Re: local_unbound failing to resolve after switching jails to VNET

On Thu, 5 Mar 2026, Vahid Shaik wrote:

> Hi,
>
> I migrated a couple of jails from shared IP to VNET on FreeBSD 14.1 
> and now local_unbound inside the jails can't resolve anything. The 
> host resolves fine.
>
> My jail.conf for the VNET jail:
>
>  myapp {
>      vnet;
>      vnet.interface = "epair0b";
>      exec.start = "/bin/sh /etc/rc";
>      exec.stop = "/bin/sh /etc/rc.shutdown";
>      mount.devfs;
>      allow.raw_sockets;
>  }
>
> Inside the jail, /etc/resolv.conf points to 127.0.0.1 (local_unbound) 
> and the service is running. But dig @127.0.0.1 google.com just hangs 
> and times out. If I change resolv.conf to point directly at 1.1.1.1, 
> everything works.
>
> So local_unbound is listening but can't reach upstream forwarders. I 
> checked pf rules on the host and DNS traffic from the epair isn't 
> being blocked as far as I can tell.
>
> I compared what the jail sees versus what outside resolvers return 
> using https://dnsrobot.net/dns-lookup and the external results come 
> back instantly, so it's definitely a local issue between unbound and 
> the VNET bridge.
>
> Is there a known gotcha with local_unbound inside VNET jails? Do I 
> need to reconfigure the forwarder addresses or is there a routing 
> issue with the epair interface?

Out of curiosity, what happens if you restart the local_unbound service 
within the jail without restarting the jail?  Do you have local_unbound 
forwarding to somewhere special?

I have noticed an oddity after rebooting a 14.4-STABLE system but 
thought it to be related to new NICs, with a separate issue, I 
installed.  It has named and unbound (from ports) running on it. 
unbound forwards to named which is authoritative as well as forwards.

After a reboot, DNS queries from other computers (FreeBSD, Android, 
Windows) to the unbound process time out.  My next step is to find out 
how to reproduce it without rebooting.  However, restarting the named 
service "fixed" it.  Another time, I restarted the local_unbound on my 
workstation, and that "fixed" it.  Odd.

Of course, your issue may be entirely different than mine.

Sean
-- 
[email protected]