Bug #2246
closedPFsense code that generates Unbound's config draws on multiple sources that can conflict, causing Unbound to silently fail in an undocumented manner
0%
Description
If a user has has previously tried to set up authoritative redirects on domains using DNS forwarder or any other package that created Hosts entries in the router, then later switches to Unbound and puts similar records in Unbound's custom config, it's possible to get an undocumented fatal error (in the sense that pasting to Google doesn't seem to turn up an answer):
unbound: [15826:0] error: local-data in redirect zone must reside at top of zone, not at <DOMAIN + DNS DATA>
I think what's happening is Unbound both imports the router's hosts file to its config as well as applying custom config, failing when they contain similar entries. Either that, or it imports from DNS forwarder. The error occurs whether or not the original package (eg DNS forwarder) has been disabled.
It's quite feasible that the Hosts file or DNS forwarder may have had data before Unbound was used, so this is quite an easy issue to have. The module that creates Unbound's actual config (as reported at its status tab) should not attempt to create duplicate or conflicting records if old data exists in Hosts or other package settings.