Re: local_unbound failing to resolve after switching jails to VNET

On 3/5/26 1:42 PM, Vahid Shaik wrote:
> Hi,
> 
> I migrated a couple of jails from shared IP to VNET on FreeBSD 14.1 and 
> now local_unbound inside the jails can't resolve anything. The host 
> resolves fine.
> 
> My jail.conf for the VNET jail:
> 
>    myapp {
>        vnet;
>        vnet.interface = "epair0b";
>        exec.start = "/bin/sh /etc/rc";
>        exec.stop = "/bin/sh /etc/rc.shutdown";
>        mount.devfs;
>        allow.raw_sockets;
>    }
> 
> Inside the jail, /etc/resolv.conf points to 127.0.0.1 (local_unbound) 
> and the service is running. But dig @127.0.0.1 google.com just hangs and 
> times out. If I change resolv.conf to point directly at 1.1.1.1, 
> everything works.
> 
> So local_unbound is listening but can't reach upstream forwarders. I 
> checked pf rules on the host and DNS traffic from the epair isn't being 
> blocked as far as I can tell.
> 
> I compared what the jail sees versus what outside resolvers return using 
> https://dnsrobot.net/dns-lookup <https://dnsrobot.net/dns-lookup> and 
> the external results come back instantly, so it's definitely a local 
> issue between unbound and the VNET bridge.
> 
> Is there a known gotcha with local_unbound inside VNET jails? Do I need 
> to reconfigure the forwarder addresses or is there a routing issue with 
> the epair interface?
> 
> Thanks

Hi Vahid,

Please check your local_unbound forwarders list:
# local-unbound-control list_forwards

If required, you can add a new resolver to your unbound forwarders list 
by running:
# local-unbound-control forward_add . 9.9.9.9 2620:fe::fe

BR
-- 
Pouria

-----BEGIN PGP SIGNATURE-----

iHUEARYKAB0WIQSqt7cppfvJ816gj0lUwVnUeMwagAUCaal89wAKCRBUwVnUeMwa
gKF7AP4jK30ztbrQnr1ZjWqObdW6YwdyQgqA60AIGLz8lDCRRAEA1mJzIfbsDBfW
+aTnDTuUXSm56yLQWU1w7lYGoszruwY=
=7ySP
-----END PGP SIGNATURE-----