Queries reaching unbound but not getting any reply

[khadanja]

I can't see anything obvious in unbound logs. Can see the queries like below in unbound logs but no obvious errors.
[1687321952] unbound[1:0] info: 28RDdc mod1 rep ntllaboratory.com. HTTPS IN
[1687321952] unbound[1:0] debug: close of port 4722

[1687321952] unbound[1:0] debug: close fd 11
[1687321952] unbound[1:0] debug: serviced send timer
[1687321952] unbound[1:0] debug: EDNS lookup known=0 vs=0
[1687321952] unbound[1:0] debug: serviced query UDP timeout=3008 msec
[1687321952] unbound[1:0] debug: inserted new pending reply id=44dd
[1687321952] unbound[1:0] debug: opened UDP if=0 port=26992
[1687321952] unbound[1:0] debug: comm point start listening 10 (-1 msec

docker-compose
version: "2.1"
services:
adguard:
container_name: adguard
image: adguard/adguardhome:latest
cap_add:
- NET_ADMIN
networks:
ag_network:
ipv4_address: 192.168.1.60
volumes:
- /srv/dev-disk-by-uuid-726c5e38-c8dc-4689-bd4c-dcbff76b78f9/appdata/docker/adguard/Work:/opt/adguardhome/work
- /srv/dev-disk-by-uuid-726c5e38-c8dc-4689-bd4c-dcbff76b78f9/appdata/docker/adguard:/opt/adguardhome/conf
ports:
- 53:53/udp
- 67:67/udp
- 68:68/tcp
- 68:68/udp
- 80:80/tcp
- 443:443/tcp
- 853:853/tcp
- 3009:3000/tcp
#Unbound
unbound:
image: klutchell/unbound:build-gh-renovate-product-os-flowzone-5.x
container_name: unbound
ports:
- 5053:53/tcp
- 5053:53/udp
networks:
ag_network:
ipv4_address: 192.168.1.61
volumes:
- /etc/localtime:/etc/localtime:ro
- /srv/dev-disk-by-uuid-726c5e38-c8dc-4689-bd4c-dcbff76b78f9/appdata/docker/unbound:/etc/unbound
networks:
ag_network:
name: ag_network
driver: macvlan
driver_opts:
parent: eth0
ipam:
config:
- subnet: 192.168.1.0/24
gateway: 192.168.1.1
ip_range: 192.168.1.60/30

[klutchell]

Are you using a custom configuration file, or just the defaults?

Have you tested DNS lookups to unbound directly, or only via adguard?

What is returned by dig @localhost -p 5053 dnssec.works on the host?

[khadanja]

Defaults. Tried directly by pointing to the unbound ip witj dig command, returns server times out. Can't run on host as I'm not able to connect to the docker container unbound. Is there an entry point in the dockerfile?
dig @192.168.1.63 -p 5053 dnssec.works
; <<>> DiG 9.16.1-Ubuntu <<>> @192.168.1.63 -p 5053 dnssec.works
; (1 server found)
;; global options: +cmd
;; connection timed out; no servers could be reached

[klutchell]

The image is distroless so there is no way to log into the container, by design.

Have you tried without mounting the /etc/unbound volume? You said you were using the default config so there is no need to mount that directory, and it would rule out an issue with your config.

Also, could you try without the custom IP configuration in the dockerfile to make sure it's not an issue with your ipam setup?

[khadanja]

Yes tried without mounting too. How do I do that? Modify dicker file & create a new image?

[klutchell]

Sorry, I meant to try removing the custom ipam settings in the compose file to make sure it's not an issue with your selected subnets.

Also can you try using klutchell/unbound:latest instead of the development tag you have selected?

[klutchell]

@khadanja are you still experiencing this issue?