$current_host} IN A {$host['ipaddr']}\"\n";
                                  							$added_item_v4[$current_host] = true;
                                  							if ((!$added_item[$current_host]) && (!empty($host['descr'])) && ($unboundcfg['txtsupport'] == 'on')) {
                                  								$host_entries .= "local-data: '{$host['hostname']}.{$syscfg['domain']} TXT \"".addslashes($host['descr'])."\"'\n";
                                  								$added_item[$current_host] = true;
                                  							}
                                  						}
                                  					}
                                  		$unbound_entries .= $host_entries;
                                  	}
                                  
                                  	// Static DHCPv6 entries
                                  	$host_entries = "# DHCPv6 reservations\n";
                                  	if (isset($unboundcfg['regdhcpstatic']) && is_array($config['dhcpdv6'])) {
                                  		foreach ($config['dhcpdv6'] as $dhcpif => $dhcpifconf)
                                  			if(is_array($dhcpifconf['staticmap']) && isset($dhcpifconf['enable']))
                                  				foreach ($dhcpifconf['staticmap'] as $host)
                                  					if ($host['ipaddrv6'] && $host['hostname']) {
                                  						$current_host = $host['hostname'].".".$syscfg['domain'];
                                  						if (!$added_item_v6[$current_host]) {
                                  							$host_entries .= "local-data-ptr: \"{$host['ipaddrv6']} {$current_host}\"\n";
                                  							$host_entries .= "local-data: \"{$current_host} IN AAAA {$host['ipaddrv6']}\"\n";
                                  							$added_item_v6[$current_host] = true;
                                  							if ((!$added_item[$current_host]) && (!empty($host['descr'])) && ($unboundcfg['txtsupport'] == 'on')) {
                                  								$host_entries .= "local-data: '{$host['hostname']}.{$syscfg['domain']} TXT \"".addslashes($host['descr'])."\"'\n";
                                  								$added_item[$current_host] = true;
                                  							}
                                  						}
                                  					}
                                  		$unbound_entries .= $host_entries;
                                  	}
                                  
                                  	// Handle DHCPLeases added host entries
                                  	$dhcplcfg = read_hosts();
                                  	$host_entries = "# /etc/hosts entries\n";
                                  	if(is_array($dhcplcfg)) {
                                  		foreach($dhcplcfg as $key=>$host) {
                                  			$current_host = $host['fqdn'];
                                  			if (function_exists("is_ipaddrv6") && is_ipaddrv6($host['ipaddr'])) {
                                  				if (!$added_item_v6[$current_host]) {
                                  					$host_entries .= "local-data-ptr: \"{$host['ipaddr']} {$host['fqdn']}\"\n";
                                  					$host_entries .= "local-data: \"{$host['fqdn']} IN AAAA {$host['ipaddr']}\"\n";
                                  					$added_item_v6[$current_host] = true;
                                  					if ((!empty($host['name'])) && (!$added_item_v6[$host['name']])) {
                                  						$host_entries .= "local-data-ptr: \"{$host['ipaddr']} {$host['name']}\"\n";
                                  						$host_entries .= "local-data: \"{$host['name']} IN AAAA {$host['ipaddr']}\"\n";
                                  						$added_item_v6[$host['name']] = true;
                                  					}
                                  				}
                                  			} else {
                                  				if (!$added_item_v4[$current_host]) {
                                  					$host_entries .= "local-data-ptr: \"{$host['ipaddr']} {$host['fqdn']}\"\n";
                                  					$host_entries .= "local-data: \"{$host['fqdn']} IN A {$host['ipaddr']}\"\n";
                                  					$added_item_v4[$current_host] = true;
                                  					if ((!empty($host['name'])) && (!$added_item_v4[$host['name']])) {
                                  						$host_entries .= "local-data-ptr: \"{$host['ipaddr']} {$host['name']}\"\n";
                                  						$host_entries .= "local-data: \"{$host['name']} IN A {$host['ipaddr']}\"\n";
                                  						$added_item_v4[$host['name']] = true;
                                  					}
                                  				}
                                  			}
                                  		}
                                  		$unbound_entries .= $host_entries;
                                  	}
                                  
                                  	return $unbound_entries;
                                  }
                                  
                                  /* Setup any domain overrides that have been configured with stub-zone parameter
                                   */
                                  function unbound_add_domain_overrides($pvt=false) {
                                  	global $config;
                                  
                                  	if (isset($config['dnsmasq']['domainoverrides'])) {
                                  		$domains = $config['dnsmasq']['domainoverrides'];
                                  
                                  		// Domain overrides that have multiple entries need multiple stub-addr: added
                                  		$sorted_domains = msort($domains, "domain");
                                  		$result = array();
                                  		foreach($sorted_domains as $domain) {
                                  			$domain_key = current($domain);
                                  			if (!isset($result[$domain_key]))
                                  				$result[$domain_key] = array();
                                  			$result[$domain_key][] = $domain['ip'];
                                  		}
                                  
                                  		$domain_entries = "";
                                  		foreach($result as $domain=>$ips) {
                                  			if ($pvt == true) {
                                  				if (strpos($domain, "in-addr.arpa") !== false)
                                  					$domain_entries .= "local-zone: \"$domain\" transparent\n";
                                  				else
                                  					$domain_entries .= "private-domain: \"$domain\"\n";
                                  				if (isset($config['installedpackages']['unbound']['config'][0]['dnssec_status']))
                                  					$domain_entries .= "domain-insecure: \"$domain\"\n";
                                  			} else {
                                  				$domain_entries .= "stub-zone:\n";
                                  				$domain_entries .= "\tname: \"$domain\"\n";
                                  				foreach($ips as $ip)
                                  					$domain_entries .= "\tstub-addr: $ip\n";
                                  				$domain_entries .= "\tstub-prime: no\n";
                                  			}
                                  		}
                                  		return $domain_entries;
                                  	}
                                  }
                                  
                                  

                                  @markn62:

                                  Once Unbound quit I had to hurriedly get the system back online.  No time to collect ps.aux or logs.  I'll schedule this again for 4AM instead of 7AM when I can tolerate more downtime and get what you ask for and when I can reboot the router to perhaps clear port 53 in the event a disabled Forwarder doesn't release the port as it should.  I underlined so you don't misunderstand that I know this was why Unbound didn't start.  I don't know at this time.

                                  Yes it is probably the reason. I understand circumstances but having a second SSH open or third to launch a couple commands wouldn't hurt in the future as you are the one that needs the information after all  ;)

                                  @markn62:

                                  I did say this was an online system right? I won't bother posting again unless I can fully document the results.
                                  Sorry for the bother…

                                  I understand production. No hostility meant. It isn't the clearest process or setup in the GUI ever. That is the problem with abstracting things into a GUI sometimes stuff gets meshed together and without looking at code you have no idea what is going on.

                                  @doktornotor:

                                  No such thing needed. Frankly, with all your issues noone's able to reproduce, I'd recommend to flatten and rebuild the box from scratch.

                                  Don't think there is a need for this. I think it is just a misunderstanding. Think we have about everything covered now. Wagonza has fixed the conf generation clause order problem for custom options and probably this current problem as markn62 has noted that it was probably something to do with DNS Forwarder still running or something.

                                  1 Reply Last reply Reply Quote 0
                                  • W
                                    wagonza
                                    last edited by Mar 7, 2014, 8:01 AM

                                    @markn62:

                                    I uninstalled/reinstalled the Unbound pkg last night at 9PM PST.  Not sure if Wagonza's changes were a part of the pkg download. The PfSense server downloaded ver _21 again.

                                    Nope not yet.

                                    @markn62:

                                    Launched this morning after disabling the forwarder and all seems well except I couldn't log into forum.pfsense.org.  I have in the DNS forwarder host overrides;
                                    pfsense.com=66.219.34.171
                                    files.pfsense.org=66.111.2.167

                                    If you recall adding hostnames was recommended earlier in this thread as a way to recover Unbound from the PfSense server when Unbound won't start.

                                    So I thought well maybe I need to add;
                                    pfsense.org=192.207.126.26

                                    I entered into the forwarder then disabled unbound then enabled the forwarder to populate the changes so Unbound could pick it up from the revised hosts file.  Then I reversed the services never having both services enabled at the same time.  It's at this time Unbound refused to start again and I had to revert back to the forwarder pointing to another Win box running Unbound.

                                    Is this strike 3?

                                    You shouldn't need to do any of the above.

                                    Follow me on twitter http://twitter.com/wagonza
                                    http://www.thepackethub.co.za

                                    1 Reply Last reply Reply Quote 0
                                    • W
                                      wagonza
                                      last edited by Mar 7, 2014, 8:10 AM

                                      @bryan.paradis:

                                      I mean maybe wagonza can make it regen config on service restart would seem clearer. It has nothing to do with starting dnsmasq it just it shares the page with DNS Forwarder and is

                                      Only gonna happen in pfSense2.2.

                                      Follow me on twitter http://twitter.com/wagonza
                                      http://www.thepackethub.co.za

                                      1 Reply Last reply Reply Quote 0
                                      • B
                                        bryan.paradis
                                        last edited by Mar 8, 2014, 4:38 AM

                                        @wagonza:

                                        @bryan.paradis:

                                        I mean maybe wagonza can make it regen config on service restart would seem clearer. It has nothing to do with starting dnsmasq it just it shares the page with DNS Forwarder and is

                                        Only gonna happen in pfSense2.2.

                                        :) fair enough as it is getting integrated in.

                                        1 Reply Last reply Reply Quote 0
                                        • M
                                          markn62
                                          last edited by Mar 8, 2014, 7:05 PM

                                          Well I reinstalled unbound again @ 4AM.  Ran fine initially so I tried the option command "outgoing-range: 900" and it killed the service.  I thought Wagonza put this into the pkg.  I removed that and normal function returned.

                                          So I went back to bed until later this morning.  Complaints of *.org, *.info and *.co resolution started rolling in around 9AM.  Narrowed it down to the incoming/outgoing buffers.  When set to zero, .com, .net resolves but the others mentioned above do not.  So it appears these two parameters may not be doing what they're suppose to do, or doing more than is apparent in the GUI.  Suppose to ignore TCP and only use UDP.

                                          Doesn't make sense to me that with UDP only that DNS resolution would be selective by domain.

                                          1 Reply Last reply Reply Quote 0
                                          73 out of 85
                                          • First post
                                            73/85
                                            Last post
                                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.
                                            This community forum collects and processes your personal information.
                                            consent.not_received