For the record, I am also running the latest version of Unbound (1.5.10)
on FreeBSD 10.3 with libevent compilation option, and I have no problems
whatsoever.
Recommended things to check:
- sysctl limits for network buffers, expecially TCP buffers, since the
penetration of DNSSec means that TCP based DNS traffic is increasing.
- in case you use stateful firewall, check limits for max number of
states, since you can run out quite easily. Stateless rules for DNS
traffic are recommended. Also limit for maximum fragmented packet limits.
- try to monitor your system resource usage, especially memory - do you
have enough? does the system swap during peaks in traffic?
- check logs for messages concerning failures to send packets, limits
for various resources reached, etc
Also, my servers are constantly bombarded by bogus queries about bogus
domains featuring non-responsive authoritative nameservers (targets of
some DDOS attack, if I understand it correctly), and such queries can
exhaust your resources rapidly, since each unresolved TCP query consumes
a portion of memory before it times out. Use the command
"unbound-control dump_requestlist" to check what queries are being
resolved during the time the server appears to be non-responsive/slow. I
had to implement a countermeasure that recognizes these bogus queries
and replies with NXDOMAIN RCODE immediately, saving the resolver's
memory for legitimate traffic.
I am not saying that there cannot be a problem with the newest version
of Unbound, just reporting everything is fine here and trying to provide
some tips.
--
S pozdravem,
Daniel Ryšlink
System Administrator
Dial Telecom a. s.
Křižíkova 36a/237
186 00 Praha 3, Česká Republika
Tel.:+420.226204627
[email protected]
-----------------------------------------------
www.dialtelecom.cz
Dial Telecom, a.s.
Jednoduše se připojte
-----------------------------------------------
On 25.10.2016 16:55, tailings--- via Unbound-users wrote:
Please, let me add I am using LibreSSL instead OpenSSL.
Thank you.
On 23/10/16 20:25, tailings--- via Unbound-users wrote:
Hello,
I am running Unbound on FreeBSD, initially 10.3 and now 11, I tried
the one on the FreeBSD Base, and now the Port (unbound-1.5.10)
compiled with libevent support.
The problem I am experiencing is, from time to time unbound become
utterly slow or do not resolve anything, or almost anything.
I did several changes on unbound.conf file and the problem now return
about one time a day when just me (one user) is using Unbound as
resolver. If a second user begin to using Unbound at same time it
became slow as described until it have just one user again.
I opened a post on FreeBSD forum, what have more information:
https://forums.freebsd.org/threads/57493/
I need to add I also tried without success to disable PF firewall
looking for any kind of firewall related issue. Also, this is my
current unbound.conf:
# This file was generated by local-unbound-setup.
# Modifications will be overwritten.
server:
port: 53
username: unbound
directory: /usr/local/etc/unbound
chroot: /usr/local/etc/unbound
pidfile: /usr/local/etc/unbound/unbound.pid
auto-trust-anchor-file: /usr/local/etc/unbound/root.key
root-hints: "/usr/local/etc/unbound/root.hints"
logfile: log/unbound.log
log-time-ascii: yes
val-log-level: 2
do-ip6: no
do-tcp: yes
interface: 127.0.0.2
interface: 192.168.0.220
access-control: 127.0.0.2/16 allow
access-control: 192.168.0.0/24 allow
private-address: 192.168.0.0/24
private-domain: mydomain.com
qname-minimisation: yes
minimal-responses: no
hide-identity: yes
hide-version: yes
do-not-query-localhost: no
val-clean-additional: yes
harden-glue: yes
harden-dnssec-stripped: yes
unwanted-reply-threshold: 10000
prefetch: yes
prefetch-key: yes
cache-min-ttl: 3600
cache-max-ttl: 86400
num-threads: 4
msg-cache-slabs: 8
rrset-cache-slabs: 8
infra-cache-slabs: 8
key-cache-slabs: 8
rrset-cache-size: 100m
msg-cache-size: 50m
outgoing-range: 8192
num-queries-per-thread: 4096
so-rcvbuf: 1m
so-sndbuf: 1m
unblock-lan-zones: yes
insecure-lan-zones: yes
include: /usr/local/etc/unbound/conf.d/*.conf
#forward-zone:
# name: .
# forward-addr: 189.38.95.95
# forward-addr: 189.38.95.96
remote-control:
control-enable: yes
control-interface: /usr/local/etc/unbound/unbound.ctl
control-use-cert: no
Thank you!
Alex.
