Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Bind package for pfsense 2.1

    Scheduled Pinned Locked Moved pfSense Packages
    153 Posts 44 Posters 66.8k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • A
      aarcane
      last edited by

      Other feature I noticed:  adding a new static DHCP lease does not automatically update in bind.  It doesn't automatically update when restarting bind.  It doesn't update until you edit the relevant zone file and click Save, then restart bind.

      With regard to my other bug post:
      I'd like to recommend that zone files be configured to be bare, then the data for the zone be loaded dynamically for editing and modified dynamically when editing/clicking apply.  The utility nsupdate from the bind utility can be configured for this functionality.

      1 Reply Last reply Reply Quote 0
      • L
        lucky
        last edited by

        I installed the bind package today to set a couple of slave zones up. I added the zones, but they don't seem to get put into the config - they never transfer. The masters have transfer allowed. I did a quick packet capture and saw no traffic to the master on port 53. The bind config file in pfSense doesn't seem to have anything related to my zones in it…

        Any ideas?

        1 Reply Last reply Reply Quote 0
        • marcellocM
          marcelloc
          last edited by

          @lucky:

          Any ideas?

          Did you created firewall rules to allow dns traffic between slave and master?

          Treinamentos de Elite: http://sys-squad.com

          Help a community developer! ;D

          1 Reply Last reply Reply Quote 0
          • L
            lucky
            last edited by

            @marcelloc:

            @lucky:

            Any ideas?

            Did you created firewall rules to allow dns traffic between slave and master?

            Thanks, sure did.

            I was just looking at the named.conf on the firewall, and there are no configuration directives for the slave zone. Seems like the package is not properly creating the named.conf file.

            1 Reply Last reply Reply Quote 0
            • marcellocM
              marcelloc
              last edited by

              @lucky:

              Seems like the package is not properly creating the named.conf file.

              On what dir are you looking for config files?

              Treinamentos de Elite: http://sys-squad.com

              Help a community developer! ;D

              1 Reply Last reply Reply Quote 0
              • L
                lucky
                last edited by

                @marcelloc:

                @lucky:

                Seems like the package is not properly creating the named.conf file.

                On what dir are you looking for config files?

                /cf/named/etc/namedb

                A screen shot of the zones tab under BIND config is attached. This is the resulting config file (named.conf):

                #Bind pfsense configuration
                #Do not edit this file!!!
                
                 key "rndc-key" {
                        algorithm hmac-md5;
                        secret "**removed**";
                 };
                
                 controls {
                        inet 127.0.0.1 port 953
                                allow { 127.0.0.1; } keys { "rndc-key"; };
                 };
                
                options {
                        directory "/etc/namedb";
                        pid-file "/var/run/named/pid";
                        statistics-file "/var/log/named.stats";
                        max-cache-size 256M;
                                        listen-on-v6 { none; };
                                listen-on { *public ip address*;  };
                
                        };
                
                                logging { category default { null; }; };
                
                

                pfsense_bind_zones.png
                pfsense_bind_zones.png_thumb

                1 Reply Last reply Reply Quote 0
                • B
                  bryan.paradis
                  last edited by

                  @johnpoz:

                  I don't think this quite ready for prime time?

                  Oct 14 23:33:49 named[69425]: starting BIND 9.9.4 -c /etc/namedb/named.conf -u bind -t /conf/named/
                  Oct 14 23:33:49 named[69425]: loading configuration from '/etc/namedb/named.conf'

                  The command that it is starting with

                  named -c /etc/namedb/named.conf -u bind -t /conf/named/
                  

                  Option -c for specifying the configuration file

                  -c /etc/namedb/named.conf/
                  

                  @named(8):

                  -c config-file
                    Use config-file as the configuration file instead of the default,
                    /etc/namedb/named.conf. To ensure that reloading the configuration
                    file continues to work after the server has changed its working
                    directory due to to a possible directory option in the
                    configuration file, config-file should be an absolute pathname.

                  Option -u for setting user

                  -u bind
                  

                  @named(8):

                  -u user
                    Setuid to user after completing privileged operations, such as
                    creating sockets that listen on privileged ports.
                    Note: On Linux, named uses the kernel's capability mechanism
                    to drop all root privileges except the ability to bind(2) to
                    a privileged port and set process resource limits.
                    Unfortunately, this means that the -u option only works when
                    named is run on kernel 2.2.18 or later, or kernel
                    2.3.99-pre3 or later, since previous kernels did not allow
                    privileges to be retained after setuid(2).

                  Option -t for chrooting/jailing named to the folder

                  -t /conf/named/
                  

                  @named(8):

                  -t directory
                    Chroot to directory after processing the command line arguments,
                    but before reading the configuration file.
                    Warning: This option should be used in conjunction with the
                    -u option, as chrooting a process running as root doesn't
                    enhance security on most systems; the way chroot(2) is
                    defined allows a process with root privileges to escape a
                    chroot jail.

                  So you can see that by jailing it with a chroot using -t the path for -c is actually going to be the -t path + -c path or:

                  /cf/conf/named/etc/namedb/named.conf
                  

                  named8 BIND9 man

                  Had a look through the whole thread. Thought maybe this post would be helpful for anyone else.

                  1 Reply Last reply Reply Quote 0
                  • L
                    lucky
                    last edited by

                    @bryan.paradis:

                    So you can see that by jailing it with a chroot using -t the path for -c is actually going to be the -t path + -c path or:

                    /cf/conf/named/etc/namedb/named.conf
                    

                    Had a look through the whole thread. Thought maybe this post would be helpful for anyone else.

                    This is the bind process that I currently see running on my firewall:

                    bind   55193  0.0  0.7 22108 14140  ??  INs  22Jan14   0:00.48 /usr/pbi/bind-i386/sbin/named -c /etc/namedb/named.conf -u bind -t /cf/named/
                    

                    In this case, -t path + -c path = /cf/named/etc/namedb/named.conf, which is where the named config file actually is as part of this package. So that doesn't seem to be a problem.

                    My problem is that I configured a secondary zone, but that configuration does not appear in the config file.

                    1 Reply Last reply Reply Quote 0
                    • B
                      bryan.paradis
                      last edited by

                      @lucky:

                      This is the bind process that I currently see running on my firewall:

                      Quote wasn't directed at your problem but another uses post that prompted me to write up a breakdown of the command and the reason it looks the way it is.

                      @lucky:

                      My problem is that I configured a secondary zone, but that configuration does not appear in the config file.

                      In pfsense packages store pretty much most of the configuration in /cf/conf/config.xml. They store it under <installedpackages><packagename><packagestuff></packagestuff></packagename></installedpackages>In this case the daemon is started with named but the package is called bind and its configuration is in this xml file. Example below:

                       <bindacls><config><name>any</name></config></bindacls> 
                      		 <tab><text>Settings</text>
                      			<url>/pkg_edit.php?xml=bind.xml</url>
                      			 <active></active></tab> 
                      		 <bind><config><temp01><enable_bind>on</enable_bind>
                      				 <listenon><bind_notify><bind_hide_version><bind_ram_limit>256M</bind_ram_limit>
                      				<bind_logging>on</bind_logging>
                      				<log_severity>info</log_severity>
                      				 <log_options><rate_enabled><log_only>no</log_only>
                      				 <rate_limit><bind_forwarder><bind_forwarder_ips></bind_forwarder_ips></bind_forwarder></rate_limit></rate_enabled></log_options></bind_hide_version></bind_notify></listenon></temp01></config></bind> 
                      

                      Or more specifically for zones

                       <bindzone><config><temp01><disabled><name>testzone</name>
                      
                      				<type>master</type>
                      				 <view><reverso><custom><temp04><dnssec><backupkeys><dsset><slaveip><forwarders><temp03><tll><nameserver>192.168.55.1</nameserver>
                      				 <ipns><mail><serial>2391066341</serial>
                      				<refresh>1d</refresh>
                      				<retry>2h</retry>
                      				<expire>4w</expire>
                      				<minimum>1h</minimum>
                      				 <allowupdate><allowquery><allowtransfer><temp02><row><hostname>www</hostname>
                      					<hosttype>A</hosttype>
                      					 <hostvalue><hostdst>192.168.55.200</hostdst></hostvalue></row> 
                      				 <regdhcpstatic></regdhcpstatic></temp02></allowtransfer></allowquery></allowupdate></mail></ipns></tll></temp03></forwarders></slaveip></dsset></backupkeys></dnssec></temp04></custom></reverso></view></disabled></temp01></config></bindzone> 
                      
                      1 Reply Last reply Reply Quote 0
                      • L
                        lucky
                        last edited by

                        Ahhh…ok, thanks.

                        So under <installedpackages>, there are some bind configuration entries:

                                        <bindacls><config><name>any</name></config></bindacls> 
                        
                                        <bindzone><config><temp01><disabled><name>*****.com</name>
                                                        <description><type>slave</type>
                                                        <view><reverso><custom><temp04><dnssec><backupkeys><dsset><slaveip>71.*****</slaveip>
                                                        <forwarders><temp03><tll><nameserver><ipns><mail><serial><refresh><retry><expire><minimum><allowupdate><allowquery><allowtransfer><temp02><row><hostname><hosttype>A</hosttype>
                                                                <hostvalue><hostdst></hostdst></hostvalue></hostname></row> 
                                                        <regdhcpstatic></regdhcpstatic></temp02></allowtransfer></allowquery></allowupdate></minimum></expire></retry></refresh></serial></mail></ipns></nameserver></tll></temp03></forwarders></dsset></backupkeys></dnssec></temp04></custom></reverso></view></description></disabled></temp01></config></bindzone> 
                        

                        (***** are done by me just for this post)

                                        <bind><config><temp01><enable_bind>on</enable_bind>
                                                        <listenon>wan</listenon>
                                                        <bind_notify><bind_hide_version><bind_ram_limit>256M</bind_ram_limit>
                                                        <bind_logging><log_severity>critical</log_severity>
                                                        <log_options><rate_enabled><log_only>no</log_only>
                                                        <rate_limit><bind_forwarder><bind_forwarder_ips></bind_forwarder_ips></bind_forwarder></rate_limit></rate_enabled></log_options></bind_logging></bind_hide_version></bind_notify></temp01></config></bind> 
                        

                        So the slave zone information is in the pfsense config…but doesn't seem to make it's way into the bind config.</installedpackages>

                        1 Reply Last reply Reply Quote 0
                        • L
                          lucky
                          last edited by

                          I think I found the problem. Looking through the code that generates the bind config from the pfsense config, I noticed the only place it writes out the zone config is under code that processes Views. I did not create a view. As soon as I created one and assigned the zone to it, the bind config was created correctly - and it's working (zone was transferred). I did have to fix one more thing - the server was not resolving and I noticed there was no rule to allow dns traffic on the interface I selected bind to listen on.

                          So to sum it up - with this package, there were two gotchas that I had to deal with:

                          1. You must create a View to associate with your zones
                          2. You need to manually add firewall rules to allow port 53 (DNS) traffic
                          1 Reply Last reply Reply Quote 0
                          • A
                            Andy_
                            last edited by

                            There's a major problem with the package:

                            The zone file management is incompatible with dynamic updates.
                            I did a record update with nsupdate, and bind continued to work as expected until I made a zone change via the pfsense gui. After that, the zone wouldn'd load any more because "journal rollforward failed: journal out of sync with zone".
                            After deleting the .DB.jnl file, the zone would load again, but for obvious reasons the dynamic change was gone.

                            This renders the package unusable with any dynamic update stuff like Active Directory, Samba4 etc.

                            1 Reply Last reply Reply Quote 0
                            • B
                              bryan.paradis
                              last edited by

                              @Andy_:

                              There's a major problem with the package:

                              The zone file management is incompatible with dynamic updates.
                              I did a record update with nsupdate, and bind continued to work as expected until I made a zone change via the pfsense gui. After that, the zone wouldn'd load any more because "journal rollforward failed: journal out of sync with zone".
                              After deleting the .DB.jnl file, the zone would load again, but for obvious reasons the dynamic change was gone.

                              This renders the package unusable with any dynamic update stuff like Active Directory, Samba4 etc.

                              http://www.thedumbterminal.co.uk/?action=showArticle&articleId=168

                              How to fix BIND's journal out of sync error

                              Last updated: 16/02/2013 18:38:42

                              If you are running a BIND name server with an dynamic zone updating from from DHCP or similar, you'll find that if the zone is manually updated the zone will no longer load correctly, giving the following error:

                              zone example.com/IN: journal rollforward failed: journal out of sync with zone
                              zone example.com/IN: not loaded due to errors.
                              The error can be clearing seen by running BIND from command line as follows:

                              named -g
                              To resolve this stop BIND, then remove the journal file for problem zone, these exist in the same directory as the zone files but end in ".jnl". Once the file has been deleted BIND can be restarted and all will be back to normal.

                              If you have dynamic zones it is best to "freeze" them first before editing and "thaw" them after to avoid this problem in the first place. The commands for this are:

                              rndc freeze example.com
                              (edit example.com zonefile)
                              rndc reload example.com
                              rndc thaw sxample.com

                              Sure looks like code takes XML -> into zone configuration. For dynamic updates it has to be able to bring in the data from the current file or store the updates into the xml as well. BIND rolls the journal file into the db every 15m or something.

                              Does indeed seem incompatible with keeping dynamic updates over zone config updates. You could easily check for journal files and delete on a zone update for a zone that has allow updating turned on though. This would be an easy addition.

                              1 Reply Last reply Reply Quote 0
                              • P
                                peffyes
                                last edited by

                                @marcelloc - This is a VERY MUCH appreciated package - nicely done. Exactly what I needed. I was about to install bind via cmd line when I realized this was available. Check your email!

                                @cl:

                                […]

                                1. No matter what I set the serial to, it defaults to a timestamp.
                                2. It is a little annoying that after adding a record when editing a zone, the web page scrolls all the way up to top (Firefox 25.0.1). After creating a zone, records are the most edited part so perhaps they should be placed at the top.
                                3. There are some minor misspellings (Loggin serverity).
                                  […]

                                Regarding the serial number - I don't much care for the timestamp - have always used a date format. If the serial field is filled out on the zone form, would be nice if that was actually used instead of a timestamp. I don't mind editing that by hand - have done so for years in the shell… Perhaps a tick box to switch between manual entering and automatic timestamp.

                                The web page scrolling is inconvenient, but having the custom zone domain record box makes it a non-issue as far as I'm concerned. It's even easier to add multiple records that way.

                                1 Reply Last reply Reply Quote 0
                                • A
                                  Andy_
                                  last edited by

                                  After I outruled the package as primary DNS, I installed and configured the bind 9.9.4 package V0.3.2 for secondary zones only, and it seemed to work. But at the same time I did some major reconfiguration on ipv6/dnsforwarder/etc and found several times that my config was screwed up again and again, with values popping up that I had changed an hour ago.

                                  Last night I finally had successfully configured everything as it needed to be, time for a backup which dates 2:24 AM, then have a little nap.

                                  Now I added a gateway, and found all my interface/vif/rule settings screwed up again! Looking at the diagnostics/Backup Configuration History, I find three changes logged between 02:53:14 and 02:53:36, when my head already rested on a pillow. The message says "save result config file for zone on xml" which obviously origins from the bind package. The diff shows just the unwanted values I corrected earlier.
                                  Apparently the bind package uses some kind of outdated cache, which makes me ultimately unhappy. I'll have to remove the package and maintain bind the usual way.

                                  1 Reply Last reply Reply Quote 0
                                  • marcellocM
                                    marcelloc
                                    last edited by

                                    How did you configured sync on both machines?

                                    I have two bind configured as master/slave and my settings are not changing after config save.

                                    Treinamentos de Elite: http://sys-squad.com

                                    Help a community developer! ;D

                                    1 Reply Last reply Reply Quote 0
                                    • M
                                      ms-kassel
                                      last edited by

                                      Hello everybody,

                                      having some problems with the bind package on pfSense 2.1. It listen on WAN Interface. Bind should resolve my domain and several subdomains for privat use only. Can´t define multible view on external zone, this is my first problem. The next problem is, that my secound dns server (slave) cant transfer the internal zone lan, dmz and quarantine. Only the zone transfer of mydomain.de doing well. Think my ACL are right. Anyone who could help?

                                      Greetings Markus

                                      1 Reply Last reply Reply Quote 0
                                      • marcellocM
                                        marcelloc
                                        last edited by

                                        Can you check if resulting bind conf file are fine?

                                        Treinamentos de Elite: http://sys-squad.com

                                        Help a community developer! ;D

                                        1 Reply Last reply Reply Quote 0
                                        • J
                                          jen
                                          last edited by

                                          Hello,

                                          I am running a 2.1-RELEASE (i386)  on a KVM host. Using the VirtIO drivers.
                                          Installed the Bind package and am trying to configure a master DNS.

                                          After finishing the configurations and restarting the server I see the following errors in the log:

                                          Apr 2 08:12:09 named[56696]: network: info: additionally listening on IPv4 interface vtnet1, 172.16.2.1#53
                                          Apr 2 08:12:09 named[56696]: network: error: could not listen on UDP socket: permission denied
                                          Apr 2 08:12:09 named[56696]: network: error: creating IPv4 interface vtnet1 failed; interface ignored
                                          Apr 2 08:12:09 named[56696]: network: info: additionally listening on IPv4 interface lo0, 127.0.0.1#53
                                          Apr 2 08:12:09 named[56696]: network: error: could not listen on UDP socket: permission denied
                                          Apr 2 08:12:09 named[56696]: network: error: creating IPv4 interface lo0 failed; interface ignored
                                          Apr 2 08:12:09 named[56696]: general: info: managed-keys-zone/Local: loaded serial 0
                                          Apr 2 08:12:09 named[56696]: general: info: zone domain.com/IN/Local: loaded serial 2396415189
                                          Apr 2 08:12:09 named[56696]: general: notice: all zones loaded
                                          Apr 2 08:12:09 named[56696]: general: notice: running

                                          When running netstat -na | grep 53

                                          tcp6      0      0 ::1.53                .                    LISTEN
                                          tcp4      0      0 172.16.2.1.53          .                    LISTEN
                                          tcp4      0      0 127.0.0.1.53          .                    LISTEN
                                          udp6      0      0 ::1.53                .                   
                                          udp4      0      0 172.16.2.1.53          .                   
                                          udp4      0      0 127.0.0.1.53          .

                                          I am not able to resolve any host on this server, in fact, my hosts are not able to connect to it:

                                          nslookup ns1.domain.com 172.16.2.1
                                          ;; connection timed out; trying next origin

                                          On the other hand :

                                          nmap -p 53 172.16.2.1

                                          Starting Nmap 5.51 ( http://nmap.org ) at 2014-04-02 08:33 IDT
                                          Nmap scan report for 172.16.2.1
                                          Host is up (0.00032s latency).
                                          PORT  STATE SERVICE
                                          53/tcp open  domain

                                          Any idea what is going on here?

                                          Thanks

                                          EDIT: After restarting the instance all seems to work.  I guess this issue is resolved.

                                          1 Reply Last reply Reply Quote 0
                                          • marcellocM
                                            marcelloc
                                            last edited by

                                            Did you disabled DNS forwarder before starting bind?

                                            Treinamentos de Elite: http://sys-squad.com

                                            Help a community developer! ;D

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.