unbound stops responding when connection to upstream breaks

[Chris Snell]

Hi,

I'm experiencing issues with unbound's connection to my upstream recursive resolver.  Both my local caching forwarder and the upstream recursive resolver are running unbound.  The problem happens every time the connection between the local server and upstream fails and when this happens, the local's connection to upstream will not reconnect.  The connection might break due to a variety of things:

- wifi on the laptop changing APs
- connecting to a VPN
- rebooting the upstream recursive server

Whenever one of these conditions happen, queries to the local forwarder will fail and continue to do so until the local forwarder is restarted.  Once it's restarted, everything works fine again.  This feels like some kind of issue with TLS or a persistent connection.

Is there any way to force unbound to be a little more aggressive in reconnecting when something fails with networking?

Here's my local forwarder's unbound.conf:

server:
  do-daemonize: no
  use-syslog: yes
  log-queries: yes
  log-replies: yes
  username: "unbound"
  directory: "/etc/unbound"
  trust-anchor-file: trusted-key.key
  interface: 127.0.0.1
  do-ip6: no
  prefer-ip6: no
  do-tcp: yes
  do-udp: yes
  ssl-upstream: yes
  num-threads: 4
  msg-cache-slabs: 8
  rrset-cache-slabs: 8
  infra-cache-slabs: 8
  key-cache-slabs: 8
  rrset-cache-size: 256m
  msg-cache-size: 128m
  so-rcvbuf: 1m
  private-address: 192.168.0.0/16
  private-address: 172.16.0.0/12
  private-address: 10.0.0.0/8
forward-zone:
  name: "."
  forward-addr: <REDACTED>@443

And here is my upstream recursive resolver's:

server:
  use-syslog: yes
  verbosity: 1
  access-control: 0.0.0.0/0 allow
  log-queries: no
  log-replies: no
  username: "unbound"
  directory: "/etc/unbound"
  auto-trust-anchor-file: "/etc/unbound/etc/trusted-key.key"
  val-permissive-mode: yes
  root-hints: root.hints
  interface: 0.0.0.0 at 443
  do-ip6: no
  prefer-ip6: no
  do-udp: yes
  do-tcp: yes
  ssl-service-key: "/etc/letsencrypt/live/<REDACTED>/privkey.pem <http://silcox.island.nu/privkey.pem>"
  ssl-service-pem: "/etc/letsencrypt/live/<REDACTED>/fullchain.pem <http://silcox.island.nu/fullchain.pem>"
  ssl-port: 443
  do-daemonize: no
  chroot: "/etc/unbound"
  hide-version: yes
  hide-identity: yes
  harden-glue: no
  harden-dnssec-stripped: no
  use-caps-for-id: yes
  so-rcvbuf: 1m
  prefetch: yes
  minimal-responses: yes
  ratelimit: 1000
  ip-ratelimit: 500
  cache-max-negative-ttl: 10
  unwanted-reply-threshold: 10000
  private-address: 192.168.0.0/16
  private-address: 172.16.0.0/12
  private-address: 10.0.0.0/8

Any ideas?  Thanks.

Chris
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.nlnetlabs.nl/pipermail/unbound-users/attachments/20220209/6a45f4b3/attachment.htm>