I was having this issue since 25.5 and now I'm at 26.1. I've had to keep restarting OPNSense just so I can update to 26.1.10. I've increased the the tunable "kern.ipc.maxsockbuf" to 10MB as I've seen in a previous post before.
I don't have any VPNs configured, yet. I have a separate internal DNS server that I use for internal network. I only use Unbound for OPNSense. I've tried pointing system to my Internal DNS server and that works, but I really want to use Unbound only for OPNSense, but I don't know what else could be wrong.
Seeing the same issue here with OPNsense 26.1.11_6-amd64 (but agreed, this happens since a months or two for me).
I noticed that the Unbound logs are full of the following logs:
```
2026-07-09T00:10:21Noticeunbound[57596:0] notice: send failed: No buffer space available
2026-07-09T00:10:20Noticeunbound[57596:4] notice: remote address is 9.9.9.9 port 53
2026-07-09T00:10:20Noticeunbound[57596:4] notice: send failed: No buffer space available
2026-07-09T00:10:20Noticeunbound[57596:5] notice: remote address is 9.9.9.9 port 53
2026-07-09T00:10:20Noticeunbound[57596:5] notice: send failed: No buffer space available
2026-07-09T00:10:20Noticeunbound[57596:2] notice: remote address is 9.9.9.9 port 53
2026-07-09T00:10:20Noticeunbound[57596:2] notice: send failed: No buffer space available
2026-07-09T00:10:20Noticeunbound[57596:3] notice: remote address is 9.9.9.9 port 53
```
Firewall is quite used:
```
memory
- states: 3067500
- src-nodes: 3067500
- frags: 5000
- table-entries: 8000000
```
As for the suggested sysctl value, I have the default setting `kern.ipc.maxsockbuf: 4262144` for now.
I'm running WAN + LAN on a lagg interface with VLANs. Physical cards are Ethernet Controller X710 for 10GbE SFP+.
Also running Zenarmor (physical interface via L3 netmap native driver) + Suricata (on WAN links) and crowdsec.
I'm wondering whether the above three are compatible with each other.
Since I use 9.9.9.9 as gateway monitor IP for one of my WAN links, I switched unbound forwarder IP 9.9.9.9 to 8.8.4.4 in order to outrule too much traffic to that DNS resolver. Let's see.
Interestingly, I didn't see new unbound error messages since the forwarder modification.
Perhaps that's the culprit, since my forwarder was also set as gateway monitor IP for one of my WAN links, it had a static route configured.
This could create problems when WAN link is down, and perhaps generate too much connections from both dpinger and unbound.
When I've seen this happening Unbound was attempting to run while another Unbound was already running and hogging the resources.
Cheers,
Franco
In my case, I can confirm that I didn't see any other `notice: send failed: No buffer space available` error since I changed the Unbound DNS forwarder to be different than the gateway monitor IP.