Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    DHCP dan DNS

    Scheduled Pinned Locked Moved Indonesian
    42 Posts 6 Posters 19.8k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • I
      ipoelnet
      last edited by

      Mungkin untuk masalah DNS pakai Bind9 kayaknya bagus…
      Silahkan coba :

      • install/add package

      pkg_add -rv http://files.pfsense.org/packages/dns/bind9-9.3.2.1.tbz
      atau
      pkg_add -rv http://files.pfsense.org/packages/dns/bind9-sdb-ldap-9.3.2.tbz
      atau
      pkg_add -rv http://files.pfsense.org/packages/dns/bind9-dlz+postgres-9.3.2+0.7.0.tbz

      • pilh salah satu saja.

      disini saya pakai yang  http://files.pfsense.org/packages/dns/bind9-dlz+postgres-9.3.2+0.7.0.tbz

      • kemudian delete shorcut filse /etc/resolv.conf –-> direnew pada bootup
        dan buat file baru /etc/resolv.conf isikan

      nameserver 127.0.0.1
      nameserver xxx.xxx.xxx.xxx –--> dns primary ISP anda

      • dan jadikan permission file /etc/resolv.conf hasil buatan kita ke 7555 agar bisa dibaca saja dan pada saat booting tidak direnew/didelete oleh system…

      • cek hasil :

      $ dig -x facebook.com

      ; <<>> DiG 9.4.3-P2 <<>> -x facebook.com
      ;; global options:  printcmd
      ;; Got answer:
      ;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 31969
      ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0

      ;; QUESTION SECTION:
      ;com.facebook.in-addr.arpa. IN PTR

      ;; AUTHORITY SECTION:
      in-addr.arpa. 343 IN SOA A.ROOT-SERVERS.NET. dns-ops.ARIN.NET. 2009111516 1800 900 691200 10800

      ;; Query time: 29 msec
      ;; SERVER: 127.0.0.1#53(127.0.0.1)
      ;; WHEN: Mon Nov 16 15:39:49 2009
      ;; MSG SIZE  rcvd: 110

      $ host -a 69.63.179.26
      Trying "26.179.63.69.in-addr.arpa"
      ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 20103
      ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0

      ;; QUESTION SECTION:
      ;26.179.63.69.in-addr.arpa. IN PTR

      ;; ANSWER SECTION:
      26.179.63.69.in-addr.arpa. 2343 IN PTR mx.snc1.tfbnw.net.

      Received 74 bytes from 127.0.0.1#53 in 0 ms

      Mohon koreksinya.

      Iso cak, Asal sesuai aturan | Belajarlah seperti orang bodoh

      1 Reply Last reply Reply Quote 0
      • G
        grage95
        last edited by

        bro, coba cek dengan command, daemon yg jalan apakah masih dnsmasq / bind ?

        sockstat -4 -l |grep -i 53

        untuk settingan bind ada di /etc/namedb/named.conf

        1 Reply Last reply Reply Quote 0
        • I
          ipoelnet
          last edited by

          Ini OM, oh iya;

          **nobody   dnsmasq    515   3  udp4   :53                  :
          nobody   dnsmasq    515   4  tcp4   :53                  :

          Terus Gmn OM?
          di list data g' ada file dan folder /etc/namedb/named.conf

          Apa saja yang di setting OM?
          isi dari /etc/namedb/named.conf tersebut apa n permissionnya?
          dan juga untuk mematikan dnsmasq agar bind saja yg berjalan?

          Saya tunggu Om, hm… sekarang Q mau masuk kelas dulu,.,.,

          Iso cak, Asal sesuai aturan | Belajarlah seperti orang bodoh

          1 Reply Last reply Reply Quote 0
          • G
            grage95
            last edited by

            kalo gak ada, coba di cari dengan command find /|grep named.conf
            dnsmasq cukup responsif jika digunakan utk net kecil, namun jika utk network besar, dnsmasq sering bengong, walopun sudah dinaikkan cache-size s/d 256Mb. jika di hajar client banyak tiba2 akan muncul warning dns attack !!!!, solusinya gunakan bind, tambahkan option di named.conf  cache-data-size dan max-cache-size cukup di buat 8-64 Mb sudah maknyuss

            agak ribet menjalankan bind di pfsense, ada beberap script tambahan agar bind/named bisa running seteleh di reboot,
            langkah2nya panjang, konsepnya seperti  ini :
            1.buat dnsmasq.conf di /usr/local/etc/dnsmasq.conf dan option utk mengkatifkan dns jangan di pake, hanya gunakan option utk mengkatifkan dhcp server saja, silahkan try to google tentang dnsmasq
            2. buat script rc.conf utk mengaktifkan bind, silahkan  try to google tentang  bind/named utk freebsd

            1 Reply Last reply Reply Quote 0
            • I
              ipoelnet
              last edited by

              Hmmmm,,, gagal lagi… gagal lagi...
              Malah jadi error nich...
              Restor factory default.............
              tolongin dong Om grage...
              pakai bind-nya...
              Q udah nyontoh http://www.freebsd.org/doc/en/books/handbook/network-dns.html tapi malah tambah ngeluh....

              Q bind-nya ganti pakai http://files.pfsense.org/packages/dns/bind9-9.3.2.1.tbz ribet...

              Iso cak, Asal sesuai aturan | Belajarlah seperti orang bodoh

              1 Reply Last reply Reply Quote 0
              • G
                grage95
                last edited by

                http://howtoforge.com/installing-a-freebsd7.0-dns-server-with-bind

                http://pbraun.nethence.com/doc/net/named.html

                http://repo.fadhly.web.id/downloads/Tutorial/Konfigurasi%20DNS%20Server%20di%20FreeBSD.pdf

                1 Reply Last reply Reply Quote 0
                • I
                  ipoelnet
                  last edited by

                  Ayo yang sudah berhasil install BIND postiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiing,  :o :o :o

                  Iso cak, Asal sesuai aturan | Belajarlah seperti orang bodoh

                  1 Reply Last reply Reply Quote 0
                  • I
                    ipoelnet
                    last edited by

                    http://files.pfsense.org/packages/dns/bind9-9.3.2.1.tbz
                    hostname ns2.taqwa.local

                    tambahan /etc/defaults/rc.conf

                    hostname="ns2.taqwa.local"			# Set this!

                    tambahan di /etc/rc

                    # Start BIND
echo "Starting BIND..."
/usr/local/sbin/named
echo "done."

echo "Bootup complete"

                    Error saat menjalankan  /usr/local/sbin/named

                    /libexec/ld-elf.so.1: Shared object "libcrypto.so.4" not found, required by "named" what?

                    /var/named/named.conf

                    forwarders {
              127.0.0.1;
		192.168.254.254;
};
zone "taqwa.local" {
        type master;
        file "master/taqwa.local";
        allow-transfer { localhost; };
        allow-update { key rndc-key };
};
zone "254.168.192.in-addr.arpa" {
        type master;
        file "master/taqwa.local.rev";
        allow-transfer { localhost; };
        allow-update { key rndc-key };
};

                    /var/named/master/taqwa.local.rev

                    $TTL    3600
254.168.192.in-addr.arpa.          IN    SOA    ns2.taqwa.local.     root.taqwa.local. (
                                                   1            ; Serial
                                                    10800    ; Refresh
                                                   3600      ; Retry
                                                    604800   ; Expire
                                                    86400)   ; Minimum TTL
; DNS Servers
254.168.192.in-addr.arpa.          IN              NS    ns2.taqwa.local.

; Computer IPs
100                                     IN               PTR    ns2.taqwa.local.
100                                     IN               PTR    www.taqwa.local.

                    Iso cak, Asal sesuai aturan | Belajarlah seperti orang bodoh

                    1 Reply Last reply Reply Quote 0
                    • G
                      grage95
                      last edited by

                      heheh versi library crypt gak cocok dengan named
                      coba cek libraray crypto yang ada versi berapa ?

                      ls /lib/libcypt*
                      di buat link

                      cd /lib
                      ln -s libcrypt.so.5 libcrypt.so.4
                      ln -s libcrypto.so.6 libcrypto.so.5

                      1 Reply Last reply Reply Quote 0
                      • I
                        ipoelnet
                        last edited by

                        @grage95:

                        heheh versi library crypt gak cocok dengan named
                        coba cek libraray crypto yang ada versi berapa ?

                        ls /lib/libcypt*
                        di buat link

                        cd /lib
                        ln -s libcrypt.so.5 libcrypt.so.4
                        ln -s libcrypto.so.6 libcrypto.so.5

                        # cd /lib
# ln -s libcrypt.so.5 libcrypt.so.4
ln: libcrypt.so.4: File exists
# ln -s libcrypto.so.6 libcrypto.so.5
ln: libcrypto.so.5: File exists
#

                        Iso cak, Asal sesuai aturan | Belajarlah seperti orang bodoh

                        1 Reply Last reply Reply Quote 0
                        • G
                          grage95
                          last edited by

                          hmm sudah ada tapi tdk di kenali sama named

                          kayanya bind yang ada versi jadul (freebsd 7)
                          pfsense1-2.3 menggunakan versi freebsd7.2

                          coba install ulang bindnya dari sini

                          pkg_delet bind\*
pkg_add -rv http://dl2.foss-id.web.id/freebsd/ports/i386/packages-7.2-release/dns/bind96-9.6.0.1.tbz
rehash
                          1 Reply Last reply Reply Quote 0
                          • I
                            ipoelnet
                            last edited by

                            @grage95:

                            hmm sudah ada tapi tdk di kenali sama named

                            kayanya bind yang ada versi jadul (freebsd 7)
                            pfsense1-2.3 menggunakan versi freebsd7.2

                            coba install ulang bindnya dari sini

                            pkg_delet bind\*
pkg_add -rv http://dl2.foss-id.web.id/freebsd/ports/i386/packages-7.2-release/dns/bind96-9.6.0.1.tbz
rehash

                            :D :D :D jadul filenya….

                            Iso cak, Asal sesuai aturan | Belajarlah seperti orang bodoh

                            1 Reply Last reply Reply Quote 0
                            • I
                              ipoelnet
                              last edited by

                              Untuk konfigurasi bind saya di atas udah complite ta OM grage95?

                              Iso cak, Asal sesuai aturan | Belajarlah seperti orang bodoh

                              1 Reply Last reply Reply Quote 0
                              • G
                                grage95
                                last edited by

                                csatu2 dulu, package nya udah bener belum, baru ke config

                                1 Reply Last reply Reply Quote 0
                                • I
                                  ipoelnet
                                  last edited by

                                  Ini Om, settingannya :

                                  pkg_add -rv http://dl2.foss-id.web.id/freebsd/ports/i386/packages-7.2-release/dns/bind96-9.6.0.1.tbz

                                  /etc/resolv.conf

                                  domain taqwa.local
nameserver 127.0.0.1
nameserver 202.134.1.10

                                  /var/named/master/taqwa.local

                                  $TTL    3600
taqwa.local.                     IN    SOA     ns2.taqwa.local.   root.taqwa.local. (
                                                   1            ; Serial 
                                                   10800    ; Refresh
                                                   3600       ; Retry
                                                    604800  ; Expire
                                                   86400 )   ;Minimum TTL
; DNS Servers
taqwa.local.                     IN               NS   ns2.taqwa.local.

; Computer names and records
ns2.taqwa.local.     IN               A    192.168.254.254

; Aliases
www                          IN              CNAME    ns2.taqwa.local.

; Mail MX Records
taqwa.local.                    IN     MX     10   ns2.taqwa.local.

                                  /var/named/master/taqwa.local.rev

                                  $TTL    3600
254.168.192.in-addr.arpa.          IN    SOA    ns2.taqwa.local.     root.taqwa.local. (
                                                   1            ; Serial
                                                    10800    ; Refresh
                                                   3600      ; Retry
                                                    604800   ; Expire
                                                    86400)   ; Minimum TTL
; DNS Servers
254.168.192.in-addr.arpa.          IN              NS    ns2.taqwa.local.

; Computer IPs
100                                     IN               PTR    ns2.taqwa.local.
100                                     IN               PTR    www.taqwa.local.

                                  /usr/local/sbin/rndc-confgen -a

                                  wrote key file "/usr/local/etc/rndc.key"

                                  find / | grep rndc.key

                                  /usr/local/etc/rndc.key

                                  cat /usr/local/etc/rndc.key >> named.conf

                                  /var/named/named.conf

                                  forwarders {
              127.0.0.1;
};
zone "taqwa.local" {
        type master;
        file "master/taqwa.local";
        allow-transfer { localhost; };
        allow-update { key rndc-key };
};
zone "0.0.127.in-addr.arpa" {
        type master;
        file "master/taqwa.local.rev";
        allow-transfer { localhost; };
        allow-update { key rndc-key };
};
key "rndc-key" {
	algorithm hmac-md5;
	secret "JtU+O0PpufgIhsWdA3tSQA==";
};

                                  reboot PF….........

                                  **# sockstat -4l | grep -i 53
                                  nobody  dnsmasq    480  3  udp4  :53                  :
                                  nobody  dnsmasq    480  4  tcp4  :53                  :

                                  ??? ???

                                  Iso cak, Asal sesuai aturan | Belajarlah seperti orang bodoh

                                  1 Reply Last reply Reply Quote 0
                                  • G
                                    grage95
                                    last edited by

                                    buat file

                                    /usr/local/etc/dnsmasq.conf

                                    
port=54
# increase DNS cache size
# cache-size=10000

expand-hosts 

# Resolve(generated from WAN DHCP)
resolv-file=/etc/resolv.conf
#
# Extra : Blackhole DNS adresses. (NO blackholeDNS, comment next line)
# conf-file=/etc/blackhole.conf
#
#server=208.67.222.222
#server=208.67.220.220
# include another configuration
#conf-file=/etc/dnsmasq-adblock.conf

                                    restart dnsmasq dan jalankan bind

                                    named -4
                                    trus cek dg  sockstat lagi

                                    utk tahap pertama : config named sebagai cache dahulu, untuk zone domain belakangan saja.

                                    ini contoh named.conf hanya utk cache

                                    acl "localnet" {192.168.0.0/16;10.0.0.0/8; localhost;};

options {
        // Relative to the chroot directory, if any
        directory       "/etc/namedb";
        pid-file        "/var/run/named/pid";
        dump-file       "/var/dump/named_dump.db";
        statistics-file "/var/stats/named.stats";
        allow-recursion { any; };
      //allow-query     { any; };
      //allow-query-cache  { any; };
        allow-query     { localnet; };
        allow-query-cache  { localnet; };
        minimal-responses       yes;
        datasize 196M;
        max-cache-size 128M;
        listen-on     { any;};
        //listen-on     { 127.0.0.1; 192.168.2.1 };

forward first;
//forward only;

//forwader for block porn
//forwarders {203.34.118.12; 203.34.118.10; };

//forwader ip dns spidol

forwarders { ; 203.130.196.6; 202.134.2.5;};
};

logging {category lame-servers { null; };
};

controls { inet 127.0.0.1 port 953
allow { 127.0.0.1; } keys { "rndc-key"; };
};

zone    "localhost" {
        type master;
        file "master/localhost-forward.db";
};

zone    "127.in-addr.arpa" {
        type master;
        file "master/localhost-reverse.db";
};

zone    "." {
        type hint;
        file "named.root";
};

//include "master/hikmah-teknologi.zone";

//zone block
//include "master/zoneblock.zone";

key "rndc-key" {
        algorithm hmac-md5;
        secret "Kht7CoEd89/kbjno/KPFkA==";
};
                                    1 Reply Last reply Reply Quote 0
                                    • I
                                      ipoelnet
                                      last edited by

                                      @grage95:

                                      buat file

                                      /usr/local/etc/dnsmasq.conf

                                      
port=54
# increase DNS cache size
# cache-size=10000

expand-hosts 

# Resolve(generated from WAN DHCP)
resolv-file=/etc/resolv.conf
#
# Extra : Blackhole DNS adresses. (NO blackholeDNS, comment next line)
# conf-file=/etc/blackhole.conf
#
#server=208.67.222.222
#server=208.67.220.220
# include another configuration
#conf-file=/etc/dnsmasq-adblock.conf

                                      restart dnsmasq dan jalankan bind

                                      named -4
                                      trus cek dg  sockstat lagi

                                      setelah restartdnsmasq lewat Web GUI…
                                      terus...

                                      **# usr/local/sbin/named

                                      usr/local/sbin/named -4

                                      sockstat -4 -l |grep -i 53

                                      #**

                                      kosong Om g' da yang jalan…..........

                                      Iso cak, Asal sesuai aturan | Belajarlah seperti orang bodoh

                                      1 Reply Last reply Reply Quote 0
                                      • G
                                        grage95
                                        last edited by

                                        berarti tinggal named nya
                                        coba di log messages nya

                                        tail -f /var/log/messages ada yang aneh enggak

                                        config named.conf gunakan yg seperti contoh yang aku kasih

                                        taruh di /var/named/etc/namedb/named.conf

                                        cek dengan sockstat dan ps -ax

                                        # sockstat -4 -l |grep -i 53
                                        root     named      66164 20 tcp4   192.168.1.12:53       :
                                        root     named      66164 21 tcp4   127.0.0.1:53          :
                                        root     named      66164 22 tcp4   127.0.0.1:953         :
                                        root     named      66164 512udp4   192.168.1.12:53       :
                                        root     named      66164 513udp4   127.0.0.1:53          :

                                        #ps -ax |grep named
                                        66164  ??  Is     0:00.04 named -4

                                        #tail -f /var/log/messages
                                        Nov 19 16:48:12 freebsd named[66164]: starting BIND 9.4.3-P2 -4
                                        Nov 19 16:48:12 freebsd named[66164]: command channel listening on 127.0.0.1#953
                                        Nov 19 16:48:12 freebsd named[66164]: running

                                        1 Reply Last reply Reply Quote 0
                                        • I
                                          ipoelnet
                                          last edited by

                                          zone    "localhost" {
                                                  type master;
                                                  file "master/localhost-forward.db";
                                          };

                                          zone    "127.in-addr.arpa" {
                                                  type master;
                                                  file "master/localhost-reverse.db";
                                          };

                                          Isinya yg tebal OM?

                                          Iso cak, Asal sesuai aturan | Belajarlah seperti orang bodoh

                                          1 Reply Last reply Reply Quote 0
                                          • G
                                            grage95
                                            last edited by

                                            isinya ada di directory master (by default)

                                            /var/named/etc/namedb/master

                                            http://src.gnu-darwin.org/src/etc/namedb/master/

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.