Messages

Following up from my previous message, I double-checked everything and added a few of my custom blocklists back in.
I am still curious about this?

However.. is it normal that if one or a few lists cannot be parsed due to a format error, it will cause the overall blocklist parsing/update to completely fail? I had assumed Unbound would simply skip the list it couldn't parse and continue processing the other lists, rather than the failure affecting the rest of the blocklists?

Anyways..
I restarted the Unbound service and there was no yellow notification dot. I then rebooted the entire firewall, and again, no yellow dot. Saved everything and left it at that. Just using that as an indicator all my lists are parsing fine now.

I then enabled Flush the Unbound cache on reboot, restarted the service, and reset the Unbound Reporting stats. After that, I restarted the service again, turned Flush the Unbound cache on reboot back off, and restarted the service one more time.

After that I already notice after 1minute, 7 things on the blocklist which weren't even up before. The funny thing is the 7 things it already blocked were from the default lists, not my custom lists. Weird how it wasn't catching them before.

Might be a bit overkill to do all the restarts, but can't hurt.
At this point I'm going to let it sit for a few hours while I go out and see what things look like when I come back.
Edit: 5min later already at 30 blocks.

[extremely]

The built-in blocklist tester returns:
{"status":"error"}

This is a clue to your problem. When operating normally it will report as "OK".

Review Unbound log file for problems.

I am looking through the logs again, but I'm not seeing much that stands out. I'm not sure why.

I did notice one thing, though. I rebooted the Unbound service and noticed the OPNsense notification dot in the top right of the GUI turned yellow. When I clicked it, it said that one of the lists couldn't be parsed due to a format error. Ok that's a hint.

However.. is it normal that if one or a few lists cannot be parsed due to a format error, it will cause the overall blocklist parsing/update to completely fail? I had assumed Unbound would simply skip the list it couldn't parse and continue processing the other lists, rather than the failure affecting the rest of the blocklists?


For testing, I removed all of my custom-added lists and left only the integrated lists enabled. I applied the changes and restarted the service, and the yellow notification did not come back.

It does seem like things are working better now, at least it's not 0 blocked.. but I'm still not sure if they're working completely. I'm seeing an extremely small number of blocked queries compared to what I remember seeing in the past. I have a handful of devices on my network, including devices that should be generating plenty of questionable/tracking DNS queries simply by being on the network, so I would expect to see significantly more blocked traffic.

For example, I just tried going to ibrainer.net from my phone's web browser. I can reach the site, and it doesn't show up in Unbound Reporting at all. However, I do see my phone's client IP appearing many times in the Unbound reporting, so the phone is definitely generating DNS queries through Unbound. I can also only 2 domains that it did block, and it does mention the blocklist: LIGHT - Relaxed Blocking - Hagezi Multi; which is a good sign.

The confusing part is that I have ibrainer.net manually added under:
Unbound → Blocklists → Blocklist Domains

The Blocklist Tester also confirms that it is being blocked:

{
  "status": "OK",
  "action": "Block",
  "policy": {
    "source_nets": [],
    "address": "0.0.0.0",
    "rcode": 0,
    "description": "Primary Blocklist",
    "id": "ddbb5190-43e0-4d07-89d3-25e95053bbbf",
    "passlist": "",
    "prio": 3.402823669209385e+38,
    "hidx": 0,
    "bl": "Custom"
  }
}


So Unbound clearly knows that ibrainer.net should be blocked, yet I can still access it from the phone.


And I just triple checked, my iPhone is manually configured to use the firewall as its DNS server, so I'm not intentionally using another DNS server. And as mentioned above, I can see plenty of DNS queries from the phone in Unbound Reporting. Furthermore, I had setup Opnsense so all the devices on the network use Unbound by default. So I don't believe it's an issue that the clients simply aren't using it.

One other thing I noticed: if I query a domain, ex: ads.youtube.com without the trailing dot, Windows sometimes ends up querying ads.youtube.com.lan.. If I use the trailing dot, it correctly queries ads.youtube.com.. I don't think that's related, since OPNsense Reporting itself displays normal DNS names with the trailing dot. But just something I noticed that I wansn't sure about. I don't notice this on all the domains, idk.


I'm wondering if there is something else going on with the blocklist generation/loading, because the Blocklist Tester says the domains are blocked, but actual client behavior and the amount of blocked traffic don't seem to match what I would expect at all.

In my initial setup over a year ago and afterwards while I remember it working, Unbound was SIGNIFICANTLY much "noisier", and I saw considerably more blocked queries from the devices on my network. Now I'm seeing basically nothing, even though I have the general blocklists and several HaGeZi/OSID lists enabled.
And a few years before I had Unbound, I had a PiHole and it was just as noisy with blocking. So I know my baseline should be higher.

In the past 40 min I have 20 domains blocked, 3 which were manual inquiries.
That's not even peanuts. So something is still not working properly, but we're moving in the right direction..

Reporting - unbound dns.   Is that giving you stats of anything being blocked?

No, it remains at 0.
I even tried resetting the stats in there.

It shows domains are resolving. But 0 is blocked.

In the Reporting > Unbound page, I actually also tried clicking the GUI button for a domain that's allowed, to blocklist it.
The button DOES change the little block button-from "block" to "allow", however it does not add to the "Blocked" counter, nor does it show blocked in the list, nor in details.. and I can still resolve it from my machine. All even after restarting the Unbound service.

OPNsense 26.7.3_11 (amd64)
Everything was installed and configured using the GUI.
It has been running for over a year, I don't recall this being an issue previously, but I haven't looked at the machine beyond updating in a few months and I just noticed it this week.

I am having an issue where the Unbound DNS blocklist appears to download and load successfully, but domains are not actually being blocked for LAN clients.
It does seem to be resolving my domains without issue and properly. So I don't believe it is an issue with Unbound itself not being used, however an issue with Unblound actually blocking.
I could be wrong, but I believe it used to work without issue, I haven't messed with Opnsense in months. Just noticed this.

The Blocklist page reports approximately 1,327,249 entries loaded. I have several blocklists configured. I know that's a lot, and could cause false positives, don't really care.

As a test, ibrainer.net is known to be present in that list. I also manually added ibrainer.net under Blocklist Domains, but it continues to resolve normally.
This domain was just a random domain I chose in one of the blocklists to test with.

Testing:

From a Windows LAN client, I queried the firewall directly:
The client is definitely querying Unbound on OPNsense, but the real DNS records are returned.

Unbound Reporting shows the queries as Pass rather than Blocked. For example:

2026-09-11 03:08:58
[REDACTED CLIENT]
A
ibrainer.net.
Pass
Recursion
NOERROR
84ms
3600

2026-09-11 03:08:58
[REDACTED CLIENT]
AAAA
ibrainer.net.
Pass
Recursion
NOERROR
6ms
3600


After subsequent queries, they also appear as:

ibrainer.net.
Pass
Cache
NOERROR

I also tested metrics.icloud.com, which I manually added to Blocklist Domains, and it still resolves normally.

Other troubleshooting performed/settings statuses:

Confirmed Unbound DNS is enabled.
Confirmed all required LAN/VLAN interfaces are selected under Unbound.
Source Net(s) is empty/default.
Destination Address is empty/default.
Return NXDOMAIN is unchecked.
Cache TTL is set to 72000.
Unbound Access Lists are empty.
Restarted Unbound with Flush Cache on Restart enabled.
Flushed the Windows DNS cache with ipconfig /flushdns.
Retested using the firewall address directly (192.168.1.1).
Confirmed the blocklist downloads and reports approximately 1.33 million entries under Reporting > Unbound DNS.
Added ibrainer.net manually to Blocklist Domains as a direct test.
The built-in blocklist tester returns:
{"status":"error"}

I also tried fresh resetting the reporting. Shows 0 under blocked, while resolved is slowly going up.

I also tried manually clicking block on the ibrainer.net domain in the Reporting > Unbound DNS and it does toggle the icon so I can "allow it" after, so it seems to be "blocking it"... however it doens't actually appear to be blocking it.


The main issue appears to be that the blocklists are being downloaded/parsed, but the resulting DNSBL rules are not being applied to client queries. Fresh queries are still reported as Pass / Recursion / NOERROR instead of being blocked. Domains are resolving normally, my DNS is fine. I have my whole network set to use Unbound for DNS resolution. It just seems like absolutely NOTHING is being blocked for some reason.

Minor feature request, however I really would like the ability to add the photo/picture widget back onto the new dashboard please.  :)

I currently have OPNsense setup with Unbound, and all devices on the network use it. I want all the devices to connect directly to the firewall IP for DNS. I have a few VLANs, and port 53 is forwarded locally for all so they can reach DNS (correct me if there is a more secure way of doing that).

Now I want to setup LANCache, likely in Promox.
I do not want to have to have the computers connect to LANcache as their DNS. I want them to connect to opnsense as they currently are. But have LANcache work in the background alongside Unbound if that makes sense.



Basically I want all devices to point to 192.168.1.1 (firewall) for DNS, but if they are downloading something LANcache supports, LANcache feeds them that data.
How would I set this up ideally?

My network is basically a few VLANs (family VLAN, my vlan, guest vlan)
And I run Unbound on OPNsense. That acts as the DNS server, all devices point to it. (Which I do have a question, is this type of DNS considered an "Authoritative DNS Server?" The 2 confuse me still.

Anyways, I read about Squid, and how it can cache stuff and speed up things.
I am curious, my drive in my system is about 500gb. So OPNsense is using barely anything of it. Should I install Squid? Or does Unbound have these capabilities?
I see there are some settings about Caching in Unbound > Advance. Not sure if changing these numbers would be beneficial.

Not that stuff is slow, but more speed is always better lol ;)

..also for clarification I will never come close to even using 100gb (nevermind the 250-512gb which the drives are) so size should not be an issue.
I think I'm only using 2.2GB/452 on my current drive haha

Hey so just getting around to trying this.
Sounds good, my new drive is also going to be ada0.
However when running

Code Select Expand

gpart backup ada1 | gpart restore -F ada0
I run into a

Code Select Expand

gpart: size '983025664' invalid argument error. I assume this is because the new drive is smaller in size, so the partition sizes won't match.

Can you please help clarify how to safely proceed. Thanks.

Here is the disk layout

Code Select Expand


# geom disk list
Geom name: ada0 (new second disk adding in)
Providers:
1. Name: ada0
   Mediasize: 250059350016 (233G)
   Sectorsize: 512
   Mode: r0w0e0
   descr: SanDisk SDSSDH3 250G
   lunid: 5001b448b243e95c
   ident: 230206A0004C
   rotationrate: 0
   fwsectors: 63
   fwheads: 16

Geom name: ada1 (original disk)
Providers:
1. Name: ada1
   Mediasize: 512110190592 (477G)
   Sectorsize: 512
   Mode: r1w1e2
   descr: SanDisk SDSSDH3 512G
   lunid: 5001b448ba4679ef
   ident: 21120U801225
   rotationrate: 0
   fwsectors: 63
   fwheads: 16


I am looking to add a second SSD.
Upon first install, I installed using ZFS on a single SSD.
I recently acquired another SSD and I wanted to mirror it. I know it's an option on first install.

I am looking to avoid needing to backup, and fresh install.
How can I add it in, without fresh installing?

Ok so I believe I got this working.
I had to uncheck all my lists in blocklist, and then apply. Then re-enable the lists I want and apply.
Nslookup now shows they are resolving to 0.0.0.0 as expected (before they were actually resolving, not being blocked).
It also now shows rhe count in the new Unbound stats page.

However, after my last update it broke again, and I had to disable each list ,apply, then reenable them.
Not sure why but its working again.
Seems like some bug.

[cannot confirm]

So I want to preface this with the note that I cannot confirm this is a result of upgrading to 23.1. I did not test this beforehand. However it is not major enough of an issue to make me want to deal with flashing back. But it is major enough where I really want to try to fix it.
I do say I feel like I have always had issues with unbound blocklist in the past not working, and I remember I've tried doing resolves with some of the domains in the lists, and I think they always resolved depsite forcing unbound as my dns on all my devices, and even trying resolving directly from the opnsense shell. Nothing is using DoT/DoH. So I'm questioning now if it ever really even worked.

Anyways the issue is, it seems like the blocklists are just not working. I first noticed this with the new statistics, where it shows "Size of Blocklist" as "0". Despite having multiple blocklists selected in Unbound > Blocklists (and yes it's enabled and I've tried rebooting the service and firewall).

For example: https://blocklistproject.github.io/Lists/tracking.txt

Tried resolving from my computer:

Code Select Expand


nslookup 1000mercis.com
Server:  firewallhostname
Address:  myfirewallip

Non-authoritative answer:
Name:    1000mercis.com
Addresses:  64:ff9b::5396:f484
          83.150.244.132

And then also tried it directly in firewall shell:

Code Select Expand


nslookup 1000mercis.com
Server:         127.0.0.1
Address:        127.0.0.1#53

Non-authoritative answer:
Name:   1000mercis.com
Address: 83.150.244.132
Name:   1000mercis.com
Address: 64:ff9b::5396:f484

So I looked a bit further and ran

Code Select Expand

unbound -d -vv -c unbound.conf
and it prints the following:

Code Select Expand


[1675862429] unbound[40886:0] debug: setup SSL certificates
[1675862429] unbound[40886:0] debug: switching log to syslog
Could not find platform independent libraries <prefix>
Could not find platform dependent libraries <exec_prefix>
Consider setting $PYTHONHOME to <prefix>[:<exec_prefix>]
Python path configuration:
  PYTHONHOME = (not set)
  PYTHONPATH = (not set)
  program name = 'unbound'
  isolated = 0
  environment = 1
  user site = 1
  import site = 0
  sys._base_executable = ''
  sys.base_prefix = '/usr/local'
  sys.base_exec_prefix = '/usr/local'
  sys.platlibdir = 'lib'
  sys.executable = ''
  sys.prefix = '/usr/local'
  sys.exec_prefix = '/usr/local'
  sys.path = [
    '/usr/local/lib/python39.zip',
    '/usr/local/lib/python3.9',
    '/usr/local/lib/lib-dynload',
  ]
Fatal Python error: init_fs_encoding: failed to get the Python codec of the filesystem encoding
Python runtime state: core initialized
ModuleNotFoundError: No module named 'encodings'

Current thread 0x0000000801412000 (most recent call first):
<no Python frame>


Not sure if that is a major or related issue. Also not sure where to go from here.
I want to avoid breaking my config, and I'd like to avoid a fresh install.
Figured I'd try the forums with people who are significantly more experience with opnsense and  this stuff in general than me.

Ok final revelation because I am completely unsure of where to go from here on out with diagnosis.

So i just tested the internet on my family vlan on my brothers computer, and it seems to be working without issue.
it seems to be potentially vlan related. I cannot ping my desktop rom even the firewall, despite being on the same vlan.
I can however ping google from the firewall.
i can't ping the firewall from my desktop.

Usually it says in the shell "web interface can be reached at X ip"
I noticed it doesn't say that.
I do see sums for HTTPS.

Also It looks like all the interface ips are set correctly.
I know I have the web ui set to only listen on my vlan not my families, so it probably is something relating to that. It partially makes sense why I can't ping around my vlan, and also can't reach the web ui if it's a vlan issue.

But I fail to see why this issue occured, and I fail to see what the actual issue is.
I don't understand why the restore didn't resolve the issue either, seeing that was a period where the firewall was working without issue.

I don't know how to further diagnose this issue and really need to get this internet back up.

Ok so, I was able to delete it with os-sunnyvalley.

Also I didn't realize it made automatic backups. So I restored a backup from the 14th when the system was working no issues.
I hit yes to reboot for clean config, and then when finished it was STILL giving the same issue. So I rebooted once more, I could access the web gui and ping the server for a few seconds and then it went responsive again!

This makes no sense to me, all I did was install a package. And even after reverting to a backup created in a working period, it is still giving the same exact issue.

I see it under pkg info, I can search it with pkg search sunny
but I can't pkg delete or pkg install it without it saying it can't find it. I don't understand.
It still doesn't make sense to me that just installing the package would cause this issue.