<!DOCTYPE html><html><head><title></title><style type="text/css">p.MsoNormal,p.MsoNoSpacing{margin:0}</style></head><body><div>Thanks George, that helps a lot. It would be really helpful if the Unbound docs included a "road warrior" example for running Unbound on a laptop that forwards all its queries elsewhere. Having infra-host-ttl set low is a big improvement for this use case, but it's not very obvious when reading the documentation as a new user (who probably aren't reading the long doc linked below).<br></div><div><br></div><div>It would be helpful to have sane configuration examples in the docs for the following use cases:<br></div><div><br></div><div>- Home desktops (the default config as presented by the current docs?)<br></div><div>- Road warrior laptops that frequently change IP addresses, use VPNs, etc., and forward all queries over TLS to an off-site recursive resolver<br></div><div>- An offsite recursive resolver to use over TLS by home desktops and road warrior setups who want to avoid sniffing by consumer ISPs.<br></div><div>- A recursive resolver for use in high-traffic settings<br></div><div><br></div><div>Thanks again!<br></div><div><br></div><div>Chris<br></div><div><br></div><div>On Fri, Feb 11, 2022, at 4:35 AM, George Thessalonikefs via Unbound-users wrote:<br></div><blockquote type="cite" id="qt" style=""><div>Hi Chris,<br></div><div><br></div><div>It is the cache that holds information for all encountered upstream <br></div><div>servers (also forward-addr).<br></div><div><br></div><div>You can find more information at <br></div><div><a href="https://unbound.docs.nlnetlabs.nl/en/latest/reference/history/info-timeout-server-selection.html">https://unbound.docs.nlnetlabs.nl/en/latest/reference/history/info-timeout-server-selection.html</a><br></div><div><br></div><div>Best regards,<br></div><div>-- George<br></div><div><br></div><div>On 10/02/2022 19:19, Chris Snell via Unbound-users wrote:<br></div><div>> This seems to have fixed my problem. I want to understand the <br></div><div>> infra-host-ttl better. The docs say "Time to live for entries in the <br></div><div>> host cache". What is this cache, exactly? Is this the cache of <br></div><div>> upstream servers that are the target of the forward-addr directives? Or <br></div><div>> is this DNS host records that have been queried by clients? I'd like <br></div><div>> to set this TTL as low as possible without impacting DNS server <br></div><div>> performance or record-caching.<br></div><div>> <br></div><div>> Chris<br></div><div>> <br></div><div>> On Wed, Feb 9, 2022, at 10:36 AM, Chris Snell via Unbound-users wrote:<br></div><div>>> Thanks. I will give this a shot!<br></div><div>>><br></div><div>>> On Wed, Feb 9, 2022, at 10:06 AM, tito via Unbound-users wrote:<br></div><div>>>> On Wed, 09 Feb 2022 09:04:59 -0500<br></div><div>>>> Chris Snell via Unbound-users <<a href="mailto:unbound-users@lists.nlnetlabs.nl">unbound-users@lists.nlnetlabs.nl</a> <br></div><div>>>> <mailto:<a href="mailto:unbound-users@lists.nlnetlabs.nl">unbound-users@lists.nlnetlabs.nl</a>>> wrote:<br></div><div>>>><br></div><div>>>> > Hi,<br></div><div>>>> ><br></div><div>>>> > I'm experiencing issues with unbound's connection to my upstream <br></div><div>>>> recursive resolver. Both my local caching forwarder and the upstream <br></div><div>>>> recursive resolver are running unbound. The problem happens every <br></div><div>>>> time the connection between the local server and upstream fails and <br></div><div>>>> when this happens, the local's connection to upstream will not <br></div><div>>>> reconnect. The connection might break due to a variety of things:<br></div><div>>>> ><br></div><div>>>> > - wifi on the laptop changing APs<br></div><div>>>> > - connecting to a VPN<br></div><div>>>> > - rebooting the upstream recursive server<br></div><div>>>> ><br></div><div>>>> > Whenever one of these conditions happen, queries to the local <br></div><div>>>> forwarder will fail and continue to do so until the local forwarder <br></div><div>>>> is restarted. Once it's restarted, everything works fine again. <br></div><div>>>> This feels like some kind of issue with TLS or a persistent connection.<br></div><div>>>> ><br></div><div>>>> > Is there any way to force unbound to be a little more aggressive in <br></div><div>>>> reconnecting when something fails with networking?<br></div><div>>>> ><br></div><div>>>> > Here's my local forwarder's unbound.conf:<br></div><div>>>> ><br></div><div>>>> > server:<br></div><div>>>> > do-daemonize: no<br></div><div>>>> > use-syslog: yes<br></div><div>>>> > log-queries: yes<br></div><div>>>> > log-replies: yes<br></div><div>>>> > username: "unbound"<br></div><div>>>> > directory: "/etc/unbound"<br></div><div>>>> > trust-anchor-file: trusted-key.key<br></div><div>>>> > interface: 127.0.0.1<br></div><div>>>> > do-ip6: no<br></div><div>>>> > prefer-ip6: no<br></div><div>>>> > do-tcp: yes<br></div><div>>>> > do-udp: yes<br></div><div>>>> > ssl-upstream: yes<br></div><div>>>> > num-threads: 4<br></div><div>>>> > msg-cache-slabs: 8<br></div><div>>>> > rrset-cache-slabs: 8<br></div><div>>>> > infra-cache-slabs: 8<br></div><div>>>> > key-cache-slabs: 8<br></div><div>>>> > rrset-cache-size: 256m<br></div><div>>>> > msg-cache-size: 128m<br></div><div>>>> > so-rcvbuf: 1m<br></div><div>>>> > private-address: 192.168.0.0/16<br></div><div>>>> > private-address: 172.16.0.0/12<br></div><div>>>> > private-address: 10.0.0.0/8<br></div><div>>>> > forward-zone:<br></div><div>>>> > name: "."<br></div><div>>>> > forward-addr: <REDACTED>@443<br></div><div>>>> ><br></div><div>>>> > And here is my upstream recursive resolver's:<br></div><div>>>> ><br></div><div>>>> > server:<br></div><div>>>> > use-syslog: yes<br></div><div>>>> > verbosity: 1<br></div><div>>>> > access-control: 0.0.0.0/0 allow<br></div><div>>>> > log-queries: no<br></div><div>>>> > log-replies: no<br></div><div>>>> > username: "unbound"<br></div><div>>>> > directory: "/etc/unbound"<br></div><div>>>> > auto-trust-anchor-file: "/etc/unbound/etc/trusted-key.key"<br></div><div>>>> > val-permissive-mode: yes<br></div><div>>>> > root-hints: root.hints<br></div><div>>>> > interface: 0.0.0.0@443<br></div><div>>>> > do-ip6: no<br></div><div>>>> > prefer-ip6: no<br></div><div>>>> > do-udp: yes<br></div><div>>>> > do-tcp: yes<br></div><div>>>> > ssl-service-key: "/etc/letsencrypt/live/<REDACTED>/privkey.pem <br></div><div>>>> <<a href="http://silcox.island.nu/privkey.pem">http://silcox.island.nu/privkey.pem</a> <br></div><div>>>> <<a href="http://silcox.island.nu/privkey.pem">http://silcox.island.nu/privkey.pem</a>>>"<br></div><div>>>> > ssl-service-pem: "/etc/letsencrypt/live/<REDACTED>/fullchain.pem <br></div><div>>>> <<a href="http://silcox.island.nu/fullchain.pem">http://silcox.island.nu/fullchain.pem</a> <br></div><div>>>> <<a href="http://silcox.island.nu/fullchain.pem">http://silcox.island.nu/fullchain.pem</a>>>"<br></div><div>>>> > ssl-port: 443<br></div><div>>>> > do-daemonize: no<br></div><div>>>> > chroot: "/etc/unbound"<br></div><div>>>> > hide-version: yes<br></div><div>>>> > hide-identity: yes<br></div><div>>>> > harden-glue: no<br></div><div>>>> > harden-dnssec-stripped: no<br></div><div>>>> > use-caps-for-id: yes<br></div><div>>>> > so-rcvbuf: 1m<br></div><div>>>> > prefetch: yes<br></div><div>>>> > minimal-responses: yes<br></div><div>>>> > ratelimit: 1000<br></div><div>>>> > ip-ratelimit: 500<br></div><div>>>> > cache-max-negative-ttl: 10<br></div><div>>>> > unwanted-reply-threshold: 10000<br></div><div>>>> > private-address: 192.168.0.0/16<br></div><div>>>> > private-address: 172.16.0.0/12<br></div><div>>>> > private-address: 10.0.0.0/8<br></div><div>>>> ><br></div><div>>>> > Any ideas? Thanks.<br></div><div>>>> ><br></div><div>>>> > Chris<br></div><div>>>><br></div><div>>>> Hi,<br></div><div>>>> if I recall correctly<br></div><div>>>><br></div><div>>>> infra-host-ttl: 15<br></div><div>>>> infra-keep-probing: yes<br></div><div>>>><br></div><div>>>> fixed it for me.<br></div><div>>>><br></div><div>>>> Ciao,<br></div><div>>>> Tito<br></div><div>>>><br></div><div>>>><br></div><div>>><br></div><div>> <br></div><div><br></div></blockquote><div><br></div></body></html>