core: After reboot of OPNsense Unbound is not working for OpenVPN clients only

Version OPNsense 18.7.5_1-amd64 Installed on self-configured hardware (Intel® Celeron® CPU J1900 @ 1.99GHz (4 cores)) and as fresh Hyper-V VM installation for tests.

Issue appears after each reboot of OPNsense

Issue After rebooting OPNsense the DNS resolving for OpenVPN clients only is not working. LAN clients in three different VLANs are not affected. They can resolve internal and exteranl DNS names as well. So I guess Unbound is not completly hanging or stopped. After restarting the Unbound service DNS resolving for the OpenVPN clients works fine again.

After the restart of the service the DNS record for my OPNsense management interface (re1) contains of course the IP address of the management interface itself (192.168.1.1/24), but also the IP address of the virtual OpenVPN interface (192.168.15.1/24). Therefore when I try to access the WebGUI and my client gets the OpenVPN interface IP from Unbound I get timeouts and a lot of deny entrys in the firewall logs because this interface is not allowed for WebGUI access.

NSLOOKUP from Client VLAN (192.168.10.0/24) after restart of OPNsense, but before restart of Unbound service

C:\Users\XXX>nslookup
Standardserver:  JasWall.jasnet.home.arpa
Address:  192.168.10.1

> jaswall.mgmt.home.arpa
Server:  JasWall.jasnet.home.arpa
Address:  192.168.10.1

Name:    jaswall.mgmt.home.arpa
Addresses:  192.168.1.1

>

NSLOOKUP from Client VLAN (192.168.10.0/24) after restart of Unbound service

C:\Users\XXX>nslookup
Standardserver:  JasWall.jasnet.home.arpa
Address:  192.168.10.1

> jaswall.mgmt.home.arpa
Server:  JasWall.jasnet.home.arpa
Address:  192.168.10.1

Name:    jaswall.mgmt.home.arpa
Addresses:  192.168.1.1
          192.168.15.1

>

The fresh installed OPNsense VM is configured with the basic settings like WAN and LAN interface only. No additional plugins or services are running. But it shows the same behaviour as my productive OPNsense.

About this issue

Original URL
State: closed
Created 6 years ago
Comments: 26 (12 by maintainers)

Commits related to this issue

unbound: restart after VPN is up for #2828 — committed to opnsense/core by fichtner 6 years ago
unbound: restart after VPN is up for #2828 (cherry picked from commit 35478a8f94095a8491bcb8c5c18beee28b2b2858) — committed to opnsense/core by fichtner 6 years ago
unbound: exclude OpenVPN from IP registration for #2828 — committed to opnsense/core by fichtner 6 years ago
unbound: exclude OpenVPN from IP registration for #2828 — committed to opnsense/core by fichtner 6 years ago
unbound: exclude OpenVPN from IP registration for #2828 — committed to opnsense/core by fichtner 6 years ago

Most upvoted comments

for every one which have problem with Unbound service on opnsense

1: vi /usr/local/etc/rc.syshook.d/start/50-dnsrestarter 2: copy the below code in vi and save it (ESC :wq!) enter #!/bin/sh /usr/local/sbin/pluginctl dns restart 3: chmod 777 /usr/local/etc/rc.syshook.d/start/50-dnsrestarter

now it should be working after reboot

mubarizrahimi on Jul 19, 2020

@JasMan78 333dc0fc should fix your issue, but I’m not sure it won’t cause others to complain as well when we include it in 19.1. I’ll keep this ticket open for your feedback on the patch. 19.1 is about 1 month away.

EDIT: Updated hash, fatal unicode whitespace included 😦

fichtner on Dec 28, 2018

@JasMan78 ok, let’s close this ticket then and add the patch to 18.7.9.

@karl047 please open a separate ticket. your issue looks like a general VPN issue or possibly routing configuration related

fichtner on Dec 1, 2018