Project

General

Profile

Actions

Bug #11547

closed

DNS Resolver does not bind to an interface when it recovers from a down state

Added by Frank Gouton over 3 years ago. Updated over 3 years ago.

Status:
Closed
Priority:
Low
Assignee:
Viktor Gurov
Category:
DNS Resolver
Target version:
Start date:
02/26/2021
Due date:
% Done:

100%

Estimated time:
Plus Target Version:
Release Notes:
Default
Affected Version:
2.5.0
Affected Architecture:

Description

Unbound doesn't open a listening socket for an interface that has no active device. If you connect a device later it can't resolve domains.

Steps to reproduce:

Connect a PC directly with a LAN port of the pfsense
Boot the PC up.
Stop DNS Resolver (no reload)
Unplug THE lan cabl
Start the resolver
Wait for start,
Wait some seconds more
Connect PC.

Result: The PC can't resolve DNS
That is a serious problem for me because this happens every morning and I have to reload unbound manually.

This problem was discussed here: https://forum.netgate.com/topic/161400/unbound-stops-listening-on-interface/3

Actions #1

Updated by Frank Gouton over 3 years ago

I'm made a mistake selecting the version. It's the latest stable version 2.5. Can you fix that please?

Actions #2

Updated by Jim Pingle over 3 years ago

  • Subject changed from Unbound not working after restart to Unbound does not bind to down/nocarrier interface when it recovers
  • Status changed from New to Not a Bug
  • Priority changed from High to Low
  • Target version set to CE-Next
  • Affected Version changed from 2.4.5 to 2.5.0

This is very similar to #11087 -- Seems like you have specific interfaces selected for the resolver to use, and unbound doesn't restart when the interface status changes back to 'up' after being down to pick up the recovered interface.

You can switch the interface selection to 'All' to work around the problem.

Actions #3

Updated by Jim Pingle over 3 years ago

  • Status changed from Not a Bug to New
Actions #4

Updated by Frank Gouton over 3 years ago

The option "All" includes the WAN interface too. Wouldn't it be a security risk to open the unbound port on the wan interface?

Actions #5

Updated by Jim Pingle over 3 years ago

It's not a significant concern or it wouldn't be the default behavior. Both the firewall rules AND unbound ACLs prevent any queries from being accepted on WAN.

Unless you have overly lenient WAN rules and have manually added loose unbound ACLs (like for 0.0.0.0/0) then there is little risk in binding to all.

Actions #6

Updated by Frank Gouton over 3 years ago

Ok thanks. Looks like setting it to "All" works for now. This behavior is new with the latest pfsense update. Never had the problem with the previous version. (Pfsense on custom hardware)

Actions #7

Updated by Viktor Gurov over 3 years ago

Actions #8

Updated by Jim Pingle over 3 years ago

  • Status changed from New to Pull Request Review
Actions #9

Updated by Renato Botelho over 3 years ago

  • Status changed from Pull Request Review to Feedback
  • Assignee set to Viktor Gurov

PR has been merged. Thanks!

Actions #10

Updated by Viktor Gurov over 3 years ago

  • % Done changed from 0 to 100
Actions #11

Updated by Stéphane BARBARAY over 3 years ago

I encounter a similar problem with bind which stop responding each time an openvpn disconnection/connection is made... could the patch resolve that problem too? I'm tempted to apply it...

hereunder what happen in log when named stop responding...
filterdns9294: merge_config: configuration reload
[...]
named53473: network: error: creating IPv4 interface ovpnc2 failed; interface ignored
filterdns9294: merge_config: configuration reload
[...]

Actions #12

Updated by Viktor Gurov over 3 years ago

Stéphane BARBARAY wrote:

I encounter a similar problem with bind which stop responding each time an openvpn disconnection/connection is made... could the patch resolve that problem too? I'm tempted to apply it...

hereunder what happen in log when named stop responding...
filterdns9294: merge_config: configuration reload
[...]
named53473: network: error: creating IPv4 interface ovpnc2 failed; interface ignored
filterdns9294: merge_config: configuration reload
[...]

Please create a new redmine issue

Actions #13

Updated by Jim Pingle over 3 years ago

  • Status changed from Feedback to Waiting on Merge
  • Target version changed from CE-Next to 2.5.1
Actions #14

Updated by Renato Botelho over 3 years ago

  • Status changed from Waiting on Merge to Feedback

Cherry-picked to RELENG_2_5_1

Actions #15

Updated by Jim Pingle over 3 years ago

  • Subject changed from Unbound does not bind to down/nocarrier interface when it recovers to DNS Resolver does not bind to an interface when it recovers from a down state

Updating subject for release notes.

Actions #16

Updated by Jim Pingle over 3 years ago

  • Status changed from Feedback to Closed
Actions

Also available in: Atom PDF