DNSSEC on pfSense

johnpoz

Because to be honest I doubt that speedport router is actually a nameserver that would resolve speedport.ip like a normal nameserver would

Simple enough to test, using either nslookup or dig – do a query to that ip 192.168.2.1

nslookup

server 192.168.2.1
speedport.ip

does that work? I doubt it

Or with dig

dig @192.168.2.1 speedport.ip

If those work then your domain override should work, if not then no it would never work. So just having your unbound resolve speedport.ip to whatever IP you want is the way to do it.

Now currently mine does not seem to be reading in the additions I make to either hosts or domain overrides - but once it does, then I will point it to my other nameserver and verify it works like it should. But for now, if you don't mine do either the nslookup or dig test and post the results.. If that works then your right the override for .ip to go ask 192.168.2.1 should resolve speedport.ip for you.

ToxIcon

wagonza

I tried with forwarding enabled and disable and both times lost connection
internally but the pfsense still can reach the outside, I test it by updating
snort and squidguard but the systems behind pfsense cannot reach the internet.

here are the logs

$ dig zone @192.168.2.9

; <<>> DiG 9.6.2-P2 <<>> zone @192.168.2.9
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 1390
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0

;; QUESTION SECTION:
;zone. IN A

;; AUTHORITY SECTION:
. 86400 IN SOA a.root-servers.net. nstld.verisign-grs.com. 2011011000 1800 900 604800 86400

;; Query time: 81 msec
;; SERVER: 192.168.2.9#53(192.168.2.9)
;; WHEN: Mon Jan 10 21:26:00 2011
;; MSG SIZE rcvd: 97

$ dig @192.168.2.9 www.pfsense.org

; <<>> DiG 9.6.2-P2 <<>> @192.168.2.9 www.pfsense.org
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 3625
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 2, ADDITIONAL: 0

;; QUESTION SECTION:
;www.pfsense.org. IN A

;; ANSWER SECTION:
www.pfsense.org. 3600 IN CNAME pfsense.org.
pfsense.org. 3600 IN A 69.64.6.21

;; AUTHORITY SECTION:
pfsense.org. 3600 IN NS ns17.domaincontrol.com.
pfsense.org. 3600 IN NS ns18.domaincontrol.com.

;; Query time: 177 msec
;; SERVER: 192.168.2.9#53(192.168.2.9)
;; WHEN: Mon Jan 10 21:22:18 2011
;; MSG SIZE rcvd: 118

clog.txt

johnpoz

OK so I updated my snap, and now its showing my domain overrides.

Domain overrides

stub-zone:
name: "test.ip"
stub-addr: 192.168.1.4
stub-prime: no

But I agree its not working like it should.. So there is a server at 192.168.1.4 running bind with a zone for test.ip

see – if I query it directly authoritative for the host3 record I created.

; <<>> DiG 9.7.2-P3 <<>> @192.168.1.4 host3.test.ip
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 15037
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 1

;; QUESTION SECTION:
;host3.test.ip. IN A

;; ANSWER SECTION:
host3.test.ip. 21600 IN A 192.168.1.101

;; AUTHORITY SECTION:
test.ip. 21600 IN NS p4-28g.local.lan.

;; ADDITIONAL SECTION:
p4-28g.local.lan. 21600 IN A 192.168.1.4

;; Query time: 5 msec
;; SERVER: 192.168.1.4#53(192.168.1.4)
;; WHEN: Mon Jan 10 23:32:39 2011
;; MSG SIZE rcvd: 93

Now if I ask the pfsense box that has an override set to ask 192.168.1.4 for the domain test.ip it also gives me back servfail

; <<>> DiG 9.7.2-P3 <<>> @192.168.1.253 host3.test.ip
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 49426
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;host3.test.ip. IN A

;; Query time: 11 msec
;; SERVER: 192.168.1.253#53(192.168.1.253)
;; WHEN: Mon Jan 10 23:40:03 2011
;; MSG SIZE rcvd: 31

So seems domain override is not working??

Currently running
2.0-BETA5 (i386)
built on Mon Jan 10 13:14:45 EST 2011

serangku

hey … something error on unbound packages when updated to latest pf20 i386

Jan 11 14:10:09 php: /pkg_edit.php: The command '/usr/local/sbin/unbound-control start' returned exit code '1', the output was '[1294729809] unbound[8280:0] error: unknown size specifier: '-1m' /usr/local/etc/unbound/unbound.conf:17: error: buffer size expected read /usr/local/etc/unbound/unbound.conf failed: 1 errors in configuration file [1294729809] unbound[8280:0] fatal error: Could not read config file: /usr/local/etc/unbound/unbound.conf'

somethink error on pfsense or unbound it self ?
back again to dnsmasq

wagonza

@ToxIcon:

$ dig @192.168.2.9 www.pfsense.org

;; QUESTION SECTION:
;www.pfsense.org. IN A

;; ANSWER SECTION:
www.pfsense.org. 3600 IN CNAME pfsense.org.
pfsense.org. 3600 IN A 69.64.6.21

;; AUTHORITY SECTION:
pfsense.org. 3600 IN NS ns17.domaincontrol.com.
pfsense.org. 3600 IN NS ns18.domaincontrol.com.

This shows that it is answering correctly unless www.pfsense.org was cached. Trying another website not resolved yet something like www.food.com?

wagonza

@jlepthien:

Yeah okay. But I wanted to add that whole .ip domain so I added a whole domain overwrite, not just for the host…

Yeah I hear what you saying. Your modem would have to be running its own name server as @johnpoz mentioned.

wagonza

@serangku:

hey … something error on unbound packages when updated to latest pf20 i386

Jan 11 14:10:09 php: /pkg_edit.php: The command '/usr/local/sbin/unbound-control start' returned exit code '1', the output was '[1294729809] unbound[8280:0] error: unknown size specifier: '-1m' /usr/local/etc/unbound/unbound.conf:17: error: buffer size expected read /usr/local/etc/unbound/unbound.conf failed: 1 errors in configuration file [1294729809] unbound[8280:0] fatal error: Could not read config file: /usr/local/etc/unbound/unbound.conf'

somethink error on pfsense or unbound it self ?
back again to dnsmasq

What is kern.ipc.maxsockbuf set to on your pfSense box (sysctl kern.ipc.maxsockbuf)?

I have committed a fix for this but still interested to know what your kern.ipc.maxsockbuf is set to.

wagonza

@johnpoz:

OK so I updated my snap, and now its showing my domain overrides.

Domain overrides

stub-zone:
name: "test.ip"
stub-addr: 192.168.1.4
stub-prime: no

But I agree its not working like it should.. So there is a server at 192.168.1.4 running bind with a zone for test.ip

see – if I query it directly authoritative for the host3 record I created.

; <<>> DiG 9.7.2-P3 <<>> @192.168.1.4 host3.test.ip
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 15037
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 1

;; QUESTION SECTION:
;host3.test.ip. IN A

;; ANSWER SECTION:
host3.test.ip. 21600 IN A 192.168.1.101

;; AUTHORITY SECTION:
test.ip. 21600 IN NS p4-28g.local.lan.

;; ADDITIONAL SECTION:
p4-28g.local.lan. 21600 IN A 192.168.1.4

;; Query time: 5 msec
;; SERVER: 192.168.1.4#53(192.168.1.4)
;; WHEN: Mon Jan 10 23:32:39 2011
;; MSG SIZE rcvd: 93

Now if I ask the pfsense box that has an override set to ask 192.168.1.4 for the domain test.ip it also gives me back servfail

; <<>> DiG 9.7.2-P3 <<>> @192.168.1.253 host3.test.ip
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 49426
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;host3.test.ip. IN A

;; Query time: 11 msec
;; SERVER: 192.168.1.253#53(192.168.1.253)
;; WHEN: Mon Jan 10 23:40:03 2011
;; MSG SIZE rcvd: 31

So seems domain override is not working??

Currently running
2.0-BETA5 (i386)
built on Mon Jan 10 13:14:45 EST 2011

Do you have "Private Address support" disabled?

johnpoz

No it needs to be enabled for host and domain override to work.. You can see from previous posts that host override works.. ie
From the settings page
Note: Domain Overrides and Host entries will be allowed to return answers if this option is enabled.

See local overrides work just fine..

;; QUESTION SECTION:
;qs108t.local.lan. IN A

;; ANSWER SECTION:
qs108t.local.lan. 3600 IN A 192.168.1.128

;; Query time: 8 msec
;; SERVER: 192.168.1.253#53(192.168.1.253)
;; WHEN: Tue Jan 11 07:59:11 2011
;; MSG SIZE rcvd: 50

;; QUESTION SECTION:
;p4-28g.local.lan. IN A

;; ANSWER SECTION:
p4-28g.local.lan. 3600 IN A 192.168.1.4

;; Query time: 7 msec
;; SERVER: 192.168.1.253#53(192.168.1.253)
;; WHEN: Tue Jan 11 07:59:49 2011
;; MSG SIZE rcvd: 50

but now I have a domain override set, shows up in the unbound config, the server it points to at 192.168.1.4 is running bind, clearly answers for that zone test.ip, but when you ask the pfsense box running unbound you get servfail?

;; QUESTION SECTION:
;host2.test.ip. IN A

;; ANSWER SECTION:
host2.test.ip. 21600 IN A 192.168.1.100

;; AUTHORITY SECTION:
test.ip. 21600 IN NS p4-28g.local.lan.

;; ADDITIONAL SECTION:
p4-28g.local.lan. 21600 IN A 192.168.1.4

;; Query time: 5 msec
;; SERVER: 192.168.1.4#53(192.168.1.4)
;; WHEN: Tue Jan 11 08:01:39 2011
;; MSG SIZE rcvd: 93

; <<>> DiG 9.7.2-P3 <<>> @192.168.1.253 host2.test.ip
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 41300
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;host2.test.ip. IN A

;; Query time: 32 msec
;; SERVER: 192.168.1.253#53(192.168.1.253)
;; WHEN: Tue Jan 11 08:02:10 2011
;; MSG SIZE rcvd: 31

Here are the settings from unbound, and host and domain overrides, etc.

And showing that the override for the domain is listed in the unbound config.

Domain overrides

stub-zone:
name: "test.ip"
stub-addr: 192.168.1.4
stub-prime: no

Running snap
2.0-BETA5 (i386)
built on Mon Jan 10 13:14:45 EST 2011

edit: on and yes I tried turning off dnssec support, same thing servfail

Oh and just upgraded to last nights snap
2.0-BETA5 (i386)
built on Mon Jan 10 22:34:12 EST 2011

Still fails - also seems to me that if your pointing pfsense to itself only (unbound) for dns in general setup, that upon update to new snap the reinstall of packages fail..

unboundsettings.png_thumb

overrides.png_thumb

wagonza

@johnpoz:

but now I have a domain override set, shows up in the unbound config, the server it points to at 192.168.1.4 is running bind, clearly answers for that zone test.ip, but when you ask the pfsense box running unbound you get servfail?

Ok i think i might have an idea on the problem here, can you send me your unbound.conf please? You can comment out any private data.

@johnpoz:

Still fails - also seems to me that if your pointing pfsense to itself only (unbound) for dns in general setup, that upon update to new snap the reinstall of packages fail..

yeah it wouldnt because no name resolution can take place as unbound is not started yet.

serangku

@wagonza …

from System: Advanced: Miscellaneous: System Tunables :
kern.ipc.maxsockbuf Maximum socket buffer size default (4262144)

i hope unbound back again on my site

wagonza

@serangku:

from System: Advanced: Miscellaneous: System Tunables :
kern.ipc.maxsockbuf Maximum socket buffer size default (4262144)

i hope unbound back again on my site

hmm…odd Unbound picked up a lower amount than that. Could have been an old snap that you were on which had a lower kern.ipc.maxsockbuf. Anyway it should be working for you since I did add some additional checks which will protect against what you experienced.
I have also just committed ACL support so if you reinstall you will see an additional page to allow other networks to query Unbound.
If you do use it just remember to add the necessary firewall rules.

Let me know if you pick up any problems please.

serangku

@wagonza …

here my pfsense date

2.0-BETA5 (i386)
built on Mon Jan 10 13:14:45 EST 2011

i use unbound for simple replace of dnsmasq without any feature, not yet …
i have reinstall unbound package
here my syslog :

Jan 13 08:56:28 login: login on ttyv0 as root
Jan 13 08:56:51 php: : The command '/usr/local/sbin/unbound-control start' returned exit code '1', the output was '[1294883811] unbound[29089:0] error: bind: address already in use [1294883811] unbound[29089:0] fatal error: could not open ports'
Jan 13 08:57:30 sshd[28148]: Accepted keyboard-interactive/pam for root from 192.168.110.188 port 39425 ssh2
Jan 13 08:57:30 sshd[28148]: subsystem request for sftp
Jan 13 09:03:21 check_reload_status: syncing firewall

then manually save on gui unbound

Jan 13 09:03:22 unbound: [26869:0] info: service stopped (unbound 1.4.7).
Jan 13 09:03:22 unbound: [26869:0] info: server stats for thread 0: 53 queries, 4 answers from cache, 49 recursions, 1 prefetch
Jan 13 09:03:22 unbound: [26869:0] info: server stats for thread 0: requestlist max 5 avg 1.34 exceeded 0
Jan 13 09:03:22 unbound: [26869:0] info: average recursion processing time 1.122806 sec
Jan 13 09:03:22 unbound: [26869:0] info: histogram of recursion processing times
Jan 13 09:03:22 unbound: [26869:0] info: [25%]=0.118928 median[50%]=0.104167 [75%]=0.614583
Jan 13 09:03:22 unbound: [26869:0] info: lower(secs) upper(secs) recursions
Jan 13 09:03:22 unbound: [26869:0] info: 0.131072 0.262144 4
Jan 13 09:03:22 unbound: [26869:0] info: 0.262144 0.524288 5
Jan 13 09:03:22 unbound: [26869:0] info: 0.524288 1.000000 13
Jan 13 09:03:22 unbound: [26869:0] info: 1.000000 2.000000 24
Jan 13 09:03:22 unbound: [26869:0] info: 2.000000 4.000000 2
Jan 13 09:03:22 unbound: [26869:0] info: 4.000000 8.000000 1
Jan 13 09:03:22 unbound: [26869:0] info: server stats for thread 1: 4 queries, 0 answers from cache, 4 recursions, 0 prefetch
Jan 13 09:03:22 unbound: [26869:0] info: server stats for thread 1: requestlist max 4 avg 1 exceeded 0
Jan 13 09:03:22 unbound: [26869:0] info: average recursion processing time 1.503178 sec
Jan 13 09:03:22 unbound: [26869:0] info: histogram of recursion processing times
Jan 13 09:03:22 unbound: [26869:0] info: [25%]=0.475712 median[50%]=0.5 [75%]=1
Jan 13 09:03:22 unbound: [26869:0] info: lower(secs) upper(secs) recursions
Jan 13 09:03:22 unbound: [26869:0] info: 0.524288 1.000000 1
Jan 13 09:03:22 unbound: [26869:0] info: 1.000000 2.000000 2
Jan 13 09:03:22 unbound: [26869:0] info: 2.000000 4.000000 1
Jan 13 09:03:22 unbound: [4452:0] notice: init module 0: validator
Jan 13 09:03:22 unbound: [4452:0] notice: init module 0: validator
Jan 13 09:03:22 unbound: [4452:0] notice: init module 1: iterator
Jan 13 09:03:22 unbound: [4452:0] notice: init module 1: iterator
Jan 13 09:03:22 unbound: [4452:0] info: start of service (unbound 1.4.7).

and from dmesg

Syncing packages:
Unbound

Warning: Invalid argument supplied for foreach() in /usr/local/pkg/unbound.inc on line 258

Syncing packages:
done.
Executing rc.d items…
Starting /usr/local/etc/rc.d/proxy_monitor.sh...
done.
Starting /usr/local/etc/rc.d/squid.sh...
done.
Starting /usr/local/etc/rc.d/unbound.sh...
done.
Bootup complete

i think that warning because on acl there's im not use any acl, am i right ?

so far running well with that syslog
and back gain to use unbound
really appreciate

ToxIcon

@wagonza I am having the strangest issue

with Unbound enable

dhcp clients can't browse any webpages

but clients with Static IP can

jlepthien

@ToxIcon:

@wagonza I am having the strangest issue

with Unbound enable

dhcp clients can't browse any webpages

but clients with Static IP can

Have you set the pfSense box as a DNS server on your dhcp tab? Otherwise you will get your DNS Servers from General Setup to your clients via dhcp and there might be a rule blocking DNS outgoing traffic. I can't see more in my crystal circle here, you need to give us more info on what your setup is like…

wagonza

@serangku:

Syncing packages:
Unbound

Warning: Invalid argument supplied for foreach() in /usr/local/pkg/unbound.inc on line 258

Syncing packages:
done.

i think that warning because on acl there's im not use any acl, am i right ?

Ahhh long standing bug fixed. Thx for that!

Still investigating that darn unbound start error of yours…

_igor_

Today after updating pfsense i got the same error stating "Adress already in use". Ticking "save" at the unbound-page solved the problem. I didn't have this now long time. Only at the beginning of deployment of the unbound-package, say last year.

clarknova

Looks like Borat is no longer with us :(
http://www.downforeveryoneorjustme.com/dnssec-or-not.org

Here's another site, although a lot less satisfying to use, and not just because there's no Borat. A lookup failure is really a lame way to confirm that DNSSEC is working, considering many other factors could cause this, leading to an illusion of security. Bravo, Comcast. Anybody know of a better test site? Google results look sparse.

http://www.dnssec-failed.org

ToxIcon

Have you set the pfSense box as a DNS server on your dhcp tab? Otherwise you will get your DNS Servers from General Setup to your clients via dhcp and there might be a rule blocking DNS outgoing traffic. I can't see more in my crystal circle here, you need to give us more info on what your setup is like…

Thanks jlepthien :)

jlepthien

@ToxIcon:

Thanks jlepthien :)

So that was the problem? You could have easily found out by looking at the logs ;-)