Topics

1

21.1 Legacy Series / Huge bogonsv6 list = really long boot time

« on: April 21, 2021, 11:38:56 pm »

I don't reboot my router very often luckily, usually just when doing upgrades.  However, I recently started noticing a really long startup time which is spent waiting on "Configuring Firewall..." with the CPU just pegged out.  We're talking times of 10+ minutes waiting like that.

I decided to dig through all of my firewall rules to figure out what was taking so long.  In doing so I looked at the number of addresses defined for the bogonsv6 alias, and as soon as I saw that I knew what the holdup was.  There are 10s of thousands that are added to the firewall rules for blocking bogons via that alias (makes sense given the address space of IPv6).

I have turned off blocking bogons for now and that makes an instant difference. I wonder though if there are any optimizations that can be made to how firewall rulesets are loaded that could reduce the amount of time it takes to get through this at bootup time.  Considering that making changes to firewall rulesets and applying changes even with the block bogons enabled is very quick, it kinda surprises me that it takes so long to load the ruleset at bootup (though maybe applying changes doesn't force a full ruleset reload).

Other thought - I've had the Block Bogons feature enabled since the dawn of time, and have had dual-stack IPv6 running for the past few years - so why is this suddenly an issue more recently?

Currently on OPNsense 21.1.5-amd64

2

18.7 Legacy Series / Unbound not listening on IPV6 address

« on: December 28, 2018, 05:54:08 pm »

I'm on 18.7.9

I have IPV6 configured to go through TunnelBroker/HE.  All traffic on IPV6 flows fine.  Unbound is running as a forwarder - forwarding to IPv4 addresses - and successfullly resolves all IPV6 queries. DHCPv4 apparently includes the interface's IPV6 address in the list of DNS servers provided as it shows up in client's resolvers.  This results in slow DNS queries as clients sometimes attempt to contact DNS on IPV6 which times out.

Unbound is not listening on any IPV6 address.  Output from "sockstat | grep -i unbound" run on the OPNsense router:

 

Code: [Select]

unbound  unbound    79724 3  stream /tmp/php-fastcgi.socket-1
unbound  unbound    79724 4  udp4   *:53                  *:*
unbound  unbound    79724 5  tcp4   *:53                  *:*
unbound  unbound    79724 6  tcp4   127.0.0.1:953         *:*
unbound  unbound    79724 7  dgram  -> /var/run/logpriv
unbound  unbound    79724 8  stream -> ??
unbound  unbound    79724 9  stream -> ??
unbound  unbound    79724 10 stream -> ??
unbound  unbound    79724 11 stream -> ??
unbound  unbound    79724 12 stream -> ??
unbound  unbound    79724 13 stream -> ??
unbound  unbound    79724 14 stream -> ??
unbound  unbound    79724 15 stream -> ??

You can see it's listening on all udp4 and tcp4 addresses.  On the config page, I have "ALL" set on both Network Interfaces and Outgoing Network Interfaces.  Unbound ACLs automatically include all IPV6 subnets from all my interfaces.

I saw in some other threads there may be a need to manually add config option "do-ip6: yes", but when I put that in Custom Options on the General config page, Unbound fails to start.

Any tips here?