Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    DNSSEC on pfSense

    Scheduled Pinned Locked Moved 2.0-RC Snapshot Feedback and Problems - RETIRED
    178 Posts 18 Posters 72.1k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • J
      jlepthien
      last edited by

      Hmmm. pfSense still can't install libevent-1.3e…

      Installed it via ssh with pkg_add -r libevent and then went to the GUI to install Unbound but still nothing. Same error as before...

      | apple fanboy | music lover | network and security specialist | in love with cisco systems |

      1 Reply Last reply Reply Quote 0
      • _
        _igor_
        last edited by

        This time the installation was a big mess:

        First, after installation unbound AND dnsmasq were both enabled. It would be much better to have unbound disabled after a fresh install! I was cut off the internet instantly after the installation, nor could i reach my pfsense-Web-IF again. No dns-name neither IP worked.

        looking at the systemlog encountered that the same errors appeared again (description is parsed as config)
        Then after that logentries the log was full of "missing unbound-control, not found"-messages.

        Finally i managed by deinstalling unbound manually and doing a gitsync to get back control of my pfSense.

        1 Reply Last reply Reply Quote 0
        • W
          wagonza
          last edited by

          @jlepthien:

          Hmmm. pfSense still can't install libevent-1.3e…

          Installed it via ssh with pkg_add -r libevent and then went to the GUI to install Unbound but still nothing. Same error as before...

          Seems as though the package had extra make options added. I have explicitly set these now. Packages rebuilding as we speak.

          Follow me on twitter http://twitter.com/wagonza
          http://www.thepackethub.co.za

          1 Reply Last reply Reply Quote 0
          • W
            wagonza
            last edited by

            @_igor_:

            This time the installation was a big mess:

            First, after installation unbound AND dnsmasq were both enabled. It would be much better to have unbound disabled after a fresh install! I was cut off the internet instantly after the installation, nor could i reach my pfsense-Web-IF again. No dns-name neither IP worked.

            looking at the systemlog encountered that the same errors appeared again (description is parsed as config)
            Then after that logentries the log was full of "missing unbound-control, not found"-messages.

            Finally i managed by deinstalling unbound manually and doing a gitsync to get back control of my pfSense.

            not cool! Ok Ermal has made a recent change which will prevent the packages from been automatically started. So this should prevent the situation where the DNS forwarder and Unbound are trying to run at the same time. Also I have added after install notes to indicate that the user needs to configure Unbound before it will be started and also needs to disable the DNS Forwarder.

            Hopefully this commit should address your problem.

            Follow me on twitter http://twitter.com/wagonza
            http://www.thepackethub.co.za

            1 Reply Last reply Reply Quote 0
            • _
              _igor_
              last edited by

              No problem. shit happens. I'll give it a new try tomorrow. Thanks for your great work!

              Tried again, but now i'm having that same problem:

              libevent-1.3e  could not download.
              Cannot install unbound.

              1 Reply Last reply Reply Quote 0
              • J
                jlepthien
                last edited by

                Yeah. Still having the libevent problem, too…

                | apple fanboy | music lover | network and security specialist | in love with cisco systems |

                1 Reply Last reply Reply Quote 0
                • _
                  _igor_
                  last edited by

                  I was looking at the freebsd-ftp and the only libevent is libevent.tgz, which is libevent-1.4.13.tbz.
                  I installed it manually, but didn't help.

                  1 Reply Last reply Reply Quote 0
                  • S
                    serangku
                    last edited by

                    today i install unbound package …
                    still libevent-1.3e  could not download.

                    here full message on package install :
                    Beginning package installation for Unbound...
                    Downloading package configuration file... done.
                    Saving updated package information... done.
                    Downloading Unbound and its dependencies...
                    Checking for package installation...
                    unbound-1.4.7  (extracting)
                      expat-2.0.1_1  (extracting)
                    openssl-1.0.0_3 already installed.
                      libevent-1.3e  could not download.
                    of unbound-1.4.7 failed!

                    Installation aborted.Removing package...
                    Starting package deletion for unbound-1.4.7...done.
                    Starting package deletion for expat-2.0.1_1...done.
                    Skipping package deletion for openssl-1.0.0_2 because it is required by other packages.
                    Starting package deletion for libevent-1.4.14b_1...done.
                    Removing Unbound components...
                    Tabs items... done.
                    Menu items... done.
                    Services... done.
                    Loading package instructions...
                    Include file unbound.inc could not be found for inclusion.
                    Deinstall commands...
                    Not executing custom deinstall hook because an include is missing.
                    Removing package instructions...done.
                    Auxiliary files... done.
                    Package XML... done.
                    Configuration... done.
                    Failed to install package.

                    Installation halted.

                    meanwhile, stick to dnsmasq
                    i really appreciate for provide this package

                    1 Reply Last reply Reply Quote 0
                    • jimpJ
                      jimp Rebel Alliance Developer Netgate
                      last edited by

                      Can you try one more time (I just uploaded a freshly recompiled set of packages) and if that fails, try to do this:

                      pkg_delete -f openssl-1.0.0_2

                      And then try to reinstall Unbound (Or maybe hit the 'x' to delete it and then re-add it from the list)

                      Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

                      Need help fast? Netgate Global Support!

                      Do not Chat/PM for help!

                      1 Reply Last reply Reply Quote 0
                      • _
                        _igor_
                        last edited by

                        Great! Installation works! I'm so excited!!! Thanx a lot!!

                        edit: second note) unbound works great! ping of hosts inside my LAN works. Name resolution is somewhat slower than before, but thats no problem…

                        last edit: Borat smiles into my face...

                        :-)

                        1 Reply Last reply Reply Quote 0
                        • J
                          jlepthien
                          last edited by

                          Thanks jimp! Now the install works and also a DNSSEC Test works. But I cannot ping hosts by name on my LAN. Everything works great from the pfSense box itself (eg. ping by name to every host), but not from my LAN hosts. I am only able to ping pfSense.domain.lan but no other hosts from my iMac on LAN.

                          I also clicked save on the Unbound tab more than once…

                          | apple fanboy | music lover | network and security specialist | in love with cisco systems |

                          1 Reply Last reply Reply Quote 0
                          • J
                            jlepthien
                            last edited by

                            Ok. I can see in the unbound.conf that my hosts do not get written into it. Also I want Unbound to listen on three interfaces but it only listens on my main LAN. So WLAN cannot be used at the moment…

                            Any ideas? I really have checked all three interfaces on the Unbound tab...

                            | apple fanboy | music lover | network and security specialist | in love with cisco systems |

                            1 Reply Last reply Reply Quote 0
                            • W
                              wagonza
                              last edited by

                              Ok I gather nothing has changed in your config that you sent me originally, so let me check and I'll come back to you tomorrow.

                              Follow me on twitter http://twitter.com/wagonza
                              http://www.thepackethub.co.za

                              1 Reply Last reply Reply Quote 0
                              • W
                                wagonza
                                last edited by

                                @_igor_:

                                Great! Installation works! I'm so excited!!! Thanx a lot!!

                                edit: second note) unbound works great! ping of hosts inside my LAN works. Name resolution is somewhat slower than before, but thats no problem…

                                Are you using forwarders or letting Unbound do all the name resolution? Also, is it slow just the 1st time or all the time?

                                Follow me on twitter http://twitter.com/wagonza
                                http://www.thepackethub.co.za

                                1 Reply Last reply Reply Quote 0
                                • J
                                  jlepthien
                                  last edited by

                                  @wagonza:

                                  Ok I gather nothing has changed in your config that you sent me originally, so let me check and I'll come back to you tomorrow.

                                  Yeah, nothing changed in my config. How should I actually use these static dns mappings? Before it was done by dnsmasq and now with Unbound it says that I shouldn't activate the forwarder when using DNSSEC. So how should I configure this?

                                  | apple fanboy | music lover | network and security specialist | in love with cisco systems |

                                  1 Reply Last reply Reply Quote 0
                                  • _
                                    _igor_
                                    last edited by

                                    The forwarder is disabled. Unbound does all the job. As i can say - very subjective opinion - it was only the first call, say some minutes slow with every DNS-query, but then its mostly like before. I'm happy. Thats the best description of the actual state.

                                    You did a really great work! Thanx again!

                                    1 Reply Last reply Reply Quote 0
                                    • S
                                      serangku
                                      last edited by

                                      yup … give it try for now ...
                                      resolve more faster than before

                                      @igor ...
                                      can isee your syslog when firs time boot ?

                                      thanks

                                      1 Reply Last reply Reply Quote 0
                                      • W
                                        wagonza
                                        last edited by

                                        @jlepthien:

                                        Yeah, nothing changed in my config. How should I actually use these static dns mappings? Before it was done by dnsmasq and now with Unbound it says that I shouldn't activate the forwarder when using DNSSEC. So how should I configure this?

                                        You can use the static dns mappings, its just the upstream DNS servers (forwarders) that it says you should ideally not use unless you are certain that they handle DNSSEC correctly. These static DNS mappings will be created as as local-zone in unbound and the relevant A and PTR record will be configured included a TXT record if you supplied a description.

                                        So a simple dig zone @pfsense_ip will return the A record and a dig -x IP @pfsense_ip will return the PTR record. Likewise can be done for a TXT record.

                                        Hope that answers your question.

                                        Follow me on twitter http://twitter.com/wagonza
                                        http://www.thepackethub.co.za

                                        1 Reply Last reply Reply Quote 0
                                        • L
                                          lyserge
                                          last edited by

                                          Are you using forwarders or letting Unbound do all the name resolution? Also, is it slow just the 1st time or all the time?

                                          If someone is interested in measuring DNS performance: http://code.google.com/p/namebench/

                                          Just uncheck the other servers that are included by defalt, then do the test on your pfSense IP :)

                                          It should give some numbers to compare the overall performance…

                                          pfSense 2.0.3 nanoBSD (i386) on Soekris net5501

                                          1 Reply Last reply Reply Quote 0
                                          • _
                                            _igor_
                                            last edited by

                                            @serangku:

                                            Dec 11 00:56:43	unbound: [32918:0] info: start of service (unbound 1.4.7).
Dec 11 00:56:43	unbound: [32918:0] notice: init module 1: iterator
Dec 11 00:56:43	unbound: [32918:0] notice: init module 0: validator
Dec 11 00:56:43	unbound: [37916:0] info: 2.000000 4.000000 1
Dec 11 00:56:43	unbound: [37916:0] info: 1.000000 2.000000 1
Dec 11 00:56:43	unbound: [37916:0] info: 0.524288 1.000000 2
Dec 11 00:56:43	unbound: [37916:0] info: 0.262144 0.524288 2
Dec 11 00:56:43	unbound: [37916:0] info: 0.131072 0.262144 3
Dec 11 00:56:43	unbound: [37916:0] info: 0.065536 0.131072 4
Dec 11 00:56:43	unbound: [37916:0] info: 0.016384 0.032768 1
Dec 11 00:56:43	unbound: [37916:0] info: lower(secs) upper(secs) recursions
Dec 11 00:56:43	unbound: [37916:0] info: [25%]=0.04096 median[50%]=0.0873813 [75%]=0.118928
Dec 11 00:56:43	unbound: [37916:0] info: histogram of recursion processing times
Dec 11 00:56:43	unbound: [37916:0] info: average recursion processing time 0.507960 sec
Dec 11 00:56:43	unbound: [37916:0] info: server stats for thread 0: requestlist max 1 avg 0.142857 exceeded 0
Dec 11 00:56:43	unbound: [37916:0] info: server stats for thread 0: 14 queries, 0 answers from cache, 14 recursions, 0 prefetch
                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.