Bind package for pfsense 2.1

marcelloc

@rondex:

Any solution, or temporary workaround?

you can use custom options to define your settings.

paste what is wrong and how it should be.

If you know php, you can edit bind.inc to fix the code to work the way you need.

rondex

@marcelloc:

If you know php, you can edit bind.inc to fix the code to work the way you need.

I don't really know that much php, but I made some modifications to make records SRV work correctly. Here is part of the code of bind.inc file:

for ($y=0; $y<sizeof($zone['row']); $y++)<br=""> {
$hostname = (preg_match("/(MX|NS)/",$zone['row'][$y]['hosttype'])?"@":$zone['row'][$y]['hostname']);
$hosttype = $zone['row'][$y]['hosttype'];
$hostdst = $zone['row'][$y]['hostdst'];
if (preg_match("/[a-zA-Z]/",$hostdst) && !preg_match("/(TXT|SPF|AAAA)/",$hosttype))
$hostdst .= ".";
$hostvalue = $zone['row'][$y]['hostvalue'];
$hostweight = $zone['row'][$y]['hostweight'];
$hostport = $zone['row'][$y]['hostport'];

$zone_conf .= "$hostname \t IN $hosttype $hostvalue \t$hostweight \t$hostport \t$hostdst\n";
}

I just added 2 variables to fit requirement of SRV records: $hostweight and $hostport. Then added it to $zone_conf output variable.
See attachment also. Added 2 fields to xml file to be used by SRV, weight and port.

I can see on output bind config file, that $zone_conf is correct, but it's not getting the values of weight and port from GUI.

Anyone can help me with this issue? I'm sure I'm missing some small detail to get those variables read.

Thanks in advance.</sizeof($zone['row']);>

rondex

Hi,

It's almost ready, I just have to adjust one thing: it's not saving priority value, probably due to previous rule on php. I'll keep on search were it is, and as soon as I find it, I'll make it available, if anyone else is interested. Again, I'm not a php programer =) so any help is appreciated.

rondex

:D Job done!

If someone else is interested, just let me know, then I'll make it available.
As soon I have more free time to deal with it, I'll enhance the algorithm to include more options and better warnings/erros on GUI.

fonzy2013

Hi, i am interested! Will the maintainer add this to the uppstramning release?
Also i am interested in some expert Help which i am willing to pay for. You can drop me a Line on niklas at vireone.com if you know this package, pfsense and bind9 in depth.

periko

Try to setup, buy i have this errors related to crypto stuff.

Jul 25 14:56:53 firewall named[47298]: built with '–localstatedir=/var' '--disable-linux-caps' '--disable-symtable' '--with-randomdev=/dev/random' '--with-libxml2=/usr/pbi/bind-amd64' '--without-python' '--enable-filter-aaaa' '--disable-fixed-rrset' '--without-gssapi' '--without-idn' '--enable-ipv6' '--enable-largefile' '--disable-newstats' '--disable-rpz-nsdname' '--disable-rpz-nsip' '--enable-rrl' 'STD_CDEFINES=-DDIG_SIGCHASE=1' '--with-openssl=/usr/pbi/bind-amd64' '--with-dlz-filesystem=yes' '--enable-threads' '--sysconfdir=/usr/pbi/bind-amd64/etc' '--prefix=/usr/pbi/bind-amd64' '--mandir=/usr/pbi/bind-amd64/man' '--infodir=/usr/pbi/bind-amd64/info/' '--build=x86_64-portbld-freebsd8.3' 'build_alias=x86_64-portbld-freebsd8.3' 'CC=cc' 'CFLAGS=-O2 -pipe -fno-strict-aliasing' 'LDFLAGS= -Wl,-rpath,/usr/pbi/bind-amd64/lib' 'CPPFLAGS=' 'CPP=cpp'
Jul 25 14:56:53 firewall named[47298]: –--------------------------------------------------
Jul 25 14:56:53 firewall named[47298]: BIND 9 is maintained by Internet Systems Consortium,
Jul 25 14:56:53 firewall named[47298]: Inc. (ISC), a non-profit 501(3) public-benefit
Jul 25 14:56:53 firewall named[47298]: corporation. Support and training for BIND 9 are
Jul 25 14:56:53 firewall named[47298]: available at https://www.isc.org/support
Jul 25 14:56:53 firewall named[47298]: –--------------------------------------------------
Jul 25 14:56:53 firewall named[47298]: found 2 CPUs, using 2 worker threads
Jul 25 14:56:53 firewall named[47298]: using 2 UDP listeners per interface
Jul 25 14:56:53 firewall named[47298]: using up to 4096 sockets
Jul 25 14:56:53 firewall named[47298]: ENGINE_by_id failed (crypto failure)
Jul 25 14:56:53 firewall named[47298]: error:25070067:DSO support routines:DSO_load:could not load the shared library:dso_lib.c:244:
Jul 25 14:56:53 firewall named[47298]: error:260B6084:engine routines:DYNAMIC_LOAD:dso not found:eng_dyn.c:450:
Jul 25 14:56:53 firewall named[47298]: error:2606A074:engine routines:ENGINE_by_id:no such engine:eng_list.c:418:id=gost
Jul 25 14:56:53 firewall named[47298]: initializing DST: crypto failure
Jul 25 14:56:53 firewall named[47298]: exiting (due to fatal error)

I reinstall the package but same error, maybe need to reinstall the whole system again?

periko

Setup vbox, same error, both installation running x64 version, could be the issue?
I'm going to try x32 and let u know.

KOM

Search the forums. I answered this one three days ago in the DNS forum:

https://forum.pfsense.org/index.php?topic=79714.0

periko

I had try this under x32/x64 bits and the correction from KOM works.

Marcelloc if u have time the fix this will be great, looks like is not difficult to add.

I tested on 3 different machines.

Thanks again KOM.

KOM

They are very busy with the upcoming pfSense 2.2 based on FreeBSD 10. There are snapshots you can try, but a production version is still many months away.

router_wang

@periko:

Try to setup, buy i have this errors related to crypto stuff.

Jul 25 14:56:53 firewall named[47298]: built with '–localstatedir=/var' '--disable-linux-caps' '--disable-symtable' '--with-randomdev=/dev/random' '--with-libxml2=/usr/pbi/bind-amd64' '--without-python' '--enable-filter-aaaa' '--disable-fixed-rrset' '--without-gssapi' '--without-idn' '--enable-ipv6' '--enable-largefile' '--disable-newstats' '--disable-rpz-nsdname' '--disable-rpz-nsip' '--enable-rrl' 'STD_CDEFINES=-DDIG_SIGCHASE=1' '--with-openssl=/usr/pbi/bind-amd64' '--with-dlz-filesystem=yes' '--enable-threads' '--sysconfdir=/usr/pbi/bind-amd64/etc' '--prefix=/usr/pbi/bind-amd64' '--mandir=/usr/pbi/bind-amd64/man' '--infodir=/usr/pbi/bind-amd64/info/' '--build=x86_64-portbld-freebsd8.3' 'build_alias=x86_64-portbld-freebsd8.3' 'CC=cc' 'CFLAGS=-O2 -pipe -fno-strict-aliasing' 'LDFLAGS= -Wl,-rpath,/usr/pbi/bind-amd64/lib' 'CPPFLAGS=' 'CPP=cpp'
Jul 25 14:56:53 firewall named[47298]: –--------------------------------------------------
Jul 25 14:56:53 firewall named[47298]: BIND 9 is maintained by Internet Systems Consortium,
Jul 25 14:56:53 firewall named[47298]: Inc. (ISC), a non-profit 501(3) public-benefit
Jul 25 14:56:53 firewall named[47298]: corporation. Support and training for BIND 9 are
Jul 25 14:56:53 firewall named[47298]: available at https://www.isc.org/support
Jul 25 14:56:53 firewall named[47298]: –--------------------------------------------------
Jul 25 14:56:53 firewall named[47298]: found 2 CPUs, using 2 worker threads
Jul 25 14:56:53 firewall named[47298]: using 2 UDP listeners per interface
Jul 25 14:56:53 firewall named[47298]: using up to 4096 sockets
Jul 25 14:56:53 firewall named[47298]: ENGINE_by_id failed (crypto failure)
Jul 25 14:56:53 firewall named[47298]: error:25070067:DSO support routines:DSO_load:could not load the shared library:dso_lib.c:244:
Jul 25 14:56:53 firewall named[47298]: error:260B6084:engine routines:DYNAMIC_LOAD:dso not found:eng_dyn.c:450:
Jul 25 14:56:53 firewall named[47298]: error:2606A074:engine routines:ENGINE_by_id:no such engine:eng_list.c:418:id=gost
Jul 25 14:56:53 firewall named[47298]: initializing DST: crypto failure
Jul 25 14:56:53 firewall named[47298]: exiting (due to fatal error)

I reinstall the package but same error, maybe need to reinstall the whole system again?

Same problem here…. I guess I'll go run the fix.... :(

MnM

Just like others before me:

Installed bind, configured it. Have couple of zones (allowing DHCP to populate as well)
I can resolve external addresses but nothing from my zones. I cant work it out why. DNS forwarder is off, I have aaded a temp rule to any, any any. Same result.

From a host on my network:

xbox360
Server: 192.168.0.254
Address: 192.168.0.254#53

** server can't find xbox360: NXDOMAIN

xbox360
Server: 192.168.0.254
Address: 192.168.0.254#53

** server can't find xbox360: NXDOMAIN

or after adding the domain part:

xbox360.domain.local
;; Got SERVFAIL reply from 192.168.0.254, trying next server
;; connection timed out; trying next origin
Server: 192.168.0.254
Address: 192.168.0.254#53

** server can't find xbox360.domain.local: NXDOMAIN

The logs are:

Aug 25 22:21:43 named[23629]: resolver: debug 3: fctx 0x803392000(xbox360/A): destroy
Aug 25 22:21:43 named[23629]: resolver: debug 3: fctx 0x803392000(xbox360/A): unlink
Aug 25 22:21:43 named[23629]: resolver: debug 3: fctx 0x803392000(xbox360/A): cancelqueries
Aug 25 22:21:43 named[23629]: resolver: debug 3: fctx 0x803392000(xbox360/A): stopeverything
Aug 25 22:21:43 named[23629]: resolver: debug 3: fctx 0x803392000(xbox360/A): doshutdown
Aug 25 22:21:43 named[23629]: resolver: debug 3: fctx 0x803392000(xbox360/A): shutdown
Aug 25 22:21:43 named[23629]: resolver: debug 3: fetch 0x802e3aa00 (fctx 0x803392000(xbox360/A)): destroyfetch
Aug 25 22:21:43 named[23629]: client: debug 3: client 192.168.0.177#58120 (xbox360): view LAN: endrequest
Aug 25 22:21:43 named[23629]: client: debug 3: client 192.168.0.177#58120 (xbox360): view LAN: next
Aug 25 22:21:43 named[23629]: client: debug 3: client 192.168.0.177#58120 (xbox360): view LAN: senddone
Aug 25 22:21:43 named[23629]: client: debug 3: client 192.168.0.177#58120 (xbox360): view LAN: sendto
Aug 25 22:21:43 named[23629]: client: debug 3: client 192.168.0.177#58120 (xbox360): view LAN: send

mrwizardno2

I think I may have found an issue with IPV6 reverse zones.

When creating a reverse zone, I enter the nibble format of 2001:470:1f11:1062::/64, which is 1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.6.0.1.1.1.f.1.0.7.4.0.1.0.0.2 as the Zone Name. Based off the directions given (and the grouchiness of the service if you enter anything after that!) I omit the .ip6.arpa. bit.

This results in a zone file that contains what I think might be an invalid ORIGIN.

$ORIGIN 2.6.0.1.1.1.f.1.0.7.4.0.1.0.0.2.in-addr.arpa.

Should it not be $ORIGIN 2.6.0.1.1.1.f.1.0.7.4.0.1.0.0.2.ip6.arpa. ?

When I try to do a lookup, I never get a response because it's looking for a different zone.

Jimmies-MacBook:~ jimmie$ dig @2607:fcc8:ffc0:6a:2cba:30be:e115:969d -x 2001:470:1f11:1062::1

; <<>> DiG 9.8.3-P1 <<>> @2607:fcc8:ffc0:6a:2cba:30be:e115:969d -x 2001:470:1f11:1062::1
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 9412
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.6.0.1.1.1.f.1.0.7.4.0.1.0.0.2.ip6.arpa. IN PTR

;; Query time: 3007 msec
;; SERVER: 2607:fcc8:ffc0:6a:2cba:30be:e115:969d#53(2607:fcc8:ffc0:6a:2cba:30be:e115:969d)
;; WHEN: Fri Sep  5 23:53:54 2014
;; MSG SIZE  rcvd: 90

Also, this is in the log file at service refresh.

named[31510]: general: warning: /etc/namedb/master/Internal/2.6.0.1.1.1.f.1.0.7.4.0.1.0.0.2.DB:21: ignoring out-of-zone data (1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.6.0.1.1.1.f.1.0.7.4.0.1.0.0.2.ip6.arpa)

Caboosey

@periko:

Try to setup, buy i have this errors related to crypto stuff.

Jul 25 14:56:53 firewall named[47298]: built with '–localstatedir=/var' '--disable-linux-caps' '--disable-symtable' '--with-randomdev=/dev/random' '--with-libxml2=/usr/pbi/bind-amd64' '--without-python' '--enable-filter-aaaa' '--disable-fixed-rrset' '--without-gssapi' '--without-idn' '--enable-ipv6' '--enable-largefile' '--disable-newstats' '--disable-rpz-nsdname' '--disable-rpz-nsip' '--enable-rrl' 'STD_CDEFINES=-DDIG_SIGCHASE=1' '--with-openssl=/usr/pbi/bind-amd64' '--with-dlz-filesystem=yes' '--enable-threads' '--sysconfdir=/usr/pbi/bind-amd64/etc' '--prefix=/usr/pbi/bind-amd64' '--mandir=/usr/pbi/bind-amd64/man' '--infodir=/usr/pbi/bind-amd64/info/' '--build=x86_64-portbld-freebsd8.3' 'build_alias=x86_64-portbld-freebsd8.3' 'CC=cc' 'CFLAGS=-O2 -pipe -fno-strict-aliasing' 'LDFLAGS= -Wl,-rpath,/usr/pbi/bind-amd64/lib' 'CPPFLAGS=' 'CPP=cpp'
Jul 25 14:56:53 firewall named[47298]: –--------------------------------------------------
Jul 25 14:56:53 firewall named[47298]: BIND 9 is maintained by Internet Systems Consortium,
Jul 25 14:56:53 firewall named[47298]: Inc. (ISC), a non-profit 501(3) public-benefit
Jul 25 14:56:53 firewall named[47298]: corporation. Support and training for BIND 9 are
Jul 25 14:56:53 firewall named[47298]: available at https://www.isc.org/support
Jul 25 14:56:53 firewall named[47298]: –--------------------------------------------------
Jul 25 14:56:53 firewall named[47298]: found 2 CPUs, using 2 worker threads
Jul 25 14:56:53 firewall named[47298]: using 2 UDP listeners per interface
Jul 25 14:56:53 firewall named[47298]: using up to 4096 sockets
Jul 25 14:56:53 firewall named[47298]: ENGINE_by_id failed (crypto failure)
Jul 25 14:56:53 firewall named[47298]: error:25070067:DSO support routines:DSO_load:could not load the shared library:dso_lib.c:244:
Jul 25 14:56:53 firewall named[47298]: error:260B6084:engine routines:DYNAMIC_LOAD:dso not found:eng_dyn.c:450:
Jul 25 14:56:53 firewall named[47298]: error:2606A074:engine routines:ENGINE_by_id:no such engine:eng_list.c:418:id=gost
Jul 25 14:56:53 firewall named[47298]: initializing DST: crypto failure
Jul 25 14:56:53 firewall named[47298]: exiting (due to fatal error)

I reinstall the package but same error, maybe need to reinstall the whole system again?

I am same issue. The x64 fix will do nothing for me since my pfsense is x86.

My hardware is a Watchguard Firebox X700 running pfSense 2.1.5 (i386).

madforic

Try this, to fix ip6.arpa issue

https://forum.pfsense.org/index.php?topic=67917.msg383934#msg383934

nadir.latif

Hi,

We are using bind package for pfsense. One drawback of the package is that it does not allow fine grained control over the configuration. For example it is not possible to configure keys in acls. Also it is not possible to use negation operator in acls. Both these are needed in Bind multi view replication. It would be useful to be able to make these changes in bind from the pfsense gui.

Thanks,

Nadir Latif

qseb

Hi
thank you so much for your great job on bind package!

It's related to read-only filesystem. I'm:

on 2.1-RELEASE (i386) built on Wed Sep 11 18:16:22 EDT 2013 FreeBSD 8.3-RELEASE-p11 nanobsd 4Go
with bind 9.9.5P1_5 pkg v 0.3.6

extracts from logs when I try to notify a slave zone hosted on pfsense:

Feb  3 22:43:34 pf02 named[60496]: notify: info: client 172.16.0.5#36109: view test_view: received notify for zone 'zonecompany.al'
Feb  3 22:43:34 pf02 named[60496]: general: debug 1: queue_soa_query: zone zonecompany.al/IN/test_view: enter
Feb  3 22:43:34 pf02 named[60496]: general: debug 1: soa_query: zone zonecompany.al/IN/test_view: enter
Feb  3 22:43:34 pf02 named[60496]: general: debug 1: refresh_callback: zone zonecompany.al/IN/test_view: enter
Feb  3 22:43:34 pf02 named[60496]: general: debug 1: refresh_callback: zone zonecompany.al/IN/test_view: serial: new 2015020301, old 2014122901
Feb  3 22:43:34 pf02 named[60496]: general: debug 1: queue_xfrin: zone zonecompany.al/IN/test_view: enter
Feb  3 22:43:34 pf02 named[60496]: general: info: zone zonecompany.al/IN/test_view: Transfer started.
Feb  3 22:43:34 pf02 named[60496]: general: debug 1: zone zonecompany.al/IN/test_view: requesting IXFR from 172.16.0.5#53
Feb  3 22:43:34 pf02 named[60496]: xfer-in: info: transfer of 'zonecompany.al/IN/test_view' from 172.16.0.5#53: connected using 10.0.17.2#16732
Feb  3 22:43:34 pf02 named[60496]: general: debug 1: zone_needdump: zone zonecompany.al/IN/test_view: enter
Feb  3 22:43:34 pf02 named[60496]: general: debug 1: zone_settimer: zone zonecompany.al/IN/test_view: enter
Feb  3 22:43:34 pf02 named[60496]: database: debug 1: calling free_rbtdb(zonecompany.al)
Feb  3 22:43:34 pf02 named[60496]: database: debug 1: adjust_quantum -> 325
Feb  3 22:43:34 pf02 named[60496]: general: debug 1: zone zonecompany.al/IN/test_view: zone transfer finished: success
Feb  3 22:43:34 pf02 named[60496]: general: info: zone zonecompany.al/IN/test_view: transferred serial 2015020301
Feb  3 22:43:34 pf02 named[60496]: general: error: file.c:192: unexpected error:
Feb  3 22:43:34 pf02 named[60496]: general: error: unable to convert errno to isc_result: 30: Read-only file system
Feb  3 22:43:34 pf02 named[60496]: general: error: zone zonecompany.al/IN/test_view: transfer: could not set file modification time of '/etc/namedb/slave/test_view/zonecompany.al.DB': unexpected error
Feb  3 22:43:34 pf02 named[60496]: general: debug 1: zone_settimer: zone zonecompany.al/IN/test_view: enter
Feb  3 22:43:34 pf02 named[60496]: xfer-in: info: transfer of 'zonecompany.al/IN/test_view' from 172.16.0.5#53: Transfer completed: 1 messages, 227 records, 5805 bytes, 0.103 secs (56359 bytes/sec)
Feb  3 22:43:34 pf02 named[60496]: database: debug 1: done free_rbtdb(zonecompany.al)
Feb  3 22:43:34 pf02 named[60496]: general: debug 1: zone_timer: zone zonecompany.al/IN/test_view: enter
Feb  3 22:43:34 pf02 named[60496]: general: debug 1: zone_maintenance: zone zonecompany.al/IN/test_view: enter
Feb  3 22:43:34 pf02 named[60496]: general: debug 1: zone_dump: zone zonecompany.al/IN/test_view: enter
Feb  3 22:43:34 pf02 named[60496]: general: debug 1: zone_settimer: zone zonecompany.al/IN/test_view: enter
Feb  3 22:43:34 pf02 named[60496]: general: debug 1: zone_gotwritehandle: zone zonecompany.al/IN/test_view: enter
Feb  3 22:43:34 pf02 named[60496]: general: error: file.c:323: unexpected error:
Feb  3 22:43:34 pf02 named[60496]: general: error: unable to convert errno to isc_result: 30: Read-only file system
Feb  3 22:43:34 pf02 named[60496]: general: error: dumping master file: /etc/namedb/slave/test_view/tmp-YMLXyK5eB7: open: unexpected error

to make it working, I have to play with /etc/rc.conf_mount_rw before a notify and with /etc/rc.conf_mount_ro after…
On first page I saw some errors solved with an update, but maybe is there still some bugs ;)

stevew

BIND slave zone is not updated.

I configured a BIND slave zone, all DNS entries on master zone has been synced to slave zone. But after that, any new DNS entries on master zone are not updated to slave zone.

"Enable Notify" is enabled on master server. "Allow-transfer" has set the slave server IP.

I didn't find any place to define a slave on master zone. I tried pfSense v2.1.x and v2.2.x.

Anything else needed to config?

Thanks!

Scissorfish

https://forum.pfsense.org/index.php?topic=103157.0

hazza

Running BIND 0.4.3 on pfSense 2.2.5.

I got BIND up and running as a master, syncing to third-party slaves. I set up an ACL so only these two slaves can initiate AXFR. pfSense sends a notify to the servers when the zone changes, and they respond accordingly. All working, hunky dory.

Later I changed the ACL to include some additional IP addresses that I wanted to use a yet more slave servers. However, BIND seems to be ignoring my changes - it's only sending notifys to the original two nameservers (2x IPv4, 2x IPv6).

No matter what changes I make, BIND keeps using the old ACL values. It's sending notify requests to IPv6 addresses that are no longer in the ACL! I've even tried deleting the original ACL and creating a new one!

I've tried everything I can think of, short of wiping BIND and starting from scratch: Restarting the service, recreating the ACL with a different name, clearing out the zone files in ../master/[view]/[zone]/; nothing seems to work.

The correct ACL values are present in the GUI, the zone is set to the correct ACL in the GUI, and I've verified these values as present in /cf/named/etc/named/named.conf.

Does anyone have any suggestions?

EDIT: I've also tried disabling the notify function within the settings tab - and BIND still sends notify messages!