Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    DNSSEC on pfSense

    Scheduled Pinned Locked Moved 2.0-RC Snapshot Feedback and Problems - RETIRED
    178 Posts 18 Posters 71.2k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • S
      serangku
      last edited by

      great job …  :)

      have tested on pf 2.0 32 bit and 64 bit
      on new package now have a bit custom on gui ...
      really appreciate ...

      1 Reply Last reply Reply Quote 0
      • M
        mromero
        last edited by

        Thanks wagonza, adrianhensler and jimp and all the other techno Gods on PFSENSE for making this work  ;D

        Have just upgraded to today's second snapshot build on i386 and it took very long to go through the process. Apparently de-installed Squid and Unbound and re-installed them but in the end everything ran through smoothly.

        I did not have to manually install any package or anything like that.

        Still get the Unbound error on the logs but Squid and Unbound are working fine and Borat is smiling.

        From the console I glimpsed something like Unbound log in already exists or something like that.

        Where I am ALL the ISPs we tested including satellite are not running DNSSEC thus I am humbled by maybe being the first  :o

        P.S. Working good also on Saturday's second snapshot on 64 bit.

        @serangku:

        great job …  :)

        have tested on pf 2.0 32 bit and 64 bit
        on new package now have a bit custom on gui ...
        really appreciate ...

        1 Reply Last reply Reply Quote 0
        • R
          ResIpsa
          last edited by

          Does Unbound have an equivalent to the host override section of DNS Forwarder?

          1 Reply Last reply Reply Quote 0
          • johnpozJ
            johnpoz LAYER 8 Global Moderator
            last edited by

            Check the private address section

            "Note: Domain Overrides and Host entries will be allowed to return answers if this option is enabled. "

            It returns local hosts for sure.

            ; <<>> DiG 9.7.2-P3 <<>> quad-w7.local.lan
            ;; global options: +cmd
            ;; Got answer:
            ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 14529
            ;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0

            ;; QUESTION SECTION:
            ;quad-w7.local.lan.            IN      A

            ;; ANSWER SECTION:
            quad-w7.local.lan.      3600    IN      A      192.168.1.100

            ;; Query time: 8 msec
            ;; SERVER: 192.168.1.253#53(192.168.1.253)
            ;; WHEN: Sun Jan 09 10:11:52 2011
            ;; MSG SIZE  rcvd: 51

            An intelligent man is sometimes forced to be drunk to spend time with his fools
            If you get confused: Listen to the Music Play
            Please don't Chat/PM me for help, unless mod related
            SG-4860 24.11 | Lab VMs 2.7.2, 24.11

            1 Reply Last reply Reply Quote 0
            • R
              ResIpsa
              last edited by

              Thank you, I saw that entry.  I don't think that I was clear enough in my question.  Where do I enter the host names and corresponding IP addresses?  Will Unbound pull them from the DNS forwarder page or do I need to re-enter them somewhere else?

              1 Reply Last reply Reply Quote 0
              • T
                ToxIcon
                last edited by

                sorry guys I seem to be having a problem loosing access to the internet when I enable Unbound it work for about 20 minutes then I loose all internet connection cannot access any webpages then I have to disable Unbound and reboot the firewall to restore internet access.

                Here is my settings

                Enable Unbound

                lan Lan1

                Enable DNSSEC

                Enable forwarding mode

                Private Address support

                Register DHCP static mappings

                Enable DNS forwarder disable

                This webpage is not available
                The webpage at http://www.google.com/search?sourceid=chrome&ie=UTF-8&q=linksys+forum might be temporarily down or it may have moved permanently to a new web address.
                Here are some suggestions:
                Reload this web page later.
                Error 105 (net::ERR_NAME_NOT_RESOLVED): The server could not be found.

                This webpage is not available
                The webpage at http://www.helpsintl.org/programs/education.php might be temporarily down or it may have moved permanently to a new web address.
                Here are some suggestions:
                Reload this web page later.
                Error 105 (net::ERR_NAME_NOT_RESOLVED): The server could not be found.

                1 Reply Last reply Reply Quote 0
                • johnpozJ
                  johnpoz LAYER 8 Global Moderator
                  last edited by

                  "Will Unbound pull them from the DNS forwarder page or do I need to re-enter them somewhere else?"

                  Yes it pulls them from the forwarder page, this is where I entered all my local host names it unbound resolves them.  Have not tried the domain over ride yet.. But hosts work just fine.

                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                  If you get confused: Listen to the Music Play
                  Please don't Chat/PM me for help, unless mod related
                  SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                  1 Reply Last reply Reply Quote 0
                  • A
                    adrianhensler
                    last edited by

                    @ToxIcon:

                    sorry guys I seem to be having a problem loosing access to the internet when I enable Unbound it work for about 20 minutes then I loose all internet connection cannot access any webpages then I have to disable Unbound and reboot the firewall to restore internet access.

                    I can confirm that unbound has crapped out for me at least twice in the past 4 days.  I haven't had time to look at it at all, but restarting it from services page fixed it for me both times.

                    Hopefully next time it happens I'll have a minute to take a look at the logs.

                    1 Reply Last reply Reply Quote 0
                    • R
                      ResIpsa
                      last edited by

                      Thank you for the help.  I'm now using DNSSEC - Borat is my friend.

                      1 Reply Last reply Reply Quote 0
                      • M
                        mromero
                        last edited by

                        So far good nuff for me for maybe a snapshot junkie upgrading almost everyday. I would hope the developers are giving this attention so as not to make for a buggy RC1  ::)

                        @adrianhensler:

                        @ToxIcon:

                        sorry guys I seem to be having a problem loosing access to the internet when I enable Unbound it work for about 20 minutes then I loose all internet connection cannot access any webpages then I have to disable Unbound and reboot the firewall to restore internet access.

                        I can confirm that unbound has crapped out for me at least twice in the past 4 days.   I haven't had time to look at it at all, but restarting it from services page fixed it for me both times.

                        Hopefully next time it happens I'll have a minute to take a look at the logs.

                        1 Reply Last reply Reply Quote 0
                        • W
                          wagonza
                          last edited by

                          @ResIpsa:

                          Thank you, I saw that entry.  I don't think that I was clear enough in my question.  Where do I enter the host names and corresponding IP addresses?  Will Unbound pull them from the DNS forwarder page or do I need to re-enter them somewhere else?

                          It pulls them from the DNS forwarder page. So configure them there and once you have completed them, restart Unbound and it will then answer for those entries.

                          Follow me on twitter http://twitter.com/wagonza
                          http://www.thepackethub.co.za

                          1 Reply Last reply Reply Quote 0
                          • W
                            wagonza
                            last edited by

                            @johnpoz:

                            "Will Unbound pull them from the DNS forwarder page or do I need to re-enter them somewhere else?"

                            Yes it pulls them from the forwarder page, this is where I entered all my local host names it unbound resolves them.  Have not tried the domain over ride yet.. But hosts work just fine.

                            Domain overrides will work as well. There was problems in the beginning with them but those have been ironed out. Please let me know if you come across any other problems.

                            Follow me on twitter http://twitter.com/wagonza
                            http://www.thepackethub.co.za

                            1 Reply Last reply Reply Quote 0
                            • W
                              wagonza
                              last edited by

                              @ToxIcon:

                              sorry guys I seem to be having a problem loosing access to the internet when I enable Unbound it work for about 20 minutes then I loose all internet connection cannot access any webpages then I have to disable Unbound and reboot the firewall to restore internet access.

                              Here is my settings

                              Enable Unbound

                              lan Lan1

                              Enable DNSSEC

                              Enable forwarding mode

                              Private Address support

                              Register DHCP static mappings

                              Enable DNS forwarder disable

                              I see you have forwarding enabled. So when this problem happens can you then query your name servers that have been defined in General. If those answer can you then query Unbound (using dig) and see what it's response is i.e. dig @pfsense_ip www.pfsense.org

                              Then let me know what it sees. Also have a log at /var/log/unbound/log (cmd is clog /var/log/unbound.log).

                              Follow me on twitter http://twitter.com/wagonza
                              http://www.thepackethub.co.za

                              1 Reply Last reply Reply Quote 0
                              • W
                                wagonza
                                last edited by

                                @adrianhensler:

                                I can confirm that unbound has crapped out for me at least twice in the past 4 days.   I haven't had time to look at it at all, but restarting it from services page fixed it for me both times.

                                Hopefully next time it happens I'll have a minute to take a look at the logs.

                                If you could do the same please - when it happens try query, using dig, and see what its answers with. Then when you do have time see if /var/log/unbound.log contains anything useful.

                                Follow me on twitter http://twitter.com/wagonza
                                http://www.thepackethub.co.za

                                1 Reply Last reply Reply Quote 0
                                • J
                                  jlepthien
                                  last edited by

                                  I tried using Unbound again and everything seems to be working fine except one small thing…
                                  I have one domain override configured but I cannot resolve the hostname. Not on the pfSense box itself and not on any LAN/WLAN interface.  Any info on how/what to test?

                                  Here is the part of the config:

                                  # Domain overrides
                                  stub-zone:
                                  	name: "ip"
                                  	stub-addr: 192.168.2.1
                                  	stub-prime: no
                                  

                                  And there should be my modem with a dns name of speedport.ip which is on vr1 (my external interface). This works with dnsmasq but not with Unbound yet…

                                  Edit: the speedport.ip entry also is missing from /etc/hosts on my pfSense box...

                                  | apple fanboy | music lover | network and security specialist | in love with cisco systems |

                                  1 Reply Last reply Reply Quote 0
                                  • johnpozJ
                                    johnpoz LAYER 8 Global Moderator
                                    last edited by

                                    I just tried putting in a domain override, and restarted unbound - and its not showing up in the unbound config.

                                    Domain overrides

                                    Remote Control Config

                                    So I have the below domain set to override and use 192.168.1.4, I even stopped and restarted unbound service - just not showing up in the config??

                                    But to your question, for a host to resolve with your domain .ip the nameserver you point to for .ip would have to have that host record.

                                    overridedomain.jpg
                                    overridedomain.jpg_thumb

                                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                                    If you get confused: Listen to the Music Play
                                    Please don't Chat/PM me for help, unless mod related
                                    SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                                    1 Reply Last reply Reply Quote 0
                                    • J
                                      jlepthien
                                      last edited by

                                      @johnpoz:

                                      I just tried putting in a domain override, and restarted unbound - and its not showing up in the unbound config.

                                      Domain overrides

                                      Remote Control Config

                                      So I have the below domain set to override and use 192.168.1.4, I even stopped and restarted unbound service - just not showing up in the config??

                                      But to your question, for a host to resolve with your domain .ip the nameserver you point to for .ip would have to have that host record.

                                      For me it shows up in the config. And it hasn't to be the hostname, just the domain. That way it works with dnsmasq. Try just setting the domain there.

                                      | apple fanboy | music lover | network and security specialist | in love with cisco systems |

                                      1 Reply Last reply Reply Quote 0
                                      • johnpozJ
                                        johnpoz LAYER 8 Global Moderator
                                        last edited by

                                        What modem you have?  When I do a search for speedport.ip I see stuff about this modem

                                        Speedport W 701V

                                        Thanks just your modem resolving to itself is all, thats not what you would do to if you want unbound to resolve speedport.ip to the 192.168.2.1 address of your modem.

                                        From the manual of that modem, its in german but translates too

                                        Type in the address bar of Internet browsing, "speedport.ip" or "192.168.2.1"and confirm.

                                        This just means that if using your modem (really a router) as your dns, that would resolve speedport.ip to itself.  And then would work if you were forwarding dns to the router, ie 192.168.2.1 – but with unbound its doing the actual dns lookups, speedport.ip is never going to resolve in the real world.. You would have to have a dns server that thinks owner of the .ip tld and then a A record for speedport in it.

                                        If you want to resolve speedport.ip using unbound, just add a host record for that, and then it will resolve it to whatever IP you want.

                                        so for example. I add it in mine to speedport.ip to 192.168.2.1

                                        As you can see from the attachments -- but even with restart its not reading that entry in??  but it has all my other entries??  Im not on the current snap - but don't want to upgrade while not there.. So will have to do when I get back.. But that is what take your problem is for this speedport.ip.

                                        It resolves my other local hosts just fine
                                        ;; QUESTION SECTION:
                                        ;quad-w7.local.lan.            IN      A

                                        ;; ANSWER SECTION:
                                        quad-w7.local.lan.      3600    IN      A      192.168.1.100

                                        ;; Query time: 4 msec
                                        ;; SERVER: 192.168.1.253#53(192.168.1.253)
                                        ;; WHEN: Mon Jan 10 15:44:50 2011
                                        ;; MSG SIZE  rcvd: 51

                                        But his new one I just added for speedport.ip its not??

                                        ;; QUESTION SECTION:
                                        ;speedport.ip.                  IN      A

                                        ;; AUTHORITY SECTION:
                                        .                      86400  IN      SOA    a.root-servers.net. nstld.verisi        gn-grs.com. 2011011000 1800 900 604800 86400

                                        ;; Query time: 52 msec
                                        ;; SERVER: 192.168.1.253#53(192.168.1.253)
                                        ;; WHEN: Mon Jan 10 15:44:37 2011
                                        ;; MSG SIZE  rcvd: 105

                                        When I look at the status tab is not showing that new entry, even upon start and stop of unbound service..  Will update the snap when I get home and see if that fixes it, currently on
                                        2.0-BETA5 (i386)
                                        built on Sat Jan 8 01:01:27 EST 2011

                                        edithost.jpg
                                        edithost.jpg_thumb
                                        myhosts.jpg
                                        myhosts.jpg_thumb

                                        An intelligent man is sometimes forced to be drunk to spend time with his fools
                                        If you get confused: Listen to the Music Play
                                        Please don't Chat/PM me for help, unless mod related
                                        SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                                        1 Reply Last reply Reply Quote 0
                                        • J
                                          jlepthien
                                          last edited by

                                          Yeah okay. But I wanted to add that whole .ip domain so I added a whole domain overwrite, not just for the host…

                                          | apple fanboy | music lover | network and security specialist | in love with cisco systems |

                                          1 Reply Last reply Reply Quote 0
                                          • johnpozJ
                                            johnpoz LAYER 8 Global Moderator
                                            last edited by

                                            If you want that resolve whole .ip domain – then you need another nameserver that would be authoritative for the .ip tld -- and this nameserver would have to house all the records of hosts in that domain.

                                            example

                                            speedport.ip
                                            hostA.ip
                                            hostB.ip
                                            etc..

                                            So does your modem at 2.1 allow you to put in other hosts that would resolve to with .ip domain?

                                            A domain override would be used if you want to have some other nameserver resolve for say yourdomain.com vs root servers point to for example.  Or you have some nameserver that is authoritative for an invalid tld like .ip

                                            An intelligent man is sometimes forced to be drunk to spend time with his fools
                                            If you get confused: Listen to the Music Play
                                            Please don't Chat/PM me for help, unless mod related
                                            SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.