Bind package for pfsense 2.1

pfsense123

we have an exist bind on an old ubuntu, i want turn this machine off when bind on pfsense works.

the zone in this "test" is test.intern. I need a forward and a reverse lookup, is there any wrong parameter in my config?

@smarc the IP Config on the Client is static, the DNS is the same like the pfsense server.

peffyes

@pfsense123:

nslookup 192.168.1.1
Server: UnKnown
Adress: 192.168.1.1
not exist

nslookup testserver
Server: UnKnown
Adress: 192.168.1.1
not exist

I don't think your client machine knows about the bind server.

marcelloc

Did you…

configured a firewall rule to allow dns requests?
disabled dns forwarder to do not conflict with bind?

shad0w

Sorry for asking(maybe it's already answered before) but how exactly do you run bind(named) on startup? Thanks

marcelloc

@shad0w:

Sorry for asking(maybe it's already answered before) but how exactly do you run bind(named) on startup? Thanks

Pfsense starts all installed services during startup.

shad0w

Thanks for your response.

Hmm i had installed bind package(before latest upgrade) and wasn't any service in web interface. Now after latest upgrade and reinstallation works ok. Thanks

rondex

Hello everyone,

I already have primary and secondary dns servers running on linux boxes. I'm configuring bind on 2 pfSense do replace both, primary and secondary linux, but I did not find a correct SVR entry, as it asks for a prio, weight and port. Generated conf file does not show a correct line for this entry, missing those parameters.

Any solution, or temporary workaround?

Thanks

marcelloc

@rondex:

Any solution, or temporary workaround?

you can use custom options to define your settings.

paste what is wrong and how it should be.

If you know php, you can edit bind.inc to fix the code to work the way you need.

rondex

@marcelloc:

If you know php, you can edit bind.inc to fix the code to work the way you need.

I don't really know that much php, but I made some modifications to make records SRV work correctly. Here is part of the code of bind.inc file:

for ($y=0; $y<sizeof($zone['row']); $y++)<br=""> {
$hostname = (preg_match("/(MX|NS)/",$zone['row'][$y]['hosttype'])?"@":$zone['row'][$y]['hostname']);
$hosttype = $zone['row'][$y]['hosttype'];
$hostdst = $zone['row'][$y]['hostdst'];
if (preg_match("/[a-zA-Z]/",$hostdst) && !preg_match("/(TXT|SPF|AAAA)/",$hosttype))
$hostdst .= ".";
$hostvalue = $zone['row'][$y]['hostvalue'];
$hostweight = $zone['row'][$y]['hostweight'];
$hostport = $zone['row'][$y]['hostport'];

$zone_conf .= "$hostname \t IN $hosttype $hostvalue \t$hostweight \t$hostport \t$hostdst\n";
}

I just added 2 variables to fit requirement of SRV records: $hostweight and $hostport. Then added it to $zone_conf output variable.
See attachment also. Added 2 fields to xml file to be used by SRV, weight and port.

I can see on output bind config file, that $zone_conf is correct, but it's not getting the values of weight and port from GUI.

Anyone can help me with this issue? I'm sure I'm missing some small detail to get those variables read.

Thanks in advance.</sizeof($zone['row']);>

rondex

Hi,

It's almost ready, I just have to adjust one thing: it's not saving priority value, probably due to previous rule on php. I'll keep on search were it is, and as soon as I find it, I'll make it available, if anyone else is interested. Again, I'm not a php programer =) so any help is appreciated.

rondex

:D Job done!

If someone else is interested, just let me know, then I'll make it available.
As soon I have more free time to deal with it, I'll enhance the algorithm to include more options and better warnings/erros on GUI.

fonzy2013

Hi, i am interested! Will the maintainer add this to the uppstramning release?
Also i am interested in some expert Help which i am willing to pay for. You can drop me a Line on niklas at vireone.com if you know this package, pfsense and bind9 in depth.

periko

Try to setup, buy i have this errors related to crypto stuff.

Jul 25 14:56:53 firewall named[47298]: built with '–localstatedir=/var' '--disable-linux-caps' '--disable-symtable' '--with-randomdev=/dev/random' '--with-libxml2=/usr/pbi/bind-amd64' '--without-python' '--enable-filter-aaaa' '--disable-fixed-rrset' '--without-gssapi' '--without-idn' '--enable-ipv6' '--enable-largefile' '--disable-newstats' '--disable-rpz-nsdname' '--disable-rpz-nsip' '--enable-rrl' 'STD_CDEFINES=-DDIG_SIGCHASE=1' '--with-openssl=/usr/pbi/bind-amd64' '--with-dlz-filesystem=yes' '--enable-threads' '--sysconfdir=/usr/pbi/bind-amd64/etc' '--prefix=/usr/pbi/bind-amd64' '--mandir=/usr/pbi/bind-amd64/man' '--infodir=/usr/pbi/bind-amd64/info/' '--build=x86_64-portbld-freebsd8.3' 'build_alias=x86_64-portbld-freebsd8.3' 'CC=cc' 'CFLAGS=-O2 -pipe -fno-strict-aliasing' 'LDFLAGS= -Wl,-rpath,/usr/pbi/bind-amd64/lib' 'CPPFLAGS=' 'CPP=cpp'
Jul 25 14:56:53 firewall named[47298]: –--------------------------------------------------
Jul 25 14:56:53 firewall named[47298]: BIND 9 is maintained by Internet Systems Consortium,
Jul 25 14:56:53 firewall named[47298]: Inc. (ISC), a non-profit 501(3) public-benefit
Jul 25 14:56:53 firewall named[47298]: corporation. Support and training for BIND 9 are
Jul 25 14:56:53 firewall named[47298]: available at https://www.isc.org/support
Jul 25 14:56:53 firewall named[47298]: –--------------------------------------------------
Jul 25 14:56:53 firewall named[47298]: found 2 CPUs, using 2 worker threads
Jul 25 14:56:53 firewall named[47298]: using 2 UDP listeners per interface
Jul 25 14:56:53 firewall named[47298]: using up to 4096 sockets
Jul 25 14:56:53 firewall named[47298]: ENGINE_by_id failed (crypto failure)
Jul 25 14:56:53 firewall named[47298]: error:25070067:DSO support routines:DSO_load:could not load the shared library:dso_lib.c:244:
Jul 25 14:56:53 firewall named[47298]: error:260B6084:engine routines:DYNAMIC_LOAD:dso not found:eng_dyn.c:450:
Jul 25 14:56:53 firewall named[47298]: error:2606A074:engine routines:ENGINE_by_id:no such engine:eng_list.c:418:id=gost
Jul 25 14:56:53 firewall named[47298]: initializing DST: crypto failure
Jul 25 14:56:53 firewall named[47298]: exiting (due to fatal error)

I reinstall the package but same error, maybe need to reinstall the whole system again?

periko

Setup vbox, same error, both installation running x64 version, could be the issue?
I'm going to try x32 and let u know.

KOM

Search the forums. I answered this one three days ago in the DNS forum:

https://forum.pfsense.org/index.php?topic=79714.0

periko

I had try this under x32/x64 bits and the correction from KOM works.

Marcelloc if u have time the fix this will be great, looks like is not difficult to add.

I tested on 3 different machines.

Thanks again KOM.

KOM

They are very busy with the upcoming pfSense 2.2 based on FreeBSD 10. There are snapshots you can try, but a production version is still many months away.

router_wang

@periko:

Try to setup, buy i have this errors related to crypto stuff.

Jul 25 14:56:53 firewall named[47298]: built with '–localstatedir=/var' '--disable-linux-caps' '--disable-symtable' '--with-randomdev=/dev/random' '--with-libxml2=/usr/pbi/bind-amd64' '--without-python' '--enable-filter-aaaa' '--disable-fixed-rrset' '--without-gssapi' '--without-idn' '--enable-ipv6' '--enable-largefile' '--disable-newstats' '--disable-rpz-nsdname' '--disable-rpz-nsip' '--enable-rrl' 'STD_CDEFINES=-DDIG_SIGCHASE=1' '--with-openssl=/usr/pbi/bind-amd64' '--with-dlz-filesystem=yes' '--enable-threads' '--sysconfdir=/usr/pbi/bind-amd64/etc' '--prefix=/usr/pbi/bind-amd64' '--mandir=/usr/pbi/bind-amd64/man' '--infodir=/usr/pbi/bind-amd64/info/' '--build=x86_64-portbld-freebsd8.3' 'build_alias=x86_64-portbld-freebsd8.3' 'CC=cc' 'CFLAGS=-O2 -pipe -fno-strict-aliasing' 'LDFLAGS= -Wl,-rpath,/usr/pbi/bind-amd64/lib' 'CPPFLAGS=' 'CPP=cpp'
Jul 25 14:56:53 firewall named[47298]: –--------------------------------------------------
Jul 25 14:56:53 firewall named[47298]: BIND 9 is maintained by Internet Systems Consortium,
Jul 25 14:56:53 firewall named[47298]: Inc. (ISC), a non-profit 501(3) public-benefit
Jul 25 14:56:53 firewall named[47298]: corporation. Support and training for BIND 9 are
Jul 25 14:56:53 firewall named[47298]: available at https://www.isc.org/support
Jul 25 14:56:53 firewall named[47298]: –--------------------------------------------------
Jul 25 14:56:53 firewall named[47298]: found 2 CPUs, using 2 worker threads
Jul 25 14:56:53 firewall named[47298]: using 2 UDP listeners per interface
Jul 25 14:56:53 firewall named[47298]: using up to 4096 sockets
Jul 25 14:56:53 firewall named[47298]: ENGINE_by_id failed (crypto failure)
Jul 25 14:56:53 firewall named[47298]: error:25070067:DSO support routines:DSO_load:could not load the shared library:dso_lib.c:244:
Jul 25 14:56:53 firewall named[47298]: error:260B6084:engine routines:DYNAMIC_LOAD:dso not found:eng_dyn.c:450:
Jul 25 14:56:53 firewall named[47298]: error:2606A074:engine routines:ENGINE_by_id:no such engine:eng_list.c:418:id=gost
Jul 25 14:56:53 firewall named[47298]: initializing DST: crypto failure
Jul 25 14:56:53 firewall named[47298]: exiting (due to fatal error)

I reinstall the package but same error, maybe need to reinstall the whole system again?

Same problem here…. I guess I'll go run the fix.... :(

MnM

Just like others before me:

Installed bind, configured it. Have couple of zones (allowing DHCP to populate as well)
I can resolve external addresses but nothing from my zones. I cant work it out why. DNS forwarder is off, I have aaded a temp rule to any, any any. Same result.

From a host on my network:

xbox360
Server: 192.168.0.254
Address: 192.168.0.254#53

** server can't find xbox360: NXDOMAIN

xbox360
Server: 192.168.0.254
Address: 192.168.0.254#53

** server can't find xbox360: NXDOMAIN

or after adding the domain part:

xbox360.domain.local
;; Got SERVFAIL reply from 192.168.0.254, trying next server
;; connection timed out; trying next origin
Server: 192.168.0.254
Address: 192.168.0.254#53

** server can't find xbox360.domain.local: NXDOMAIN

The logs are:

Aug 25 22:21:43 named[23629]: resolver: debug 3: fctx 0x803392000(xbox360/A): destroy
Aug 25 22:21:43 named[23629]: resolver: debug 3: fctx 0x803392000(xbox360/A): unlink
Aug 25 22:21:43 named[23629]: resolver: debug 3: fctx 0x803392000(xbox360/A): cancelqueries
Aug 25 22:21:43 named[23629]: resolver: debug 3: fctx 0x803392000(xbox360/A): stopeverything
Aug 25 22:21:43 named[23629]: resolver: debug 3: fctx 0x803392000(xbox360/A): doshutdown
Aug 25 22:21:43 named[23629]: resolver: debug 3: fctx 0x803392000(xbox360/A): shutdown
Aug 25 22:21:43 named[23629]: resolver: debug 3: fetch 0x802e3aa00 (fctx 0x803392000(xbox360/A)): destroyfetch
Aug 25 22:21:43 named[23629]: client: debug 3: client 192.168.0.177#58120 (xbox360): view LAN: endrequest
Aug 25 22:21:43 named[23629]: client: debug 3: client 192.168.0.177#58120 (xbox360): view LAN: next
Aug 25 22:21:43 named[23629]: client: debug 3: client 192.168.0.177#58120 (xbox360): view LAN: senddone
Aug 25 22:21:43 named[23629]: client: debug 3: client 192.168.0.177#58120 (xbox360): view LAN: sendto
Aug 25 22:21:43 named[23629]: client: debug 3: client 192.168.0.177#58120 (xbox360): view LAN: send

mrwizardno2

I think I may have found an issue with IPV6 reverse zones.

When creating a reverse zone, I enter the nibble format of 2001:470:1f11:1062::/64, which is 1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.6.0.1.1.1.f.1.0.7.4.0.1.0.0.2 as the Zone Name. Based off the directions given (and the grouchiness of the service if you enter anything after that!) I omit the .ip6.arpa. bit.

This results in a zone file that contains what I think might be an invalid ORIGIN.

$ORIGIN 2.6.0.1.1.1.f.1.0.7.4.0.1.0.0.2.in-addr.arpa.

Should it not be $ORIGIN 2.6.0.1.1.1.f.1.0.7.4.0.1.0.0.2.ip6.arpa. ?

When I try to do a lookup, I never get a response because it's looking for a different zone.

Jimmies-MacBook:~ jimmie$ dig @2607:fcc8:ffc0:6a:2cba:30be:e115:969d -x 2001:470:1f11:1062::1

; <<>> DiG 9.8.3-P1 <<>> @2607:fcc8:ffc0:6a:2cba:30be:e115:969d -x 2001:470:1f11:1062::1
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 9412
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.6.0.1.1.1.f.1.0.7.4.0.1.0.0.2.ip6.arpa. IN PTR

;; Query time: 3007 msec
;; SERVER: 2607:fcc8:ffc0:6a:2cba:30be:e115:969d#53(2607:fcc8:ffc0:6a:2cba:30be:e115:969d)
;; WHEN: Fri Sep  5 23:53:54 2014
;; MSG SIZE  rcvd: 90

Also, this is in the log file at service refresh.

named[31510]: general: warning: /etc/namedb/master/Internal/2.6.0.1.1.1.f.1.0.7.4.0.1.0.0.2.DB:21: ignoring out-of-zone data (1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.6.0.1.1.1.f.1.0.7.4.0.1.0.0.2.ip6.arpa)