DHCP dan DNS

grage95

kalo gak ada, coba di cari dengan command find /|grep named.conf
dnsmasq cukup responsif jika digunakan utk net kecil, namun jika utk network besar, dnsmasq sering bengong, walopun sudah dinaikkan cache-size s/d 256Mb. jika di hajar client banyak tiba2 akan muncul warning dns attack !!!!, solusinya gunakan bind, tambahkan option di named.conf cache-data-size dan max-cache-size cukup di buat 8-64 Mb sudah maknyuss

agak ribet menjalankan bind di pfsense, ada beberap script tambahan agar bind/named bisa running seteleh di reboot,
langkah2nya panjang, konsepnya seperti ini :
1.buat dnsmasq.conf di /usr/local/etc/dnsmasq.conf dan option utk mengkatifkan dns jangan di pake, hanya gunakan option utk mengkatifkan dhcp server saja, silahkan try to google tentang dnsmasq
2. buat script rc.conf utk mengaktifkan bind, silahkan try to google tentang bind/named utk freebsd

ipoelnet

Hmmmm,,, gagal lagi… gagal lagi...
Malah jadi error nich...
Restor factory default.............
tolongin dong Om grage...
pakai bind-nya...
Q udah nyontoh http://www.freebsd.org/doc/en/books/handbook/network-dns.html tapi malah tambah ngeluh....

Q bind-nya ganti pakai http://files.pfsense.org/packages/dns/bind9-9.3.2.1.tbz ribet...

grage95

http://howtoforge.com/installing-a-freebsd7.0-dns-server-with-bind

http://pbraun.nethence.com/doc/net/named.html

http://repo.fadhly.web.id/downloads/Tutorial/Konfigurasi%20DNS%20Server%20di%20FreeBSD.pdf

ipoelnet

Ayo yang sudah berhasil install BIND postiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiing, :o :o :o

ipoelnet

http://files.pfsense.org/packages/dns/bind9-9.3.2.1.tbz
hostname ns2.taqwa.local

tambahan /etc/defaults/rc.conf

hostname="ns2.taqwa.local"			# Set this!

tambahan di /etc/rc

# Start BIND
echo "Starting BIND..."
/usr/local/sbin/named
echo "done."

echo "Bootup complete"

Error saat menjalankan /usr/local/sbin/named

/libexec/ld-elf.so.1: Shared object "libcrypto.so.4" not found, required by "named" what?

/var/named/named.conf

forwarders {
              127.0.0.1;
		192.168.254.254;
};
zone "taqwa.local" {
        type master;
        file "master/taqwa.local";
        allow-transfer { localhost; };
        allow-update { key rndc-key };
};
zone "254.168.192.in-addr.arpa" {
        type master;
        file "master/taqwa.local.rev";
        allow-transfer { localhost; };
        allow-update { key rndc-key };
};

/var/named/master/taqwa.local.rev

$TTL    3600
254.168.192.in-addr.arpa.          IN    SOA    ns2.taqwa.local.     root.taqwa.local. (
                                                   1            ; Serial
                                                    10800    ; Refresh
                                                   3600      ; Retry
                                                    604800   ; Expire
                                                    86400)   ; Minimum TTL
; DNS Servers
254.168.192.in-addr.arpa.          IN              NS    ns2.taqwa.local.

; Computer IPs
100                                     IN               PTR    ns2.taqwa.local.
100                                     IN               PTR    www.taqwa.local.

grage95

heheh versi library crypt gak cocok dengan named
coba cek libraray crypto yang ada versi berapa ?

ls /lib/libcypt*
di buat link

cd /lib
ln -s libcrypt.so.5 libcrypt.so.4
ln -s libcrypto.so.6 libcrypto.so.5

ipoelnet

@grage95:

heheh versi library crypt gak cocok dengan named
coba cek libraray crypto yang ada versi berapa ?

ls /lib/libcypt*
di buat link

cd /lib
ln -s libcrypt.so.5 libcrypt.so.4
ln -s libcrypto.so.6 libcrypto.so.5

# cd /lib
# ln -s libcrypt.so.5 libcrypt.so.4
ln: libcrypt.so.4: File exists
# ln -s libcrypto.so.6 libcrypto.so.5
ln: libcrypto.so.5: File exists
#

grage95

hmm sudah ada tapi tdk di kenali sama named

kayanya bind yang ada versi jadul (freebsd 7)
pfsense1-2.3 menggunakan versi freebsd7.2

coba install ulang bindnya dari sini

pkg_delet bind\*
pkg_add -rv http://dl2.foss-id.web.id/freebsd/ports/i386/packages-7.2-release/dns/bind96-9.6.0.1.tbz
rehash

ipoelnet

@grage95:

hmm sudah ada tapi tdk di kenali sama named

kayanya bind yang ada versi jadul (freebsd 7)
pfsense1-2.3 menggunakan versi freebsd7.2

coba install ulang bindnya dari sini
pkg_delet bind\*
pkg_add -rv http://dl2.foss-id.web.id/freebsd/ports/i386/packages-7.2-release/dns/bind96-9.6.0.1.tbz
rehash
:D :D :D jadul filenya….

ipoelnet

Untuk konfigurasi bind saya di atas udah complite ta OM grage95?

grage95

csatu2 dulu, package nya udah bener belum, baru ke config

ipoelnet

Ini Om, settingannya :

pkg_add -rv http://dl2.foss-id.web.id/freebsd/ports/i386/packages-7.2-release/dns/bind96-9.6.0.1.tbz

/etc/resolv.conf

domain taqwa.local
nameserver 127.0.0.1
nameserver 202.134.1.10

/var/named/master/taqwa.local

$TTL    3600
taqwa.local.                     IN    SOA     ns2.taqwa.local.   root.taqwa.local. (
                                                   1            ; Serial 
                                                   10800    ; Refresh
                                                   3600       ; Retry
                                                    604800  ; Expire
                                                   86400 )   ;Minimum TTL
; DNS Servers
taqwa.local.                     IN               NS   ns2.taqwa.local.

; Computer names and records
ns2.taqwa.local.     IN               A    192.168.254.254

; Aliases
www                          IN              CNAME    ns2.taqwa.local.

; Mail MX Records
taqwa.local.                    IN     MX     10   ns2.taqwa.local.

/var/named/master/taqwa.local.rev

$TTL    3600
254.168.192.in-addr.arpa.          IN    SOA    ns2.taqwa.local.     root.taqwa.local. (
                                                   1            ; Serial
                                                    10800    ; Refresh
                                                   3600      ; Retry
                                                    604800   ; Expire
                                                    86400)   ; Minimum TTL
; DNS Servers
254.168.192.in-addr.arpa.          IN              NS    ns2.taqwa.local.

; Computer IPs
100                                     IN               PTR    ns2.taqwa.local.
100                                     IN               PTR    www.taqwa.local.

/usr/local/sbin/rndc-confgen -a

wrote key file "/usr/local/etc/rndc.key"

find / | grep rndc.key

/usr/local/etc/rndc.key

cat /usr/local/etc/rndc.key >> named.conf

/var/named/named.conf

forwarders {
              127.0.0.1;
};
zone "taqwa.local" {
        type master;
        file "master/taqwa.local";
        allow-transfer { localhost; };
        allow-update { key rndc-key };
};
zone "0.0.127.in-addr.arpa" {
        type master;
        file "master/taqwa.local.rev";
        allow-transfer { localhost; };
        allow-update { key rndc-key };
};
key "rndc-key" {
	algorithm hmac-md5;
	secret "JtU+O0PpufgIhsWdA3tSQA==";
};

reboot PF….........

**# sockstat -4l | grep -i 53
nobody dnsmasq 480 3 udp4 :53 :
nobody dnsmasq 480 4 tcp4 :53 :

??? ???

grage95

buat file

/usr/local/etc/dnsmasq.conf


port=54
# increase DNS cache size
# cache-size=10000

expand-hosts 

# Resolve(generated from WAN DHCP)
resolv-file=/etc/resolv.conf
#
# Extra : Blackhole DNS adresses. (NO blackholeDNS, comment next line)
# conf-file=/etc/blackhole.conf
#
#server=208.67.222.222
#server=208.67.220.220
# include another configuration
#conf-file=/etc/dnsmasq-adblock.conf

restart dnsmasq dan jalankan bind

named -4
trus cek dg sockstat lagi

utk tahap pertama : config named sebagai cache dahulu, untuk zone domain belakangan saja.

ini contoh named.conf hanya utk cache

acl "localnet" {192.168.0.0/16;10.0.0.0/8; localhost;};

options {
        // Relative to the chroot directory, if any
        directory       "/etc/namedb";
        pid-file        "/var/run/named/pid";
        dump-file       "/var/dump/named_dump.db";
        statistics-file "/var/stats/named.stats";
        allow-recursion { any; };
      //allow-query     { any; };
      //allow-query-cache  { any; };
        allow-query     { localnet; };
        allow-query-cache  { localnet; };
        minimal-responses       yes;
        datasize 196M;
        max-cache-size 128M;
        listen-on     { any;};
        //listen-on     { 127.0.0.1; 192.168.2.1 };

forward first;
//forward only;

//forwader for block porn
//forwarders {203.34.118.12; 203.34.118.10; };

//forwader ip dns spidol

forwarders { ; 203.130.196.6; 202.134.2.5;};
};

logging {category lame-servers { null; };
};

controls { inet 127.0.0.1 port 953
allow { 127.0.0.1; } keys { "rndc-key"; };
};

zone    "localhost" {
        type master;
        file "master/localhost-forward.db";
};

zone    "127.in-addr.arpa" {
        type master;
        file "master/localhost-reverse.db";
};

zone    "." {
        type hint;
        file "named.root";
};

//include "master/hikmah-teknologi.zone";

//zone block
//include "master/zoneblock.zone";

key "rndc-key" {
        algorithm hmac-md5;
        secret "Kht7CoEd89/kbjno/KPFkA==";
};

ipoelnet

@grage95:

buat file

/usr/local/etc/dnsmasq.conf


port=54
# increase DNS cache size
# cache-size=10000

expand-hosts 

# Resolve(generated from WAN DHCP)
resolv-file=/etc/resolv.conf
#
# Extra : Blackhole DNS adresses. (NO blackholeDNS, comment next line)
# conf-file=/etc/blackhole.conf
#
#server=208.67.222.222
#server=208.67.220.220
# include another configuration
#conf-file=/etc/dnsmasq-adblock.conf

restart dnsmasq dan jalankan bind

named -4
trus cek dg sockstat lagi

setelah restartdnsmasq lewat Web GUI…
terus...

**# usr/local/sbin/named

usr/local/sbin/named -4

sockstat -4 -l |grep -i 53

#**

kosong Om g' da yang jalan…..........

grage95

berarti tinggal named nya
coba di log messages nya

tail -f /var/log/messages ada yang aneh enggak

config named.conf gunakan yg seperti contoh yang aku kasih

taruh di /var/named/etc/namedb/named.conf

cek dengan sockstat dan ps -ax

# sockstat -4 -l |grep -i 53
root named 66164 20 tcp4 192.168.1.12:53 :
root named 66164 21 tcp4 127.0.0.1:53 :
root named 66164 22 tcp4 127.0.0.1:953 :
root named 66164 512udp4 192.168.1.12:53 :
root named 66164 513udp4 127.0.0.1:53 :

#ps -ax |grep named
66164 ?? Is 0:00.04 named -4

#tail -f /var/log/messages
Nov 19 16:48:12 freebsd named[66164]: starting BIND 9.4.3-P2 -4
Nov 19 16:48:12 freebsd named[66164]: command channel listening on 127.0.0.1#953
Nov 19 16:48:12 freebsd named[66164]: running

ipoelnet

zone "localhost" {
type master;
file "master/localhost-forward.db";
};

zone "127.in-addr.arpa" {
type master;
file "master/localhost-reverse.db";
};

Isinya yg tebal OM?

grage95

isinya ada di directory master (by default)

/var/named/etc/namedb/master

http://src.gnu-darwin.org/src/etc/namedb/master/

ipoelnet

named-checkconf

/usr/local/etc/named.conf:32: unknown option 'controls'
/usr/local/etc/named.conf:37: unknown option 'zone'
/usr/local/etc/named.conf:42: unknown option 'zone'
/usr/local/etc/named.conf:47: unknown option 'zone'
/usr/local/etc/named.conf:57: unknown option 'key'
/usr/local/etc/named.conf:61: '}' expected near end of file

grage95

coba paste kesini :
/usr/local/etc/named.conf

ipoelnet

ip server 192.168.254.254
hostname ns2.taqwa.local

/usr/local/etc/named.conf

acl "localnet" {192.168.0.0/16;10.0.0.0/8; localhost;};

options {
// Relative to the chroot directory, if any
directory "/etc/namedb";
pid-file "/var/run/named/pid";
dump-file "/var/dump/named_dump.db";
statistics-file "/var/stats/named.stats";
allow-recursion { any; };
//allow-query { any; };
//allow-query-cache { any; };
allow-query { localnet; };
allow-query-cache { localnet; };
minimal-responses yes;
datasize 196M;
max-cache-size 128M;
listen-on { any;};
//listen-on { 127.0.0.1; 192.168.2.1 };

forward first;
//forward only;

//forwader for block porn
//forwarders {203.34.118.12; 203.34.118.10; };

//forwader ip dns spidol

forwarders { 203.130.196.155; 202.134.1.10;};

//logging {category name-servers { null; }; };

controls { inet 127.0.0.1 port 953
allow { 127.0.0.1; };
keys { "rndc-key"; };
};

zone "localhost" {
type master;
file "master/localhost-forward.db";
};

zone "127.in-addr.arpa" {
type master;
file "master/localhost-reverse.db";
};

zone "." {
type hint;
file "named.root";
};

//include "master/hikmah-teknologi.zone";

//zone block
//include "master/zoneblock.zone";

key "rndc-key" {
algorithm hmac-md5;
secret "JtU+O0PpufgIhsWdA3tSQA==";
};