[tor-relays] debugging unbound on 'torexit' failing DNS queries

[nusenu]

<tor-admin at portaltodark.world> wrote:
> Resent under the correct alias.
> 
> I'm having high amounts of failures on this VPS (PulseServers). I run a
> local unbound instance, and see an incredible amount of:
> Jan 17 19:27:33 torexit unbound: [559:0] notice: sendto failed: Operation
> not permitted
> Jan 17 19:27:33 torexit unbound: [559:0] notice: remote address is
> 198.97.190.53 port 53
> Jan 17 19:27:33 torexit unbound: [559:0] notice: sendto failed: Operation
> not permitted
> Jan 17 19:27:33 torexit unbound: [559:0] notice: remote address is
> 192.42.93.30 port 53
> Jan 17 19:27:33 torexit unbound: [559:0] notice: sendto failed: Operation
> not permitted
> Jan 17 19:27:33 torexit unbound: [559:0] notice: remote address is
> 192.35.51.30 port 53
> Jan 17 19:27:33 torexit unbound: [559:0] notice: sendto failed: Operation
> not permitted
> 
> To give proportion to "incredible amount",
> Jan 17 19:21:32 torexit rsyslogd: imjournal: 9897 messages lost due to
> rate-limiting
> Jan 17 19:22:02 torexit journal: Suppressed 1216 messages from
> /system.slice/unbound.service
> Jan 17 19:22:32 torexit journal: Suppressed 1209 messages from
> /system.slice/unbound.service
> Jan 17 19:23:02 torexit journal: Suppressed 1827 messages from
> /system.slice/unbound.service
> Jan 17 19:23:32 torexit journal: Suppressed 2333 messages from
> /system.slice/unbound.service
> Jan 17 19:24:02 torexit journal: Suppressed 3029 messages from
> /system.slice/unbound.service
> Jan 17 19:24:32 torexit journal: Suppressed 2822 messages from
> /system.slice/unbound.service
> Jan 17 19:25:02 torexit journal: Suppressed 2715 messages from
> /system.slice/unbound.service
> Jan 17 19:25:32 torexit journal: Suppressed 3166 messages from
> /system.slice/unbound.service
> Jan 17 19:26:02 torexit journal: Suppressed 4093 messages from
> /system.slice/unbound.service
> Jan 17 19:26:32 torexit journal: Suppressed 45878 messages from
> /system.slice/unbound.service
> Jan 17 19:27:02 torexit journal: Suppressed 30125 messages from
> /system.slice/unbound.service
> Jan 17 19:27:32 torexit journal: Suppressed 31764 messages from
> /system.slice/unbound.service
> Jan 17 19:28:02 torexit journal: Suppressed 31229 messages from
> /system.slice/unbound.service
> 
> Could it be limits from the VPS provider on the amount of outbound udp/53
> connections?

To me this looks more like a local problem?
Are you doing any packet filtering on the host (outbound)?

Does DNS work on that host if you try manual queries?

From the IPs in your logs I assume your unbound is configured to query
recursively itself (no upstream forwarding) that is good, can you confirm that
and provide your unbound config + iptalbes -vnL?


-- 
https://mastodon.social/@nusenu
twitter: @nusenu_

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: OpenPGP digital signature
URL: <http://lists.torproject.org/pipermail/tor-relays/attachments/20180118/9bea487d/attachment.sig>