Yesterday, I updated the openWRT installed on my router (AVM Fritzbox 7490) to the latest stable version. Afterward, I briefly had trouble connecting to the Internet. After restarting the router and IPFire_ a few times, the Internet connection started working again.
Today, the problem occurred again, and I was once more unable to access the Internet for several times.
During my investigation, I noticed that IPFire_ displays “broken” for the DNS server.
In the IPFire_ DHCP configuration, I entered the IP address of the green or blue network (for Wi-Fi) as the DHCP server, e.g., 192.168.128.1. I also configured a secondary DHCP server for DHCP.
The issue is that the IPFire_ DHCP server isn’t working, so the network is using the secondary one instead. And that one occasionally goes down, which explains my problems connecting to the Internet. If I delete the secondary DNS server from the DHCP configuration, I lose my Internet connection.
My question is: How do I get the IPFire DNS server working again? What’s the best way to troubleshoot this issue?
I’ve read that DNS Firewall requires a lot of memory, and I’m aware of that. Until now, memory usage has been very high (see image). It hasn’t been that high since the beginning of the week, even though DNS Firewall is still active.
Your problem is that you have run out of memory (even swap was being used) and the usual thing that will happen is that the kernel Out-Of-Memory (OOM) Killer will be activated and unbound will be stopped and you will need to restart unbound manually on the console or by rebooting.
The memory problem with the DNS Firewall is related to limitations in unbound that can’t or aren’t being addressed and so CU203, due for full release in the not too distant future, has changed from using unbound to using knot-resolver.
The memory consumption is much lower with knot and also, unlike with unbound, the amount of memory consumed does not progressively increase over time with each update of the lists.
Porn, Phishing and Malware are the three largest lists and will easily use up 4 GiB over a short time.
Your best bet is to disable the DNS Firewall until you update to CU203.
That is because unbound has crashed (the red broken at the top left hand side of the DNS WUI page) and has to be restarted manually from the console command line by running the command
/etc/rc.d/init.d/unbound start
but only do this after disabling all the DNS Firewall categories, or certainly the three large ones porn, phishing, malware
