########################### Unbound Configuration############################# Server configuration##server:chroot: /var/unboundusername: unbounddirectory: /var/unboundpidfile: /var/run/unbound.pidroot-hints: /var/unbound/root.hintsuse-syslog: yesport: 53include: /var/unbound/advanced.confharden-referral-path: nodo-ip4: yesdo-ip6: yesdo-udp: yesdo-tcp: yesdo-daemonize: yesso-reuseport: yesmodule-config: "python iterator"num-threads: 4msg-cache-slabs: 8rrset-cache-slabs: 8infra-cache-slabs: 8key-cache-slabs: 8# Interface IP(s) to bind tointerface: 0.0.0.0interface: ::interface-automatic: yes# Private networks for DNS Rebinding prevention (when enabled)private-address: 0.0.0.0/8private-address: 10.0.0.0/8private-address: 100.64.0.0/10private-address: 169.254.0.0/16private-address: 172.16.0.0/12private-address: 192.0.2.0/24private-address: 192.168.0.0/16private-address: 198.18.0.0/15private-address: 198.51.100.0/24private-address: 203.0.113.0/24private-address: 233.252.0.0/24private-address: ::1/128private-address: 2001:db8::/32private-address: fc00::/8private-address: fd00::/8private-address: fe80::/10# Private domains (DNS Rebinding)include: /var/unbound/private_domains.conf# Static host entriesinclude: /var/unbound/host_entries.conf# DHCP leases (if configured)# Custom includesinclude: /var/unbound/etc/*.confpython:python-script: dnsbl_module.pyremote-control: control-enable: yes control-interface: 127.0.0.1 control-port: 953 server-key-file: /var/unbound/unbound_server.key server-cert-file: /var/unbound/unbound_server.pem control-key-file: /var/unbound/unbound_control.key control-cert-file: /var/unbound/unbound_control.pem
tcpdump -i igb1 'port 853' # WAN DoT
tcpdump -i igb0 'port 53' # LAN DNS
WWW <--DoT:853--> Unbound (DoT) <-x-BROKEN?-> Unbound (DNS) <--DNS:53-WORKS--> Lokal Clients | | -------------------- DNS:53-WORKS ----------------------
After I applied the patch that franco requested to be tested: https://forum.opnsense.org/index.php?topic=37243
2023-12-03T19:58:27 Error unbound [24652:3] error: reading root hints /root.hints 2:6: Syntax error, could not parse the RR's type
For anyone reading up on my issue: Unbound seems to break when upgrade to 23.7.7.x. Unbound worked perfect before latest and greatest - and now it just don't. I am not sure when I did the latest upgrade before 23.7.7 so I can not say exactly which level broke Unbound. But something sure did.
Hi @Fright!Thanks for helping out.I can add this that I wrote in the other Unbound thread:Quote from: lar.hed on January 23, 2024, 10:44:08 amI need to be more precis I think...So, my current setup is OPNsense 23.7.11-amd64.On this I have the two patches earlier referenced:Code: [Select]opnsense-patch a086f40bopnsense-patch 845fbd384fe The I have removed a two plugins: mDNS and IGMP Proxy - and is only running UDP Broadcast Relay: https://forum.opnsense.org/index.php?topic=38114.0Also, since in my case there seem to be some kind of connection to IP adress changes or something I decided to uncheck "Register DHCP Leases" and "Register DHCP Static Mappings".So in all 6 changes. I can not say that each change has anything to do with this challenge I have with Unbound, however, the changes above has made Unbound stable from 100% CPU Bound. Which one I would vote for? Patches all day long....I have had one Unbound stop which I have no reference to why. Monit restarted Unbound directly and since I'm not at home where the OPNsense is installed, I have not been able to check anything....I have not had any more 100% CPU on one core since I changed the above. Currently I do not know exactly which one that is most likely to have solved this. Although I have to say that removing the extra plugins should not be the reason....
I need to be more precis I think...So, my current setup is OPNsense 23.7.11-amd64.On this I have the two patches earlier referenced:Code: [Select]opnsense-patch a086f40bopnsense-patch 845fbd384fe The I have removed a two plugins: mDNS and IGMP Proxy - and is only running UDP Broadcast Relay: https://forum.opnsense.org/index.php?topic=38114.0Also, since in my case there seem to be some kind of connection to IP adress changes or something I decided to uncheck "Register DHCP Leases" and "Register DHCP Static Mappings".So in all 6 changes. I can not say that each change has anything to do with this challenge I have with Unbound, however, the changes above has made Unbound stable from 100% CPU Bound. Which one I would vote for? Patches all day long....I have had one Unbound stop which I have no reference to why. Monit restarted Unbound directly and since I'm not at home where the OPNsense is installed, I have not been able to check anything....
opnsense-patch a086f40bopnsense-patch 845fbd384fe
I think I will quote myself from two other threads where this has been an standing challenge, which for the moment seems to be under control untill I find another challenge (16 days withut problem so far - do note the Monit scripts to help out if somethings happens anyway):Quote from: lar.hed on January 26, 2024, 05:20:13 pmHi @Fright!Thanks for helping out.I can add this that I wrote in the other Unbound thread:Quote from: lar.hed on January 23, 2024, 10:44:08 amI need to be more precis I think...So, my current setup is OPNsense 23.7.11-amd64.On this I have the two patches earlier referenced:Code: [Select]opnsense-patch a086f40bopnsense-patch 845fbd384fe The I have removed a two plugins: mDNS and IGMP Proxy - and is only running UDP Broadcast Relay: https://forum.opnsense.org/index.php?topic=38114.0Also, since in my case there seem to be some kind of connection to IP adress changes or something I decided to uncheck "Register DHCP Leases" and "Register DHCP Static Mappings".So in all 6 changes. I can not say that each change has anything to do with this challenge I have with Unbound, however, the changes above has made Unbound stable from 100% CPU Bound. Which one I would vote for? Patches all day long....I have had one Unbound stop which I have no reference to why. Monit restarted Unbound directly and since I'm not at home where the OPNsense is installed, I have not been able to check anything....I have not had any more 100% CPU on one core since I changed the above. Currently I do not know exactly which one that is most likely to have solved this. Although I have to say that removing the extra plugins should not be the reason....
If you have unchecked the "Register DHCP Leases" and "Register DHCP Static Mappings" - then DNS name resolution on your intranet will not work.