Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Bind upgrade producing errors on pfsense 2.5 upgrade

    Scheduled Pinned Locked Moved pfSense Packages
    112 Posts 16 Posters 30.5k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • GertjanG
      Gertjan @matthijs
      last edited by

      @matthijs said in Bind upgrade producing errors on pfsense 2.5 upgrade:

      Package named does not exist in current pfSense version and it has been removed. @ 2021-10-11 13:44:20

      'named' is called 'bind' now.
      Not really an issue.
      It will break the auto re install of course. You had to install in manually.

      No "help me" PM's please. Use the forum, the community will thank you.
      Edit : and where are the logs ??

      M 1 Reply Last reply Reply Quote 0
      • M
        matthijs
        last edited by matthijs

        I think the issue is caused by something wrong in /usr/local/etc/rc.d/named

        GertjanG 1 Reply Last reply Reply Quote 0
        • GertjanG
          Gertjan @matthijs
          last edited by

          @matthijs said in Bind upgrade producing errors on pfsense 2.5 upgrade:

          /usr/local/etc/rc.d/named

          You've cross checked your findings with known issues ?

          No "help me" PM's please. Use the forum, the community will thank you.
          Edit : and where are the logs ??

          1 Reply Last reply Reply Quote 0
          • A
            aligator638
            last edited by

            Configuration:

            unbound is listening on:
            192.168.10.1
            192.168.20.1
            localhost
            The control port is set to 953

            bind is listening on
            192.168.10.9
            The control port is set to 8953
            some zones are dynamic and updated by the dhcp service

            pfblocker with dnsbl is enabled

            The problem:

            Upon rebooting the server, startup is really slow. This happened during and since the upgrade to version 21 (aka 2.5)

            Investigation:
            reboot the server and connect with the serial console and ssh
            When server seems frozen run ps -aux | grep (various names here name/bind/rndc) on the ssh console
            We notice rndc is being started multiple times (rndc freeze/thaw commands) and take a long time to complete (it seem to go over all defined bind zones) freeze/thaw operations are related to editing the zone files manually on a dynamic zone
            We notice no new services are starting while bind is in this process loop
            keep killing the rndc processes and the boot sequence will finish in a reasonable time
            leave it running and pfsense will eventually finish starting (seems to depend on the number of zones configured in bind)

            Possible causes:
            rndc commands are being run before bind is started (rndc cannot start bind on its own)
            rndc is using the wrong port
            bind is started but control channel is on the wrong port

            M 1 Reply Last reply Reply Quote 0
            • M
              matthijs @aligator638
              last edited by matthijs

              @aligator638
              I rather see this issue fixed, but a workaround can be installing the package "Shellcmd" and add the following line:

              /usr/local/sbin/named -c /etc/namedb/named.conf -u bind -t /cf/named/

              My system boots a lot faster/services starting faster with this workaround

              A 1 Reply Last reply Reply Quote 1
              • A
                aligator638 @matthijs
                last edited by

                @matthijs it is a workaround but still what is meant by these commands ? Are they essential ? That is the question. IMHO pfsense is trying to do something with the zones at startup. like freeze - do something with the zone- thaw etc... bypassing this process could have some impact.

                GertjanG 1 Reply Last reply Reply Quote 0
                • GertjanG
                  Gertjan @aligator638
                  last edited by

                  @aligator638 said in Bind upgrade producing errors on pfsense 2.5 upgrade:

                  IMHO pfsense is trying to do something with the zones at startup. like freeze - do something with the zone- thaw etc... bypassing this process could have some impact.

                  For that to work, named has to be started first ;)

                  That's what this :

                  @matthijs said in Bind upgrade producing errors on pfsense 2.5 upgrade:

                  /usr/local/sbin/named -c /etc/namedb/named.conf -u bind -t /cf/named

                  does.

                  No "help me" PM's please. Use the forum, the community will thank you.
                  Edit : and where are the logs ??

                  A 1 Reply Last reply Reply Quote 0
                  • M
                    matthijs @Gertjan
                    last edited by matthijs

                    @gertjan

                    If you search your (backup) config file for the following lines:

                    <package>
                    <name>bind</name>
                    <internal_name>named</internal_name>

                    change it to:

                    <package>
                    <name>bind</name>
                    <internal_name>bind</internal_name>

                    You do not get the warning during config restore that named is now called bind in PFsense packages, and the packet re installation continues without errors or warnings

                    GertjanG 1 Reply Last reply Reply Quote 0
                    • A
                      aligator638 @Gertjan
                      last edited by

                      @gertjan Yes, but this is the job of pfsense to start the service, I should not make a 3 hours long trip to console into the firewall and start the service manually every time a reboot is required.

                      johnpozJ 1 Reply Last reply Reply Quote 0
                      • GertjanG
                        Gertjan @matthijs
                        last edited by

                        @matthijs said in Bind upgrade producing errors on pfsense 2.5 upgrade:

                        You do not get the warning

                        No warnings .... as I'm not using bind / named.

                        @aligator638 said in Bind upgrade producing errors on pfsense 2.5 upgrade:

                        I should not make a 3 hours long trip to console

                        Don't we all have a "remote warrior VPN access" these days, to access the GUI from distance, and be able to SSH (a remote 'close to' console access) ??

                        No "help me" PM's please. Use the forum, the community will thank you.
                        Edit : and where are the logs ??

                        1 Reply Last reply Reply Quote 0
                        • johnpozJ
                          johnpoz LAYER 8 Global Moderator @aligator638
                          last edited by

                          @aligator638 said in Bind upgrade producing errors on pfsense 2.5 upgrade:

                          I should not make a 3 hours long trip to console

                          No offense - but if some install you manage is 3 hours away, and and you have not setup some sort of remote access, even via a out of band, etc. Your doing it wrong ;)

                          Could be as simple as open up gui/ssh on the wan of pfsense to your known remote IP.. I have this setup on an install that is only 30 minutes from me.. I can access the gui and ssh, from my known home IP..

                          To issues with upgrades of packages and stuff breaking or working different. It would not be possible for pfsense to simulate every possible config that a user might setup. So it is quite possible that a previous configuration that didn't throw errors, and worked before might have problems after an upgrade where package was changed or checks were put in place to help prevent non standard configs, etc.

                          I had an issue awhile back where freerad was working, I then upgraded it and it didn't - why because there was an issue in the previous version that allowed it to work how I had it configured - even though it was not right. When I upgraded it that bad config no longer worked, etc.

                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                          If you get confused: Listen to the Music Play
                          Please don't Chat/PM me for help, unless mod related
                          SG-4860 24.11 | Lab VMs 2.8, 24.11

                          1 Reply Last reply Reply Quote 0
                          • M
                            matthijs
                            last edited by matthijs

                            It looks like the issue is resolved with the latest Bind package version 9.16_17

                            1 Reply Last reply Reply Quote 0
                            • A
                              aligator638
                              last edited by

                              I confirm the boot problem is gone on on my firewall

                              A 1 Reply Last reply Reply Quote 0
                              • A
                                aligator638 @aligator638
                                last edited by

                                Well one issue with the move to the new version. Previously bind was installed on my /cf now it is in /var/etc/named/etc/namedb/ a side effect, is whenever the router is restarted all my keys specified as global option will vanish

                                include "/etc/namedb/acme-keys.key";
                                include "/etc/namedb/ddns-key-inf.key";
                                include "/etc/namedb/ddns-key-sec.key";
                                include "/etc/namedb/ddns-key.key";

                                An idea would be to save them in the pfsense configuration.

                                1 Reply Last reply Reply Quote 0
                                • First post
                                  Last post
                                Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.