Setup Error - "queryNs ETIMEOUT"

[kk_cloudron]

And this from the Service log:

systemd[1]: Starting unbound.service - Unbound DNS Resolver...
systemd[1]: unbound.service: Control process exited, code=exited, status=203/EXEC
systemd[1]: unbound.service: Failed with result 'exit-code'.

[kk_cloudron]

Via SSH the command cloudron-support --troubleshoot returned

[WARN]  Domain [domain.tld] expiry check skipped because whois does not have this information
        unbound is down. updating root anchor to see if it fixes it

[kk_cloudron]

I searched how to updating root achor and found this thread: https://forum.cloudron.io/topic/12496/unbound-anchor-not-found-in-ubuntu-24-04/2

When I run apt list --installed | grep unbound there is an entry unbound/noble-updates,noble-security,now 1.19.2-1ubuntu3.3 amd64 [installed].

When I check for installable unbound packages, there are two:

unbound/noble-updates,noble-security,now 1.19.2-1ubuntu3.3 amd64 [installed]
unbound/noble 1.19.2-1ubuntu3 amd64

Do I need to install the second too?

[joseph]

I don't think it's an apt package / update issue. Something is causing unbound to not run error (it's an EXEC error). Do you have SELINUX or something like that enabled (this is what some stackoverflow posts suggest for that error).

Are you able to run /usr/sbin/unbound -dv manually?

[kk_cloudron]

@joseph

root@...:~# /usr/sbin/unbound -dv
[1731569630] unbound[455868:0] notice: Start of unbound 1.19.2.

[nebulon]

that seems to start then. So systemctl restart unbound still fails? If so not sure what the issue is then, we just install unbound from Ubuntu, this is not specific to Cloudron then unless you have changed the unbound configs maybe.

You may also try, just to be sure to reinstall unbound and depending on ubuntu version also unbound-anchor:

apt reinstall  unbound unbound-anchor

[kk_cloudron]

Hello Nebulon,
yes, the restart still fails. When I run the reinstall command, a message appears that two new packages are being installed: libunbound8 and unbound-anchor.
So could this be the problem?

If I have changed any configurations, I don't know how, because normally I don't access the server via ssh, but let cloudron manage everything. I only use ssh for disk adjustments or specific instructions from the Cloudron interface.

However. I have started the reinstallation and will wait and see. It is currently taking a while (approx. 5 minutes). The latest message is Setting up unbound (1.19.2-1ubuntu3.3) ...

Thanks for the inputs so far !

[kk_cloudron]

This post is deleted!

[kk_cloudron]

Solved! Thanks a lot! (re)installation works.

Do I have to pay attention to any follow-up measures? Or can I leave the administration to Cloudron again?

[nebulon]

Great. No further things should be required. Maybe some ubuntu dist-upgrade in the past didn't go as planned and something messed with the unbound installation. But glad it got solved.

[potemkin_ai]

Got the same problem on vanilla Ubuntu 24.04, reinstall didn't help.
status give all green, host command fails though:

# host -t NS apple.com 127.0.0.150
;; communications error to 127.0.0.150#53: timed out
Using domain server:
Name: 127.0.0.150
Address: 127.0.0.150#53
Aliases:

Host apple.com not found: 2(SERVFAIL)

[joseph]

Have you tried with just vanilla Ubuntu 24.04 and without Cloudron? I suspect the problem is something network related since this works on all the VPS providers. Besides Cloudron configuration is just apt install unbound-server and the config file - https://git.cloudron.io/platform/box/-/tree/master/setup/start/unbound?ref_type=heads . Nothing else is done.

[potemkin_ai]

@joseph I can't uninstall cloudron, but plain host apple.com works perfectly fine!

[potemkin_ai]

[4776:0] error: udp connect failed: Network is unreachable for 2001:500:2::c port 53 (len 28)
guess that's a reasonable error for the case when IPv6 is disabled?

do-ip6: no in config doesn't help thought...

[potemkin_ai]

That is quite embarrassing... I am blocked at the setup process of fresh cloudron on a fresh ubuntu for a few hours...

And that is all due to # Unbound is used primarily for RBL queries (host 2.0.0.127.zen.spamhaus.org) - which is not quite true / right anymore as well?

[Gengar]

@potemkin_ai & @kk_cloudron

On my side I was also having the issue "queryNs ETIMEOUT" , and it was because my outbound UDP port 53 was not open.

I just had to add it like that on my Hetzner Cloud Firewall :