unbound stops responding when connection to upstream breaks

[tito]

On Wed, 09 Feb 2022 09:04:59 -0500
Chris Snell via Unbound-users <unbound-users at lists.nlnetlabs.nl> wrote:

> Hi,
> 
> I'm experiencing issues with unbound's connection to my upstream recursive resolver.  Both my local caching forwarder and the upstream recursive resolver are running unbound.  The problem happens every time the connection between the local server and upstream fails and when this happens, the local's connection to upstream will not reconnect.  The connection might break due to a variety of things:
> 
> - wifi on the laptop changing APs
> - connecting to a VPN
> - rebooting the upstream recursive server
> 
> Whenever one of these conditions happen, queries to the local forwarder will fail and continue to do so until the local forwarder is restarted.  Once it's restarted, everything works fine again.  This feels like some kind of issue with TLS or a persistent connection.
> 
> Is there any way to force unbound to be a little more aggressive in reconnecting when something fails with networking?
> 
> Here's my local forwarder's unbound.conf:
> 
> server:
>   do-daemonize: no
>   use-syslog: yes
>   log-queries: yes
>   log-replies: yes
>   username: "unbound"
>   directory: "/etc/unbound"
>   trust-anchor-file: trusted-key.key
>   interface: 127.0.0.1
>   do-ip6: no
>   prefer-ip6: no
>   do-tcp: yes
>   do-udp: yes
>   ssl-upstream: yes
>   num-threads: 4
>   msg-cache-slabs: 8
>   rrset-cache-slabs: 8
>   infra-cache-slabs: 8
>   key-cache-slabs: 8
>   rrset-cache-size: 256m
>   msg-cache-size: 128m
>   so-rcvbuf: 1m
>   private-address: 192.168.0.0/16
>   private-address: 172.16.0.0/12
>   private-address: 10.0.0.0/8
> forward-zone:
>   name: "."
>   forward-addr: <REDACTED>@443
> 
> And here is my upstream recursive resolver's:
> 
> server:
>   use-syslog: yes
>   verbosity: 1
>   access-control: 0.0.0.0/0 allow
>   log-queries: no
>   log-replies: no
>   username: "unbound"
>   directory: "/etc/unbound"
>   auto-trust-anchor-file: "/etc/unbound/etc/trusted-key.key"
>   val-permissive-mode: yes
>   root-hints: root.hints
>   interface: 0.0.0.0 at 443
>   do-ip6: no
>   prefer-ip6: no
>   do-udp: yes
>   do-tcp: yes
>   ssl-service-key: "/etc/letsencrypt/live/<REDACTED>/privkey.pem <http://silcox.island.nu/privkey.pem>"
>   ssl-service-pem: "/etc/letsencrypt/live/<REDACTED>/fullchain.pem <http://silcox.island.nu/fullchain.pem>"
>   ssl-port: 443
>   do-daemonize: no
>   chroot: "/etc/unbound"
>   hide-version: yes
>   hide-identity: yes
>   harden-glue: no
>   harden-dnssec-stripped: no
>   use-caps-for-id: yes
>   so-rcvbuf: 1m
>   prefetch: yes
>   minimal-responses: yes
>   ratelimit: 1000
>   ip-ratelimit: 500
>   cache-max-negative-ttl: 10
>   unwanted-reply-threshold: 10000
>   private-address: 192.168.0.0/16
>   private-address: 172.16.0.0/12
>   private-address: 10.0.0.0/8
> 
> Any ideas?  Thanks.
> 
> Chris

Hi,
if I recall correctly

       infra-host-ttl: 15
        infra-keep-probing: yes

fixed it for me.

Ciao,
Tito