Adding a Subnet to an Interface

[noGoSubnet]

@johnpoz Fair enough, - thanks.

The problem with the webserver connections being forcibly killed is definitely a pfSense issue: I do not know what is happening, and have no way of tracing it, but there is definitely something on the pfSense side of things that is blocking (and actively killing) connectivity with the webserver.

I have also tried to implement the DNS ANY fix and can confirm that it does not work in BIND, as BIND does not recognize the records as being valid syntax and, quite honestly, even the hacker groups do not recognize the 'fix' so, yes, it may look good but, outside of that, it would unfortunately appear to be nothing but another cute piece of theory.

As an example of what is happening on the connectivity side of things, pfSense will often show OPT1 as being down when it is not and SSh connections will immediately freeze and die upon opening ...or everything will be running fine on the webserver but it will be impossible to view the website or to connect via SSh (connection to one of the web addresses), - indicating a possible issue with the HTTP or HTTPS rules even though both are fine.

[johnpoz]

@nogosubnet said in Adding a Subnet to an Interface:

The problem with the webserver connections being forcibly killed is definitely a pfSense issue

Says who? Do you have logs of this? Who says anything is being killed? Maybe your internet connection just blows? Why don't you open up your wan IP so can ping that at least. And can validate if can even get to pfsense. Pfsense can not allow traffic it never sees, etc.

Your dns is not working currently either.

BIND does not recognize the records as being valid syntax

Zero idea what your talking about.. Support for this was added back in bind 9.11
https://www.isc.org/blogs/bind-release-911/

Minimal Response to ANY Queries

Queries for ANY records are a possible abuse mechanism because they typically extract a response much larger than the query.

The new minimal-any option reduces the size of answers to UDP queries for type ANY by implementing one of the strategies in “draft-ietf-dnsop-refuse-any”: returning a single arbitrarily-selected RRset that matches the query name rather than returning all of the matching RRsets.

minimal-responses takes two arguments: no-auth suppresses populating the authority section but not the additional section; no-auth-recursive does the same but only when answering recursive queries.

pfSense will often show OPT1 as being down

Well if pfsense says the interface is down, then its down to pfsense for some reason - if that is the case then yeah your going to have issue.. Again you have not given any insight at all to how you have any of this connected together. So nobody can help you.

[noGoSubnet]

This post is deleted!

[noGoSubnet]

This post is deleted!

[noGoSubnet]

@johnpoz I have now fixed this issue by reinstalling the webserver distro. DHCP Server on the pfSense side of things allows me to access the webserver, but does not work with BIND (now installed via a package on the pfSense side of things), nor is it possible to get working alongside the DHCP Server. No matter, everything has its limitations and I will just have to use an alternative solution for a webserver.

Obviously I have also looked at the DNS Forwarder and DNS Resolver options, but, as far as I can tell from the documentation, neither is of any real use and certainly would not help with my setup.

For anyone attempting this, I have the following arrangement:

webserver with domain name
DHCP Server for the webserver enabled
domain records configured under Services > BIND DNS Service
DNS Server added under System > General
DNS Forwarder in place

[johnpoz]

@nogosubnet said in Adding a Subnet to an Interface:

nor is it possible to get working alongside the DHCP Server

Have no idea what your talking about.. You can for sure run bind and dhcp at the same time. And the bind package works just fine.

Resolver (unbound) or the forwarder (dnsmasq) are not meant to be authoritative name servers - so no those will not work if your wanting to run the authoritative NS for your domain(s).

[noGoSubnet]

@johnpoz so, just BIND DNS Server and nothing else? - Tried it, - does not work.

[johnpoz]

@nogosubnet Huh? The bind package works just fine - takes all of couple of minutes to get it running.

You can not run bind and unbound or dnsmasq at the same time, they would be on the same port (53).. You could run both at the same time if they are not on the same interfaces.

But if your going to run bind you really have no use for unbound or dnsmasq.

[noGoSubnet]

@johnpoz Thanks, but then I hit the problem of DHCP Server and BIND DNS Server not being able to run concurrently.

To explain a bit more clearly, I had to use DHCP Server in order for my new distro installation to pick-up on an address (which was taken from the /29 subnet) but, obviously, that does not meet my webserver DNS requirements; hence the need for installing the BIND DNS Server package.

After dropping into the shell for rndc-confgen -a I had no problem adding the required records, including PTR, but now I cannot get BIND to play nice with DHCP Server: DNS lookups are failing, even with appropriate firewall rules in place; so something is not working. This is why I looked at the option of adding a server to System > General (Allow DNS server list to be overridden by DHCP/PPP on WAN box ticked) and using unbound or dnsmaq.

[johnpoz]

@nogosubnet this took me what all of 2 minutes to download and install the packaqe and configure it... Boom running bind with a zone with records..

[21.05.1-RELEASE][admin@sg4860.local.lan]/root: dig @192.168.200.1 example.com ns

; <<>> DiG 9.16.16 <<>> @192.168.200.1 example.com ns
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 17609
;; flags: qr aa rd; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 2
;; WARNING: recursion requested but not available

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
; COOKIE: 4a616f8062b04f920100000061544bc98fd0c0702ba2a376 (good)
;; QUESTION SECTION:
;example.com.                   IN      NS

;; ANSWER SECTION:
example.com.            43200   IN      NS      ns.example.com.

;; ADDITIONAL SECTION:
ns.example.com.         43200   IN      A       192.168.200.1

;; Query time: 1 msec
;; SERVER: 192.168.200.1#53(192.168.200.1)
;; WHEN: Wed Sep 29 06:19:37 CDT 2021
;; MSG SIZE  rcvd: 101

[21.05.1-RELEASE][admin@sg4860.local.lan]/root: dig @192.168.200.1 example.com 

; <<>> DiG 9.16.16 <<>> @192.168.200.1 example.com
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 44640
;; flags: qr aa rd; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
;; WARNING: recursion requested but not available

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
; COOKIE: 7156bfc6f1f42d760100000061544be5a8331bf703c26ab2 (good)
;; QUESTION SECTION:
;example.com.                   IN      A

;; ANSWER SECTION:
example.com.            43200   IN      A       192.168.200.1

;; Query time: 0 msec
;; SERVER: 192.168.200.1#53(192.168.200.1)
;; WHEN: Wed Sep 29 06:20:05 CDT 2021
;; MSG SIZE  rcvd: 84

[21.05.1-RELEASE][admin@sg4860.local.lan]/root: dig @192.168.200.1 www.example.com

; <<>> DiG 9.16.16 <<>> @192.168.200.1 www.example.com
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 21277
;; flags: qr aa rd; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
;; WARNING: recursion requested but not available

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
; COOKIE: a4ed727e914027300100000061544becbda41dd2866b310c (good)
;; QUESTION SECTION:
;www.example.com.               IN      A

;; ANSWER SECTION:
www.example.com.        43200   IN      A       192.168.200.200

;; Query time: 0 msec
;; SERVER: 192.168.200.1#53(192.168.200.1)
;; WHEN: Wed Sep 29 06:20:12 CDT 2021
;; MSG SIZE  rcvd: 88

[21.05.1-RELEASE][admin@sg4860.local.lan]/root: dig @192.168.200.1 www.example.com soa

; <<>> DiG 9.16.16 <<>> @192.168.200.1 www.example.com soa
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 43097
;; flags: qr aa rd; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1
;; WARNING: recursion requested but not available

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
; COOKIE: aac3a9f0cfce85720100000061544bef45e90e4342d1cfd8 (good)
;; QUESTION SECTION:
;www.example.com.               IN      SOA

;; AUTHORITY SECTION:
example.com.            3600    IN      SOA     ns.example.com. zonemaster.example.com. 2632914345 86400 7200 2419200 3600

;; Query time: 0 msec
;; SERVER: 192.168.200.1#53(192.168.200.1)
;; WHEN: Wed Sep 29 06:20:15 CDT 2021
;; MSG SIZE  rcvd: 122

[21.05.1-RELEASE][admin@sg4860.local.lan]/root: 

And still running unbound as well - just have bind on different interface that unbound is not running on.. And change the control port of bind.

DHCP Server and BIND DNS Server not being able to run concurrently.

They have nothing to do with each other.. Look both running..

[noGoSubnet]

@johnpoz Thanks, - time for a complete reset, then, I guess, as it would appear that something has been set wrong somewhere.

Is there a way to access the shell via the webConfigurator?

[johnpoz]

@nogosubnet Not sure how you could mis configure either of those that would prevent the other from running since they have zero in common.. They do not use the same ports.. They are completely different protocols..

Is there a way to access the shell via the webConfigurator?

You can run commands via Diagnostics / Command Prompt

If you want a shell - enable ssh and ssh to pfsense.

[noGoSubnet]

@johnpoz No idea, - I spent hours looking for information on the subject in order to ensure that every had been added correctly, - found absolutely nothing; so I do not know what to do with this now.

[johnpoz]

@nogosubnet said in Adding a Subnet to an Interface:

I spent hours looking for information on the subject

What subject? Pfsense provides a gui to bind - you have to understand how to use bind if you want to run it.. Again - took all of 2 minutes to get it up and running..

Here is pretty much everything there is to know about bind

https://kb.isc.org/docs/aa-01031

[noGoSubnet]

@johnpoz I understand BIND command-line and nano, not GUI.

Diagnostics > Command Prompt > dig shows no instances of my /29 at all, so BIND is not working ...but BIND is enabled.

BIND is also not shown under Status > Services, either; so, first things first, why is BIND not working?

There is a mention of /usr/local/etc/rc.d/named script. What is the point of this? - I tried to use / access it in shell and got nothing but command parameters that are unusable and not recognized.

[johnpoz]

@nogosubnet said in Adding a Subnet to an Interface:

dig shows no instances of my /29 at all, so BIND is not working.

That makes no sense at all.. Have no idea what you did or what your trying to do.. What interface did you set bind to listen on, did you disable unbound or the forward from running and or listening on the same IP?

The gui is just an interface to the same commands you would do via conf - if you understand how bind works.. Then the gui is childs play.. If all your doing is copy stuff you find on the internet until something works - then yeah your going to have a hard time..

The gui will even show you your conf

$TTL 43200
;
$ORIGIN example.com.

;	Database file example.com.DB for example.com zone.
;	Do not edit this file!!!
;	Zone version 2632914345
;
example.com.	 IN  SOA ns.example.com. 	 zonemaster.example.com. (
		2632914345 ; serial
		1d ; refresh
		2h ; retry
		4w ; expire
		1h ; default_ttl
		)

;
; Zone Records
;
@ 	 IN NS 	ns.example.com.
@ 	 IN A 	192.168.200.1
ns 	 IN A  	192.168.200.1
www 	 IN A  	192.168.200.200

There is mine for example that I just set up.

[noGoSubnet]

@johnpoz OK, fine, - it works on your setup; but it looks as though the service needs to be started using that damned script, so how do I get that working? - Telling people to run the script when the script, straight-out, will not run is a bit pointless.

[bingo600]

@nogosubnet
AFAIK it's not adviceable to use nano to configure bind in pfSense.
You have to use the gui.
pfSense often expect the settings to be present in the pfSense config file, and will populate the different packet config files from pfSense config file.

/Bingo

[noGoSubnet]

@bingo600 Thanks, have done; but the point I am making (my apologies if not clear) is that the BIND daemon does not appear to actually be running, - the GUI frontend may be, but there appears that there is an issue with the underlying process; hence my reason for trying to figure out what I need to do, command-line, with that rc.d/named script.

[johnpoz]

^ exactly!

Pfsense is meant to be completely managed from the gui, for pretty much all things. If your trying to configure anything on it, even packages via direct edits your going to have issues.

Yes you can do some stuff via shell, but if your trying to hand edit conf for bind - its going to fail.. If you want create conf and manage bind that way - then run it on something else.

BIND daemon does not appear to actually be running

Did you actually enable it? Did you turn off unbound or dnsmasq.. Again they will be using the port, and unbound likes to use the same control port bind 8953.. So that also conflicts.. If you want to run bind and unbound at the same time you need to properly configure both of them so they do not conflict with each other..