Strange dnsmasq logs / can't post on GoToSocial unless I manually restart dnsmasq

Support apps
,
1

What app is this about, and its version: GoToSocial 0.21.2~ynh1
What YunoHost version are you running: 12.1.39
What type of hardware are you using: VPS bought online

Describe your issue

Last week I ran a few app upgrades (GoToSocial, NextCloud and PeerTube) and the PeerTube one was botched. Backups didn’t work, so I had to revert back to a VPS snapshot. Since then, everything has been working fine except for my GoToSocial. I basically need to restart dnsmasq every morning if I want to use it.

The dnsmasq logs are filled with messages like:
Mar 31 06:02:45 dnsmasq[358468]: Maximum number of concurrent DNS queries reached (max: 150)

And then when I restart dnsmasq, the logs get populated with messages like these (I’m redacting IP addresses):

Mar 31 05:11:40 dnsmasq[358468]: using nameserver REDACTED#53 for domain *.zen.spamhaus.org
Mar 31 05:11:40 dnsmasq[358468]: using nameserver REDACTED#53 for domain *.zen.spamhaus.org
Mar 31 05:11:40 dnsmasq[358468]: using nameserver REDACTED#53 for domain *.zen.spamhaus.org

Now port 53 is closed to the outside. I don’t have a mailserver on my YunoHost. I don’t understand what is going on here. Is my system being exploited to send spam?

Share relevant logs or error messages

Mar 31 06:02:45 dnsmasq[358468]: Maximum number of concurrent DNS queries reached (max: 150)

and

Mar 31 05:11:40 dnsmasq[358468]: using nameserver REDACTED#53 for domain *.zen.spamhaus.org

2

See

1 Like
3

Thank you!

I will follow the advice and increase dns-forward-max from 150 to 300 (or even 500) as it was explained in that post.

Follow-up question: what’s the deal with all the mentions of *.zen.spamhaus.org in my dnsmasq logs? I’m really confused.

I wonder if I can add firewall rules (about port 53) on the VPS layer… but would that mess up my YunoHost system?

4

Well, I don’t think the port 53 should be opened on a VPS…

5

I closed it in YunoHost’s Firewall page as soon as I noticed the problem, but that port is still mentioned in my strange logs :smiling_face_with_tear:

6

Because of local requests I guess.

7

Ports 53 and 5353 should not be exposed to the internet. It’s OK to have them open locally when the server is at home so other devices in home network can use it.

And it’s OK to see requests from localhost since you have federated apps.

8

Yet ports are open by default.

9

Thanks! I actually closed them both but I am still seeing the port mentioned in my dnsmasq logs and I can’t understand why. Is there a way to safely flush the logs?

Can I run this? truncate -s 0 /var/log/dnsmasq.log

Anyway, I increased my dns-forward-max from 150 to 300 and today for the first time in a week I didn’t have to restart dnsmasq to post on GoToSocial (yay).

Thanks for your help

10

This command truncates the size of the file to 0 bytes.
No risk in itself.
The only thing is not to have the information anymore if you need it.

I also found this: