Menu
What's new
By:
Filters Better Search

Unbound Unable to make Unbound work

  • SNBForums Code of Conduct

    SNBForums is a community for everyone, no matter what their level of experience.

    Please be tolerant and patient of others, especially newcomers. We are all here to share and learn!

    The rules are simple: Be patient, be nice, be helpful or be gone!

M

mangkoran

New Around Here
Hi all. I am trying to install Unbound on my AX-56U. I tried to install Unbound via amtm -> unbound_manager. I fulfilled all the pre-reqs and unbound is successfully installed with the default config. However, when I tried to dig @127.0.0.1 -p 53535 google.com, it showed SERVFAIL status.

Code: 
; <<>> DiG 9.18.16 <<>> @127.0.0.1 -p 53535 google.com
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 17418
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1472
;; QUESTION SECTION:
;google.com.                    IN      A

;; Query time: 158 msec
;; SERVER: 127.0.0.1#53535(127.0.0.1) (UDP)
;; WHEN: Mon Sep 11 05:29:02 ICT 2023
;; MSG SIZE  rcvd: 39

This makes all clients connected to the router to have no connectivity/internet access due to DNS resolution failure. Could anyone please guide me where I did it wrong?
 
Last edited:
Check the router with:
ASP.net: 
netstat -nltup | grep -E ":53 |unbound|dnsmasq"
dig google.com @127.0.0.1
 
dave14305 said:
Check the router with:
ASP.net: 
netstat -nltup | grep -E ":53 |unbound|dnsmasq"
dig google.com @127.0.0.1
Click to expand...
Below is the output.
Code: 
tcp        0      0 127.0.0.1:953           0.0.0.0:*               LISTEN      32281/unbound
tcp        0      0 127.0.0.1:53535         0.0.0.0:*               LISTEN      32281/unbound
udp        0      0 127.0.0.1:53535         0.0.0.0:*                           32281/unbound
udp        0      0 0.0.0.0:67              0.0.0.0:*                           32309/dnsmasq

Looks like unbound is running. But the dig command seems indicate it failed to connect.
Code: 
;; communications error to 127.0.0.1#53: connection refused
;; communications error to 127.0.0.1#53: connection refused
;; communications error to 127.0.0.1#53: connection refused

; <<>> DiG 9.18.16 <<>> google.com @127.0.0.1
;; global options: +cmd
;; no servers could be reached
 
mangkoran said:
Looks like unbound is running. But the dig command seems indicate it failed to connect.
Click to expand...
Nothing is listening on port 53, so clients can’t find a DNS server. It sounds like you somehow disabled dnsmasq DNS (e.g. port=0), but Unbound isn’t listening on port: 53 in its place.
 
I found that there is port=0 config added in /jffs/configs/dnsmasq.conf.add (idk maybe I forgot about this). After removing that line, I think dnsmasq now up and listening to :53.
Code: 
tcp        0      0 127.0.0.1:53            0.0.0.0:*               LISTEN      2605/dnsmasq
tcp        0      0 192.168.50.1:53         0.0.0.0:*               LISTEN      2605/dnsmasq
tcp        0      0 127.0.0.1:953           0.0.0.0:*               LISTEN      2214/unbound
tcp        0      0 127.0.0.1:53535         0.0.0.0:*               LISTEN      2214/unbound
udp        0      0 127.0.0.1:53535         0.0.0.0:*                           2214/unbound
udp        0      0 127.0.0.1:53            0.0.0.0:*                           2605/dnsmasq
udp        0      0 192.168.50.1:53         0.0.0.0:*                           2605/dnsmasq
udp        0      0 0.0.0.0:67              0.0.0.0:*                           2605/dnsmasq

However, the dig still fails.
Code: 
; <<>> DiG 9.18.16 <<>> google.com @127.0.0.1
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 43749
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;google.com.                    IN      A

;; Query time: 1 msec
;; SERVER: 127.0.0.1#53(127.0.0.1) (UDP)
;; WHEN: Mon Sep 11 06:28:57 ICT 2023
;; MSG SIZE  rcvd: 39
 
I would uninstall unbound manager, cleanup /jffs/configs/dnsmasq.conf.add and /jffs/scripts/dnsmasq.postconf so you can get a working system again. Then start over slowly with Unbound. Document each step and option selected.
 
Did you mean I should reinstall unbound with unbound_manager? Or manually install from entware? Apologize as I am pretty new in networking so I thought unbound_manager could help me to setup unbound easier.
 
mangkoran said:
Did you mean I should reinstall unbound with unbound_manager? Or manually install from entware? Apologize as I am pretty new in networking so I thought unbound_manager could help me to setup unbound easier.
Click to expand...
Yes, I did mean with unbound_manager, if it isn’t too complicated. It just seemed it wasn‘t setup correctly the first time.

The fact that your original dig command on port 53535 failed, suggested Unbound couldn’t reach the internet. Is Skynet also installed?
 
dave14305 said:
Yes, I did mean with unbound_manager, if it isn’t too complicated. It just seemed it wasn‘t setup correctly the first time.

The fact that your original dig command on port 53535 failed, suggested Unbound couldn’t reach the internet. Is Skynet also installed?
Click to expand...
I see. I will try to reinstall unbound and report the step here. And no I have no skynet installed. Although I have diversion installed but I disabled it.
 
I have cleaned those 2 files and reinstalled unbound. Below are the options I chose.
Code: 
Do you want to ENABLE unbound logging? (NO recommended)

        Reply 'y' or press ENTER  to skip (skip)

Do you want to optimise Performance/Memory parameters? (YES recommended)

        Reply 'y' or press [Enter]  to skip (y)

After that, below is the router configuration as reported by unbound_manager.
Code: 
        Router Configuration recommended pre-reqs status:

        [✔] Swapfile=2097148 kB
        [✔] DNS Filter=ON
        [✔] DNS Filter=ROUTER
        [✔] WAN: Use local caching DNS server as system resolver=NO
        [✔] Entware NTP server 'S77ntpd' is running
        [✔] Enable DNS Rebind protection=NO
        [✔] Enable DNSSEC support=NO

        Options:

        [✔] unbound CPU/Memory Performance tweaks
        [✔] Firefox DNS-over-HTTPS (DoH) DISABLE/Blocker
        [✔] unbound-control FAST response ENABLED

Netstat output.
Code: 
netstat: showing only processes with your user ID
tcp        0      0 127.0.0.1:53            0.0.0.0:*               LISTEN      7751/dnsmasq
tcp        0      0 192.168.50.1:53         0.0.0.0:*               LISTEN      7751/dnsmasq
tcp        0      0 127.0.0.1:953           0.0.0.0:*               LISTEN      7652/unbound
tcp        0      0 127.0.0.1:53535         0.0.0.0:*               LISTEN      7652/unbound
udp        0      0 127.0.0.1:53535         0.0.0.0:*                           7652/unbound
udp        0      0 127.0.0.1:53            0.0.0.0:*                           7751/dnsmasq
udp        0      0 192.168.50.1:53         0.0.0.0:*                           7751/dnsmasq
udp        0      0 0.0.0.0:67              0.0.0.0:*                           7751/dnsmasq

However, dig still reported SERVFAIL.
Code: 
; <<>> DiG 9.18.16 <<>> www.google.com @127.0.0.1
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 22929
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;www.google.com.                        IN      A

;; Query time: 0 msec
;; SERVER: 127.0.0.1#53(127.0.0.1) (UDP)
;; WHEN: Mon Sep 11 07:37:19 ICT 2023
;; MSG SIZE  rcvd: 43
 
I tried to dig snbforums.com and it still reported SERVFAIL.
Code: 
; <<>> DiG 9.18.16 <<>> snbforums.com @127.0.0.1
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 55342
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;snbforums.com.                 IN      A

;; Query time: 1 msec
;; SERVER: 127.0.0.1#53(127.0.0.1) (UDP)
;; WHEN: Mon Sep 11 07:54:51 ICT 2023
;; MSG SIZE  rcvd: 42

Below is the content of unbound.log.
Code: 
Sep 11 07:37:39 unbound[7652:0] info: service stopped (unbound 1.17.1).
Sep 11 07:54:28 unbound[13089:0] info: start of service (unbound 1.17.1).
Sep 11 07:54:44 unbound[13089:0] info: validation failure <snbforums.com. A IN>: No DNSKEY record from 192.43.172.30 for key com. while building chain of trust
Sep 11 07:55:01 unbound[13089:0] info: validation failure <agent-oc.ninjarmm.com. AAAA IN>: key for validation com. is marked as invalid
Sep 11 07:55:01 unbound[13089:0] info: validation failure <agent-oc.ninjarmm.com. A IN>: key for validation com. is marked as invalid
Sep 11 07:55:02 unbound[13089:0] info: validation failure <edgeapi.slack.com. HTTPS IN>: key for validation com. is marked as invalid
Sep 11 07:55:02 unbound[13089:0] info: validation failure <edgeapi.slack.com. A IN>: key for validation com. is marked as invalid
Sep 11 07:55:06 unbound[13089:0] info: validation failure <signaler-pa.clients6.google.com. A IN>: key for validation com. is marked as invalid

I suppose this key validation thing is the culprit?

Edit: After I searched the net for a while, I suppose this has something to do with DNSSEC. If its the case, is it possible to turn off unbound's DNSSEC and see if it will work?
 
Last edited:
mangkoran said:
I suppose this key validation thing is the culprit?
Click to expand...
Try:
Code: 
cat /opt/var/lib/unbound/root.key
/opt/sbin/unbound-anchor -a /opt/var/lib/unbound/root.key
cat /opt/var/lib/unbound/root.key
mangkoran said:
is it possible to turn off unbound's DNSSEC
Click to expand...
Possible by removing validatorfrom the module-config option. But without dnssec, there’s not much extra benefit to Unbound over dnsmasq. Recursive resolving is fun to try, but not a must-have for small home routers.
 
I tried the unbound-anchor command and added -v for verbosity. Below is the output.
Code: 
/opt/var/lib/unbound/root.key has content
fail: the anchor is NOT ok and could not be fixed

I have searched the net and it seems it has something to do with ntp. But I have ntpMerlin running with ntpd.
 
You must log in or register to reply here.

Similar threads

D
Unbound DNSSec with unbound_manager?
Replies
6
Views
1K
dominik
D
pdc
Router DNS returning Refused
Replies
2
Views
287
pdc
pdc
Don Walker
Unbound Unbound fails to resolve "epaper.ottawacitizen.com" with SERVFAIL
Replies
3
Views
1K
Don Walker
Don Walker
K
Unbound Unbound suddenly not resolving certian domains!
2 3
Replies
57
Views
5K
Khadanja
K
StrikerXXX
Correct way to configure quad9 dns in EDNS/ECS
Replies
0
Views
2K
StrikerXXX
StrikerXXX
Similar threads
Thread starter Title Forum Replies Date
BATTLEPENCIL Skynet Unable to uninstall Skynet Asuswrt-Merlin AddOns 11
B YazFi YazFi Guest Network unable to access Pi-Hole DNS server Asuswrt-Merlin AddOns 22
U Skynet Unable to Install Skynet Asuswrt-Merlin AddOns 31
P Entware Unable to install Entware on a RT-AX86S with 3004.388.4 Asuswrt-Merlin AddOns 1
A Setup Merlin and Skynet - Now only my Echo Plus is unable to access the internet Asuswrt-Merlin AddOns 6
U Unbound Help setting up Unbound. Asuswrt-Merlin AddOns 2
B Knot Resolver vs unbound? Asuswrt-Merlin AddOns 1
V unbound blocking apple private relay. Asuswrt-Merlin AddOns 1
B Unbound unbound/WAN settings Asuswrt-Merlin AddOns 31
Viktor Jaep Solved Latest entware update borked up Unbound Asuswrt-Merlin AddOns 25

Similar threads

Latest threads

Sign Up For SNBForums Daily Digest

Get an update of what's new every day delivered to your mailbox. Sign up here!

Members online

Total: 887 (members: 17, guests: 870)
Top