Setup Error - "queryNs ETIMEOUT"

[joseph]

@jxmesth you can try host -t NS domain.com on your server. Does it return TIMEOUT ?

[jxmesth]

@joseph, thanks for getting back.

I've run the command and get this as the output

xx.co.uk name server liz.ns.cloudflare.com.
xx.co.uk name server albert.ns.cloudflare.com.

[joseph]

@jxmesth That seems ok. Can you run cloudron-support --troubleshoot on the server? Maybe it gives ideas on why DNS might be failing . Which version of Cloudron have you installed (/home/yellowtent/box/VERSION) ? If it's Cloudron 8, you can also try host -t NS domain.com 127.0.0.150 . In that IP, there is unbound running.

[jxmesth]

@joseph, I've just tried it out again after playing around with a few firewall settings and rules and I've figured out that it was these rules causing the issue.

I've managed to solve this now.

Thanks for your help.

[kk_cloudron]

@joseph Hi I have the same problem, only I don't think it's a firewall problem because I haven't changed anything and I assume that Cloudron manages the firewall so that everything works fine.
Anyways: I am running Cloudron v8.0.6 (Ubuntu 24.04 LTS) and the command host -t NS {{domain.tld}} 127.0.0.150 gives me the following message:

Any ideas what I could try?

Thanks a lot!

[nebulon]

@kk_cloudron can you check in the services view if unbound is running? The error indicates that it is not.

You can also check this via SSH using systemctl status unbound

[kk_cloudron]

@nebulon Thank you, the unbound service is not running and don't starts when I trigger the restart in the services.
In the logs I see related messages (i guess)

at genericNodeError (node:internal/errors:984:15)
at wrappedFn (node:internal/errors:538:14)
at ChildProcess.exithandler (node:child_process:422:12)
at ChildProcess.emit (node:events:518:28)
at maybeClose (node:internal/child_process:1105:16)
at Socket.<anonymous> (node:internal/child_process:457:11)
at Socket.emit (node:events:518:28)
at Pipe.<anonymous> (node:net:337:12) {
	code: 3,
	killed: false,
	signal: null,
	cmd: 'systemctl is-active unbound'
}
Nov 13 14:55:55 box:shell statusUnbound: systemctl with args is-active unbound errored Error: Command failed: systemctl is-active unbound

Could that help to solve the Problem?

[kk_cloudron]

And this from the Service log:

systemd[1]: Starting unbound.service - Unbound DNS Resolver...
systemd[1]: unbound.service: Control process exited, code=exited, status=203/EXEC
systemd[1]: unbound.service: Failed with result 'exit-code'.

[kk_cloudron]

Via SSH the command cloudron-support --troubleshoot returned

[WARN]  Domain [domain.tld] expiry check skipped because whois does not have this information
        unbound is down. updating root anchor to see if it fixes it

[kk_cloudron]

I searched how to updating root achor and found this thread: https://forum.cloudron.io/topic/12496/unbound-anchor-not-found-in-ubuntu-24-04/2

When I run apt list --installed | grep unbound there is an entry unbound/noble-updates,noble-security,now 1.19.2-1ubuntu3.3 amd64 [installed].

When I check for installable unbound packages, there are two:

unbound/noble-updates,noble-security,now 1.19.2-1ubuntu3.3 amd64 [installed]
unbound/noble 1.19.2-1ubuntu3 amd64

Do I need to install the second too?

[joseph]

I don't think it's an apt package / update issue. Something is causing unbound to not run error (it's an EXEC error). Do you have SELINUX or something like that enabled (this is what some stackoverflow posts suggest for that error).

Are you able to run /usr/sbin/unbound -dv manually?

[kk_cloudron]

@joseph

root@...:~# /usr/sbin/unbound -dv
[1731569630] unbound[455868:0] notice: Start of unbound 1.19.2.

[nebulon]

that seems to start then. So systemctl restart unbound still fails? If so not sure what the issue is then, we just install unbound from Ubuntu, this is not specific to Cloudron then unless you have changed the unbound configs maybe.

You may also try, just to be sure to reinstall unbound and depending on ubuntu version also unbound-anchor:

apt reinstall  unbound unbound-anchor

[kk_cloudron]

Hello Nebulon,
yes, the restart still fails. When I run the reinstall command, a message appears that two new packages are being installed: libunbound8 and unbound-anchor.
So could this be the problem?

If I have changed any configurations, I don't know how, because normally I don't access the server via ssh, but let cloudron manage everything. I only use ssh for disk adjustments or specific instructions from the Cloudron interface.

However. I have started the reinstallation and will wait and see. It is currently taking a while (approx. 5 minutes). The latest message is Setting up unbound (1.19.2-1ubuntu3.3) ...

Thanks for the inputs so far !

[kk_cloudron]

This post is deleted!

[kk_cloudron]

Solved! Thanks a lot! (re)installation works.

Do I have to pay attention to any follow-up measures? Or can I leave the administration to Cloudron again?

[nebulon]

Great. No further things should be required. Maybe some ubuntu dist-upgrade in the past didn't go as planned and something messed with the unbound installation. But glad it got solved.

[potemkin_ai]

Got the same problem on vanilla Ubuntu 24.04, reinstall didn't help.
status give all green, host command fails though:

# host -t NS apple.com 127.0.0.150
;; communications error to 127.0.0.150#53: timed out
Using domain server:
Name: 127.0.0.150
Address: 127.0.0.150#53
Aliases:

Host apple.com not found: 2(SERVFAIL)

[joseph]

Have you tried with just vanilla Ubuntu 24.04 and without Cloudron? I suspect the problem is something network related since this works on all the VPS providers. Besides Cloudron configuration is just apt install unbound-server and the config file - https://git.cloudron.io/platform/box/-/tree/master/setup/start/unbound?ref_type=heads . Nothing else is done.

[potemkin_ai]

@joseph I can't uninstall cloudron, but plain host apple.com works perfectly fine!