Bind package for pfsense 2.1

bryan.paradis

This is the bind process that I currently see running on my firewall:

Quote wasn't directed at your problem but another uses post that prompted me to write up a breakdown of the command and the reason it looks the way it is.

@lucky:

My problem is that I configured a secondary zone, but that configuration does not appear in the config file.

In pfsense packages store pretty much most of the configuration in /cf/conf/config.xml. They store it under <installedpackages><packagename><packagestuff></packagestuff></packagename></installedpackages>In this case the daemon is started with named but the package is called bind and its configuration is in this xml file. Example below:

 <bindacls><config><name>any</name></config></bindacls> 
		 <tab><text>Settings</text>
			<url>/pkg_edit.php?xml=bind.xml</url>
			 <active></active></tab> 
		 <bind><config><temp01><enable_bind>on</enable_bind>
				 <listenon><bind_notify><bind_hide_version><bind_ram_limit>256M</bind_ram_limit>
				<bind_logging>on</bind_logging>
				<log_severity>info</log_severity>
				 <log_options><rate_enabled><log_only>no</log_only>
				 <rate_limit><bind_forwarder><bind_forwarder_ips></bind_forwarder_ips></bind_forwarder></rate_limit></rate_enabled></log_options></bind_hide_version></bind_notify></listenon></temp01></config></bind>

Or more specifically for zones

 <bindzone><config><temp01><disabled><name>testzone</name>

				<type>master</type>
				 <view><reverso><custom><temp04><dnssec><backupkeys><dsset><slaveip><forwarders><temp03><tll><nameserver>192.168.55.1</nameserver>
				 <ipns><mail><serial>2391066341</serial>
				<refresh>1d</refresh>
				<retry>2h</retry>
				<expire>4w</expire>
				<minimum>1h</minimum>
				 <allowupdate><allowquery><allowtransfer><temp02><row><hostname>www</hostname>
					<hosttype>A</hosttype>
					 <hostvalue><hostdst>192.168.55.200</hostdst></hostvalue></row> 
				 <regdhcpstatic></regdhcpstatic></temp02></allowtransfer></allowquery></allowupdate></mail></ipns></tll></temp03></forwarders></slaveip></dsset></backupkeys></dnssec></temp04></custom></reverso></view></disabled></temp01></config></bindzone>

lucky

Ahhh…ok, thanks.

So under <installedpackages>, there are some bind configuration entries:

                <bindacls><config><name>any</name></config></bindacls>

                <bindzone><config><temp01><disabled><name>*****.com</name>
                                <description><type>slave</type>
                                <view><reverso><custom><temp04><dnssec><backupkeys><dsset><slaveip>71.*****</slaveip>
                                <forwarders><temp03><tll><nameserver><ipns><mail><serial><refresh><retry><expire><minimum><allowupdate><allowquery><allowtransfer><temp02><row><hostname><hosttype>A</hosttype>
                                        <hostvalue><hostdst></hostdst></hostvalue></hostname></row> 
                                <regdhcpstatic></regdhcpstatic></temp02></allowtransfer></allowquery></allowupdate></minimum></expire></retry></refresh></serial></mail></ipns></nameserver></tll></temp03></forwarders></dsset></backupkeys></dnssec></temp04></custom></reverso></view></description></disabled></temp01></config></bindzone>

(***** are done by me just for this post)

                <bind><config><temp01><enable_bind>on</enable_bind>
                                <listenon>wan</listenon>
                                <bind_notify><bind_hide_version><bind_ram_limit>256M</bind_ram_limit>
                                <bind_logging><log_severity>critical</log_severity>
                                <log_options><rate_enabled><log_only>no</log_only>
                                <rate_limit><bind_forwarder><bind_forwarder_ips></bind_forwarder_ips></bind_forwarder></rate_limit></rate_enabled></log_options></bind_logging></bind_hide_version></bind_notify></temp01></config></bind>

So the slave zone information is in the pfsense config…but doesn't seem to make it's way into the bind config.</installedpackages>

lucky

I think I found the problem. Looking through the code that generates the bind config from the pfsense config, I noticed the only place it writes out the zone config is under code that processes Views. I did not create a view. As soon as I created one and assigned the zone to it, the bind config was created correctly - and it's working (zone was transferred). I did have to fix one more thing - the server was not resolving and I noticed there was no rule to allow dns traffic on the interface I selected bind to listen on.

So to sum it up - with this package, there were two gotchas that I had to deal with:

You must create a View to associate with your zones
You need to manually add firewall rules to allow port 53 (DNS) traffic

Andy_

There's a major problem with the package:

The zone file management is incompatible with dynamic updates.
I did a record update with nsupdate, and bind continued to work as expected until I made a zone change via the pfsense gui. After that, the zone wouldn'd load any more because "journal rollforward failed: journal out of sync with zone".
After deleting the .DB.jnl file, the zone would load again, but for obvious reasons the dynamic change was gone.

This renders the package unusable with any dynamic update stuff like Active Directory, Samba4 etc.

bryan.paradis

@Andy_:

There's a major problem with the package:

The zone file management is incompatible with dynamic updates.
I did a record update with nsupdate, and bind continued to work as expected until I made a zone change via the pfsense gui. After that, the zone wouldn'd load any more because "journal rollforward failed: journal out of sync with zone".
After deleting the .DB.jnl file, the zone would load again, but for obvious reasons the dynamic change was gone.

This renders the package unusable with any dynamic update stuff like Active Directory, Samba4 etc.

http://www.thedumbterminal.co.uk/?action=showArticle&articleId=168

How to fix BIND's journal out of sync error

Last updated: 16/02/2013 18:38:42

If you are running a BIND name server with an dynamic zone updating from from DHCP or similar, you'll find that if the zone is manually updated the zone will no longer load correctly, giving the following error:

zone example.com/IN: journal rollforward failed: journal out of sync with zone
zone example.com/IN: not loaded due to errors.
The error can be clearing seen by running BIND from command line as follows:

named -g
To resolve this stop BIND, then remove the journal file for problem zone, these exist in the same directory as the zone files but end in ".jnl". Once the file has been deleted BIND can be restarted and all will be back to normal.

If you have dynamic zones it is best to "freeze" them first before editing and "thaw" them after to avoid this problem in the first place. The commands for this are:

rndc freeze example.com
(edit example.com zonefile)
rndc reload example.com
rndc thaw sxample.com

Sure looks like code takes XML -> into zone configuration. For dynamic updates it has to be able to bring in the data from the current file or store the updates into the xml as well. BIND rolls the journal file into the db every 15m or something.

Does indeed seem incompatible with keeping dynamic updates over zone config updates. You could easily check for journal files and delete on a zone update for a zone that has allow updating turned on though. This would be an easy addition.

peffyes

@marcelloc - This is a VERY MUCH appreciated package - nicely done. Exactly what I needed. I was about to install bind via cmd line when I realized this was available. Check your email!

@cl:

[…]

No matter what I set the serial to, it defaults to a timestamp.

It is a little annoying that after adding a record when editing a zone, the web page scrolls all the way up to top (Firefox 25.0.1). After creating a zone, records are the most edited part so perhaps they should be placed at the top.

There are some minor misspellings (Loggin serverity).
[…]

Regarding the serial number - I don't much care for the timestamp - have always used a date format. If the serial field is filled out on the zone form, would be nice if that was actually used instead of a timestamp. I don't mind editing that by hand - have done so for years in the shell… Perhaps a tick box to switch between manual entering and automatic timestamp.

The web page scrolling is inconvenient, but having the custom zone domain record box makes it a non-issue as far as I'm concerned. It's even easier to add multiple records that way.

Andy_

After I outruled the package as primary DNS, I installed and configured the bind 9.9.4 package V0.3.2 for secondary zones only, and it seemed to work. But at the same time I did some major reconfiguration on ipv6/dnsforwarder/etc and found several times that my config was screwed up again and again, with values popping up that I had changed an hour ago.

Last night I finally had successfully configured everything as it needed to be, time for a backup which dates 2:24 AM, then have a little nap.

Now I added a gateway, and found all my interface/vif/rule settings screwed up again! Looking at the diagnostics/Backup Configuration History, I find three changes logged between 02:53:14 and 02:53:36, when my head already rested on a pillow. The message says "save result config file for zone on xml" which obviously origins from the bind package. The diff shows just the unwanted values I corrected earlier.
Apparently the bind package uses some kind of outdated cache, which makes me ultimately unhappy. I'll have to remove the package and maintain bind the usual way.

marcelloc

How did you configured sync on both machines?

I have two bind configured as master/slave and my settings are not changing after config save.

ms-kassel

Hello everybody,

having some problems with the bind package on pfSense 2.1. It listen on WAN Interface. Bind should resolve my domain and several subdomains for privat use only. Can´t define multible view on external zone, this is my first problem. The next problem is, that my secound dns server (slave) cant transfer the internal zone lan, dmz and quarantine. Only the zone transfer of mydomain.de doing well. Think my ACL are right. Anyone who could help?

Greetings Markus

marcelloc

Can you check if resulting bind conf file are fine?

jen

Hello,

I am running a 2.1-RELEASE (i386) on a KVM host. Using the VirtIO drivers.
Installed the Bind package and am trying to configure a master DNS.

After finishing the configurations and restarting the server I see the following errors in the log:

Apr 2 08:12:09 named[56696]: network: info: additionally listening on IPv4 interface vtnet1, 172.16.2.1#53
Apr 2 08:12:09 named[56696]: network: error: could not listen on UDP socket: permission denied
Apr 2 08:12:09 named[56696]: network: error: creating IPv4 interface vtnet1 failed; interface ignored
Apr 2 08:12:09 named[56696]: network: info: additionally listening on IPv4 interface lo0, 127.0.0.1#53
Apr 2 08:12:09 named[56696]: network: error: could not listen on UDP socket: permission denied
Apr 2 08:12:09 named[56696]: network: error: creating IPv4 interface lo0 failed; interface ignored
Apr 2 08:12:09 named[56696]: general: info: managed-keys-zone/Local: loaded serial 0
Apr 2 08:12:09 named[56696]: general: info: zone domain.com/IN/Local: loaded serial 2396415189
Apr 2 08:12:09 named[56696]: general: notice: all zones loaded
Apr 2 08:12:09 named[56696]: general: notice: running

When running netstat -na | grep 53

tcp6 0 0 ::1.53 . LISTEN
tcp4 0 0 172.16.2.1.53 . LISTEN
tcp4 0 0 127.0.0.1.53 . LISTEN
udp6 0 0 ::1.53 .
udp4 0 0 172.16.2.1.53 .
udp4 0 0 127.0.0.1.53 .

I am not able to resolve any host on this server, in fact, my hosts are not able to connect to it:

nslookup ns1.domain.com 172.16.2.1
;; connection timed out; trying next origin

On the other hand :

nmap -p 53 172.16.2.1

Starting Nmap 5.51 ( http://nmap.org ) at 2014-04-02 08:33 IDT
Nmap scan report for 172.16.2.1
Host is up (0.00032s latency).
PORT STATE SERVICE
53/tcp open domain

Any idea what is going on here?

Thanks

EDIT: After restarting the instance all seems to work. I guess this issue is resolved.

marcelloc

Did you disabled DNS forwarder before starting bind?

zlyzwy

Hi Marcelloc,

I need to import over 1000 domain overwrite record into bind package.
Can I use custom options for this? if yes, can you give me a sample?
eg: example.com 100.100.100.100
OR address=example/100.100.100.100

Thanks in advance.
Zlyzwy

marcelloc

Custom options are bind options.do the same way you do while editing files.

You may need to edit pkg_edit.php to allow 1000 domains.

peffyes

@zlyzwy:

Hi Marcelloc,

I need to import over 1000 domain overwrite record into bind package.
Can I use custom options for this? if yes, can you give me a sample?
eg: example.com 100.100.100.100
OR address=example/100.100.100.100

Thanks in advance.
Zlyzwy

The custom options are exactly the same format as a zone file. So it would look like this:

xbox1       IN A 10.9.8.34
xbox360   IN A 10.9.8.35
wii            IN A 10.9.8.36
3ds           IN A 10.9.8.37
vita           IN A 10.9.8.38

pfsense123

Hello,

we want to work with bind in pfsense. but i cant find any good manual for the pfsense version. i hope someone can help me!

i make this settings

Enable bind: checked
listen-on: LAN
rest defaults

Zone One (Foward):
Zone name: test.intern
Type: Master
Name Server: pfsense.test.intern (PFSense Hostname)
Base Domain IP: 192.168.1.1 (PFSense IP)
Records

- NS - pfsense.test.intern
  pfsense - A - 192.168.1.1
  testserver - A - 192.168.1.30

Zone Two (Reverse):
Zone Name: 1.1.168.192
Type: Master
Reverse Zone: checked
Name Server: pfsense.test.intern (PFSense Hostname)
Base Domain IP: 192.168.1.1 (PFSense IP)
Records

- NS - 192.168.1.1
  1 - PTR - pfsense.test.intern
  30 - PTR - testserver.test.intern

Test with Notebook:
IP: 192.168.1.5
GW: 192.168.1.1 (PFSense IP)
DNS: 192.168.1.1 (PFSense IP)

nslookup 192.168.1.1
Server: UnKnown
Adress: 192.168.1.1
not exist

nslookup testserver
Server: UnKnown
Adress: 192.168.1.1
not exist

What is wrong? :o

jen

@marcelloc:

Did you disabled DNS forwarder before starting bind?

Thanks for your reply, I did disable the DNS forward service before installing Bind.
A restart solved the issue I had.

zlyzwy

@peffyes:

@zlyzwy:

Hi Marcelloc,

I need to import over 1000 domain overwrite record into bind package.
Can I use custom options for this? if yes, can you give me a sample?
eg: example.com 100.100.100.100
OR address=example/100.100.100.100

Thanks in advance.
Zlyzwy

The custom options are exactly the same format as a zone file. So it would look like this:
xbox1       IN A 10.9.8.34
xbox360   IN A 10.9.8.35
wii            IN A 10.9.8.36
3ds           IN A 10.9.8.37
vita           IN A 10.9.8.38

Thanks for the reply.
I tired you code but it doesn't work for me. After I saved the change, the services was broken.
If I removed the custom options, it will be just fine.

peffyes

What ever you put in the custom box is simply added to the zone file for the domain name. You do not need to put the START OF AUTHORITY (SOA) in the custom section, this is generated for you. You do need to take care that you have formatted everything correctly. Here is a description of what could go in the custom section: taken from https://en.wikipedia.org/wiki/Zone_file


example.com.  NS    ns                    ; ns.example.com is a nameserver for example.com
example.com.  NS    ns.somewhere.example. ; ns.somewhere.example is a backup nameserver for example.com
example.com.  MX    10 mail.example.com.  ; mail.example.com is the mailserver for example.com
@             MX    20 mail2.example.com. ; equivalent to above line, "@" represents zone origin
@             MX    50 mail3              ; equivalent to above line, but using a relative host name
example.com.  A     192.0.2.1             ; IPv4 address for example.com
              AAAA  2001:db8:10::1        ; IPv6 address for example.com
ns            A     192.0.2.2             ; IPv4 address for ns.example.com
              AAAA  2001:db8:10::2        ; IPv6 address for ns.example.com
www           CNAME example.com.          ; www.example.com is an alias for example.com
wwwtest       CNAME www                   ; wwwtest.example.com is another alias for www.example.com
mail          A     192.0.2.3             ; IPv4 address for mail.example.com,
                                          ;  any MX record host must be an address record
                                          ; as explained in RFC 2181 (section 10.3)
mail2         A     192.0.2.4             ; IPv4 address for mail2.example.com
mail3         A     192.0.2.5             ; IPv4 address for mail3.example.com

My guess is that you're most likely going to use A records, which associate a name to an ip address.
If you use a CNAME, you must have a period at the end of the name you type. IP addresses do NOT get followed by a period.
A semicolon ; is a comment - anything following it is ignored.

@zlyzwy:

@peffyes:
@zlyzwy:

Hi Marcelloc,

I need to import over 1000 domain overwrite record into bind package.
Can I use custom options for this? if yes, can you give me a sample?
eg: example.com 100.100.100.100
OR address=example/100.100.100.100

Thanks in advance.
Zlyzwy

The custom options are exactly the same format as a zone file. So it would look like this:
xbox1       IN A 10.9.8.34
xbox360   IN A 10.9.8.35
wii            IN A 10.9.8.36
3ds           IN A 10.9.8.37
vita           IN A 10.9.8.38
Thanks for the reply.
I tired you code but it doesn't work for me. After I saved the change, the services was broken.
If I removed the custom options, it will be just fine.

finalcut

does it work on multiple network range ?
192.168.16.0/24
192.168.17.0/24
10.0.2.10/24
10.0.7.0/24