mailcowdockerized-unbound-mailcow-1 is unhealthy

ULLLUPOLLLLO

i already tried looking around existing threads and issues on github, but i wasn’t able to find a solution for my issue

unbound logs
`root@mail:/opt/mailcow-dockerized# docker logs mailcowdockerized-unbound-mailcow-1 -f
Setting console permissions…
Receiving anchor key…
Receiving root hints…
curl: (6) Could not resolve host: www.internic.net # # # #

setup in directory /etc/unbound
Certificate request self-signature ok
subject=CN = unbound-control
removing artifacts
Setup success. Certificates created. Enable in unbound.conf file to use
[1705793606] unbound[1:0] notice: init module 0: validator
[1705793606] unbound[1:0] notice: init module 1: iterator
[1705793606] unbound[1:0] info: start of service (unbound 1.19.0).
`

root@mail:/opt/mailcow-dockerized# [+] Running 13/19 ⠴ Network mailcowdockerized_mailcow-network ✔ Container mailcowdockerized-solr-mailcow-1 ✔ Container mailcowdockerized-memcached-mailcow-1 ✔ Container mailcowdockerized-olefy-mailcow-1 ✔ Container mailcowdockerized-redis-mailcow-1 ✘ Container mailcowdockerized-unbound-mailcow-1 ✔ Container mailcowdockerized-sogo-mailcow-1 ✔ Container mailcowdockerized-dockerapi-mailcow-1 ⠴ Container mailcowdockerized-clamd-mailcow-1 ✔ Container mailcowdockerized-mysql-mailcow-1 ✔ Container mailcowdockerized-php-fpm-mailcow-1 ✔ Container mailcowdockerized-nginx-mailcow-1 ✔ Container mailcowdockerized-dovecot-mailcow-1 ⠼ Container mailcowdockerized-postfix-mailcow-1 ⠼ Container mailcowdockerized-acme-mailcow-1 ✔ Container mailcowdockerized-rspamd-mailcow-1 ✔ Container mailcowdockerized-ofelia-mailcow-1 ⠼ Container mailcowdockerized-netfilter-mailcow-1 ⠼ Container mailcowdockerized-watchdog-mailcow-1 docker compose up -d Created 52.6s Started 0.5s Started 0.9s Started 0.8s Started 0.4s Error 52.4s Started 0.8s Started 0.9s Created 52.5s Started 1.3s Started 1.0s Started 1.5s Started 1.9s Created 52.5s Created 52.5s Started 2.2s Started 2.2s Created 52.5s Created

if you need any other information let me know

jimmy_jummy

Maybe this thread can help:

mailcow/mailcow-dockerized5649

ULLLUPOLLLLO

i solved it was my fault

MascHman

ULLLUPOLLLLO - How did you solve it?

Same problem here, after updating Mailcow Dockerized to the current january’24 release. Never had problems with updating, poked a bit around but didn’t find any clues as to why oubund was unhealthy. Decided to revert back to old state saved in snapshot, to keep downtime low.

ULLLUPOLLLLO

MascHman
https://docs.mailcow.email/troubleshooting/debug-common_problems/#container-xy-is-unhealthy
this may help but in your case it could be different you should ask or look for the answer in the forum

DocFraggle

@MascHman please have a look at this thread, maybe you ran into the problem with the new ICMP check as well and have to allow it in your firewall?

https://community.mailcow.email/d/2977-container-unbound-unhealthy/9

MascHman

DocFraggle
Thank you for your help!
Since I’m unable to allow ICMP replies from the Internet past our firewall, I’ve disabled the unbound healthcheck with the recently intruduced variable SKIP_UNBOUND_HEALTHCHECK in mailcow.conf . Now the current release is installed and everything is working again.

DocFraggle

It’s the other way round, allow ICMP to the Internet, because the health check is pinging the Google DNS servers…

MascHman

DocFraggle

I know, but I’m not able to do this for now. Need to talk to some people to allow that, will revert the settings afterwards.

J0K3R

I have the same problem with my Mailcow Server on the Hetzner Cloud.
Outbound all ports are enabled with Any IPv4 and IPv6 but Unbound is still unhealthy.
I have also read the documentation that certain ports must be enabled for Unbound especially on the Hetzner Cloud but this still does not work.

DocFraggle

J0K3R My mailcow is running in the Hetzner cloud as well, everything working fine here.

Back in the days I created these firewall rules:

That’s for outgoing traffic

J0K3R

DocFraggle
Intried the same Rules but Unbound is unhealthy.
In the Unbound Docker CLI i can not Ping any Website or IP Adress.
I just restored the Server with the old Version.

DocFraggle

Did you allow ICMP as well in you firewall?

J0K3R

DocFraggle
Yes

Ok i tried the Update again.
Everything is working but in Portainer the Unbound Docker is “Unhealthy” again i tried the SKIP_UNBOUND_HEALTHCHECK Flag and everything works fine.

DocFraggle

OK, I don’t use Portainer on my Hetzner VM, so no clue…

J0K3R

DocFraggle
Portainer is only a “WebGUI” or Mangement for Docker.

i see the Problem here.
The “Health” Command is ping 1.1.1.1 but i can not ping anything in the Unbound Docker.
With the Command “dig” i can see i can reach Cloudflare 1.1.1.1

Don’t know why ping is not working..

DocFraggle

J0K3R Hmm, works for me…

docker compose exec unbound-mailcow /bin/bash 

728992fc9ee9:/# ping 1.1.1.1
PING 1.1.1.1 (1.1.1.1): 56 data bytes
64 bytes from 1.1.1.1: seq=0 ttl=54 time=5.681 ms
64 bytes from 1.1.1.1: seq=1 ttl=54 time=5.888 ms
64 bytes from 1.1.1.1: seq=2 ttl=54 time=5.677 ms

IMHO I would revert at least the new ICMP check for the Unbound healthcheck… it just makes no sense for me.

J0K3R

DocFraggle

That is very strange.
Attached you can see my virtual firewall (Hetzner) from Mailcow.

I don’t know what to change to make “ping” work.

DocFraggle

OK, now I’m confused 🙂
Sorry, muss kurz auf Deutsch schreiben: ich habe gar keine Regeln für ausgehenden Traffic definiert, denn da steht:

“Der gesamte ausgehende Traffic ist erlaubt. Fügen Sie eine Regel hinzu, um ausgehenden Traffic zu blockieren.”

Theoretisch müsste bei Dir jetzt ja TCP+UDP ausgehend komplett deaktiviert sein?? Alternativ auch mal bei “Ausgehend” eine ICMP Regel machen und schauen obs was hilft.

Geht denn Ping vom Host-System aus zur 1.1.1.1?

J0K3R

DocFraggle
Kein Problem haben indemfall das Ding dadurch gelöst…
Hab die Regel verworfen nun funktioniert und alles ist Healthy..

Ich danke dir!!!!