Messages

It was through going through the config.xml that I found the IP address under Wireguard
<dns>10.x.y.z</dns>

this is configured on the Advanced enabled GUI of the WireGuard Local Configuration screen.

For some reason it seems to take the WireGuard DNS setting to populate resolv.conf when rebooted. But then takes the General DNS settings when I use General - Save.

Interesting result:

# Generated by resolvconf
nameserver 10.x.y.z

... and this IP is from a Wireguard VPN fixed DNS IP.

"General - Save" set the values as you have described.

Unbound is running, drill @127.0.0.1 google.com worked, and requests from outside the firewall (from LAN devices) succeeded. However update check and diagnostic DNS queries through the GUI fail still. I haven't found and rules that are blocking these DNS Queries. Doing "General - Save" then has things working correctly again.

When I reboot DNS resolution by either Unbound or DNSmasq doesn't work. DNS requests from the LAN can go through the firewall to the internet during this time. Port 53 (TCP) can be opened from the LAN but DNS requests timeout.

Going in to SYSTEM: SETTINGS: GENERAL and clicking "Save" fixes the issue (with no setting changes).

This behavior affects Firewall requests like update checks and DNS diagnostics (etc) too.

I have tried seeing any of this in the firewall logs but couldn't see any - until I did the "General - Save" fix then I would see allowed DNS requests.

Any suggestions for what settings I may have missed - or further tests I can run?

Update 1
Further testing seems to show that the issue doesn't self correct, and after the General-Save fix a reboot will rebreak DNS using the Opnsense/DNSmasq DNS resolver.

For anyone wondering: I have been using another DNS server on the LAN since this issue started.

I too had Unbound stop after running for a period of time, quickly after a reboot, then after restarting the service it ran for longer before stopping. All other functions seem to work normally, but anything that relied on DNS failed (obviously). For me reverting to the previous version has stopped the service from frequently stopping.

Is this related to:
https://github.com/NLnetLabs/unbound/issues/376
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=251821

(Found these threads before finding this thread here.)