BIND Package (or similar functioning authoritative DNS server)

ScottyDM

I'm considering it.

I haven't actually seen any of the GUI source code (I believe that's the bulk of the development effort), but I know PHP quite well, and other web tech like CSS and the lot. Haven't used GIT, at least not effectively. And I'm an absolute newbe with BIND. But what the heck. I'll need to figure out the old GUI framework and the new. I get the feeling it's more than just a template change.

The biggest problem is getting an effective test bed. I've got this ancient 1U system I should have tossed years ago, and I dug it out of my closet. Single-core P3 at 1.whatever GHz, a tiny bit of ram, and six 100 Mbps Ethernet ports. Might work, but I remember it runs hot. I should fire it up and see what's what.

CaptainElmo

You would be my hero! Even if the UI was nothing more than a big textarea where I could paste in the zone definition files that would cover the bulk of the functionality. I'm not sure what coding would be involved with getting DNSSEC to work, but it's already there in the old format so surely that would help as a guide.

ScottyDM

Converting the old to the new was my thought too.

In other news I fired up my ancient box and it booted into CentOS. 1.0 GHz P-III, 1/2 GB RAM, and PS2 interface. Fortunately it can see the keyboard through USB, but not the CD drive. I vaguely remember it uses parallel ATA for storage. I don't even know if I have a working CD drive with parallel ATA.

Perhaps I can run pfSense through VirtualBox on my Mac. Kind of inconvenient for shoving and filtering packets, but I can diddle the GUI at least.

Callan05

@ScottyDM:

Converting the old to the new was my thought too.

I might be able to help you with this, if you need any.
I don't have the time to take on ownership of this long term, but happy to give some time to get it working again on 2.3

Cheers - Callan

tdi

I need this one for upgrade, too.

What is the progress on BIND package conversion to 2.3 and what can I do to help?

voleatech

We are working on it.

Stay tuned.

Best
Sven

Voleatech
pfSense Select Partner

justauserforaday

Looking forward to test !

peffyes

As I also depend on running bind on the pfsense box, l'm happy to help in anyway that I can, with testing, further donations, etc.

Cybertoy

me too!

Is there a bounty we can donate to?

voleatech

Hi,

no need for a donation or bounty.

We might require testing, I will write an update by the end of the week about it.

Best
Sven

Voleatech
pfSense Select Partner

okapi

I will be one of your tester.

voleatech

Hi everyone,

so the pull request is out (https://github.com/pfsense/FreeBSD-ports/pull/134).

If you want to test the bind package, feedback is welcome:

https://owncloud.voleatech.de/index.php/s/DUo0JQDp7Rs87kf

You need to download both packages, copy them over to the pfSense.
Login via SSH and then add them with:

pkg add pfsense-bind910-9.10.3P4.txz
pkg add pfSense-pkg-bind-9.10_7.txz

the order is important here.

Also make sure to disable unbound or any other DNS server before starting bind.
Otherwise the port is blocked.

Best
Sven

Voleatech
pfSense Select Partner

tdi

I would like to test bind package, however:

pkg add pfsense-bind910-9.10.3P4.txz
Installing pfsense-bind910-9.10.3P4...
pkg: wrong architecture: FreeBSD:10:amd64 instead of FreeBSD:10:i386

Failed to install the following 1 package(s): pfsense-bind910-9.10.3P4.txz

I have tried downloading bind99-9.9.8P4.txz from http://pkg.pfsense.org/orig-pfSense_v2_3_1_i386-pfSense_v2_3_1/All/, but I get the following error:

pkg add bind99-9.9.8P4.txz
Installing bind99-9.9.8P4...
pkg: bind99-9.9.8P4 conflicts with bind-tools-9.10.3P4 (installs files into the same place).  Problematic file: /usr/local/bin/dig

Failed to install the following 1 package(s): bind99-9.9.8P4.txz

If i try to remove problematic package, pfSense reports it will remove bind-tools-9.10.3P4 and pfSense-2.3.1, which I am not sure I want to do…

Is it possible to get bind9.10 i386 packages?

Thanks!

voleatech

Hi,

the bind package from us is a different one than the bind package you are using.
Thats why it is labeled pfsense-bind, to avoid the problem you encountered.

Unfortunately we do not have a i386 development environment for this.

I can send you the code if you like?
Otherwise the package should be merged soon.

Best
Sven

Voleatech
pfSense Select Partner

Willsy7

First, I wanted to say thank you for providing this. Since BIND is what I'm most familiar with, I was disappointed when pfSense discontinued the package in the 2.3.0 branch. However, so far this has worked as a great drop-in replacement for the previous BIND package.

I can confirm the following with regards to my setup:

All my data from the previous package was maintained. For me, that includes settings (some custom), zones, ACLs, and views.
Dynamic updates from DHCP are working.
I'm able to add and remove records to zones through the GUI.
All queries are working, including zone transfers.
RNDC commands from the CLI are working.

I did have two issues, but nothing major.

My main forward zone complained that it was unable to load initially. It complained of the error: named[69987]: general: error: zone "$MYDOMAIN"/IN/default: journal rollforward failed: not exact However, deleting the .jnl file for the zone resolved the issue. I'm not sure if that was an issue with this package or the actual zone.
I don't seem to be able to uncheck "Enable BIND DNS server", it will complain with the error: The following input errors were detected:
The field Enable BIND is required.

However, for me, those are relatively minor. Thank you again for providing this!

voleatech

Hi,

thank you for your feedback.

My main forward zone complained that it was unable to load initially. It complained of the error: named[69987]: general: error: zone "$MYDOMAIN"/IN/default: journal rollforward failed: not exact However, deleting the .jnl file for the zone resolved the issue. I'm not sure if that was an issue with this package or the actual zone.

I am not sure about his one either.

I don't seem to be able to uncheck "Enable BIND DNS server", it will complain with the error: The following input errors were detected:
The field Enable BIND is required.

Thank you for this. I fixed it and uploaded the fix to the pull request.

If you want to fix it yourself do:
vi /usr/local/pkg/bind.xml
delete line 135 where it reads required.

Best
Sven

Voleatech
pfSense Select Partner

Willsy7

Cheers!

Just wanted to alert you to the disable thing in case anyone else decided they wanted to disable BIND. I definitely don't want to go back to unbound. :D

voleatech

Hi,

it is just so good you are not supposed to disable it ;)
We should call it a feature.

Best
Sven

Voleatech
pfSense Select Partner

rhyskoedijk

Hi Sven,

First of all, thanks for putting this package together, great work!
I'm having a bit of an issue getting BIND to start after following your instructions, just wondering if you have any ideas as to what might be wrong?

I have set up the BIND server in the pfSense UI, clicked save, the changes seem to stick in the UI just fine (if I reload the page), but the service fails to start.
The log file shows…


Jun 1 18:54:26	named	42941	exiting (due to fatal error)
Jun 1 18:54:26	named	42941	loading configuration: failure
Jun 1 18:54:26	named	42941	/etc/namedb/named.conf:27: missing ';' before '}'
Jun 1 18:54:26	named	42941	loading configuration from '/etc/namedb/named.conf'
Jun 1 18:54:26	named	42941	using up to 4096 sockets
Jun 1 18:54:26	named	42941	using 8 UDP listeners per interface
Jun 1 18:54:26	named	42941	found 16 CPUs, using 16 worker threads
Jun 1 18:54:26	named	42941	----------------------------------------------------
Jun 1 18:54:26	named	42941	available at https://www.isc.org/support
Jun 1 18:54:26	named	42941	corporation. Support and training for BIND 9 are
Jun 1 18:54:26	named	42941	Inc. (ISC), a non-profit 501(c)(3) public-benefit
Jun 1 18:54:26	named	42941	BIND 9 is maintained by Internet Systems Consortium,
Jun 1 18:54:26	named	42941	----------------------------------------------------
Jun 1 18:54:26	named	42941	built with '--localstatedir=/var' '--disable-linux-caps' '--disable-symtable' '--with-randomdev=/dev/random' '--with-libxml2=/usr/local' '--with-readline=-ledit' '--sysconfdir=/usr/local/etc/namedb' '--disable-fetchlimit' '--disable-filter-aaaa' '--disable-fixed-rrset' '--without-geoip' '--with-idn=/usr/local' '--enable-ipv6' '--disable-largefile' '--disable-newstats' '--without-python' '--disable-querytrace' '--disable-rpz-nsdname' '--disable-rpz-nsip' '--enable-rrl' 'STD_CDEFINES=-DDIG_SIGCHASE=1' '--without-gssapi' '--with-openssl=/usr' '--disable-native-pkcs11' '--without-gost' '--enable-threads' '--prefix=/usr/local' '--mandir=/usr/local/man' '--infodir=/usr/local/info/' '--build=amd64-portbld-freebsd10.3' 'build_alias=amd64-portbld-freebsd10.3' 'CC=cc' 'CFLAGS=-O2 -pipe -isystem /usr/local/include -DLIBICONV_PLUG -fstack-protector -fno-strict-aliasing' 'LDFLAGS= -L/usr/local/lib -fstack-protector' 'LIBS=' 'CPPFLAGS=-isystem /usr/local/include -DLIBICONV_PLUG' 'CPP=cpp'
Jun 1 18:54:26	named	42941	starting BIND 9.10.3-P4 <id:ebd72b3>-c /etc/namedb/named.conf -u bind -t /cf/named/</id:ebd72b3>

The config file in /usr/local/etc/namedb/named.conf doesn't appear to reflect the settings from the UI either.
By my count, line 27 of the config file is a comment line?! Is this the correct file? are the UI settings being saved somewhere else?


// $FreeBSD$
//
// Refer to the named.conf(5) and named(8) man pages, and the documentation
// in /usr/local/share/doc/bind for more details.
//
// If you are going to set up an authoritative server, make sure you
// understand the hairy details of how DNS works.  Even with
// simple mistakes, you can break connectivity for affected parties,
// or cause huge amounts of useless Internet traffic.

options {
        // All file and path names are relative to the chroot directory,
        // if any, and should be fully qualified.
        directory       "/usr/local/etc/namedb/working";
        pid-file        "/var/run/named/pid";
        dump-file       "/var/dump/named_dump.db";
        statistics-file "/var/stats/named.stats";

// If named is being used only as a local resolver, this is a safe default.
// For named to be accessible to the network, comment this option, specify
// the proper IP address, or delete this option.
        listen-on       { 127.0.0.1; };

// If you have IPv6 enabled on this system, uncomment this option for
// use as a local resolver.  To give access to the network, specify
// an IPv6 address, or the keyword "any".
//      listen-on-v6    { ::1; };

// These zones are already covered by the empty zones listed below.
// If you remove the related empty zones below, comment these lines out.
        disable-empty-zone "255.255.255.255.IN-ADDR.ARPA";
        disable-empty-zone "0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.IP6.ARPA";
        disable-empty-zone "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.IP6.ARPA";

// If you've got a DNS server around at your upstream provider, enter
// its IP address here, and enable the line below.  This will make you
// benefit from its cache, thus reduce overall DNS traffic in the Internet.
/*
        forwarders {
                127.0.0.1;
        };
*/

Any leads on where to go with this, was there anything else required beyond just disabling the other DNS services and installing the packages in the specified order?
Thanks in advance

===========
EDIT

I've attached a copy of the http response I get from pfSense when saving the configuration in the UI. The response is "302 Moved", is this normal?

![Screen Shot 2016-06-01 at 7.21.09 PM.png](/public/imported_attachments/1/Screen Shot 2016-06-01 at 7.21.09 PM.png)
![Screen Shot 2016-06-01 at 7.21.09 PM.png_thumb](/public/imported_attachments/1/Screen Shot 2016-06-01 at 7.21.09 PM.png_thumb)

Scissorfish

@rhyskoedijk:

Hi Sven,

First of all, thanks for putting this package together, great work!
I'm having a bit of an issue getting BIND to start after following your instructions, just wondering if you have any ideas as to what might be wrong?

I have set up the BIND server in the pfSense UI, clicked save, the changes seem to stick in the UI just fine (if I reload the page), but the service fails to start.
The log file shows…


Jun 1 18:54:26	named	42941	exiting (due to fatal error)
Jun 1 18:54:26	named	42941	loading configuration: failure
Jun 1 18:54:26	named	42941	/etc/namedb/named.conf:27: missing ';' before '}'
Jun 1 18:54:26	named	42941	loading configuration from '/etc/namedb/named.conf'
Jun 1 18:54:26	named	42941	using up to 4096 sockets
Jun 1 18:54:26	named	42941	using 8 UDP listeners per interface
Jun 1 18:54:26	named	42941	found 16 CPUs, using 16 worker threads
Jun 1 18:54:26	named	42941	----------------------------------------------------
Jun 1 18:54:26	named	42941	available at https://www.isc.org/support
Jun 1 18:54:26	named	42941	corporation. Support and training for BIND 9 are
Jun 1 18:54:26	named	42941	Inc. (ISC), a non-profit 501(c)(3) public-benefit
Jun 1 18:54:26	named	42941	BIND 9 is maintained by Internet Systems Consortium,
Jun 1 18:54:26	named	42941	----------------------------------------------------
Jun 1 18:54:26	named	42941	built with '--localstatedir=/var' '--disable-linux-caps' '--disable-symtable' '--with-randomdev=/dev/random' '--with-libxml2=/usr/local' '--with-readline=-ledit' '--sysconfdir=/usr/local/etc/namedb' '--disable-fetchlimit' '--disable-filter-aaaa' '--disable-fixed-rrset' '--without-geoip' '--with-idn=/usr/local' '--enable-ipv6' '--disable-largefile' '--disable-newstats' '--without-python' '--disable-querytrace' '--disable-rpz-nsdname' '--disable-rpz-nsip' '--enable-rrl' 'STD_CDEFINES=-DDIG_SIGCHASE=1' '--without-gssapi' '--with-openssl=/usr' '--disable-native-pkcs11' '--without-gost' '--enable-threads' '--prefix=/usr/local' '--mandir=/usr/local/man' '--infodir=/usr/local/info/' '--build=amd64-portbld-freebsd10.3' 'build_alias=amd64-portbld-freebsd10.3' 'CC=cc' 'CFLAGS=-O2 -pipe -isystem /usr/local/include -DLIBICONV_PLUG -fstack-protector -fno-strict-aliasing' 'LDFLAGS= -L/usr/local/lib -fstack-protector' 'LIBS=' 'CPPFLAGS=-isystem /usr/local/include -DLIBICONV_PLUG' 'CPP=cpp'
Jun 1 18:54:26	named	42941	starting BIND 9.10.3-P4 <id:ebd72b3>-c /etc/namedb/named.conf -u bind -t /cf/named/</id:ebd72b3>

The config file in /usr/local/etc/namedb/named.conf doesn't appear to reflect the settings from the UI either.
By my count, line 27 of the config file is a comment line?! Is this the correct file? are the UI settings being saved somewhere else?


// $FreeBSD$
//
// Refer to the named.conf(5) and named(8) man pages, and the documentation
// in /usr/local/share/doc/bind for more details.
//
// If you are going to set up an authoritative server, make sure you
// understand the hairy details of how DNS works.  Even with
// simple mistakes, you can break connectivity for affected parties,
// or cause huge amounts of useless Internet traffic.

options {
        // All file and path names are relative to the chroot directory,
        // if any, and should be fully qualified.
        directory       "/usr/local/etc/namedb/working";
        pid-file        "/var/run/named/pid";
        dump-file       "/var/dump/named_dump.db";
        statistics-file "/var/stats/named.stats";

// If named is being used only as a local resolver, this is a safe default.
// For named to be accessible to the network, comment this option, specify
// the proper IP address, or delete this option.
        listen-on       { 127.0.0.1; };

// If you have IPv6 enabled on this system, uncomment this option for
// use as a local resolver.  To give access to the network, specify
// an IPv6 address, or the keyword "any".
//      listen-on-v6    { ::1; };

// These zones are already covered by the empty zones listed below.
// If you remove the related empty zones below, comment these lines out.
        disable-empty-zone "255.255.255.255.IN-ADDR.ARPA";
        disable-empty-zone "0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.IP6.ARPA";
        disable-empty-zone "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.IP6.ARPA";

// If you've got a DNS server around at your upstream provider, enter
// its IP address here, and enable the line below.  This will make you
// benefit from its cache, thus reduce overall DNS traffic in the Internet.
/*
        forwarders {
                127.0.0.1;
        };
*/

Any leads on where to go with this, was there anything else required beyond just disabling the other DNS services and installing the packages in the specified order?
Thanks in advance

===========
EDIT

I've attached a copy of the http response I get from pfSense when saving the configuration in the UI. The response is "302 Moved", is this normal?

/etc/namedb/named.conf:27: missing ';' before '}'
check your config

Installed bind yesterday on 2.3.3_1 and it is working flawlessly so far

BIND Package (or similar functioning authoritative DNS server)

=========== EDIT

=========== EDIT

===========
EDIT

===========
EDIT