Network Failure After Switching from dnsmasq to unbound

dedu · October 17, 2025, 12:38am

I tried couple times to replace the default dnsmasq with unbound. The router I'm using is Flint 2 GL-MT6000. The issue appearing either immediately or after some time. Devices already connected via Wi-Fi lose internet access but remain connected to the network. When attempting to reconnect a device or connect a new device to Wi-Fi the connection fails. Some times I can still access the router through wired connection, some times even the wired connection fails.

Here are the steps I took and some relavent outputs:

Before disabling dnsmasq, this is netstat output:

Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name    
tcp        0      0 127.0.0.1:53            0.0.0.0:*               LISTEN      16597/dnsmasq
tcp        0      0 192.168.1.158:53        0.0.0.0:*               LISTEN      16597/dnsmasq
tcp        0      0 192.168.8.1:53          0.0.0.0:*               LISTEN      16597/dnsmasq
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      16398/dropbear
tcp        0      0 0.0.0.0:443             0.0.0.0:*               LISTEN      9757/nginx.conf -g 
tcp        0      0 127.0.0.1:8443          0.0.0.0:*               LISTEN      7321/uhttpd
tcp        0      0 0.0.0.0:80              0.0.0.0:*               LISTEN      9757/nginx.conf -g 
tcp        0      0 127.0.0.1:8080          0.0.0.0:*               LISTEN      7321/uhttpd
tcp        0      0 ::1:53                  :::*                    LISTEN      16597/dnsmasq
tcp        0      0 fe80::8891:2aff:fee6:56ed:53 :::*                    LISTEN      16597/dnsmasq
tcp        0      0 fe80::9683:c4ff:feba:d812:53 :::*                    LISTEN      16597/dnsmasq
tcp        0      0 :::22                   :::*                    LISTEN      16398/dropbear
tcp        0      0 :::443                  :::*                    LISTEN      9757/nginx.conf -g 
tcp        0      0 :::80                   :::*                    LISTEN      9757/nginx.conf -g 
udp        0      0 127.0.0.1:53            0.0.0.0:*                           16597/dnsmasq
udp        0      0 192.168.1.158:53        0.0.0.0:*                           16597/dnsmasq
udp        0      0 192.168.8.1:53          0.0.0.0:*                           16597/dnsmasq
udp        0      0 0.0.0.0:67              0.0.0.0:*                           16597/dnsmasq
udp        0      0 0.0.0.0:5353            0.0.0.0:*                           7728/avahi-daemon: 
udp        0      0 ::1:53                  :::*                                16597/dnsmasq
udp        0      0 fe80::8891:2aff:fee6:56ed:53 :::*                                16597/dnsmasq
udp        0      0 fe80::9683:c4ff:feba:d812:53 :::*                                16597/dnsmasq
udp        0      0 :::5353                 :::*                                7728/avahi-daemon:

Then I run service dnsmasq stop and service dnsmasq disable to disable the dnsmasq, here is the netstat output after:

Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name    
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      16398/dropbear
tcp        0      0 0.0.0.0:443             0.0.0.0:*               LISTEN      9757/nginx.conf -g 
tcp        0      0 127.0.0.1:8443          0.0.0.0:*               LISTEN      7321/uhttpd
tcp        0      0 0.0.0.0:80              0.0.0.0:*               LISTEN      9757/nginx.conf -g 
tcp        0      0 127.0.0.1:8080          0.0.0.0:*               LISTEN      7321/uhttpd
tcp        0      0 :::22                   :::*                    LISTEN      16398/dropbear
tcp        0      0 :::443                  :::*                    LISTEN      9757/nginx.conf -g 
tcp        0      0 :::80                   :::*                    LISTEN      9757/nginx.conf -g 
udp        0      0 0.0.0.0:5353            0.0.0.0:*                           7728/avahi-daemon: 
udp        0      0 :::5353                 :::*                                7728/avahi-daemon:

I then run service unbound enabled and service unbound start, and netstat:

I think unbound is reached since I saw the output from unbound-control dump_cache (I enabled unbound-control and ran service unbound restart).

I’m a bit clueless regarding the cause and how should I go about troubleshoot this. Any advice would be appericiated. Thanks in advance.

dave14305 · October 17, 2025, 1:02am

dnsmasq still needs to provide DHCP. Did you consult the readme?

github.com/openwrt/packages

net/unbound/files/README.md

master

# Unbound Recursive DNS Server with UCI
<!-- markdownlint-disable -->

## Unbound Description
[Unbound](https://www.unbound.net/) is a validating, recursive, and caching DNS resolver. The C implementation of Unbound is developed and maintained by [NLnet Labs](https://www.nlnetlabs.nl/). It is based on ideas and algorithms taken from a java prototype developed by Verisign labs, Nominet, Kirei and ep.net. Unbound is designed as a set of modular components, so that also DNSSEC (secure DNS) validation and stub-resolvers (that do not run as a server, but are linked into an application) are easily possible.

## Package Overview
OpenWrt default build uses [dnsmasq](http://www.thekelleys.org.uk/dnsmasq/docs/dnsmasq-man.html) for DNS forwarding and DHCP. With a forward only resolver, dependence on the upstream recursors may be cause for concern. They are often provided by the ISP, and some users have switched to public DNS providers. Either way may result in problems due to performance, "snoop-vertising", hijacking (MiM), and other causes. Running a recursive resolver or resolver capable of TLS may be a solution.

Unbound may be useful on consumer grade embedded hardware. It is fully DNSSEC and TLS capable. It is _intended_ to be a recursive resolver only. NLnet Labs [NSD](https://www.nlnetlabs.nl/projects/nsd/) is _intended_ for the authoritative task. This is different than [ISC Bind](https://www.isc.org/downloads/bind/) and its inclusive functions. Unbound configuration effort and memory consumption may be easier to control. A consumer could have their own recursive resolver with 8/64 MB router, and remove potential issues from forwarding resolvers outside of their control.

This package builds on Unbounds capabilities with OpenWrt UCI. Not every Unbound option is in UCI, but rather, UCI simplifies the combination of related options. Unbounds native options are bundled and balanced within a smaller set of choices. Options include resources, DNSSEC, access control, and some TTL tweaking. The UCI also provides an escape option and works at the raw `unbound.conf` level.

## HOW TO: Ad Blocking
The UCI scripts will work with [net/adblock](https://github.com/openwrt/packages/blob/master/net/adblock/files/README.md) and/or [net/adblock-fast](https://github.com/openwrt/packages/blob/master/net/adblock-fast/files/README.md), if they are installed and enabled. It's all detected and integrated automatically. In brief, the [net/adblock](https://github.com/openwrt/packages/blob/master/net/adblock/files/README.md) or [net/adblock-fast](https://github.com/openwrt/packages/blob/master/net/adblock-fast/files/README.md) create distinct local-zone files that are simply included in the unbound conf file during UCI generation. If you don't want this, then disable or reconfigure respective package to not send these files to Unbound.

With [net/adblock](https://github.com/openwrt/packages/blob/master/net/adblock/files/README.md) package specifically, a few additional tweaks may be needed to enhance the realiability and effectiveness. Ad Block option for delay time may need to be set for upto one minute (adb_triggerdelay), because of boot up race conditions with interfaces calling Unbound restarts. Also many smart devices (TV, microwave, or refigerator) will also use public DNS servers either as a bypass or for certain connections in general. If you wish to force exclusive DNS to your router, then you will need a firewall rule for example:

**/etc/config/firewall**:
```

This file has been truncated. show original

dedu · October 19, 2025, 3:18am

You are right. Working now after bringing dnsmasq back but only as DHCP server.

system · October 29, 2025, 3:18am

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.