Messages

1

23.7 Production Series / suggestion: show defaults so people can help themselves..

« on: December 04, 2023, 02:30:38 pm »

There are many posts about asking to improve unbound.. and there are more solutions on the internet about people and their solutions.. but it's possible that it isn't clear what setting goes with which field.. or what is available to tweak in OpnSense unbound..

I came across this:

Code: [Select]

# pkg info unbound
unbound-1.19.0
Name           : unbound
Version        : 1.19.0
Installed on   : Thu Nov 23 23:09:22 2023 EST
Origin         : dns/unbound
Architecture   : FreeBSD:13:amd64
Prefix         : /usr/local
Categories     : dns
Licenses       : BSD3CLAUSE
Maintainer     : jaap@NLnetLabs.nl
WWW            : https://www.nlnetlabs.nl/projects/unbound
Comment        : Validating, recursive, and caching DNS resolver
Options        :
        DEP-RSA1024    : off
        DNSCRYPT       : on
        DNSTAP         : off
        DOCS           : off
        DOH            : on
        DYNLIB         : on
        ECDSA          : on
        EVAPI          : off
        FILTER_AAAA    : off
        GOST           : on
        HIREDIS        : off
        LIBEVENT       : on
        MUNIN_PLUGIN   : off
        PYTHON         : on
        SUBNET         : off
        TFOCL          : off
        TFOSE          : off
        THREADS        : on

which showed me why I could not get ecs going..

* which was great * saved me tons of time and I stopped trying to set something which was never going to work..

Possibly something like this might help:

(picture attached)

My 0.02

2

23.7 Production Series / suggestion: menu option for transparent setup..

« on: December 02, 2023, 06:56:04 pm »

https://docs.opnsense.org/manual/how-tos/transparent_bridge.html

Wifi calling doesn't work through double nat..

So anyone with a consumer 'orbi', 'google', 'linksys', 'eero', etc. mesh setup who then for some reason wants to put a better router in front will then fall into the double nat issue.. and then have wifi calling issues; ie the phones will show vzw-wifi, att-wifi but won't actually be working (some androids seem to be better at this than others.. :dunno:)

having a transparent solution would resolve the double nat issue and all that comes with it..

(unless you had a three legged device.. usb eth adapter, wifi etc..)

Anyway.. having a console menu option like vlan, wan, lan, for creating this bridge.. etc.. might be a good idea.

My 0.02

3

23.7 Production Series / Re: unbound Enable AAAA-only mode and squid dns_v4_first

« on: December 02, 2023, 06:44:42 pm »

Thank you for that..

I was trying to get ECS going.. and could not confirm that it was working.. I couldn't find a way to find out what unbound was compiled with..

@maurice

If you don't use squid, then I agree it does not seem like a logical request.

if squid gets an AAAA entry it tries to process it, the dns_v4_first used to mitigate that..

modern squid seems to not respect that anymore..

This looks to be the squid answer:

(https://wiki.squid-cache.org/Features/IPv6)
Example creation in squid.conf:

acl to_ipv6 dst ipv6
acl from_ipv6 src ipv6

(and then something like)
http_access deny to_ipv6

there doesn't seem to be a way to from the gui to get to the squid.conf for local additions..

dnscrypt-proxy can filter (and log) ipv6/AAAA being blocked..

Doing so reduced the squid lag tremendously..

at least in my case (as shown in the graphs..)

Not sure if that helps..

4

23.7 Production Series / unbound Enable AAAA-only mode and squid dns_v4_first

« on: December 01, 2023, 10:00:48 pm »

squid no longer supports dns_v4_first.. which means that if squid gets an AAAA it will try to use it..

I enabled dnscrypt-proxy to filter out AAAA (made custom dns stamps as well..) records and it made a little bit of a difference in squid..

(not so much you could notice..)

Is there a way to get unbound to filter out AAAA (I know there used to be a python filter for it.. but that was a while ago..)

(the second image is a using the squid proxy to make the same query.. the red is trying to get the dns_v4_first working..)

Also.. any plans to update dnscrypt-proxy2?

Franks github says January 3, 2021 is when 2.0.45 came out..

Open to suggestions..

Thanks in advance..

5

Web Proxy Filtering and Caching / shutdown_lifetime proper way to add?

« on: November 30, 2023, 04:39:50 pm »

Looking to add:

shutdown_lifetime 0 seconds

looks like /usr/local/etc/squid/auth and /usr/local/etc/squid/post-auth look for *.conf files

I added a local.conf in auth

squid -k parse seems to show it correctly..

Does that survive a reboot?

Is there something 'more correct'?

Thanks in advance.

6

23.7 Production Series / Re: 23.7.8 - squid keeps crashing

« on: November 11, 2023, 02:49:57 am »

1am EST November 10th is when I updated the systems..

8:30pm EST is when I write the post..

Is there anything between those times about squid 6.5 package?

 

7

23.7 Production Series / Re: 23.7.8 - squid keeps crashing

« on: November 11, 2023, 02:44:02 am »

agreed..

But where would I know to check..

Yes updating to 6.5 does fix it.

Where was that reported?

8

23.7 Production Series / Re: 23.7.8 - squid keeps crashing

« on: November 11, 2023, 02:32:57 am »

https://forum.opnsense.org/index.php?topic=36891.0

Looks like there is a squid 6.5 package..

Would that be posted here.. as that would be an update to the base system?

9

23.7 Production Series / 23.7.8 - squid keeps crashing

« on: November 11, 2023, 02:28:26 am »

Code: [Select]

root@OPNsense:~ # dmesg | grep -c squid
19
root@OPNsense:~ # uptime
 8:23PM  up 21:11, 1 user, load averages: 0.06, 0.11, 0.13

2023/11/10 20:22:13 kid1| Accepting HTTP Socket connections at conn3 local=10.20.245.42:3128 remote=[::] FD 11 flags=9
    listening port: 10.20.245.42:3128
2023/11/10 20:22:13 kid1| FATAL: assertion failed: stmem.cc:98: "lowestOffset () <= target_offset"
    current master transaction: master129
2023/11/10 20:22:13| Removing PID file (/var/run/squid/squid.pid)

root@OPNsense:~ # squid -k check
2023/11/10 20:25:27| Processing Configuration File: /usr/local/etc/squid/squid.conf (depth 0)
2023/11/10 20:25:27| Processing Configuration File: /usr/local/etc/squid/pre-auth/40-snmp.conf (depth 1)
2023/11/10 20:25:27| Processing Configuration File: /usr/local/etc/squid/pre-auth/dummy.conf (depth 1)
2023/11/10 20:25:27| Processing Configuration File: /usr/local/etc/squid/pre-auth/parentproxy.conf (depth 1)
2023/11/10 20:25:27| Processing Configuration File: /usr/local/etc/squid/auth/dummy.conf (depth 1)
2023/11/10 20:25:27| Processing Configuration File: /usr/local/etc/squid/post-auth/dummy.conf (depth 1)
2023/11/10 20:25:27| Set Current Directory to /var/squid/cache
2023/11/10 20:25:27| FATAL: failed to open /var/run/squid/squid.pid: (2) No such file or directory
    exception location: File.cc(191) open

 grep -c FATAL /var/log/squid/cache.log
13


ten locations all doing the same thing..

before the update everything was working..

10

23.7 Production Series / Re: three out of nine sites.. just had an unbound problem..

« on: October 04, 2023, 06:17:25 pm »

Just had this happen again..

root@OPNsense:/var/log/resolver # ls -al
total 46
drwx------   2 root  wheel    256 Oct  4 12:01 .
drwxr-xr-x  16 root  wheel   1600 Oct  4 03:01 ..
lrwxr-x---   1 root  wheel     39 Oct  4 12:01 latest.log -> /var/log/resolver/resolver_20230918.log
-rw-------   1 root  wheel   6740 Sep 14 23:27 resolver_20230914.log
-rw-------   1 root  wheel  18568 Sep 18 17:48 resolver_20230918.log
-rw-------   1 root  wheel  14026 Oct  4 12:02 resolver_20231004.log

the 1004.log is only after the restart of unbound..

12:09PM  up 19 days, 12:43, 1 user, load averages: 0.72, 0.69, 0.64
root@OPNsense:/var/log/resolver # exit
exit

*** OPNsense.dom1.dom0: OPNsense 23.7.5 ***

<30>1 2023-10-04T12:01:45-04:00 OPNsense.dom1.dom0 unbound 66077 - [meta sequenceId="6"] [66077:0] info: server stats for thread 0: 110496 queries, 85021 answers from cache, 25475 recursions, 0 prefetch, 0 rejected by ip ratelimiting

<30>1 2023-10-04T12:01:45-04:00 OPNsense.dom1.dom0 unbound 66077 - [meta sequenceId="7"] [66077:0] info: server stats for thread 0: requestlist max 19 avg 0.676703 exceeded 0 jostled 0

<30>1 2023-10-04T12:01:45-04:00 OPNsense.dom1.dom0 unbound 66077 - [meta sequenceId="26"] [66077:0] info: server stats for thread 1: 57621 queries, 53353 answers from cache, 4268 recursions, 0 prefetch, 0 rejected by ip ratelimiting

<30>1 2023-10-04T12:01:45-04:00 OPNsense.dom1.dom0 unbound 66077 - [meta sequenceId="27"] [66077:0] info: server stats for thread 1: requestlist max 5 avg 0.229147 exceeded 0 jostled 0

<30>1 2023-10-04T12:01:45-04:00 OPNsense.dom1.dom0 unbound 66077 - [meta sequenceId="43"] [66077:0] info: server stats for thread 2: 2553318 queries, 1607760 answers from cache, 945558 recursions, 0 prefetch, 0 rejected by ip ratelimiting

<30>1 2023-10-04T12:01:45-04:00 OPNsense.dom1.dom0 unbound 66077 - [meta sequenceId="44"] [66077:0] info: server stats for thread 2: requestlist max 29 avg 0.700493 exceeded 0 jostled 0

<30>1 2023-10-04T12:01:45-04:00 OPNsense.dom1.dom0 unbound 66077 - [meta sequenceId="66"] [66077:0] info: server stats for thread 3: 1582665 queries, 966354 answers from cache, 616311 recursions, 0 prefetch, 0 rejected by ip ratelimiting

<30>1 2023-10-04T12:01:45-04:00 OPNsense.dom1.dom0 unbound 66077 - [meta sequenceId="67"] [66077:0] info: server stats for thread 3: requestlist max 140 avg 0.848675 exceeded 0 jostled 0

Everything was fine until it wasn't..

11

23.7 Production Series / dhcp relay - opnsense to receive; possible?

« on: September 18, 2023, 11:14:37 pm »

is this possible?

Can provide more details if anyone is interested.. but hopefully the question is clear enough.

I have core router with 15 networks that I would like to relay the needed dhcp requests to opnense as it seems there's a working dhcp/dns registration..

I was going to relay to an openwrt edgerouter 6 b/c it was running dnsmasq.. but that is it's own problems..

Thanks in advance.

12

23.1 Legacy Series / Re: NTP not able to use ipv6 peer

« on: September 18, 2023, 11:04:35 pm »

Just wanted to add myself onto this..

using time.aws.com (opnsense is a bare metal protectli.. if it matters)

Using local unbound..

This happens and then I have to restart ntpd.. will probably switch to chrony but that brings other issues..

System / Settings / General / Prefer to use IPv4 even if IPv6 is available is checked as well

13

23.7 Production Series / Re: Enable registration of DHCP client names in DNS

« on: September 18, 2023, 10:57:01 pm »

I have to apologize.. I never thought about using unbound..

Thank you..

14

23.7 Production Series / Enable registration of DHCP client names in DNS

« on: September 18, 2023, 04:18:57 pm »

Is there a part of the docs that cover this?

I know it needs a BIND9 server..

I've been trying to get it working and unsuccessful so far..

Thanks in advance

I know within dnsmasq this is a trivial feature..

But I also think there is no way to swap out isc-dhcpd for dnsmasq..

Or is there?

15

23.7 Production Series / three out of nine sites.. just had an unbound problem..

« on: August 29, 2023, 07:12:06 pm »

All forwarding to NextDNS.. serving people via squid.. three sites all went down at the same time..

Unbound still running, but not resolving..

Restarted unbound brought dns back to the network..

Will check on other sites.. but was same problem - no idea why..

OPNsense 23.7.2-amd64