DNSSEC on pfSense

wagonza

sorry guys I seem to be having a problem loosing access to the internet when I enable Unbound it work for about 20 minutes then I loose all internet connection cannot access any webpages then I have to disable Unbound and reboot the firewall to restore internet access.

Here is my settings

Enable Unbound

lan Lan1

Enable DNSSEC

Enable forwarding mode

Private Address support

Register DHCP static mappings

Enable DNS forwarder disable

I see you have forwarding enabled. So when this problem happens can you then query your name servers that have been defined in General. If those answer can you then query Unbound (using dig) and see what it's response is i.e. dig @pfsense_ip www.pfsense.org

Then let me know what it sees. Also have a log at /var/log/unbound/log (cmd is clog /var/log/unbound.log).

wagonza

@adrianhensler:

I can confirm that unbound has crapped out for me at least twice in the past 4 days. I haven't had time to look at it at all, but restarting it from services page fixed it for me both times.

Hopefully next time it happens I'll have a minute to take a look at the logs.

If you could do the same please - when it happens try query, using dig, and see what its answers with. Then when you do have time see if /var/log/unbound.log contains anything useful.

jlepthien

I tried using Unbound again and everything seems to be working fine except one small thing…
I have one domain override configured but I cannot resolve the hostname. Not on the pfSense box itself and not on any LAN/WLAN interface. Any info on how/what to test?

Here is the part of the config:

# Domain overrides
stub-zone:
	name: "ip"
	stub-addr: 192.168.2.1
	stub-prime: no

And there should be my modem with a dns name of speedport.ip which is on vr1 (my external interface). This works with dnsmasq but not with Unbound yet…

Edit: the speedport.ip entry also is missing from /etc/hosts on my pfSense box...

johnpoz

I just tried putting in a domain override, and restarted unbound - and its not showing up in the unbound config.

Domain overrides

Remote Control Config

So I have the below domain set to override and use 192.168.1.4, I even stopped and restarted unbound service - just not showing up in the config??

But to your question, for a host to resolve with your domain .ip the nameserver you point to for .ip would have to have that host record.

overridedomain.jpg_thumb

jlepthien

@johnpoz:

I just tried putting in a domain override, and restarted unbound - and its not showing up in the unbound config.

Domain overrides

Remote Control Config

So I have the below domain set to override and use 192.168.1.4, I even stopped and restarted unbound service - just not showing up in the config??

But to your question, for a host to resolve with your domain .ip the nameserver you point to for .ip would have to have that host record.

For me it shows up in the config. And it hasn't to be the hostname, just the domain. That way it works with dnsmasq. Try just setting the domain there.

johnpoz

What modem you have? When I do a search for speedport.ip I see stuff about this modem

Speedport W 701V

Thanks just your modem resolving to itself is all, thats not what you would do to if you want unbound to resolve speedport.ip to the 192.168.2.1 address of your modem.

From the manual of that modem, its in german but translates too

Type in the address bar of Internet browsing, "speedport.ip" or "192.168.2.1"and confirm.

This just means that if using your modem (really a router) as your dns, that would resolve speedport.ip to itself. And then would work if you were forwarding dns to the router, ie 192.168.2.1 – but with unbound its doing the actual dns lookups, speedport.ip is never going to resolve in the real world.. You would have to have a dns server that thinks owner of the .ip tld and then a A record for speedport in it.

If you want to resolve speedport.ip using unbound, just add a host record for that, and then it will resolve it to whatever IP you want.

so for example. I add it in mine to speedport.ip to 192.168.2.1

As you can see from the attachments -- but even with restart its not reading that entry in?? but it has all my other entries?? Im not on the current snap - but don't want to upgrade while not there.. So will have to do when I get back.. But that is what take your problem is for this speedport.ip.

It resolves my other local hosts just fine
;; QUESTION SECTION:
;quad-w7.local.lan. IN A

;; ANSWER SECTION:
quad-w7.local.lan. 3600 IN A 192.168.1.100

;; Query time: 4 msec
;; SERVER: 192.168.1.253#53(192.168.1.253)
;; WHEN: Mon Jan 10 15:44:50 2011
;; MSG SIZE rcvd: 51

But his new one I just added for speedport.ip its not??

;; QUESTION SECTION:
;speedport.ip. IN A

;; AUTHORITY SECTION:
. 86400 IN SOA a.root-servers.net. nstld.verisi gn-grs.com. 2011011000 1800 900 604800 86400

;; Query time: 52 msec
;; SERVER: 192.168.1.253#53(192.168.1.253)
;; WHEN: Mon Jan 10 15:44:37 2011
;; MSG SIZE rcvd: 105

When I look at the status tab is not showing that new entry, even upon start and stop of unbound service.. Will update the snap when I get home and see if that fixes it, currently on
2.0-BETA5 (i386)
built on Sat Jan 8 01:01:27 EST 2011

edithost.jpg_thumb

myhosts.jpg_thumb

jlepthien

Yeah okay. But I wanted to add that whole .ip domain so I added a whole domain overwrite, not just for the host…

johnpoz

If you want that resolve whole .ip domain – then you need another nameserver that would be authoritative for the .ip tld -- and this nameserver would have to house all the records of hosts in that domain.

example

speedport.ip
hostA.ip
hostB.ip
etc..

So does your modem at 2.1 allow you to put in other hosts that would resolve to with .ip domain?

A domain override would be used if you want to have some other nameserver resolve for say yourdomain.com vs root servers point to for example. Or you have some nameserver that is authoritative for an invalid tld like .ip

jlepthien

I know. The point is that it works that way with dnsmasq so why not now with Unbound?

jlepthien

Ok now I changed it the way you used it and it works…

johnpoz

Because to be honest I doubt that speedport router is actually a nameserver that would resolve speedport.ip like a normal nameserver would

Simple enough to test, using either nslookup or dig – do a query to that ip 192.168.2.1

nslookup

server 192.168.2.1
speedport.ip

does that work? I doubt it

Or with dig

dig @192.168.2.1 speedport.ip

If those work then your domain override should work, if not then no it would never work. So just having your unbound resolve speedport.ip to whatever IP you want is the way to do it.

Now currently mine does not seem to be reading in the additions I make to either hosts or domain overrides - but once it does, then I will point it to my other nameserver and verify it works like it should. But for now, if you don't mine do either the nslookup or dig test and post the results.. If that works then your right the override for .ip to go ask 192.168.2.1 should resolve speedport.ip for you.

ToxIcon

wagonza

I tried with forwarding enabled and disable and both times lost connection
internally but the pfsense still can reach the outside, I test it by updating
snort and squidguard but the systems behind pfsense cannot reach the internet.

here are the logs

$ dig zone @192.168.2.9

; <<>> DiG 9.6.2-P2 <<>> zone @192.168.2.9
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 1390
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0

;; QUESTION SECTION:
;zone. IN A

;; AUTHORITY SECTION:
. 86400 IN SOA a.root-servers.net. nstld.verisign-grs.com. 2011011000 1800 900 604800 86400

;; Query time: 81 msec
;; SERVER: 192.168.2.9#53(192.168.2.9)
;; WHEN: Mon Jan 10 21:26:00 2011
;; MSG SIZE rcvd: 97

$ dig @192.168.2.9 www.pfsense.org

; <<>> DiG 9.6.2-P2 <<>> @192.168.2.9 www.pfsense.org
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 3625
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 2, ADDITIONAL: 0

;; QUESTION SECTION:
;www.pfsense.org. IN A

;; ANSWER SECTION:
www.pfsense.org. 3600 IN CNAME pfsense.org.
pfsense.org. 3600 IN A 69.64.6.21

;; AUTHORITY SECTION:
pfsense.org. 3600 IN NS ns17.domaincontrol.com.
pfsense.org. 3600 IN NS ns18.domaincontrol.com.

;; Query time: 177 msec
;; SERVER: 192.168.2.9#53(192.168.2.9)
;; WHEN: Mon Jan 10 21:22:18 2011
;; MSG SIZE rcvd: 118

clog.txt

johnpoz

OK so I updated my snap, and now its showing my domain overrides.

Domain overrides

stub-zone:
name: "test.ip"
stub-addr: 192.168.1.4
stub-prime: no

But I agree its not working like it should.. So there is a server at 192.168.1.4 running bind with a zone for test.ip

see – if I query it directly authoritative for the host3 record I created.

; <<>> DiG 9.7.2-P3 <<>> @192.168.1.4 host3.test.ip
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 15037
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 1

;; QUESTION SECTION:
;host3.test.ip. IN A

;; ANSWER SECTION:
host3.test.ip. 21600 IN A 192.168.1.101

;; AUTHORITY SECTION:
test.ip. 21600 IN NS p4-28g.local.lan.

;; ADDITIONAL SECTION:
p4-28g.local.lan. 21600 IN A 192.168.1.4

;; Query time: 5 msec
;; SERVER: 192.168.1.4#53(192.168.1.4)
;; WHEN: Mon Jan 10 23:32:39 2011
;; MSG SIZE rcvd: 93

Now if I ask the pfsense box that has an override set to ask 192.168.1.4 for the domain test.ip it also gives me back servfail

; <<>> DiG 9.7.2-P3 <<>> @192.168.1.253 host3.test.ip
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 49426
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;host3.test.ip. IN A

;; Query time: 11 msec
;; SERVER: 192.168.1.253#53(192.168.1.253)
;; WHEN: Mon Jan 10 23:40:03 2011
;; MSG SIZE rcvd: 31

So seems domain override is not working??

Currently running
2.0-BETA5 (i386)
built on Mon Jan 10 13:14:45 EST 2011

serangku

hey … something error on unbound packages when updated to latest pf20 i386

Jan 11 14:10:09 php: /pkg_edit.php: The command '/usr/local/sbin/unbound-control start' returned exit code '1', the output was '[1294729809] unbound[8280:0] error: unknown size specifier: '-1m' /usr/local/etc/unbound/unbound.conf:17: error: buffer size expected read /usr/local/etc/unbound/unbound.conf failed: 1 errors in configuration file [1294729809] unbound[8280:0] fatal error: Could not read config file: /usr/local/etc/unbound/unbound.conf'

somethink error on pfsense or unbound it self ?
back again to dnsmasq

wagonza

@ToxIcon:

$ dig @192.168.2.9 www.pfsense.org

;; QUESTION SECTION:
;www.pfsense.org. IN A

;; ANSWER SECTION:
www.pfsense.org. 3600 IN CNAME pfsense.org.
pfsense.org. 3600 IN A 69.64.6.21

;; AUTHORITY SECTION:
pfsense.org. 3600 IN NS ns17.domaincontrol.com.
pfsense.org. 3600 IN NS ns18.domaincontrol.com.

This shows that it is answering correctly unless www.pfsense.org was cached. Trying another website not resolved yet something like www.food.com?

wagonza

@jlepthien:

Yeah okay. But I wanted to add that whole .ip domain so I added a whole domain overwrite, not just for the host…

Yeah I hear what you saying. Your modem would have to be running its own name server as @johnpoz mentioned.

wagonza

@serangku:

hey … something error on unbound packages when updated to latest pf20 i386

Jan 11 14:10:09 php: /pkg_edit.php: The command '/usr/local/sbin/unbound-control start' returned exit code '1', the output was '[1294729809] unbound[8280:0] error: unknown size specifier: '-1m' /usr/local/etc/unbound/unbound.conf:17: error: buffer size expected read /usr/local/etc/unbound/unbound.conf failed: 1 errors in configuration file [1294729809] unbound[8280:0] fatal error: Could not read config file: /usr/local/etc/unbound/unbound.conf'

somethink error on pfsense or unbound it self ?
back again to dnsmasq

What is kern.ipc.maxsockbuf set to on your pfSense box (sysctl kern.ipc.maxsockbuf)?

I have committed a fix for this but still interested to know what your kern.ipc.maxsockbuf is set to.

wagonza

@johnpoz:

OK so I updated my snap, and now its showing my domain overrides.

Domain overrides

stub-zone:
name: "test.ip"
stub-addr: 192.168.1.4
stub-prime: no

But I agree its not working like it should.. So there is a server at 192.168.1.4 running bind with a zone for test.ip

see – if I query it directly authoritative for the host3 record I created.

; <<>> DiG 9.7.2-P3 <<>> @192.168.1.4 host3.test.ip
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 15037
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 1

;; QUESTION SECTION:
;host3.test.ip. IN A

;; ANSWER SECTION:
host3.test.ip. 21600 IN A 192.168.1.101

;; AUTHORITY SECTION:
test.ip. 21600 IN NS p4-28g.local.lan.

;; ADDITIONAL SECTION:
p4-28g.local.lan. 21600 IN A 192.168.1.4

;; Query time: 5 msec
;; SERVER: 192.168.1.4#53(192.168.1.4)
;; WHEN: Mon Jan 10 23:32:39 2011
;; MSG SIZE rcvd: 93

Now if I ask the pfsense box that has an override set to ask 192.168.1.4 for the domain test.ip it also gives me back servfail

; <<>> DiG 9.7.2-P3 <<>> @192.168.1.253 host3.test.ip
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 49426
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;host3.test.ip. IN A

;; Query time: 11 msec
;; SERVER: 192.168.1.253#53(192.168.1.253)
;; WHEN: Mon Jan 10 23:40:03 2011
;; MSG SIZE rcvd: 31

So seems domain override is not working??

Currently running
2.0-BETA5 (i386)
built on Mon Jan 10 13:14:45 EST 2011

Do you have "Private Address support" disabled?

johnpoz

No it needs to be enabled for host and domain override to work.. You can see from previous posts that host override works.. ie
From the settings page
Note: Domain Overrides and Host entries will be allowed to return answers if this option is enabled.

See local overrides work just fine..

;; QUESTION SECTION:
;qs108t.local.lan. IN A

;; ANSWER SECTION:
qs108t.local.lan. 3600 IN A 192.168.1.128

;; Query time: 8 msec
;; SERVER: 192.168.1.253#53(192.168.1.253)
;; WHEN: Tue Jan 11 07:59:11 2011
;; MSG SIZE rcvd: 50

;; QUESTION SECTION:
;p4-28g.local.lan. IN A

;; ANSWER SECTION:
p4-28g.local.lan. 3600 IN A 192.168.1.4

;; Query time: 7 msec
;; SERVER: 192.168.1.253#53(192.168.1.253)
;; WHEN: Tue Jan 11 07:59:49 2011
;; MSG SIZE rcvd: 50

but now I have a domain override set, shows up in the unbound config, the server it points to at 192.168.1.4 is running bind, clearly answers for that zone test.ip, but when you ask the pfsense box running unbound you get servfail?

;; QUESTION SECTION:
;host2.test.ip. IN A

;; ANSWER SECTION:
host2.test.ip. 21600 IN A 192.168.1.100

;; AUTHORITY SECTION:
test.ip. 21600 IN NS p4-28g.local.lan.

;; ADDITIONAL SECTION:
p4-28g.local.lan. 21600 IN A 192.168.1.4

;; Query time: 5 msec
;; SERVER: 192.168.1.4#53(192.168.1.4)
;; WHEN: Tue Jan 11 08:01:39 2011
;; MSG SIZE rcvd: 93

; <<>> DiG 9.7.2-P3 <<>> @192.168.1.253 host2.test.ip
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 41300
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;host2.test.ip. IN A

;; Query time: 32 msec
;; SERVER: 192.168.1.253#53(192.168.1.253)
;; WHEN: Tue Jan 11 08:02:10 2011
;; MSG SIZE rcvd: 31

Here are the settings from unbound, and host and domain overrides, etc.

And showing that the override for the domain is listed in the unbound config.

Domain overrides

stub-zone:
name: "test.ip"
stub-addr: 192.168.1.4
stub-prime: no

Running snap
2.0-BETA5 (i386)
built on Mon Jan 10 13:14:45 EST 2011

edit: on and yes I tried turning off dnssec support, same thing servfail

Oh and just upgraded to last nights snap
2.0-BETA5 (i386)
built on Mon Jan 10 22:34:12 EST 2011

Still fails - also seems to me that if your pointing pfsense to itself only (unbound) for dns in general setup, that upon update to new snap the reinstall of packages fail..

unboundsettings.png_thumb

overrides.png_thumb

wagonza

@johnpoz:

but now I have a domain override set, shows up in the unbound config, the server it points to at 192.168.1.4 is running bind, clearly answers for that zone test.ip, but when you ask the pfsense box running unbound you get servfail?

Ok i think i might have an idea on the problem here, can you send me your unbound.conf please? You can comment out any private data.

@johnpoz:

Still fails - also seems to me that if your pointing pfsense to itself only (unbound) for dns in general setup, that upon update to new snap the reinstall of packages fail..

yeah it wouldnt because no name resolution can take place as unbound is not started yet.