• Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login
Netgate Discussion Forum
  • Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login

Bind - Setup pfSense as slave DNS server

pfSense Packages
bind dns
5
21
5.6k
Loading More Posts
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • L
    leungda @Gertjan
    last edited by Dec 7, 2020, 5:14 PM

    @gertjan The reason is I want to have Let's Encrypt DNS-01 verify. Most of the DNS providers it for fee (not free) or not even support it. That's why I build my own DNS server. I already have ns1 running and works fine. Now, I want to build another one at my office location for a SLAVE DNS. Yes, I can build another VM for it. I know that but I want to use the pfsense BIND. I don't want to pay extra MS license or build another VM into the ESXi. not enough space and memory on the ESXi server.

    J 1 Reply Last reply Dec 7, 2020, 5:25 PM Reply Quote 0
    • L
      leungda @johnpoz
      last edited by Dec 7, 2020, 5:21 PM

      @johnpoz Yes, that's the reason I want to remove another 5 NS and use the pfsense BIND to do the job. At least, it can SYNC with ns1 (I guess). The main reason is the Let's encrypt DNS-01 verify. Many of the DNS providers do not support DNS-01 verify or you will have to pay for premium service.

      1 Reply Last reply Reply Quote 0
      • J
        johnpoz LAYER 8 Global Moderator @leungda
        last edited by johnpoz Dec 7, 2020, 5:32 PM Dec 7, 2020, 5:25 PM

        @leungda said in Bind - Setup pfSense as slave DNS server:

        Let's Encrypt DNS-01 verify. Most of the DNS providers it for fee (not free) or not even support it.

        Not sure where you got that idea.. I use cloudflare dns with my acme cert.. There is a huge list of supported dns providers you can use.. Many of them FREE..

        An intelligent man is sometimes forced to be drunk to spend time with his fools
        If you get confused: Listen to the Music Play
        Please don't Chat/PM me for help, unless mod related
        SG-4860 24.11 | Lab VMs 2.7.2, 24.11

        G 1 Reply Last reply Dec 8, 2020, 7:25 AM Reply Quote 0
        • G
          Gertjan @johnpoz
          last edited by Dec 8, 2020, 7:25 AM

          @leungda said in Bind - Setup pfSense as slave DNS server:

          I already have ns1 running and works fine.

          That 'master' is the one that gets used by acme and the DNS-01 protocol. Ones the records are set in the master DNS , it will NOTIFY the slave DNS's. And when they are ready, they will ask for a zone transfer.
          acme and other do not communicate with slave domain servers.

          The domain master to slave setup itself is another story. Ones you know how to set up bind using it's a straight forward config, the same thing would work using the GUI of pfSense, although using a clumsy way as bind (and nginx, and apache2, and postfix etc) really can't be set up using a GUI. It's just to .... complicated to do it that way.

          edit : I just installed bind.
          I kept unbound bound to the LAN type and localhost, and bind was bound to the WAN .
          The GUI does not seem (but I won't be categoric here) to offer all the needed options to configure a slave domain name server.

          No "help me" PM's please. Use the forum, the community will thank you.
          Edit : and where are the logs ??

          J 1 Reply Last reply Dec 8, 2020, 11:19 AM Reply Quote 0
          • J
            johnpoz LAYER 8 Global Moderator @Gertjan
            last edited by Dec 8, 2020, 11:19 AM

            @gertjan said in Bind - Setup pfSense as slave DNS server:

            The GUI does not seem (but I won't be categoric here) to offer all the needed options to configure a slave domain name server.

            And why do you say that?
            login-to-view

            An intelligent man is sometimes forced to be drunk to spend time with his fools
            If you get confused: Listen to the Music Play
            Please don't Chat/PM me for help, unless mod related
            SG-4860 24.11 | Lab VMs 2.7.2, 24.11

            G 1 Reply Last reply Dec 8, 2020, 12:09 PM Reply Quote 0
            • G
              Gertjan @johnpoz
              last edited by Dec 8, 2020, 12:09 PM

              @johnpoz : Saw the "Slave" option.
              Setup start there.
              Good luck for those maintaining it like this ;)

              GUI, or not, one has to know how to set up bind before actually using it.
              Using 'vi' or some GUI : it's just a choice.

              Setting up a slave DNS using some free service, like the one mentioned above, is waaaaaaaaaay simpler.

              No "help me" PM's please. Use the forum, the community will thank you.
              Edit : and where are the logs ??

              J 1 Reply Last reply Dec 8, 2020, 12:27 PM Reply Quote 0
              • J
                johnpoz LAYER 8 Global Moderator @Gertjan
                last edited by johnpoz Dec 8, 2020, 12:40 PM Dec 8, 2020, 12:27 PM

                @gertjan said in Bind - Setup pfSense as slave DNS server:

                one has to know how to set up bind before actually using it.

                Could not agree more! This is requirement for sure...

                Is that what you meant.. I took your post that something was missing from the gui to be able to setup a slave?

                Other than local dns, or just as a learning experience I can not think of one reason why anyone would want to host their own dns.. It makes no sense to do so.. When you can leverage huge deployments of NS across the globe using anycast and allow you to setup dns in a robust and stable way without having to know the ins and outs of bind configuration, etc.

                Learning is great, but I sure wouldn't do it on any sort of production domain. Ie something you want anyone to be able to get to.. Fire up some play domain you want to learn with.. Its not like you can not get a domain to play with for like $1.. They always specific tlds on sale all the time where you can get them for a year for shoot like 88 cents sometimes..

                But if this is some domain you actually want to people to be able to use to get to your stuff - then no I would not suggest you host it yourself.

                edit: Here you go
                https://www.namecheap.com/promos/99-cent-domain-names/

                Bunch of tlds you can use to create a play/learning domain..

                An intelligent man is sometimes forced to be drunk to spend time with his fools
                If you get confused: Listen to the Music Play
                Please don't Chat/PM me for help, unless mod related
                SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                L 1 Reply Last reply Dec 8, 2020, 3:32 PM Reply Quote 0
                • L
                  leungda @johnpoz
                  last edited by Dec 8, 2020, 3:32 PM

                  @johnpoz

                  Thanks all, I switched to Cloudflare and it works with Let'encrypt. Anyway, I really want to know how to set up the pfsense BIND as a SLAVE DNS. It might be useful

                  J G 2 Replies Last reply Dec 8, 2020, 3:44 PM Reply Quote 0
                  • J
                    johnpoz LAYER 8 Global Moderator @leungda
                    last edited by johnpoz Dec 8, 2020, 4:25 PM Dec 8, 2020, 3:44 PM

                    If I get a chance later this week I will throw up a simple walk through.. It really should be as simple as picking slave and putting in the IP of the master, and then allowing the firewall rules to let the master talk to bind on pfsense.

                    edit: Take it your talking about some other domain then the one you sent me via PM. Because that domain still shows what it shows before. It has not been moved anywhere.

                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                    If you get confused: Listen to the Music Play
                    Please don't Chat/PM me for help, unless mod related
                    SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                    1 Reply Last reply Reply Quote 0
                    • G
                      Gertjan @leungda
                      last edited by Dec 9, 2020, 9:18 AM

                      @leungda said in Bind - Setup pfSense as slave DNS server:

                      I really want to know how to set up the pfsense BIND as a SLAVE DNS. It might be useful

                      bind, apache2, nginx and postfix are the 4 most documented programs on the Internet.
                      One might say these ARE the Internet.
                      It's old science, most of their functionality has become 'RFC'.

                      If you already have a bind master domain name server, you've prepared 85 % of the work (== learning bind and what DNS really is).

                      It all start with a phrase like this : bind how to create a slave dns server ?

                      Then the fun part start :
                      My advice : never ever do this @home. DNS servers should be reachable 99,99999 % of the time. That exclude our ISP connections right away.
                      Take a 1 € / month VPS - do not go for any Microsoft solution, do what everybody does : a recent Debian, no GUI. just you, the keyboard, the chair (these 3 help centralize 99 % of issues). No GUI, just you and a command line.

                      When you've installed 'bind' on the VPS 'to become a DNS slave) you change the zone info of your domain master DNS servers.
                      Like ns1 = the IP of you master zone DNS
                      ns2 = the IP of your salve DNS server.

                      Now, do what all admins do : goto /var/log/ and look for the 'bind' logs.
                      Read (tail -f) them. Always. Do not stop until every line means something to you. Learn to be allergic for warnings. Accept none, make them go away. Learn to panic when you see 'error' or worse.

                      Connect to the domain registrar where you got your domain name from.
                      Go to the page where you have to enter your DNS servers, your ns1, ns2, etc.
                      (Your master domain name server IPv4 should be there already.)

                      Make it look like :
                      login-to-view
                      Like

                      Note : I have a bind DNS master, and 2 bind slave name servers, running on my dedicated servers (two bare bone and one VPS).
                      This needs to be done, because the tld ".fr." needs to know where the domain name servers of my test-domaine.fr (my domain) 'lives'. And now you know what happens when you don't pay the annual rent of your domain name : the name server entries in the tld are wiped by your registrar, as they have access to the tld, not you.

                      Use tools like https://www.zonemaster.net/domain_check - and use them often.
                      Make something clean, like https://www.zonemaster.net/result/abd0e923f67b5728

                      When you think you've got it, remember that you only reached level 1. Grat's.
                      Check if you have a drugs store close by, and their opening hours. Check our health insurance (chapter psychological issues) and go for DNSSEC. Not the one your registrar offers you, make it happen on your own DNS name servers. You will need your registrar to hand them over your DS key. you'll reach master level if you pull this one of using scripts (the registrar has to an API access). implementing and following DNSSEC takes days, weeks.
                      You wind up having this mess : https://dnsviz.net/d/test-domaine.fr/dnssec/ Again : NO red or yellow stuff here, otherwise, people that use Resolvers and DNSSEC checking, like pfSense does by default, will NOT resolve your domain any more.

                      last, but not least : your DNS zone has to be fully IPv6 and IPv4. Your name servers have to use both of them, can be contacted using both protocols.
                      Your reverse PTR should be set correctly,
                      Etc.

                      If your still here .... 👍
                      A last one : go for the ultimate : throw in TLS to DNS, security, authentication DANE.

                      No "help me" PM's please. Use the forum, the community will thank you.
                      Edit : and where are the logs ??

                      J 1 Reply Last reply Dec 9, 2020, 12:08 PM Reply Quote 0
                      • J
                        johnpoz LAYER 8 Global Moderator @Gertjan
                        last edited by johnpoz Dec 9, 2020, 12:10 PM Dec 9, 2020, 12:08 PM

                        @gertjan said in Bind - Setup pfSense as slave DNS server:

                        your DNS zone has to be fully IPv6 and IPv4

                        Don't agree with this.. While sure if you have IPv6 then yeah be nice to do that.. But it sure doesn't have to do anything IPv6..

                        And while I agree you should do dnssec - again not a requirement.. You do not have to setup dnssec - and people using dnssec will still resolve you. Unless you try setup dnssec and you mess it up.. Then yeah if your dnssec fails you won't resolve.

                        He is trying to show you that yes it gets complicated very quickly.. But when it comes down to setting up a slave. You tell your master what IP are you slaves, and you setup the zones on your slave and tell them the IP of the master.

                        But he makes a good point about your PTR.. Can you even set that either of your NSers IPs? That really should be set.. Is where you running pfsense even a static IP?

                        What are you going to do if someone attacks your dns? What are you going to do if someone tries to use your NSers for a amplification attack and you didn't secure for that? What your using for NS should not be recursive.. An authoritative NS should not do queries for other clients. They only should answer for the domains they are authoritative for..

                        An intelligent man is sometimes forced to be drunk to spend time with his fools
                        If you get confused: Listen to the Music Play
                        Please don't Chat/PM me for help, unless mod related
                        SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                        1 Reply Last reply Reply Quote 0
                        20 out of 21
                        • First post
                          20/21
                          Last post
                        Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.