Hello Bernhard, > On 29 Apr 2026, at 23:19, Bernhard Bitsch <[email protected]> wrote: > > Hello Michael, > > Am 29.04.2026 um 22:09 schrieb Michael Tremer: >> Hello Bernhard, >>> On 29 Apr 2026, at 18:43, Bernhard Bitsch <[email protected]> wrote: >>> >>> Hi, >>> >>> after using the new DNS FW ( congrats to this nice feature! ), I found some >>> issues. >> Thanks. I believe that the entire feature has received very poor testing. >> Considering how many people have stated how important it is to them, really >> critical issues have been reported very late in the release process which >> indicates that the feature has not been tested, or if people found those >> bugs, they have not been reported. >> I have to say that I am very disappointed about this. But it has nothing to >> do with your question. >>> - Each 'save' in WUI page increases the memory consumption. Even if nothing >>> changed. A restart of unbound frees this huge allocation. >> Yes, this is known. It is a problem inside Unbound and there is nothing we >> can do about it. I did not report it to Unbound, but I am sure they should >> be made aware. >> Unbound in general is using a lot of memory when it is downloading the >> lists. I have imported the lists into PowerDNS Recursor and it raises its >> memory consumption by about ~300 MiB when Unbound is going into 1.6-1.7 GiB. > > Some more investigation in unbound docs about the operation fast_reload > ("This command is experimental at this time.") and some experiments I can > state, that the fast_reload doesn't free the copy of the state. This gives > the increase in memory consumption. > The runtime for the 'reload_keep_cache' operation is about the same as for > 'fast_reload' ( just my feeling ). But the memory load doesn't increase ( > measured just with the WUI memory stats ).
Well, that is not experimental then, it is utterly broken. We are however between a rock and a hard place, because the alternative would be to run a regular reload which will result in Unbound stopping to process any queries, reload the zones and then resuming. On some hardware, we are in the area of minutes to load the zones which will cause absolute chaos if there is no DNS resolution for that time. >> For now we are stuck with Unbound, but it has always been giving us a lot of >> trouble. > > Does this mean we are switching to PowerDNs? But we should have a stable > system meantime. What about going back to the 'reload_keep_cache' operation? No, we are not switching to anything at the moment because I simply don’t have the time. We will however do it at some point in the future. PowerDNS Recursor is one of the candidates because it is very scriptable with Lua. Knot Resolver would also be a good option. I tested running them on IPFire and they both work great, but we have a lot of custom tooling which will be quite time-consuming to migrate to any of the other solutions. -Michael > Regards, > Bernhard >>> - Knowing from using Jon's RPZ prototype, I checked whether a single reload >>> ( used in DNS FW? ) propagates the changes, new list and/or allow/deny >>> entries, really. I found cases where this isn't true. A unbound restart >>> yielded the right behaviour. >>> >>> >>> I must apologize not to have tested the release. But I haven't the >>> equipment, yet ( only one production system ). >>> >>> Regards, >>> Bernhard >>> > >
