unbound becomes unhealthy with CSF

fearz

Hi,

I have mailcow dockered, its all good but becomes unhealthy when i restart CSF, upon checking logs:

unbound-mailcow-1 | 2024-09-02 19:52:49,682 INFO stopped: unbound (exit status 0)
unbound-mailcow-1 | 2024-09-02 19:52:49,685 WARN received SIGQUIT indicating exit request
unbound-mailcow-1 | Sep 2 19:52:49 0d5cbdbae185 syslog-ng[23]: syslog-ng shutting down; version=‘4.7.1’
unbound-mailcow-1 | 2024-09-02 19:52:50,846 INFO stopped: syslog-ng (exit status 0)
unbound-mailcow-1 | 2024-09-02 19:52:50,847 WARN stopped: processes (terminated by SIGTERM)
unbound-mailcow-1 | Setting console permissions…
unbound-mailcow-1 | Receiving anchor key…
unbound-mailcow-1 | Receiving root hints…
######################################################################## 100.0%
unbound-mailcow-1 | setup in directory /etc/unbound
unbound-mailcow-1 | removing artifacts
unbound-mailcow-1 | Setup success. Certificates created. Enable in unbound.conf file to use
unbound-mailcow-1 | 2024-09-02 19:53:15,115 INFO Set uid to user 0 succeeded
unbound-mailcow-1 | 2024-09-02 19:53:15,128 INFO supervisord started with pid 1
unbound-mailcow-1 | 2024-09-02 19:53:16,130 INFO spawned: ‘processes’ with pid 16
unbound-mailcow-1 | 2024-09-02 19:53:16,137 INFO spawned: ‘syslog-ng’ with pid 17
unbound-mailcow-1 | 2024-09-02 19:53:16,166 INFO spawned: ‘unbound’ with pid 18
unbound-mailcow-1 | 2024-09-02 19:53:16,192 INFO spawned: ‘unbound-healthcheck’ with pid 19
unbound-mailcow-1 | [1725295996] unbound[18:0] notice: init module 0: validator
unbound-mailcow-1 | [1725295996] unbound[18:0] notice: init module 1: iterator
unbound-mailcow-1 | Sep 2 19:53:16 0d5cbdbae185 syslog-ng[17]: syslog-ng starting up; version=‘4.7.1’
unbound-mailcow-1 | [1725295996] unbound[18:0] info: start of service (unbound 1.20.0).
unbound-mailcow-1 | [1725295996] unbound[18:0] info: generate keytag query _ta-4f66. NULL IN
unbound-mailcow-1 | 2024-09-02 19:53:17,443 INFO success: processes entered RUNNING state, process has stayed up for > than 1 seconds (startsecs)
unbound-mailcow-1 | 2024-09-02 19:53:17,443 INFO success: syslog-ng entered RUNNING state, process has stayed up for > than 1 seconds (startsecs)
unbound-mailcow-1 | 2024-09-02 19:53:17,443 INFO success: unbound entered RUNNING state, process has stayed up for > than 1 seconds (startsecs)
unbound-mailcow-1 | 2024-09-02 19:53:17,443 INFO success: unbound-healthcheck entered RUNNING state, process has stayed up for > than 1 seconds (startsecs)
unbound-mailcow-1 | 2024-09-02 19:55:52: Healthcheck: Failed to ping 1.1.1.1 on attempt 1. Trying again…
unbound-mailcow-1 | 2024-09-02 19:56:04: Healthcheck: Failed to ping 1.1.1.1 on attempt 2. Trying again…
unbound-mailcow-1 | 2024-09-02 19:56:16: Healthcheck: Failed to ping 1.1.1.1 on attempt 3. Trying again…
unbound-mailcow-1 | 2024-09-02 19:56:16: Healthcheck: Couldn’t ping 1.1.1.1 after 3 attempts. Marking this IP as failed.
unbound-mailcow-1 | 2024-09-02 19:56:28: Healthcheck: Failed to ping 8.8.8.8 on attempt 1. Trying again…
unbound-mailcow-1 | 2024-09-02 19:56:40: Healthcheck: Failed to ping 8.8.8.8 on attempt 2. Trying again…
unbound-mailcow-1 | 2024-09-02 19:56:52: Healthcheck: Failed to ping 8.8.8.8 on attempt 3. Trying again…
unbound-mailcow-1 | 2024-09-02 19:56:52: Healthcheck: Couldn’t ping 8.8.8.8 after 3 attempts. Marking this IP as failed.
unbound-mailcow-1 | 2024-09-02 19:57:04: Healthcheck: Failed to ping 9.9.9.9 on attempt 1. Trying again…
unbound-mailcow-1 | 2024-09-02 19:57:16: Healthcheck: Failed to ping 9.9.9.9 on attempt 2. Trying again…
unbound-mailcow-1 | 2024-09-02 19:57:28: Healthcheck: Failed to ping 9.9.9.9 on attempt 3. Trying again…

so then i check from the container itself, as soon as i restart docker, its healthy, im in the container and can dig, when it becomes unhealthy dig doesn’t work inside the container.

What could be wrong here?

I double-checked all ports are opened….unbound container is healthy without CSF

Any support is appreciated.

fearz

One thing I noticed inside the container:

9237d91b15ef:/# dig google.com
;; communications error to 127.0.0.11#53: timed out
;; communications error to 127.0.0.11#53: timed out
;; communications error to 127.0.0.11#53: timed out

I don’t know why it goes to 127.0.0.11

if I change in /etc/resolv.conf:

nameserver 127.0.0.11
to nameserver 127.0.0.1

dig works.

Any ideas?

accolon

fearz I don’t know why it goes to 127.0.0.11

127.0.0.11 is Docker’s own internal DNS service. All containers automatically use 127.0.0.11 to include internal names of Docker containers.

fearz

accolon are there any iptables rules that should be set for mailcow? If you know them can you please paste them?

DocFraggle

See here:

https://docs.mailcow.email/getstarted/prerequisite-system/#firewall-ports

fearz

DocFraggle

Hi,

This didn’t solve my issue, anything else i can try?

DocFraggle

You have to debug your CSF firewall then, I’m not familiar with it.

fearz

DocFraggle

I’m not good with iptables either, but all i know is that unbound becomes unhealthy when i enable csf…currently i disabled csf for it to work but i have other problems..

Any help is appreciated.

DocFraggle

mailcow creates it’s own iptables rule set, why do you need CSF?

fearz

DocFraggle

It’s a firewall for the server not just mailcow, it also has IDS & IPS.

DocFraggle

As I wrote before, you have to take a deeper look into CSF then. It seems you aren’t the only one who has problems with CSF and docker

https://www.google.com/search?q=csf+and+docker