can't install cloudron due to unbound issues

[potemkin_ai]

@joseph, as described in the issue earlier, referenced in my original thread earler, I'm installing latest cloudron instance (the one that is fetched with your original script from the site) and I'm receiving error 'queryNs ETIMEOUT mydomain.com'.

I'd like to reiterate that I've provided all of the information required at the thread earlier: https://forum.cloudron.io/topic/12145/setup-error-queryns-etimeout/20 - would you mind re-checking it please?

[joseph]

I can't think of a reason why NS query will fail (unbound is quite mature software). It makes even less sense that normal host command works because to resolve the IP, first you need the NS to work!

The way I see it, if you want to get to the bottom of this, you have to just install fresh ubuntu, then apt install unbound unbound-anchor . And then check why unbound is not resolving and report this to your VPS provider.

Alternately, to move along ignoring the problem, put something like below and systemctl restart unbound . This most likely works because the VPS provider put in effort to make it work with Cloudflare/Google DNS . You can also just change it to whatever the default DNS server of your VPS is.

root@my:~# cat /etc/unbound/unbound.conf.d/forward-everything.conf
forward-zone:
    name: "."
    forward-addr: 1.1.1.1
    forward-addr: 8.8.8.8

The above will cause SpamHaus resolutions to fail since Zen does not like Google/Cloudflare requests. For this, you have to get to the bottom of why unbound is unable to resolve on a fresh VPS (just to remove Cloudron from the equation)

[joseph]

If you feeling brave, there is also the option to debug unbound itself . You have to uncomment the verbosity field in /etc/unbound/unbound.conf.d/cloudron-network.conf and restart unbound. Unbound logs are not for the light of heart.

[potemkin_ai]

@joseph , a very fresh machine with no firewall, whatsover fails the very same way; not sure what I can bring to the cloud provider, as 1.1.1.1 works and all of the other services I have there works just fine!

Another reason that it doesn't seem to be related to the cloud provider, is that with the config file you offered - I'm getting the very same error from unbound!

[potemkin_ai]

The following config file works on a fresh installed Ubuntu, but not on Cloudron:

server:
    # can be uncommented if you do not need user privilege protection
    # username: ""

    # can be uncommented if you do not need file access protection
    # chroot: ""

    # location of the trust anchor file that enables DNSSEC. note that
    # the location of this file can be elsewhere
    # auto-trust-anchor-file: "/usr/local/etc/unbound/root.key"
    # auto-trust-anchor-file: "/var/lib/unbound/root.key"

    # send minimal amount of information to upstream servers to enhance privacy
    qname-minimisation: yes

    # specify the interface to answer queries from by ip-address.
    interface: 127.0.0.150
    # interface: ::0

    # addresses from the IP range that are allowed to connect to the resolver
    access-control: 0.0.0.0/0 allow
    # access-control: 2001:DB8/64 allow

[potemkin_ai]

btw, I wonder why didn't you add qname-minimisation?

[potemkin_ai]

btw #2: here is the command to quickly verify unbound configuration unbound -d -vvvvv -c my.conf - as per unbound docs.

[joseph]

ah very nice. so @potemkin_ai , the completel unbound config cloudron uses is:

server:
        port: 53
        interface: 127.0.0.150
        ip-freebind: yes
        do-ip6: yes
        access-control: 127.0.0.1 allow
        cache-max-negative-ttl: 30
        cache-max-ttl: 300
        prefer-ip4: yes
        # enable below for logging to journalctl -u unbound
        # verbosity: 5
        # log-queries: yes

# https://github.com/NLnetLabs/unbound/issues/806
remote-control:
    control-enable: no

I removed some lines (because it requires docker) but does it work with the above config?

[potemkin_ai]

@joseph , nop - it doesn't... that's what I keep saying for a few hours now - vanilla cloudron & vanilla ubuntu - I didn't touch a thing - and yeah, that's a config I've seen, with the only exception that prefer-ip4 option is in separate file (for the reasons I didn't find a confirmation for).

I've tried to migrated working config from ubuntu machine without cloudron to the machine with cloudron and it fails

[nebulon]

If you can narrow down which config option breaks it in your environment, we can investigate further, but since we have no setup where it fails there is not very much for us to look into besides guessing.

Maybe something about the access-control ?

[Gengar]

@potemkin_ai dum question but : Did you try to reboot the server ?

[potemkin_ai]

@nebulon, the things is that it's your config... Like you've seen - I've made unbound working on vanilla Ubuntu. But the very same config fails on Ubuntu with Cloudron setup on it...

I can setup a dedicated server so that you can check it on your own - with or without just cloudron-setup, injecting your support ssh keys, if you keen to see on your own?

[potemkin_ai]

@Gengar I even tried with various Ubuntu versions: 22.04 & 24.04

[jdaviescoates]

@potemkin_ai out of interest, which server provider is this with?

[scooke]

@jdaviescoates This is a pertinent question. I've bought VPSes over the years from different providers that were not ready to roll. The user had to install or activate networks, or the port, or something that I'd say was non-trivial. I'd say 20% of the time I come across this, including other small niggly things like no time server, wrong fs, dns resolvers, etc. At some point, if Cloudron ain't working in your server when it works on soooo many others fine, it's time to just cut your losses and change servers and service providers.

[potemkin_ai]

@jdaviescoates it is not cloud provider related.

To demonstrate that created an instance on Hetzner - installed unbound and nothing else - at all - and it doesn't work.

Screenshot from 2025-03-26 12-56-09.png

[nebulon]

This is quite strange indeed, we use hetzner quite a lot and don't encounter those issues. Indeed I just spun up a new one yesterday and only ran cloudron-setup which ended up fine. Not sure how to go about this to be honest.

[nebulon]

Ah so you are referring to a stock ubuntu with only unbound installed! Not yet Cloudron.

So by default unbound would run at 127.0.0.1 and only once Cloudron is installed it will be moved to 127.0.0.150

[girish]

as @nebulon said please test host -t NS apple.com 127.0.0.1 on a fresh ubuntu + unbound. If this works, this is already a start . Next step is to use the unbound config at https://forum.cloudron.io/post/104349 . With that config in place, you have to test with host -t NS apple.com 127.0.0.150 . Here's a demo recording if it helps - https://asciinema.org/a/9mMqdLmgJ2X7vWgBUkQVAgB5i

[potemkin_ai]

@nebulon , I'm quite confused as well - I realize it's a basic thing that, would it be broken, would affect everyone at all.

Default unbound works on 127.0.0.1 indeed and so far I ended up with point-finger with firewall - it seems UDP requires 53 port to be open on the inbound firewall rules to be working - something you have on your iptables rules as well.

For your reference - it's much easier to troubleshoot unbound with systemctl stop unbound && unbound -dd -vvvv as it start writing everything on the console, so we stop the guess work.
Other common troubleshooting steps are ss -tulnp | grep 53 to see if there is anyone listening.

@girish , thank you - for the time being I ended up disabling firewall completely to process with installation process.
I believe I unexpectedly advanced with unbound server for the last 24 hours and will be looking to reconfigure it once the setup is done.

It seems like unbound is only used for SpamHause and during setup. If the setup issue will resorted, only SpamHause issue will remain.