Bind package for pfsense 2.1

zlyzwy

@zlyzwy:

Hi Marcelloc,

I need to import over 1000 domain overwrite record into bind package.
Can I use custom options for this? if yes, can you give me a sample?
eg: example.com 100.100.100.100
OR address=example/100.100.100.100

Thanks in advance.
Zlyzwy

The custom options are exactly the same format as a zone file. So it would look like this:
xbox1       IN A 10.9.8.34
xbox360   IN A 10.9.8.35
wii            IN A 10.9.8.36
3ds           IN A 10.9.8.37
vita           IN A 10.9.8.38

Thanks for the reply.
I tired you code but it doesn't work for me. After I saved the change, the services was broken.
If I removed the custom options, it will be just fine.

peffyes

What ever you put in the custom box is simply added to the zone file for the domain name. You do not need to put the START OF AUTHORITY (SOA) in the custom section, this is generated for you. You do need to take care that you have formatted everything correctly. Here is a description of what could go in the custom section: taken from https://en.wikipedia.org/wiki/Zone_file


example.com.  NS    ns                    ; ns.example.com is a nameserver for example.com
example.com.  NS    ns.somewhere.example. ; ns.somewhere.example is a backup nameserver for example.com
example.com.  MX    10 mail.example.com.  ; mail.example.com is the mailserver for example.com
@             MX    20 mail2.example.com. ; equivalent to above line, "@" represents zone origin
@             MX    50 mail3              ; equivalent to above line, but using a relative host name
example.com.  A     192.0.2.1             ; IPv4 address for example.com
              AAAA  2001:db8:10::1        ; IPv6 address for example.com
ns            A     192.0.2.2             ; IPv4 address for ns.example.com
              AAAA  2001:db8:10::2        ; IPv6 address for ns.example.com
www           CNAME example.com.          ; www.example.com is an alias for example.com
wwwtest       CNAME www                   ; wwwtest.example.com is another alias for www.example.com
mail          A     192.0.2.3             ; IPv4 address for mail.example.com,
                                          ;  any MX record host must be an address record
                                          ; as explained in RFC 2181 (section 10.3)
mail2         A     192.0.2.4             ; IPv4 address for mail2.example.com
mail3         A     192.0.2.5             ; IPv4 address for mail3.example.com

My guess is that you're most likely going to use A records, which associate a name to an ip address.
If you use a CNAME, you must have a period at the end of the name you type. IP addresses do NOT get followed by a period.
A semicolon ; is a comment - anything following it is ignored.

@zlyzwy:

@peffyes:
@zlyzwy:

Hi Marcelloc,

I need to import over 1000 domain overwrite record into bind package.
Can I use custom options for this? if yes, can you give me a sample?
eg: example.com 100.100.100.100
OR address=example/100.100.100.100

Thanks in advance.
Zlyzwy

The custom options are exactly the same format as a zone file. So it would look like this:
xbox1       IN A 10.9.8.34
xbox360   IN A 10.9.8.35
wii            IN A 10.9.8.36
3ds           IN A 10.9.8.37
vita           IN A 10.9.8.38
Thanks for the reply.
I tired you code but it doesn't work for me. After I saved the change, the services was broken.
If I removed the custom options, it will be just fine.

finalcut

does it work on multiple network range ?
192.168.16.0/24
192.168.17.0/24
10.0.2.10/24
10.0.7.0/24

marcelloc

@finalcut:

does it work on multiple network range ?
192.168.16.0/24
192.168.17.0/24
10.0.2.10/24
10.0.7.0/24

I've never used this way. Check bind documentation.

pfsense123

@pfsense123:

Hello,

we want to work with bind in pfsense. but i cant find any good manual for the pfsense version. i hope someone can help me!

i make this settings

Enable bind: checked
listen-on: LAN
rest defaults

Zone One (Foward):
Zone name: test.intern
Type: Master
Name Server: pfsense.test.intern (PFSense Hostname)
Base Domain IP: 192.168.1.1 (PFSense IP)
Records

NS - pfsense.test.intern
pfsense - A - 192.168.1.1
testserver - A - 192.168.1.30

Zone Two (Reverse):
Zone Name: 1.1.168.192
Type: Master
Reverse Zone: checked
Name Server: pfsense.test.intern (PFSense Hostname)
Base Domain IP: 192.168.1.1 (PFSense IP)
Records

NS - 192.168.1.1
1 - PTR - pfsense.test.intern
30 - PTR - testserver.test.intern

Test with Notebook:
IP: 192.168.1.5
GW: 192.168.1.1 (PFSense IP)
DNS: 192.168.1.1 (PFSense IP)

nslookup 192.168.1.1
Server: UnKnown
Adress: 192.168.1.1
not exist

nslookup testserver
Server: UnKnown
Adress: 192.168.1.1
not exist

What is wrong? :o

any ideas please? How can i get it work

peffyes

What is the notebook computer using for a DNS server? If you use DHCP to configure IP services, make sure your DHCP server is telling the clients the proper address to use for DNS lookups. Looks like that should be 192.168.1.1 in your example.

Try nslookup 192.168.1.5 192.168.1.1 and see if you get an answer. If so, your client is probably not looking at the correct address for DNS resolution.

marcelloc

pfsense 123, do you have a zone to configure on it?
If it's just a forward dns, why don't you use built in dns forwarder package?

pfsense123

we have an exist bind on an old ubuntu, i want turn this machine off when bind on pfsense works.

the zone in this "test" is test.intern. I need a forward and a reverse lookup, is there any wrong parameter in my config?

@smarc the IP Config on the Client is static, the DNS is the same like the pfsense server.

peffyes

@pfsense123:

nslookup 192.168.1.1
Server: UnKnown
Adress: 192.168.1.1
not exist

nslookup testserver
Server: UnKnown
Adress: 192.168.1.1
not exist

I don't think your client machine knows about the bind server.

marcelloc

Did you…

configured a firewall rule to allow dns requests?
disabled dns forwarder to do not conflict with bind?

shad0w

Sorry for asking(maybe it's already answered before) but how exactly do you run bind(named) on startup? Thanks

marcelloc

@shad0w:

Sorry for asking(maybe it's already answered before) but how exactly do you run bind(named) on startup? Thanks

Pfsense starts all installed services during startup.

shad0w

Thanks for your response.

Hmm i had installed bind package(before latest upgrade) and wasn't any service in web interface. Now after latest upgrade and reinstallation works ok. Thanks

rondex

Hello everyone,

I already have primary and secondary dns servers running on linux boxes. I'm configuring bind on 2 pfSense do replace both, primary and secondary linux, but I did not find a correct SVR entry, as it asks for a prio, weight and port. Generated conf file does not show a correct line for this entry, missing those parameters.

Any solution, or temporary workaround?

Thanks

marcelloc

@rondex:

Any solution, or temporary workaround?

you can use custom options to define your settings.

paste what is wrong and how it should be.

If you know php, you can edit bind.inc to fix the code to work the way you need.

rondex

@marcelloc:

If you know php, you can edit bind.inc to fix the code to work the way you need.

I don't really know that much php, but I made some modifications to make records SRV work correctly. Here is part of the code of bind.inc file:

for ($y=0; $y<sizeof($zone['row']); $y++)<br=""> {
$hostname = (preg_match("/(MX|NS)/",$zone['row'][$y]['hosttype'])?"@":$zone['row'][$y]['hostname']);
$hosttype = $zone['row'][$y]['hosttype'];
$hostdst = $zone['row'][$y]['hostdst'];
if (preg_match("/[a-zA-Z]/",$hostdst) && !preg_match("/(TXT|SPF|AAAA)/",$hosttype))
$hostdst .= ".";
$hostvalue = $zone['row'][$y]['hostvalue'];
$hostweight = $zone['row'][$y]['hostweight'];
$hostport = $zone['row'][$y]['hostport'];

$zone_conf .= "$hostname \t IN $hosttype $hostvalue \t$hostweight \t$hostport \t$hostdst\n";
}

I just added 2 variables to fit requirement of SRV records: $hostweight and $hostport. Then added it to $zone_conf output variable.
See attachment also. Added 2 fields to xml file to be used by SRV, weight and port.

I can see on output bind config file, that $zone_conf is correct, but it's not getting the values of weight and port from GUI.

Anyone can help me with this issue? I'm sure I'm missing some small detail to get those variables read.

Thanks in advance.</sizeof($zone['row']);>

rondex

Hi,

It's almost ready, I just have to adjust one thing: it's not saving priority value, probably due to previous rule on php. I'll keep on search were it is, and as soon as I find it, I'll make it available, if anyone else is interested. Again, I'm not a php programer =) so any help is appreciated.

rondex

:D Job done!

If someone else is interested, just let me know, then I'll make it available.
As soon I have more free time to deal with it, I'll enhance the algorithm to include more options and better warnings/erros on GUI.

fonzy2013

Hi, i am interested! Will the maintainer add this to the uppstramning release?
Also i am interested in some expert Help which i am willing to pay for. You can drop me a Line on niklas at vireone.com if you know this package, pfsense and bind9 in depth.

periko

Try to setup, buy i have this errors related to crypto stuff.

Jul 25 14:56:53 firewall named[47298]: built with '–localstatedir=/var' '--disable-linux-caps' '--disable-symtable' '--with-randomdev=/dev/random' '--with-libxml2=/usr/pbi/bind-amd64' '--without-python' '--enable-filter-aaaa' '--disable-fixed-rrset' '--without-gssapi' '--without-idn' '--enable-ipv6' '--enable-largefile' '--disable-newstats' '--disable-rpz-nsdname' '--disable-rpz-nsip' '--enable-rrl' 'STD_CDEFINES=-DDIG_SIGCHASE=1' '--with-openssl=/usr/pbi/bind-amd64' '--with-dlz-filesystem=yes' '--enable-threads' '--sysconfdir=/usr/pbi/bind-amd64/etc' '--prefix=/usr/pbi/bind-amd64' '--mandir=/usr/pbi/bind-amd64/man' '--infodir=/usr/pbi/bind-amd64/info/' '--build=x86_64-portbld-freebsd8.3' 'build_alias=x86_64-portbld-freebsd8.3' 'CC=cc' 'CFLAGS=-O2 -pipe -fno-strict-aliasing' 'LDFLAGS= -Wl,-rpath,/usr/pbi/bind-amd64/lib' 'CPPFLAGS=' 'CPP=cpp'
Jul 25 14:56:53 firewall named[47298]: –--------------------------------------------------
Jul 25 14:56:53 firewall named[47298]: BIND 9 is maintained by Internet Systems Consortium,
Jul 25 14:56:53 firewall named[47298]: Inc. (ISC), a non-profit 501(3) public-benefit
Jul 25 14:56:53 firewall named[47298]: corporation. Support and training for BIND 9 are
Jul 25 14:56:53 firewall named[47298]: available at https://www.isc.org/support
Jul 25 14:56:53 firewall named[47298]: –--------------------------------------------------
Jul 25 14:56:53 firewall named[47298]: found 2 CPUs, using 2 worker threads
Jul 25 14:56:53 firewall named[47298]: using 2 UDP listeners per interface
Jul 25 14:56:53 firewall named[47298]: using up to 4096 sockets
Jul 25 14:56:53 firewall named[47298]: ENGINE_by_id failed (crypto failure)
Jul 25 14:56:53 firewall named[47298]: error:25070067:DSO support routines:DSO_load:could not load the shared library:dso_lib.c:244:
Jul 25 14:56:53 firewall named[47298]: error:260B6084:engine routines:DYNAMIC_LOAD:dso not found:eng_dyn.c:450:
Jul 25 14:56:53 firewall named[47298]: error:2606A074:engine routines:ENGINE_by_id:no such engine:eng_list.c:418:id=gost
Jul 25 14:56:53 firewall named[47298]: initializing DST: crypto failure
Jul 25 14:56:53 firewall named[47298]: exiting (due to fatal error)

I reinstall the package but same error, maybe need to reinstall the whole system again?