Hi,
My unbound service won't start after upgrading from 26.1 to 26.1.1. I tried it with a clean install, but the same problem persist. I also tried upgrading to 26.1.2 and 26.1.3 with no success.
Unbound logs shows these error messages:
2026-03-04T17:01:08 Critical unbound [86957:0] fatal error: failed to init modules
2026-03-04T17:01:08 Error unbound [86957:0] error: module init for module python failed
2026-03-04T17:01:08 Error unbound [86957:0] error: python exception in Py_InitializeFromConfig: Failed to import encodings module
My machine is Protectli V1211 with coreboot firmware v0.9.4.
Any ideas?
Any extra repositories enabled? The normal reboot did go through? Anything in the health output?
I assume this is part of the Python 3.13 switch.
Cheers,
Franco
Can you grab "opnsense-update -g" output for me?
Thanks,
Franco
No extra plugins. Installed 26.1 image and everything works with defaults. Upgrade to 26.1.3, machine reboots and everything else works, but unbound is stopped and wont's start manually from gui.
thanks
Isn't the default DNSmasq, now?
Quote from: iddqd on March 04, 2026, 06:38:34 PMNo extra plugins. Installed 26.1 image and everything works with defaults. Upgrade to 26.1.3, machine reboots and everything else works, but unbound is stopped and wont's start manually from gui.
thanks
What is the output of
opnsense-update -p
root@OPNsense:~ # opnsense-update -p
Updating OPNsense repository catalogue...
OPNsense repository is up to date.
All repositories are up to date.
Updating OPNsense repository catalogue...
OPNsense repository is up to date.
All repositories are up to date.
Checking for upgrades (74 candidates): 100%
Processing candidates (74 candidates): 100%
Checking integrity... done (0 conflicting)
Your packages are up to date.
Checking integrity... done (0 conflicting)
Nothing to do.
Checking all packages: 100%
Nothing to do.
Flushing temporary package files... done
pkg install -f unbound
See if unbound starts after, and please post the full output from the reinstall command above
Installed and rebooted but the problem persist. Same error messages.
root@OPNsense:~ # pkg install -f unbound
Updating OPNsense repository catalogue...
OPNsense repository is up to date.
All repositories are up to date.
The following 1 package(s) will be affected (of 0 checked):
Installed packages to be REINSTALLED:
unbound-1.24.2_1
Number of packages to be reinstalled: 1
2 MiB to be downloaded.
Proceed with this action? [y/N]: y
[1/1] Fetching unbound-1.24.2_1.pkg: 100% 2 MiB 1.6MB/s 00:01
Checking integrity... done (0 conflicting)
[1/1] Reinstalling unbound-1.24.2_1...
===> Creating groups
Using existing group 'unbound'
===> Creating users
Using existing user 'unbound'
[1/1] Extracting unbound-1.24.2_1: 100%
root@OPNsense:~ #
Perhaps I did not make myself clear: is DNSmasq already running and listening on ports 53 TCP and UDP so Unbound cannot start up?
Yeah that wasn't clear for me.
I don't think unbound would fail with those errors in case other service is running on 53...
Unbound is still the default resolver. Dnsmasq does DHCP and local DHCP client hostname resolving to Unbound.
At first glance I don't see why a new install would fail. But also didn't see a health audit or update log.
Cheers,
Franco
Quote from: franco on March 04, 2026, 09:25:56 PMUnbound is still the default resolver. Dnsmasq does DHCP and local DHCP client hostname resolving to Unbound.
Good to know, thanks.
Quote from: franco on March 04, 2026, 09:25:56 PMUnbound is still the default resolver. Dnsmasq does DHCP and local DHCP client hostname resolving to Unbound.
At first glance I don't see why a new install would fail. But also didn't see a health audit or update log.
Cheers,
Franco
I posted those as an attachement earlier, because of the charatcter limit exceeded.
You are right. I'm sorry, too late yesterday for me.
It's a bit odd the package manager decided to remove the core package:
> [9/111] Deinstalling opnsense-26.1...
> Stopping configd...done
> Resetting root shell
> Updating /etc/shells
> Unhooking from /etc/rc
> Unhooking from /etc/rc.shutdown
> [9/111] Deleting files for opnsense-26.1: .......... done
But it doesn't matter too much since in the end if finishes the installation and the integrity checks are ok.
I still expect some Python files to be cached that shouldn't. Can you list the files inside the Unbound chroot?
# find /var/unbound/unbound-dnsbl -type f -name "*.pyc"
Thanks,
Franco
No problem. If it is some upgrading error, that wouldn't explain that the clean install from 26.1.1 image didn't work, no? I can try fresh install from the latest image later.
root@OPNsense:~ # find /var/unbound/unbound-dnsbl -type f -name "*.pyc"
/var/unbound/unbound-dnsbl/lib/__pycache__/log.cpython-313.pyc
/var/unbound/unbound-dnsbl/lib/__pycache__/dnsbl.cpython-313.pyc
/var/unbound/unbound-dnsbl/lib/__pycache__/utils.cpython-313.pyc
/var/unbound/unbound-dnsbl/lib/__pycache__/__init__.cpython-313.pyc
At this point it seems that this is a more fundamental OS/Python issue than update related. We've found forum posts from the past regarding similar issues. Not a lot of clues on why this happened, but they all seem to have tainted Python load orders.
Did you install anything via pip? Just trying to find out what's wrong that the audits aren't telling us.
Cheers,
Franco
24 and 25 versions worked well and upgrading to 26.1 went smoothly. Problems started after upgrading 26.1.1. I thought something went wrong when upgrading so I did a fresh install with 26.1.1 image, but got the same problem and error messages. Then I did fresh install with 26.1 image and everyhting worked. Tried upgrading from 26.1 to 26.1.2 and 26.1.3, but the same problem persist. All with defaults and nothing extra installed. 26.1 is the last working image.
My theory is if you do an "opnsense-bootstrap" the error will persist through a complete reinstall, which means it's a local issue with some stray file left for whatever reason and not a global one.
It's worth a try but chances are it doesn't help.
Just as an additional data point:
> community/24.7/24.7:OpenVPN DCO support, FreeBSD 14.1, Python 3.11 plus much more.
So we've had 3.11 for 1,5 years in total which roughly matches your "24" and "25" were working.
Cheers,
Franco
Downloaded the latest image OPNsense-26.1.2-vga-amd64.img and created bootable usb. Installation went ok, but the problem persist.
Guess I go back with OPNsense-26.1-vga-amd64.img and wait for a fix.
Thanks
I'd suggest migrating your dhcp handling to kea and disabling dnsmasq entirely and seeing if that fixes your issue. Depends on how much work it'd take.
@iddqd
Can you unplug everything from your firewall for 10 minutes -including power cable- before making another attempt?
My OPNSense complained about an "unknown error" but I cannot find the log of it yet. Any pointers to reviewing logs for upgrades welcomed!!
My upgrade did work however, and I have modded my OPNSense a little out-of-band.
Another suggestion to try, if you don't want to migrate from dnsmasq to kea - set a machine with a static ip and disable dnsmasq, then try to start unbound. If it succeeds you know something in dnsmasq is blocking it.