DNS leak test should only show my own IP address
6 servers were found when I ran the standard test on https://www.dnsleaktest.com. All of them were Google IP addresses even though I already unchecked Google in the Upstream DNS Servers setting and only put 127.0.0.1#5335 as Upstream DNS Server.
I had also installed unbound according to the pihole documentation and it passed the DNSSEC validations.
Please post the output of the following command:
sudo grep -v '#\|^$' -R /etc/unbound/unbound.conf*
/etc/unbound/unbound.conf:include: "/etc/unbound/unbound.conf.d/*.conf"
/etc/unbound/unbound.conf.d/resolvconf_resolvers.conf:forward-zone:
/etc/unbound/unbound.conf.d/resolvconf_resolvers.conf: name: "."
/etc/unbound/unbound.conf.d/resolvconf_resolvers.conf: forward-addr: 8.8.8.8
/etc/unbound/unbound.conf.d/resolvconf_resolvers.conf: forward-addr: 8.8.4.4
/etc/unbound/unbound.conf.d/resolvconf_resolvers.conf: forward-addr: 2001:558:feed::1
/etc/unbound/unbound.conf.d/resolvconf_resolvers.conf: forward-addr: 2001:558:feed::2
/etc/unbound/unbound.conf.d/resolvconf_resolvers.conf: forward-addr: 2601:603:2080:b1a0:32b8::
/etc/unbound/unbound.conf.d/pi-hole.conf:server:
/etc/unbound/unbound.conf.d/pi-hole.conf: verbosity: 0
/etc/unbound/unbound.conf.d/pi-hole.conf: interface: 127.0.0.1
/etc/unbound/unbound.conf.d/pi-hole.conf: port: 5335
/etc/unbound/unbound.conf.d/pi-hole.conf: do-ip4: yes
/etc/unbound/unbound.conf.d/pi-hole.conf: do-udp: yes
/etc/unbound/unbound.conf.d/pi-hole.conf: do-tcp: yes
/etc/unbound/unbound.conf.d/pi-hole.conf: do-ip6: no
/etc/unbound/unbound.conf.d/pi-hole.conf: prefer-ip6: no
/etc/unbound/unbound.conf.d/pi-hole.conf: harden-glue: yes
/etc/unbound/unbound.conf.d/pi-hole.conf: harden-dnssec-stripped: yes
/etc/unbound/unbound.conf.d/pi-hole.conf: use-caps-for-id: no
/etc/unbound/unbound.conf.d/pi-hole.conf: edns-buffer-size: 1472
/etc/unbound/unbound.conf.d/pi-hole.conf: prefetch: yes
/etc/unbound/unbound.conf.d/pi-hole.conf: num-threads: 1
/etc/unbound/unbound.conf.d/pi-hole.conf: so-rcvbuf: 1m
/etc/unbound/unbound.conf.d/pi-hole.conf: private-address: 192.168.0.0/16
/etc/unbound/unbound.conf.d/pi-hole.conf: private-address: 169.254.0.0/16
/etc/unbound/unbound.conf.d/pi-hole.conf: private-address: 172.16.0.0/12
/etc/unbound/unbound.conf.d/pi-hole.conf: private-address: 10.0.0.0/8
/etc/unbound/unbound.conf.d/pi-hole.conf: private-address: fd00::/8
/etc/unbound/unbound.conf.d/pi-hole.conf: private-address: fe80::/10
/etc/unbound/unbound.conf.d/pi-hole.conf:
This is your problem. Bullseye (at least the native version posted by Raspberry Pi at the end of October 2021) installs this, without you knowing it. The solution is to remove openresolv and the installed files.
sudo apt remove openresolv
sudo rm /etc/unbound/unbound.conf.d/resolvconf_resolvers.conf
sudo service unbound restart
Then run the command again to verify the file is gone.
I ran the command sudo grep -v '#\|^$' -R /etc/unbound/unbound.conf* again and resolvconf_resolvers.conf is gone. DNS leak test only shows my ISP's IP address now. Thank you so much!
I had the same issue (running pihole + unbound, getting Google DNS appearing in leak tests) and this seems to have fixed it. Thank you!
I dont think its a smart move removing the openresolv package?
Most network managers address openresolv to populate /etc/resolv.conf.
Better comment out below line:
pi@ph5b:~ $ cat /etc/resolvconf.conf
[..]
#unbound_conf=/etc/unbound/unbound.conf.d/resolvconf_resolvers.conf
Above will prevent that resolvconf_resolvers.conf file being created in the first place.
And make sure that file doesnt exist (delete it and restart unbound):
pi@ph5b:~ $ sudo stat /etc/unbound/unbound.conf.d/resolvconf_resolvers.conf
stat: cannot statx '/etc/unbound/unbound.conf.d/resolvconf_resolvers.conf': No such file or directory
Or remove the openresolv package and replace it with resolvconf instead which wont create above config file:
pi@ph5b:~ $ apt depends dhcpcd5
[..]
|Recommends: openresolv
Recommends: resolvconf
With that config file included:
pi@ph5b:~ $ sudo unbound-control list_forwards
. IN forward 10.0.0.1
home.dehakkelaar.nl. IN forward 10.0.0.1
pi@ph5b:~ $ sudo unbound-control lookup pi-hole.net
The following name servers are used for lookup of pi-hole.net.
forwarding request:
Delegation with 0 names, of which 0 can be examined to query further addresses.
It provides 1 IP addresses.
10.0.0.1 not in infra cache.
Without:
pi@ph5b:~ $ sudo unbound-control list_forwards
pi@ph5b:~ $
pi@ph5b:~ $ sudo unbound-control lookup pi-hole.net
The following name servers are used for lookup of pi-hole.net.
;rrset 2853 4 1 11 5
pi-hole.net. 2853 IN NS ns1.pi-hole.net.
pi-hole.net. 2853 IN NS ns3.pi-hole.net.
pi-hole.net. 2853 IN NS ns2.pi-hole.net.
pi-hole.net. 2853 IN NS ns4.pi-hole.net.
[..]
EDIT: Aha, noticed this being discussed below:
All network managers/stacks I know (including dhcpcd) can work pretty well without resolvconf and then do edit /etc/resolv.conf directly instead. Basically, if you do not actively use the features that resolvconf allows, like setting a fixed default and/or a fallback nameserver entry, local domain/search entries etc, which you want to stay even when e.g. the DHCP client provides different info, then resolvconf is usually not required. Especially when using the system as server with a then static/reserved IP, you most likely do not want nameservers to change at all. And if there is really any package depending on resolvconf, then apt will warn you and allow you to confirm or abort.
But indeed as a general recommendation, as we cannot know users individual systems and people come here and copy&paste commands they may not fully understand, in the other thread I suggested to replace the openresolv with the resolvconf package, both providing the same core feature (resolvconf command), but the resolvconf package without the harmful magic around:
if dpkg-query -s 'openresolv' &> /dev/null
then
apt -y install resolvconf
apt -y purge openresolv
rm -f /etc/unbound/unbound.conf.d/resolvconf_resolvers.conf
fi
@deHakkelaar
Do you think such would be feasible for: unbound - Pi-hole documentation
All Raspberry Pi OS Bullseye users have this issue OOTB now. Not sure how much details make sense, all three solutions (purge package, replace package, comment setting) or, to not confuse readers, only one that we find most compatible?
In the specific case of Raspbian Bullseye (may extend to other Debian flavors of Bullseye as well, I haven't tested), in the absence of openresolv, file /etc/resolv.conf is properly populated by dhcpcd.
The simple fix for the problem that was described is to remove openresolv. The optional step (should you decide you want a replacement package) is to install resolvconf.
Edit - although commenting out the offending line in /etc/resolvconf.conf does not change the underlying OS install, which may be desirable to some users.
This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.