Re: Feedback about the DNS FW

[Michael Tremer <michael.tremer@ipfire.org>]

Hello Bernhard,

> On 29 Apr 2026, at 18:43, Bernhard Bitsch <bbitsch@ipfire.org> wrote:
> 
> Hi,
> 
> after using the new DNS FW ( congrats to this nice feature! ), I found some issues.

Thanks. I believe that the entire feature has received very poor testing. Considering how many people have stated how important it is to them, really critical issues have been reported very late in the release process which indicates that the feature has not been tested, or if people found those bugs, they have not been reported.

I have to say that I am very disappointed about this. But it has nothing to do with your question.

> - Each 'save' in WUI page increases the memory consumption. Even if nothing changed. A restart of unbound frees this huge allocation.

Yes, this is known. It is a problem inside Unbound and there is nothing we can do about it. I did not report it to Unbound, but I am sure they should be made aware.

Unbound in general is using a lot of memory when it is downloading the lists. I have imported the lists into PowerDNS Recursor and it raises its memory consumption by about ~300 MiB when Unbound is going into 1.6-1.7 GiB.

For now we are stuck with Unbound, but it has always been giving us a lot of trouble.

> - Knowing from using Jon's RPZ prototype, I checked whether a single reload ( used in DNS FW? ) propagates the changes, new list and/or allow/deny entries, really. I found cases where this isn't true. A unbound restart yielded the right behaviour.
> 
> 
> I must apologize not to have tested the release. But I haven't the equipment, yet ( only one production system ).
> 
> Regards,
> Bernhard
>