<!DOCTYPE html><html><head><title></title><style type="text/css">p.MsoNormal,p.MsoNoSpacing{margin:0}
p.MsoNormal,p.MsoNoSpacing{margin:0}</style></head><body><div>Hi,<br></div><div><br></div><div>I'm experiencing issues with unbound's connection to my upstream recursive resolver. Both my local caching forwarder and the upstream recursive resolver are running unbound. The problem happens every time the connection between the local server and upstream fails and when this happens, the local's connection to upstream will not reconnect. The connection might break due to a variety of things:<br></div><div><br></div><div>- wifi on the laptop changing APs<br></div><div>- connecting to a VPN<br></div><div>- rebooting the upstream recursive server<br></div><div><br></div><div>Whenever one of these conditions happen, queries to the local forwarder will fail and continue to do so until the local forwarder is restarted. Once it's restarted, everything works fine again. This feels like some kind of issue with TLS or a persistent connection.<br></div><div><br></div><div>Is there any way to force unbound to be a little more aggressive in reconnecting when something fails with networking?<br></div><div><br></div><div>Here's my local forwarder's unbound.conf:<br></div><div><br></div><div dir="ltr"><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;">server:<br></span></div><div dir="ltr"><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"> do-daemonize: no<br></span></div><div dir="ltr"><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"> use-syslog: yes<br></span></div><div dir="ltr"><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"> log-queries: yes<br></span></div><div dir="ltr"><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"> log-replies: yes<br></span></div><div dir="ltr"><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"> username: "unbound"<br></span></div><div dir="ltr"><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"> directory: "/etc/unbound"<br></span></div><div dir="ltr"><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"> trust-anchor-file: trusted-key.key<br></span></div><div dir="ltr"><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"> interface: 127.0.0.1<br></span></div><div dir="ltr"><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"> do-ip6: no<br></span></div><div dir="ltr"><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"> prefer-ip6: no<br></span></div><div dir="ltr"><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"> do-tcp: yes<br></span></div><div dir="ltr"><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"> do-udp: yes<br></span></div><div dir="ltr"><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"> ssl-upstream: yes<br></span></div><div dir="ltr"><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"> num-threads: 4<br></span></div><div dir="ltr"><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"> msg-cache-slabs: 8<br></span></div><div dir="ltr"><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"> rrset-cache-slabs: 8<br></span></div><div dir="ltr"><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"> infra-cache-slabs: 8<br></span></div><div dir="ltr"><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"> key-cache-slabs: 8<br></span></div><div dir="ltr"><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"> rrset-cache-size: 256m<br></span></div><div dir="ltr"><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"> msg-cache-size: 128m<br></span></div><div dir="ltr"><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"> so-rcvbuf: 1m<br></span></div><div dir="ltr"><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"> private-address: 192.168.0.0/16<br></span></div><div dir="ltr"><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"> private-address: 172.16.0.0/12<br></span></div><div dir="ltr"><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"> private-address: 10.0.0.0/8<br></span></div><div dir="ltr"><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;">forward-zone:<br></span></div><div dir="ltr"><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"> name: "."<br></span></div><div dir="ltr"><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"> forward-addr: <REDACTED>@443</span><br></div><div dir="ltr"><br></div><div dir="ltr">And here is my upstream recursive resolver's:<br></div><div dir="ltr"><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"><br></span></div><div dir="ltr"><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;">server:</span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"><br></span></div><div><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"> use-syslog: yes</span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"><br></span></div><div><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"> verbosity: 1</span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"><br></span></div><div><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"> access-control: 0.0.0.0/0 allow</span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"><br></span></div><div><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"> log-queries: no</span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"><br></span></div><div><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"> log-replies: no</span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"><br></span></div><div><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"> username: "unbound"</span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"><br></span></div><div><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"> directory: "/etc/unbound"</span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"><br></span></div><div><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"> auto-trust-anchor-file: "/etc/unbound/etc/trusted-key.key"</span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"><br></span></div><div><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"> val-permissive-mode: yes</span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"><br></span></div><div><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"> root-hints: root.hints</span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"><br></span></div><div><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"> interface: 0.0.0.0@443</span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"><br></span></div><div><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"> do-ip6: no</span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"><br></span></div><div><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"> prefer-ip6: no</span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"><br></span></div><div><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"> do-udp: yes</span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"><br></span></div><div><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"> do-tcp: yes</span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"><br></span></div><div><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"> ssl-service-key: "/etc/letsencrypt/live/</span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"><REDACTED></span><a href="http://silcox.island.nu/privkey.pem"><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;">/privkey.pem</span></a><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;">"</span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"><br></span></div><div><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"> ssl-service-pem: "/etc/letsencrypt/live/<REDACTED></span><a href="http://silcox.island.nu/fullchain.pem"><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;">/fullchain.pem</span></a><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;">"</span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"><br></span></div><div><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"> ssl-port: 443</span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"><br></span></div><div><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"> do-daemonize: no</span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"><br></span></div><div><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"> chroot: "/etc/unbound"</span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"><br></span></div><div><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"> hide-version: yes</span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"><br></span></div><div><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"> hide-identity: yes</span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"><br></span></div><div><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"> harden-glue: no</span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"><br></span></div><div><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"> harden-dnssec-stripped: no</span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"><br></span></div><div><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"> use-caps-for-id: yes</span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"><br></span></div><div><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"> so-rcvbuf: 1m</span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"><br></span></div><div><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"> prefetch: yes</span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"><br></span></div><div><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"> minimal-responses: yes</span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"><br></span></div><div><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"> ratelimit: 1000</span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"><br></span></div><div><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"> ip-ratelimit: 500</span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"><br></span></div><div><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"> cache-max-negative-ttl: 10</span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"><br></span></div><div><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"> unwanted-reply-threshold: 10000</span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"><br></span></div><div><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"> private-address: 192.168.0.0/16</span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"><br></span></div><div><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"> private-address: 172.16.0.0/12</span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"><br></span></div><div><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"> private-address: 10.0.0.0/8</span><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"><br></span></div><div><br></div><div>Any ideas? Thanks.<br></div><div><br></div><div>Chris<br></div><div></div><div></div></body></html>