DNS issue #3735
Comments
|
Does your other Docker container also use its own recursor? ;) You cannot compare that. This looks good. |
No they don't. Here are others results: |
|
Here is iptable output: |
|
|
@andryyy I found the issue and it is related to If I change How can I help you to find the issue in |
|
Hm? Which issue did you find exactly? If there was a general issue with netfilter, shouldn't everyone have that problem? :) Maybe there is a broken rule in your fail2ban blacklist or something like that? But your iptables output seemed fine. Perhaps someone can chime in and help you debug the network. It can be a bug in a constellation that happens on your system, try to compare tcpdumps etc. I don't know what you changed IPV4_NETWORK to, but perhaps the default network conflicts with anything in your internal network. I don't know how I can help you debug this, sorry. |
|
My logs are full of DNS errors too. Like: and Restarting the whole server seems to solved the DNS issue. |
|
I'm running the latest version and I'm also facing issues with postfix. I can't send and receive emails.
If I try to see the DNS record inside the postfix Docker container, I get this: Same with nslookup command Using a different DNS server (8.8.8.8) inside the container is working. ** server can't find gmail.com: REFUSED I think this is the root cause of the sending/receiving issue but didn't figure out how to solve it yet. |
|
I manage to make it work with a workaround by stopping the unbound service. I suspect a conflict with the host DNS server running on port 53 (TCP/UDP) but not sure at all. |
On my side, I required to disable |
|
Hi @guyguy333, |
I commented netfilter part in docker-compose.yml |
|
You should not disable netfilter. Don't. That's not a valid fix, is unsupported and will break things. Thanks. |
I second this, PLEASE DON'T DO THAT |
|
I used From the unbound doc: I added the forward-zone to I verified that the forward-zone is exist in the container. (OK) I tried @andryyy you should add some upstream DNS to the config file, like 1.1.1.1 / 1.0.0.1. I created a PR #3841 |
|
Commenting netfilter doesn't solve anything. I'm still not able to send/receive email. |
|
DONT do that. DO NOT use a public forwarder. Read the docs. That's a no-go... |
|
Can't send an email to the accountant, which is not so good... Can you suggest something to resolve this issue? Edit: From Andre: I set my own recursive DNS in my |
|
I've added the following in unbound.conf But dig command still show I've revert everything back. Still not working |
|
@nouhouari My comment is NOT the solution, so DONT use it. Other: The doc clearly write down how DONT set unbound. |
@g0rbe I'm using dig in postfix container, not in unbound container or the host. |
|
@nouhouari Do you uncomment the netfilter in |
|
Yes, I'm aligned with master branch. No change. |
|
Having the same issue as @guyguy333 on Ubuntu 20.04 (unbound not being able to resolve anything) I'd like to record my cause for posterity. Running mailcow on a Hetzner dedicated server with firewall enabled in Hetzner Robot breaks unbound DNS resolving completely, while resolving from host works fine. My guess is they have some source ip filtering in place that drops DNS packets from unbound container. |
|
That's a very good hint, thank you for that. Should probably be posted in the docs. |
What do you recommend then? Still blocked with the same error and upgrade everything today. |
|
@nouhouari check with your hosting provider (or network equipment that you control) that they don't do any source (ip and/or mac) filtering for outgoing UDP traffic. This was my case, but it's entirely possible that something is borked on your OS (ie firewall) that prevents unbound from resolving. |
If it were a UDP outbound traffic issue, setting a DNS to 8.8.8.8 (/etc/resolv.conf) in postfix container won't work. What do you think? |
|
No. That's not the same. Setting the DNS to 8.8.8.8 is completely different from using 127.0.0.11. Broken NAT can also lead to unmasqueraded packages, which are eventually dropped by the next gw. Just one of many things that can go wrong. |
|
Hi @andryyy , I've changed the dns inside the container only to validate that it can not be an outgoing UDP traffic issue. |
|
This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. |
github-actions
bot
added
stale
|
This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. |
github-actions
bot
added
the
stale
|
@guyguy333 @nouhouari |
Prior to placing the issue, please check following: (fill out each checkbox with an
Xonce done)Description of the bug:
After a mailcow update, containers have many DNS issues. If I understand right, unbound is the DNS server/forwarder for others containers. However, unbound itself have DNS issues as we can see at the beginning of the log : curl: (6) Could not resolve host: www.internic.net.
Running a docker container not related to mailcow has no DNS issues. I did try to disable all firewalls but it didn't fix the issue.
Docker container logs of affected containers:
Also in postfix:
Reproduction of said bug:
Nothing special, just an up to date mailcow.
System information:
docker version)docker-compose version)git diff origin/master, any other changes to the code? If so, please post them.iptables -L -vn,ip6tables -L -vn,iptables -L -vn -t natandip6tables -L -vn -t nat.docker exec -it $(docker ps -qf name=acme-mailcow) dig +short stackoverflow.com @172.22.1.254(set the IP accordingly, if you changed the internal mailcow network) and post the output.docker exec -it $(docker ps -qf name=acme-mailcow) dig +short stackoverflow.com @172.22.1.254
151.101.1.69
151.101.129.69
151.101.193.69
151.101.65.69
This docker has no issues. A ping to
stackoverflow.comin unbound container doesn't work.The text was updated successfully, but these errors were encountered: