Hello Michael,
Am 29.04.2026 um 22:09 schrieb Michael Tremer:
Hello Bernhard,
On 29 Apr 2026, at 18:43, Bernhard Bitsch <[email protected]> wrote:
Hi,
after using the new DNS FW ( congrats to this nice feature! ), I found some
issues.
Thanks. I believe that the entire feature has received very poor testing.
Considering how many people have stated how important it is to them, really
critical issues have been reported very late in the release process which
indicates that the feature has not been tested, or if people found those bugs,
they have not been reported.
I have to say that I am very disappointed about this. But it has nothing to do
with your question.
- Each 'save' in WUI page increases the memory consumption. Even if nothing
changed. A restart of unbound frees this huge allocation.
Yes, this is known. It is a problem inside Unbound and there is nothing we can
do about it. I did not report it to Unbound, but I am sure they should be made
aware.
Unbound in general is using a lot of memory when it is downloading the lists. I
have imported the lists into PowerDNS Recursor and it raises its memory
consumption by about ~300 MiB when Unbound is going into 1.6-1.7 GiB.
Some more investigation in unbound docs about the operation fast_reload
("This command is experimental at this time.") and some experiments I
can state, that the fast_reload doesn't free the copy of the state. This
gives the increase in memory consumption.
The runtime for the 'reload_keep_cache' operation is about the same as
for 'fast_reload' ( just my feeling ). But the memory load doesn't
increase ( measured just with the WUI memory stats ).
For now we are stuck with Unbound, but it has always been giving us a lot of
trouble.
Does this mean we are switching to PowerDNs? But we should have a stable
system meantime. What about going back to the 'reload_keep_cache' operation?
Regards,
Bernhard
- Knowing from using Jon's RPZ prototype, I checked whether a single reload (
used in DNS FW? ) propagates the changes, new list and/or allow/deny entries,
really. I found cases where this isn't true. A unbound restart yielded the
right behaviour.
I must apologize not to have tested the release. But I haven't the equipment,
yet ( only one production system ).
Regards,
Bernhard
