DNS Resolver

raab

Has anyone run namebench using unbound? It felt like DNS lookups were happening slower than what I'd seen with dnsmasq on 2.1.5 and Tomato USB so decided to give it a go, these were the results:

dnsmasq (2.2): https://dl.dropboxusercontent.com/u/90391152/pfsense/namebench_dnsmasq.html

unbound (recursive): https://dl.dropboxusercontent.com/u/90391152/pfsense/namebench_unbound_recursive.html

unbound (forward): https://dl.dropboxusercontent.com/u/90391152/pfsense/namebench_unbound_forward.html

Don't really know how to take these results other than dnsmasq appears to be the fastest, thoughts?

wagonza

@raab:

Has anyone run namebench using unbound? It felt like DNS lookups were happening slower than what I'd seen with dnsmasq on 2.1.5 and Tomato USB so decided to give it a go, these were the results:

dnsmasq (2.2): https://dl.dropboxusercontent.com/u/90391152/pfsense/namebench_dnsmasq.html

unbound (recursive): https://dl.dropboxusercontent.com/u/90391152/pfsense/namebench_unbound_recursive.html

unbound (forward): https://dl.dropboxusercontent.com/u/90391152/pfsense/namebench_unbound_forward.html

Don't really know how to take these results other than dnsmasq appears to be the fastest, thoughts?

Well thats expected you can't compare the two.

DNSMasq is a forwarder and Unbound is a resolver. There is a lot to consider including how your Unbound service is configured e.g. DNSSec enabled?
So Unbound performs the task of doing iterative queries as well as validating answers. DNSMasq does not and relies on another name server to do all the hard work of doing iterative queries etc.

wagonza

@markuhde:

@wagonza:

@markuhde:

Correct, but as far as I know it was the second WAN (the PPPoE one) going down (or changing IPs), not the primary WAN, that killed resolution. Also, why would it still answer queries from localhost but not from machines on the network?

Hmm that makes no sense if its doing recursion, your DNS traffic is going via the default route as Chris has mentioned. It would make sense if 'DNS Query Forwarding' and 'Allow DNS server list to be overridden by DHCP/PPP on WAN' was enabled, and the traffic to those DNS servers were going via the PPPoE connection. Any chance those were enabled at the time?

Nope, and to clarify, it didn't just kill it while it was down (or IP changed) - it KILLED it, needed to restart the service to get it resolving again. I gave up for now, back to DNSmasq.

Ok thanks you gave me an idea of where the problem could be but I would need to test to confirm.

raab

dnssec was disabled

Does the option under DNS resolver "Enable forwarding mode" not do the same thing as dnsmasq?

q54e3w

Couple of small issues I spotted it tuning up my Resolver in build dated December 28th.

In Resolver>General Settings>Advanced, parameters which include double quotes require a space on the end of each line to enforce the carriage return, i.e

local-data: "example1.com A 10.10.10.1"
local-data: "example2.com A 10.10.10.1"
local-data: "example3.com A 10.10.10.1"

Save & Apply, migrate away and back to the General settings page and you will see they have been reduced to one line.

Also, not sure if this is a real issue, on advance settings page, when increasing the Message Cache Size, the associated RRset cache size isn't set correctly in the unbound.con file - not quite sure if its being internally handled correctly though.

phil.davis

I believe the double quotes carriage returns business has been fixed in later snapshots. Dec 28th was last year ;)

q54e3w

thx for the info Phil, I'll upgrade as soon as get a clear moment.

wagonza

@raab:

dnssec was disabled

Does the option under DNS resolver "Enable forwarding mode" not do the same thing as dnsmasq?

Yes it does, Unbound then forwards all queries to the addresses defined and lets that server handle the recursion. However the other factors to consider are, for example, how the cache is tuned, prefetching enabled and other settings which are different or don't exist in dnsmasq.

Thanks for the tests though I should attempt the same and see what I can come up with.

raab

Good to know, just want to make it clear that I'm not knocking unbound at all.

I just wanted to see if there was any difference, granted I've done no tuning of unbound yet

q54e3w

Hi guys, Unbound has been working really well for me. I've been using unbound to filter some web sites using the advanced options of unbound which works really well. It it possible to apply these filters to only a subset of all my available subnets? For example, I'd like my VPN and wifi subnets to scrub adverts and tracking but for my 'clearnet' LAN subnet to ignore these filters.

For example, i have redirects for Adverts configured as so….

local-data: "www.google-analytics.com A 10.10.10.1"
local-data: "click01.aditic.net A 10.10.10.1"

johnpoz

How are you getting these to work.. No matter what I try putting in the advanced section of the resolver, it won't start if anything is in there.

So for test I put exactly what you put in
local-data: "click01.aditic.net A 10.10.10.1"

But unbound will not start if I put that in the advanced section.

doktornotor

server:
local-data: "click01.aditic.net A 10.10.10.1"

johnpoz

that works! Thanks - is that documented somewhere? I can add this to docs for the resolver advanced stuff. This will answer the questions about how to easy load in stuff vs using the gui when you have lots of host over rides as well.

doktornotor

@johnpoz:

Thanks - is that documented somewhere?

Not that I'm aware of.

johnpoz

Well I added a bit of info to https://doc.pfsense.org/index.php/Unbound_DNS_Resolver about it. If I can find more info on the reason for that will be happy to update the wiki.

doktornotor

@johnpoz:

If I can find more info on the reason for that

https://www.unbound.net/documentation/unbound.conf.html

Afraid unless someone's willing to recode the pfSense code per the manpage to stick various advanced options to respective clauses as required, people will have to specify that themselves.

dstroot

Wow - I have been putting things in "advanced" and anything in there caused unbound to not come up. I just thought there was something wrong with what I was doing. Just tried adding 'server:" and it worked!!

doktornotor

I think this should be presented as a bold red hint in the GUI. Not just the wiki. Apparently people have no idea how's this supposed to work. Worth a bug IMO.

Hugovsky

I've found that I had to use the "server:" by accident. I'm using this to block dns from ads and spyware. Just make a file and put it at /conf folder to survive updates. Then, use this syntax:

server:
include: /conf/local-blocking-data.conf
include: ………
….

and it works. Free ad internet.

the file itself is in this format:

local-data: "000freexxx.com A 0.0.0.0"
local-data: "004.frnl.de A 0.0.0.0"
local-data: "01sexe.com A 0.0.0.0"
local-data: "01viral.com A 0.0.0.0"
local-data: "039068a.dialer-select.com A 0.0.0.0"
local-data: "0427d7.se A 0.0.0.0"
local-data: "0702.de A 0.0.0.0"
……

I use a script to generate it from varius sources like http://pgl.yoyo.org/adservers/ or https://github.com/jodrell/unbound-block-hosts.

Hugovsky

But there seems to be something wrong. If I use advanced options, I can't use "Register DHCP leases in the DNS Resolver" enabled. Although it works fine.