DietPi-Software | Unbound: Toggle IPv6 based on present IPv6 address #5412
Comments
|
Pls try to reboot your system and check the log afterwards |
This is what I get after reboot. Makes me think it's working? |
|
Yes looks like. You can check following as well |
|
This is the output: But... Below is my installed list and unbound isn't showing |
|
If I try to install Unbound from inside Dietpi-software (where it's not showing as installed) this is what I get: Edit: for some reason all my replies show up twice :/ |
|
Somehow you are posting everything twice. If you are hit by the issue, you should have an error handling menu. There should be an option to open a sub shell. Do this and execute |
|
Did as you suggested, check status again and this is the outcome. I don't understand why it's not showing under software but is apparently installed but not running. Again, not sure why I'm double-posting my reply's. Sorry for that. root@DietPi:~# systemctl status unbound.service Apr 09 09:54:02 DietPi systemd[1]: unbound.service: Scheduled restart job, restart counter is at 5. |
|
The What does the log is stating now |
Logfile attached. Click to expand! |
|
Unbound tries to connect to IPv6 interface. Question, do you use IPv6? Yes or No? can you check what configuration exist? |
|
No, I don't use IPv6. This is the output: Could this have anything to do with dietpi-vpn? I'm trying to run my outgoing traffic over VPN (Nordvpn/Nordlynx) and I did a fresh install and setup Nordvpn first (using dietpi-vpn). I've installed both AG Home and Unbound before with zero problems. |
|
can you share unbound configuration as well as IP config |
|
Output: |
|
Not sure why but your unbound configuration has IPv6 enabled > try following you should be able to install unbound + AGH now |
|
The issue is that IPv6 is disabled automatically when connecting to the VPN. Most VPN providers do not support IPv6, NordVPN, AFAIK on a few selected servers only, so to prevent IPv6 leaks, it needs to be disabled. But Unbound is configured based on whether IPv6 is generally enabled (without taking the VPN into account). As a quick solution, you can hence disable IPv6 via Not sure if/how we can address this properly. Disabling IPv6 (hence starting the VPN) while Unbound is running is not an issue (hence no issue on Unbound start at reboot, before VPN is up), but when (re)starting the server, like during (re)install, of course it cannot bind to IPv6 when it's down. We could check whether the Internet facing adapter currently has an IPv6 address to decide whether to set the IPv6 flag, instead of for the general IPv6 toggle. So if the VPN is up during (re)install, it is configured to listen on and use IPv4 only. When the VPN is down, it depends on whether IPv6 is enabled or disabled in general. Sounds actually like a robust solution. I mean having IPv6 disabled for Unbound has no real downsides: It can still resolve AAAA records (IPv6 hosts), but clients can use IPv4 connections only to connect to it and it uses IPv4 connections to connect to upstream/root DNS servers. |
MichaIng
changed the title
|
In most cases, unbound is used together with PiHole or AGH. Means for this combination, no IPv6 is required at all. Isn't it? |
|
Yes, I mean I don't know any case where IPv6 is "required", as long as not for whatever reasons people setup an IPv6-only LAN 😄. With Pi-hole and AGH at least I'll have a look through Unbound options again. Probably there is a separation possible between Unbound port binding (connections to Unbound) and connections from Unbound. And probably there is some "auto" option for both or the latter, to simply use IPv6 only when the interface has an IPv6 address. |
Sorry, yesterday I had to leave. I just tried the above, did a reboot and tried to install both again. I'm leaning towards starting from fresh again and install both AG + Unbound, check IPv6 before running dietpi-vpn. Edit: still don't understand why all my replies show up twice too |
|
is the VPN active while you try to install Unbound? And what is the actual setting in unbound configuration? Anouther thing to share is the log again |
|
Ah, I think the Please stop the VPN, then disable IPv6 via |
|
Ok, here is what I did. Set auto-reboot off in dietpi-vpn, rebooted the pi. By the looks of it everything is working but I haven't really set things up, I just don't get an error now. |
Did you disable IPv6 before installing AdGuard Home and Unbound? That is the important part, as only then Unbound is configured to not used IPv6. After the installation finished, you can theoretically re-enable IPv6 (on the system) without any issues. However, as Unbound has now successfully installed, no need to redo everything but you can now adjust the config manually: G_CONFIG_INJECT 'do-ip6:[[:blank:]]' ' do-ip6: no' /etc/unbound/unbound.conf.d/dietpi.conf
systemctl restart unbound |
- DietPi-Software | Tor/Unbound: Resolved an issue where IPv6 usage was assumed only based on the dietpi.txt setting instead of on whether IPv6 can really be used for Internet connections. E.g. when a VPN connection is established, usually IPv6 is disabled to prevent IPv6 leaks, without changing the general dietpi.txt setting. Tor and Unbound service starts however fail then, trying to bind to the IPv6 port. If the adapter has an IPv6 address assigned, but no IPv6 default route, binding to the IPv6 port succeeds, but Internet connections via IPv6 are not possible, which isn't better. On the other hand, using IPv4 only while IPv6 is enabled, has no real downsides. Many thanks to @Wgsem for reporting this issue: #5412
MichaIng
added
Solution available 🥂
|
Solved with: 9407a8d |
|
Impressed by the help I got and how fast this is solved. Thanks |
|
(Along with some coding changes) I changed |
|
I was having the exact same issue running ubuntu server 20.04 on a raspberry pi 4. My specific problem was that I am tunneling my raspberry pi server through a cloud instance vpn in order to obtain a fresh IP address, and get proper PTR records for my server. This took me forever to figure out why unbound wasn't installing, but this issue helped me resolve it. You are correct that having ipv6 interfaces enabled while running as an ipv4 only vpn client was indeed the problem. You can solve the isssue by disabling all ipv6 interfaces in then running the command Theoretically, this should be all you need to do to fully disable ipv6, thus allowing unbound to have a successful install. HOWEVER, I chose to disable ipv6 on all interfaces via a much easier approach. This solution works for raspberry pi only, but you can find the equivilent file in x86 versions of grub to edit. All I did to solve this was add "ipv6.disable=1" to the I'm certain dietpi has an equivilent file to cmdline.txt on the raspberry pi version. Hope this helps to anyone reading and having the problem with installing unbound on ubuntu server 20.04. |
|
Not exactly the same issue, since in the case here having IPv6 disabled system-wise wouldn't have solved the issue. The problem only was However, it makes much sense to disable IPv6 when you connect to an IPv4-only VPN, else otherwise IPv6 leaks are likely, i.e. the system bypassing the VPN for connections to every host which does have an AAAA record, as IPv6 is usually preferred, when available. |
Details:
Linux DietPi 5.15.32-v8+ #1538 SMP PREEMPT Thu Mar 31 19:40:39 BST 2022 aarch64 GNU/Linuxsystemctl restart unboundSteps to reproduce:
Expected behaviour:
Actual behaviour:
Extra details:
Additional logs:
Systemctl status unbound.service log
The text was updated successfully, but these errors were encountered: