Unbound DNS Question (with some pihole thrown in)

[Pocky Is God]

So I am using OPNSense (love it), and Unbound on said box. Am trying to get to an address that I know is up, but that my DNS cannot resolve. I do have the option to forward queries to name servers it cannot resolve (Using Cloudflare and OpenDNS) and still, it cannot get to this address. Shouldn't my machine forward queries it itself cannot resolve until it gets to the address in question? Do I have something configured incorrectly?

And yes, I'm trying to watch some weird Anime my buddy recommended. Don't judge me.

 

[evan_s]

If you have a piHole setup I'd check that and make sure it isn't being blocked there. If it's in the block list that would stop the progression of look ups and just return a not exists message. If the look ups kept going up the chain when the piHole blocked it that would defeat the whole point of blocking as you'd still end up getting the server address anyway. I'd try manually setting the DNS on one machine to CloudFlare or OpenDNS and confirm you can access the site.

 

[spiralscratch]

Yeah, my bet is also on the Pi-Hole blocking the query if it's just one or a few hosts that are problematic. Its logs should show what queries are being dropped.

A simple diagnostic might be to use the dig command to run test queries against the various resolvers in the chain to see where it's getting lost. e.g.:

dig <hostname> # this uses the local resolver
dig @<pi-hole addr> <hostname>
dig @<unbound addr> <hostname>
dig @<upstream addr> <hostname>

 

[wxfisch]

Yeah, my bet is also on the Pi-Hole blocking the query if it's just one or a few hosts that are problematic. Its logs should show what queries are being dropped.

A simple diagnostic might be to use the dig command to run test queries against the various resolvers in the chain to see where it's getting lost. e.g.:

dig <hostname> # this uses the local resolver
dig @<pi-hole addr> <hostname>
dig @<unbound addr> <hostname>
dig @<upstream addr> <hostname>

I use this quite often when I have odd DNS lookup issues on my recursive pi-hole. I did learn that Tailscale did odd things to the DNS settings on my Pi-hole box when I had it setup and would cause lookups to somewhat randomly fail because pi-hole would lose its settings to go to localhost for the unbound lookup and instead would send them to Tailscale which just sent them back to the pi-hole.
I never did fix that issue, instead just ripped Tailscale out of the network and use UniFi Identity to VPN to my network when I need to now.

 

[Pocky Is God]

Here is the straight Unbound DNS, without hitting pihole:

 

[spiralscratch]

Here is the straight Unbound DNS, without hitting pihole:

View attachment 117234

Query only the hostname, not the full URL: dig fmhy.net

 

[drnick1]

Isn't Pi-hole redundant when you are running Unbound? The Pi-hole blacklists can be added to Unbound directly in the appropriate format.

 

[Pocky Is God]

You know what makes no sense? the URL works fine on my Macbook. Doesn't work on my desktop. Streamed it last night when I got home from a concert.

Thats stupid.

 

[spiralscratch]

You know what makes no sense? the URL works fine on my Macbook. Doesn't work on my desktop. Streamed it last night when I got home from a concert.

Thats stupid.

Are you certain the Mac's browser isn't using its own DNS settings separate from the system's?

 

[Pocky Is God]

Are you certain the Mac's browser isn't using its own DNS settings separate from the system's?

Pretty sure it would have to for it to resolve these addresses and my laptop doesn't. I'll check its settings right now.

 

[Pocky Is God]

So, I double checked, I can get to hianime.to from my Macbook, but it is still using my unbound DNS server. Here is a dig output using my forwarding DNS (1.1.1.1) and my unbound dns (10.0.0.1):

 

[andygoblins]

Late to the party, but based on that last output, unbound is returning 0.0.0.0 instead of a valid IP. That's a common blocklist technique, like what pihole does.

Is it possible opnsense has some default blocklist configs? (Just a guess...I don't use opnsense and write my unbound configs directly)

 

[Paladin]

Yeah I would also bet some kind of policy causing that on the opnsense/unbound setup. It should either have a log for blocked attempts or an option to log that kind of thing.

And Mac can have some odd behavior if you have any of the security/privacy features turned on in the OS or applications. It can proxy all kinds of traffic to external resources, VPNs, DNS-Sec services, etc.