Cloudron makes it easy to run web apps like WordPress, Nextcloud, GitLab on your server. Find out more or install now.


Skip to content
  • Categories
  • Recent
  • Tags
  • Popular
  • Bookmarks
  • Search
Skins
  • Light
  • Cerulean
  • Cosmo
  • Flatly
  • Journal
  • Litera
  • Lumen
  • Lux
  • Materia
  • Minty
  • Morph
  • Pulse
  • Sandstone
  • Simplex
  • Sketchy
  • Spacelab
  • United
  • Yeti
  • Zephyr
  • Dark
  • Cyborg
  • Darkly
  • Quartz
  • Slate
  • Solar
  • Superhero
  • Vapor

  • Default (No Skin)
  • No Skin
Collapse
Brand Logo

Cloudron Forum

Apps | Demo | Docs | Install
  1. Cloudron Forum
  2. Support
  3. can't install cloudron due to unbound issues

can't install cloudron due to unbound issues

Scheduled Pinned Locked Moved Solved Support
unboundinstallation
23 Posts 7 Posters 977 Views 7 Watching
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • potemkin_aiP Offline
    potemkin_aiP Offline
    potemkin_ai
    wrote on last edited by
    #3

    @joseph, as described in the issue earlier, referenced in my original thread earler, I'm installing latest cloudron instance (the one that is fetched with your original script from the site) and I'm receiving error 'queryNs ETIMEOUT mydomain.com'.

    I'd like to reiterate that I've provided all of the information required at the thread earlier: https://forum.cloudron.io/topic/12145/setup-error-queryns-etimeout/20 - would you mind re-checking it please?

    1 Reply Last reply
    0
    • J Offline
      J Offline
      joseph
      Staff
      wrote on last edited by joseph
      #4

      I can't think of a reason why NS query will fail (unbound is quite mature software). It makes even less sense that normal host command works because to resolve the IP, first you need the NS to work!

      The way I see it, if you want to get to the bottom of this, you have to just install fresh ubuntu, then apt install unbound unbound-anchor . And then check why unbound is not resolving and report this to your VPS provider.

      Alternately, to move along ignoring the problem, put something like below and systemctl restart unbound . This most likely works because the VPS provider put in effort to make it work with Cloudflare/Google DNS . You can also just change it to whatever the default DNS server of your VPS is.

      root@my:~# cat /etc/unbound/unbound.conf.d/forward-everything.conf
      forward-zone:
          name: "."
          forward-addr: 1.1.1.1
          forward-addr: 8.8.8.8
      

      The above will cause SpamHaus resolutions to fail since Zen does not like Google/Cloudflare requests. For this, you have to get to the bottom of why unbound is unable to resolve on a fresh VPS (just to remove Cloudron from the equation)

      1 Reply Last reply
      0
      • J Offline
        J Offline
        joseph
        Staff
        wrote on last edited by
        #5

        If you feeling brave, there is also the option to debug unbound itself . You have to uncomment the verbosity field in /etc/unbound/unbound.conf.d/cloudron-network.conf and restart unbound. Unbound logs are not for the light of heart.

        1 Reply Last reply
        0
        • potemkin_aiP Offline
          potemkin_aiP Offline
          potemkin_ai
          wrote on last edited by
          #6

          @joseph , a very fresh machine with no firewall, whatsover fails the very same way; not sure what I can bring to the cloud provider, as 1.1.1.1 works and all of the other services I have there works just fine!

          Screenshot from 2025-03-25 16-44-03.png

          Another reason that it doesn't seem to be related to the cloud provider, is that with the config file you offered - I'm getting the very same error from unbound!

          1 Reply Last reply
          0
          • potemkin_aiP Offline
            potemkin_aiP Offline
            potemkin_ai
            wrote on last edited by
            #7

            The following config file works on a fresh installed Ubuntu, but not on Cloudron:

            server:
                # can be uncommented if you do not need user privilege protection
                # username: ""
            
                # can be uncommented if you do not need file access protection
                # chroot: ""
            
                # location of the trust anchor file that enables DNSSEC. note that
                # the location of this file can be elsewhere
                # auto-trust-anchor-file: "/usr/local/etc/unbound/root.key"
                # auto-trust-anchor-file: "/var/lib/unbound/root.key"
            
                # send minimal amount of information to upstream servers to enhance privacy
                qname-minimisation: yes
            
                # specify the interface to answer queries from by ip-address.
                interface: 127.0.0.150
                # interface: ::0
            
                # addresses from the IP range that are allowed to connect to the resolver
                access-control: 0.0.0.0/0 allow
                # access-control: 2001:DB8/64 allow
            
            1 Reply Last reply
            0
            • potemkin_aiP Offline
              potemkin_aiP Offline
              potemkin_ai
              wrote on last edited by
              #8

              btw, I wonder why didn't you add qname-minimisation?

              1 Reply Last reply
              0
              • potemkin_aiP Offline
                potemkin_aiP Offline
                potemkin_ai
                wrote on last edited by
                #9

                btw #2: here is the command to quickly verify unbound configuration unbound -d -vvvvv -c my.conf - as per unbound docs.

                1 Reply Last reply
                0
                • J Offline
                  J Offline
                  joseph
                  Staff
                  wrote on last edited by
                  #10

                  ah very nice. so @potemkin_ai , the completel unbound config cloudron uses is:

                  server:
                          port: 53
                          interface: 127.0.0.150
                          ip-freebind: yes
                          do-ip6: yes
                          access-control: 127.0.0.1 allow
                          cache-max-negative-ttl: 30
                          cache-max-ttl: 300
                          prefer-ip4: yes
                          # enable below for logging to journalctl -u unbound
                          # verbosity: 5
                          # log-queries: yes
                  
                  # https://github.com/NLnetLabs/unbound/issues/806
                  remote-control:
                      control-enable: no
                  

                  I removed some lines (because it requires docker) but does it work with the above config?

                  1 Reply Last reply
                  0
                  • potemkin_aiP Offline
                    potemkin_aiP Offline
                    potemkin_ai
                    wrote on last edited by
                    #11

                    @joseph , nop - it doesn't... that's what I keep saying for a few hours now - vanilla cloudron & vanilla ubuntu - I didn't touch a thing - and yeah, that's a config I've seen, with the only exception that prefer-ip4 option is in separate file (for the reasons I didn't find a confirmation for).

                    I've tried to migrated working config from ubuntu machine without cloudron to the machine with cloudron and it fails

                    1 Reply Last reply
                    0
                    • nebulonN Offline
                      nebulonN Offline
                      nebulon
                      Staff
                      wrote on last edited by nebulon
                      #12

                      If you can narrow down which config option breaks it in your environment, we can investigate further, but since we have no setup where it fails there is not very much for us to look into besides guessing.

                      Maybe something about the access-control ?

                      1 Reply Last reply
                      1
                      • GengarG Offline
                        GengarG Offline
                        Gengar
                        wrote on last edited by
                        #13

                        @potemkin_ai dum question but : Did you try to reboot the server ?

                        potemkin_aiP 1 Reply Last reply
                        0
                        • potemkin_aiP Offline
                          potemkin_aiP Offline
                          potemkin_ai
                          wrote on last edited by
                          #14

                          @nebulon, the things is that it's your config... Like you've seen - I've made unbound working on vanilla Ubuntu. But the very same config fails on Ubuntu with Cloudron setup on it...

                          I can setup a dedicated server so that you can check it on your own - with or without just cloudron-setup, injecting your support ssh keys, if you keen to see on your own?

                          1 Reply Last reply
                          0
                          • GengarG Gengar

                            @potemkin_ai dum question but : Did you try to reboot the server ?

                            potemkin_aiP Offline
                            potemkin_aiP Offline
                            potemkin_ai
                            wrote on last edited by
                            #15

                            @Gengar I even tried with various Ubuntu versions: 22.04 & 24.04

                            jdaviescoatesJ 1 Reply Last reply
                            0
                            • potemkin_aiP potemkin_ai

                              @Gengar I even tried with various Ubuntu versions: 22.04 & 24.04

                              jdaviescoatesJ Offline
                              jdaviescoatesJ Offline
                              jdaviescoates
                              wrote on last edited by
                              #16

                              @potemkin_ai out of interest, which server provider is this with?

                              I use Cloudron with Gandi & Hetzner

                              scookeS potemkin_aiP 2 Replies Last reply
                              1
                              • jdaviescoatesJ jdaviescoates

                                @potemkin_ai out of interest, which server provider is this with?

                                scookeS Offline
                                scookeS Offline
                                scooke
                                wrote on last edited by scooke
                                #17

                                @jdaviescoates This is a pertinent question. I've bought VPSes over the years from different providers that were not ready to roll. The user had to install or activate networks, or the port, or something that I'd say was non-trivial. I'd say 20% of the time I come across this, including other small niggly things like no time server, wrong fs, dns resolvers, etc. At some point, if Cloudron ain't working in your server when it works on soooo many others fine, it's time to just cut your losses and change servers and service providers.

                                A life lived in fear is a life half-lived

                                1 Reply Last reply
                                4
                                • jdaviescoatesJ jdaviescoates

                                  @potemkin_ai out of interest, which server provider is this with?

                                  potemkin_aiP Offline
                                  potemkin_aiP Offline
                                  potemkin_ai
                                  wrote on last edited by
                                  #18

                                  @jdaviescoates it is not cloud provider related.

                                  To demonstrate that created an instance on Hetzner - installed unbound and nothing else - at all - and it doesn't work.

                                  Screenshot from 2025-03-26 12-56-09.png

                                  1 Reply Last reply
                                  0
                                  • nebulonN Offline
                                    nebulonN Offline
                                    nebulon
                                    Staff
                                    wrote on last edited by
                                    #19

                                    This is quite strange indeed, we use hetzner quite a lot and don't encounter those issues. Indeed I just spun up a new one yesterday and only ran cloudron-setup which ended up fine. Not sure how to go about this to be honest.

                                    1 Reply Last reply
                                    0
                                    • nebulonN Offline
                                      nebulonN Offline
                                      nebulon
                                      Staff
                                      wrote on last edited by
                                      #20

                                      Ah so you are referring to a stock ubuntu with only unbound installed! Not yet Cloudron.

                                      So by default unbound would run at 127.0.0.1 and only once Cloudron is installed it will be moved to 127.0.0.150

                                      1 Reply Last reply
                                      1
                                      • girishG Offline
                                        girishG Offline
                                        girish
                                        Staff
                                        wrote on last edited by
                                        #21

                                        as @nebulon said please test host -t NS apple.com 127.0.0.1 on a fresh ubuntu + unbound. If this works, this is already a start . Next step is to use the unbound config at https://forum.cloudron.io/post/104349 . With that config in place, you have to test with host -t NS apple.com 127.0.0.150 . Here's a demo recording if it helps - https://asciinema.org/a/9mMqdLmgJ2X7vWgBUkQVAgB5i

                                        1 Reply Last reply
                                        2
                                        • potemkin_aiP Offline
                                          potemkin_aiP Offline
                                          potemkin_ai
                                          wrote on last edited by
                                          #22

                                          @nebulon , I'm quite confused as well - I realize it's a basic thing that, would it be broken, would affect everyone at all.

                                          Default unbound works on 127.0.0.1 indeed and so far I ended up with point-finger with firewall - it seems UDP requires 53 port to be open on the inbound firewall rules to be working - something you have on your iptables rules as well.

                                          For your reference - it's much easier to troubleshoot unbound with systemctl stop unbound && unbound -dd -vvvv as it start writing everything on the console, so we stop the guess work.
                                          Other common troubleshooting steps are ss -tulnp | grep 53 to see if there is anyone listening.

                                          @girish , thank you - for the time being I ended up disabling firewall completely to process with installation process.
                                          I believe I unexpectedly advanced with unbound server for the last 24 hours and will be looking to reconfigure it once the setup is done.

                                          It seems like unbound is only used for SpamHause and during setup. If the setup issue will resorted, only SpamHause issue will remain.

                                          girishG 1 Reply Last reply
                                          0
                                          Reply
                                          • Reply as topic
                                          Log in to reply
                                          • Oldest to Newest
                                          • Newest to Oldest
                                          • Most Votes


                                          • Login

                                          • Don't have an account? Register

                                          • Login or register to search.
                                          • First post
                                            Last post
                                          0
                                          • Categories
                                          • Recent
                                          • Tags
                                          • Popular
                                          • Bookmarks
                                          • Search