DNSSEC on pfSense

serangku

great job … :)

have tested on pf 2.0 32 bit and 64 bit
on new package now have a bit custom on gui ...
really appreciate ...

mromero

Thanks wagonza, adrianhensler and jimp and all the other techno Gods on PFSENSE for making this work ;D

Have just upgraded to today's second snapshot build on i386 and it took very long to go through the process. Apparently de-installed Squid and Unbound and re-installed them but in the end everything ran through smoothly.

I did not have to manually install any package or anything like that.

Still get the Unbound error on the logs but Squid and Unbound are working fine and Borat is smiling.

From the console I glimpsed something like Unbound log in already exists or something like that.

Where I am ALL the ISPs we tested including satellite are not running DNSSEC thus I am humbled by maybe being the first :o

P.S. Working good also on Saturday's second snapshot on 64 bit.

@serangku:

great job … :)

have tested on pf 2.0 32 bit and 64 bit
on new package now have a bit custom on gui ...
really appreciate ...

ResIpsa

Does Unbound have an equivalent to the host override section of DNS Forwarder?

johnpoz

Check the private address section

"Note: Domain Overrides and Host entries will be allowed to return answers if this option is enabled. "

It returns local hosts for sure.

; <<>> DiG 9.7.2-P3 <<>> quad-w7.local.lan
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 14529
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;quad-w7.local.lan. IN A

;; ANSWER SECTION:
quad-w7.local.lan. 3600 IN A 192.168.1.100

;; Query time: 8 msec
;; SERVER: 192.168.1.253#53(192.168.1.253)
;; WHEN: Sun Jan 09 10:11:52 2011
;; MSG SIZE rcvd: 51

ResIpsa

Thank you, I saw that entry. I don't think that I was clear enough in my question. Where do I enter the host names and corresponding IP addresses? Will Unbound pull them from the DNS forwarder page or do I need to re-enter them somewhere else?

ToxIcon

sorry guys I seem to be having a problem loosing access to the internet when I enable Unbound it work for about 20 minutes then I loose all internet connection cannot access any webpages then I have to disable Unbound and reboot the firewall to restore internet access.

Here is my settings

Enable Unbound

lan Lan1

Enable DNSSEC

Enable forwarding mode

Private Address support

Register DHCP static mappings

Enable DNS forwarder disable

This webpage is not available
The webpage at http://www.google.com/search?sourceid=chrome&ie=UTF-8&q=linksys+forum might be temporarily down or it may have moved permanently to a new web address.
Here are some suggestions:
Reload this web page later.
Error 105 (net::ERR_NAME_NOT_RESOLVED): The server could not be found.

This webpage is not available
The webpage at http://www.helpsintl.org/programs/education.php might be temporarily down or it may have moved permanently to a new web address.
Here are some suggestions:
Reload this web page later.
Error 105 (net::ERR_NAME_NOT_RESOLVED): The server could not be found.

johnpoz

"Will Unbound pull them from the DNS forwarder page or do I need to re-enter them somewhere else?"

Yes it pulls them from the forwarder page, this is where I entered all my local host names it unbound resolves them. Have not tried the domain over ride yet.. But hosts work just fine.

adrianhensler

@ToxIcon:

sorry guys I seem to be having a problem loosing access to the internet when I enable Unbound it work for about 20 minutes then I loose all internet connection cannot access any webpages then I have to disable Unbound and reboot the firewall to restore internet access.

I can confirm that unbound has crapped out for me at least twice in the past 4 days. I haven't had time to look at it at all, but restarting it from services page fixed it for me both times.

Hopefully next time it happens I'll have a minute to take a look at the logs.

ResIpsa

Thank you for the help. I'm now using DNSSEC - Borat is my friend.

mromero

So far good nuff for me for maybe a snapshot junkie upgrading almost everyday. I would hope the developers are giving this attention so as not to make for a buggy RC1 ::)

@adrianhensler:

@ToxIcon:

sorry guys I seem to be having a problem loosing access to the internet when I enable Unbound it work for about 20 minutes then I loose all internet connection cannot access any webpages then I have to disable Unbound and reboot the firewall to restore internet access.

I can confirm that unbound has crapped out for me at least twice in the past 4 days. I haven't had time to look at it at all, but restarting it from services page fixed it for me both times.

Hopefully next time it happens I'll have a minute to take a look at the logs.

wagonza

@ResIpsa:

Thank you, I saw that entry. I don't think that I was clear enough in my question. Where do I enter the host names and corresponding IP addresses? Will Unbound pull them from the DNS forwarder page or do I need to re-enter them somewhere else?

It pulls them from the DNS forwarder page. So configure them there and once you have completed them, restart Unbound and it will then answer for those entries.

wagonza

@johnpoz:

"Will Unbound pull them from the DNS forwarder page or do I need to re-enter them somewhere else?"

Yes it pulls them from the forwarder page, this is where I entered all my local host names it unbound resolves them. Have not tried the domain over ride yet.. But hosts work just fine.

Domain overrides will work as well. There was problems in the beginning with them but those have been ironed out. Please let me know if you come across any other problems.

wagonza

@ToxIcon:

sorry guys I seem to be having a problem loosing access to the internet when I enable Unbound it work for about 20 minutes then I loose all internet connection cannot access any webpages then I have to disable Unbound and reboot the firewall to restore internet access.

Here is my settings

Enable Unbound

lan Lan1

Enable DNSSEC

Enable forwarding mode

Private Address support

Register DHCP static mappings

Enable DNS forwarder disable

I see you have forwarding enabled. So when this problem happens can you then query your name servers that have been defined in General. If those answer can you then query Unbound (using dig) and see what it's response is i.e. dig @pfsense_ip www.pfsense.org

Then let me know what it sees. Also have a log at /var/log/unbound/log (cmd is clog /var/log/unbound.log).

wagonza

@adrianhensler:

I can confirm that unbound has crapped out for me at least twice in the past 4 days. I haven't had time to look at it at all, but restarting it from services page fixed it for me both times.

Hopefully next time it happens I'll have a minute to take a look at the logs.

If you could do the same please - when it happens try query, using dig, and see what its answers with. Then when you do have time see if /var/log/unbound.log contains anything useful.

jlepthien

I tried using Unbound again and everything seems to be working fine except one small thing…
I have one domain override configured but I cannot resolve the hostname. Not on the pfSense box itself and not on any LAN/WLAN interface. Any info on how/what to test?

Here is the part of the config:

# Domain overrides
stub-zone:
	name: "ip"
	stub-addr: 192.168.2.1
	stub-prime: no

And there should be my modem with a dns name of speedport.ip which is on vr1 (my external interface). This works with dnsmasq but not with Unbound yet…

Edit: the speedport.ip entry also is missing from /etc/hosts on my pfSense box...

johnpoz

I just tried putting in a domain override, and restarted unbound - and its not showing up in the unbound config.

Domain overrides

Remote Control Config

So I have the below domain set to override and use 192.168.1.4, I even stopped and restarted unbound service - just not showing up in the config??

But to your question, for a host to resolve with your domain .ip the nameserver you point to for .ip would have to have that host record.

overridedomain.jpg_thumb

jlepthien

@johnpoz:

I just tried putting in a domain override, and restarted unbound - and its not showing up in the unbound config.

Domain overrides

Remote Control Config

So I have the below domain set to override and use 192.168.1.4, I even stopped and restarted unbound service - just not showing up in the config??

But to your question, for a host to resolve with your domain .ip the nameserver you point to for .ip would have to have that host record.

For me it shows up in the config. And it hasn't to be the hostname, just the domain. That way it works with dnsmasq. Try just setting the domain there.

johnpoz

What modem you have? When I do a search for speedport.ip I see stuff about this modem

Speedport W 701V

Thanks just your modem resolving to itself is all, thats not what you would do to if you want unbound to resolve speedport.ip to the 192.168.2.1 address of your modem.

From the manual of that modem, its in german but translates too

Type in the address bar of Internet browsing, "speedport.ip" or "192.168.2.1"and confirm.

This just means that if using your modem (really a router) as your dns, that would resolve speedport.ip to itself. And then would work if you were forwarding dns to the router, ie 192.168.2.1 – but with unbound its doing the actual dns lookups, speedport.ip is never going to resolve in the real world.. You would have to have a dns server that thinks owner of the .ip tld and then a A record for speedport in it.

If you want to resolve speedport.ip using unbound, just add a host record for that, and then it will resolve it to whatever IP you want.

so for example. I add it in mine to speedport.ip to 192.168.2.1

As you can see from the attachments -- but even with restart its not reading that entry in?? but it has all my other entries?? Im not on the current snap - but don't want to upgrade while not there.. So will have to do when I get back.. But that is what take your problem is for this speedport.ip.

It resolves my other local hosts just fine
;; QUESTION SECTION:
;quad-w7.local.lan. IN A

;; ANSWER SECTION:
quad-w7.local.lan. 3600 IN A 192.168.1.100

;; Query time: 4 msec
;; SERVER: 192.168.1.253#53(192.168.1.253)
;; WHEN: Mon Jan 10 15:44:50 2011
;; MSG SIZE rcvd: 51

But his new one I just added for speedport.ip its not??

;; QUESTION SECTION:
;speedport.ip. IN A

;; AUTHORITY SECTION:
. 86400 IN SOA a.root-servers.net. nstld.verisi gn-grs.com. 2011011000 1800 900 604800 86400

;; Query time: 52 msec
;; SERVER: 192.168.1.253#53(192.168.1.253)
;; WHEN: Mon Jan 10 15:44:37 2011
;; MSG SIZE rcvd: 105

When I look at the status tab is not showing that new entry, even upon start and stop of unbound service.. Will update the snap when I get home and see if that fixes it, currently on
2.0-BETA5 (i386)
built on Sat Jan 8 01:01:27 EST 2011

edithost.jpg_thumb

myhosts.jpg_thumb

jlepthien

Yeah okay. But I wanted to add that whole .ip domain so I added a whole domain overwrite, not just for the host…

johnpoz

If you want that resolve whole .ip domain – then you need another nameserver that would be authoritative for the .ip tld -- and this nameserver would have to house all the records of hosts in that domain.

example

speedport.ip
hostA.ip
hostB.ip
etc..

So does your modem at 2.1 allow you to put in other hosts that would resolve to with .ip domain?

A domain override would be used if you want to have some other nameserver resolve for say yourdomain.com vs root servers point to for example. Or you have some nameserver that is authoritative for an invalid tld like .ip