Unbound strange behavior

[ricksense]

 Hi,

OPNsense 25.7.8 runs as a VM in my Proxmox machine. I ran across a strange behavior of Unbound: my hosts behind OPNsense still have internet access and get their DNS queries resolved by Unbound if I simply uses the browser, but if I ping a website, say, google.com in the prompt command it doesn't get resolved.

I saw the logs in Reporting: Unbound DNS, and noticed that the requests from the hosts got dropped:



 Could you please help understand why it happens and how to fix it?

Thanks

[Patrick M. Hausen]

Probably local resolution fails entirely. You need to investigate the logfiles to find the cause of that SERVFAIL.

Your browsers continue to work because modern browsers implement their own methods of name resolution.

[ricksense]

Probably local resolution fails entirely. You need to investigate the logfiles to find the cause of that SERVFAIL.

Your browsers continue to work because modern browsers implement their own methods of name resolution.

Yes, I found out that I can browser websites via Firefoxr because I had cloudflare DOT activatet on it.
But if I disabled it, I have the same problem. So, there is definitely something wrong with the DNS requests to Unbound.
But what exactly?

Thanks

[Patrick M. Hausen]

As I wrote: investigate the cause of the SERVFAIL by looking at the log files.

[ricksense]

As I wrote: investigate the cause of the SERVFAIL by looking at the log files.

If I set "Use System Nameservers" in the Query Forwarding settings, it works but I don't think Unboud is working properly this way.
Thanks

[Patrick M. Hausen]

Look at the Unbound log files for the cause of the SERVFAIL - how often do I need to repeat this?

[ricksense]

Look at the Unbound log files for the cause of the SERVFAIL - how often do I need to repeat this?

I looked at both the Unbound log files and the firewall log. There is nothing meaningful. Even no log entries in the Unbound log files. The firewall lets queries PASS.

Thanks

[Patrick M. Hausen]

Then probably enable:

Services > Unbound DNS > Advanced > Log SERVFAIL

[ricksense]

Then probably enable:

Services > Unbound DNS > Advanced > Log SERVFAIL

Ok, I can see something as I ran a query:

Then probably enable:

Services > Unbound DNS > Advanced > Log SERVFAIL

Ok, I started seeing something as I ran a query:



Thanks

[ricksense]

I realized that Unbound, in this scenario (without checking the "use name server" button), works intermittently and unpredictably.

[Patrick M. Hausen]

In general it doesn't. I run it at multiple offices and an entire data centre with that setting and no problems at all.

Something about your configuration must be unusual. Still pondering what that might be. Did you change the interfaces setting for Unbound, possibly? Something in private networks?

[ricksense]

In general it doesn't. I run it at multiple offices and an entire data centre with that setting and no problems at all.

Something about your configuration must be unusual. Still pondering what that might be. Did you change the interfaces setting for Unbound, possibly? Something in private networks?

I read about another user on Reddit who is dealing with the same issue as mine. Anyway, I've never complained about OPNsense, but I have already run across a couple of problems with the last version.