Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Adding a Subnet to an Interface

    Scheduled Pinned Locked Moved Routing and Multi WAN
    128 Posts 8 Posters 35.8k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • johnpozJ
      johnpoz LAYER 8 Global Moderator @noGoSubnet
      last edited by

      @nogosubnet said in Adding a Subnet to an Interface:

      nor is it possible to get working alongside the DHCP Server

      Have no idea what your talking about.. You can for sure run bind and dhcp at the same time. And the bind package works just fine.

      Resolver (unbound) or the forwarder (dnsmasq) are not meant to be authoritative name servers - so no those will not work if your wanting to run the authoritative NS for your domain(s).

      An intelligent man is sometimes forced to be drunk to spend time with his fools
      If you get confused: Listen to the Music Play
      Please don't Chat/PM me for help, unless mod related
      SG-4860 24.11 | Lab VMs 2.8, 24.11

      N 1 Reply Last reply Reply Quote 0
      • N
        noGoSubnet @johnpoz
        last edited by

        @johnpoz so, just BIND DNS Server and nothing else? - Tried it, - does not work.

        johnpozJ 1 Reply Last reply Reply Quote 0
        • johnpozJ
          johnpoz LAYER 8 Global Moderator @noGoSubnet
          last edited by

          @nogosubnet Huh? The bind package works just fine - takes all of couple of minutes to get it running.

          You can not run bind and unbound or dnsmasq at the same time, they would be on the same port (53).. You could run both at the same time if they are not on the same interfaces.

          But if your going to run bind you really have no use for unbound or dnsmasq.

          An intelligent man is sometimes forced to be drunk to spend time with his fools
          If you get confused: Listen to the Music Play
          Please don't Chat/PM me for help, unless mod related
          SG-4860 24.11 | Lab VMs 2.8, 24.11

          N 1 Reply Last reply Reply Quote 0
          • N
            noGoSubnet @johnpoz
            last edited by noGoSubnet

            @johnpoz Thanks, but then I hit the problem of DHCP Server and BIND DNS Server not being able to run concurrently.

            To explain a bit more clearly, I had to use DHCP Server in order for my new distro installation to pick-up on an address (which was taken from the /29 subnet) but, obviously, that does not meet my webserver DNS requirements; hence the need for installing the BIND DNS Server package.

            After dropping into the shell for rndc-confgen -a I had no problem adding the required records, including PTR, but now I cannot get BIND to play nice with DHCP Server: DNS lookups are failing, even with appropriate firewall rules in place; so something is not working. This is why I looked at the option of adding a server to System > General (Allow DNS server list to be overridden by DHCP/PPP on WAN box ticked) and using unbound or dnsmaq.

            johnpozJ 1 Reply Last reply Reply Quote 0
            • johnpozJ
              johnpoz LAYER 8 Global Moderator @noGoSubnet
              last edited by johnpoz

              @nogosubnet this took me what all of 2 minutes to download and install the packaqe and configure it... Boom running bind with a zone with records..

              [21.05.1-RELEASE][admin@sg4860.local.lan]/root: dig @192.168.200.1 example.com ns
              
              ; <<>> DiG 9.16.16 <<>> @192.168.200.1 example.com ns
              ; (1 server found)
              ;; global options: +cmd
              ;; Got answer:
              ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 17609
              ;; flags: qr aa rd; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 2
              ;; WARNING: recursion requested but not available
              
              ;; OPT PSEUDOSECTION:
              ; EDNS: version: 0, flags:; udp: 1232
              ; COOKIE: 4a616f8062b04f920100000061544bc98fd0c0702ba2a376 (good)
              ;; QUESTION SECTION:
              ;example.com.                   IN      NS
              
              ;; ANSWER SECTION:
              example.com.            43200   IN      NS      ns.example.com.
              
              ;; ADDITIONAL SECTION:
              ns.example.com.         43200   IN      A       192.168.200.1
              
              ;; Query time: 1 msec
              ;; SERVER: 192.168.200.1#53(192.168.200.1)
              ;; WHEN: Wed Sep 29 06:19:37 CDT 2021
              ;; MSG SIZE  rcvd: 101
              
              [21.05.1-RELEASE][admin@sg4860.local.lan]/root: dig @192.168.200.1 example.com 
              
              ; <<>> DiG 9.16.16 <<>> @192.168.200.1 example.com
              ; (1 server found)
              ;; global options: +cmd
              ;; Got answer:
              ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 44640
              ;; flags: qr aa rd; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
              ;; WARNING: recursion requested but not available
              
              ;; OPT PSEUDOSECTION:
              ; EDNS: version: 0, flags:; udp: 1232
              ; COOKIE: 7156bfc6f1f42d760100000061544be5a8331bf703c26ab2 (good)
              ;; QUESTION SECTION:
              ;example.com.                   IN      A
              
              ;; ANSWER SECTION:
              example.com.            43200   IN      A       192.168.200.1
              
              ;; Query time: 0 msec
              ;; SERVER: 192.168.200.1#53(192.168.200.1)
              ;; WHEN: Wed Sep 29 06:20:05 CDT 2021
              ;; MSG SIZE  rcvd: 84
              
              [21.05.1-RELEASE][admin@sg4860.local.lan]/root: dig @192.168.200.1 www.example.com
              
              ; <<>> DiG 9.16.16 <<>> @192.168.200.1 www.example.com
              ; (1 server found)
              ;; global options: +cmd
              ;; Got answer:
              ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 21277
              ;; flags: qr aa rd; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
              ;; WARNING: recursion requested but not available
              
              ;; OPT PSEUDOSECTION:
              ; EDNS: version: 0, flags:; udp: 1232
              ; COOKIE: a4ed727e914027300100000061544becbda41dd2866b310c (good)
              ;; QUESTION SECTION:
              ;www.example.com.               IN      A
              
              ;; ANSWER SECTION:
              www.example.com.        43200   IN      A       192.168.200.200
              
              ;; Query time: 0 msec
              ;; SERVER: 192.168.200.1#53(192.168.200.1)
              ;; WHEN: Wed Sep 29 06:20:12 CDT 2021
              ;; MSG SIZE  rcvd: 88
              
              [21.05.1-RELEASE][admin@sg4860.local.lan]/root: dig @192.168.200.1 www.example.com soa
              
              ; <<>> DiG 9.16.16 <<>> @192.168.200.1 www.example.com soa
              ; (1 server found)
              ;; global options: +cmd
              ;; Got answer:
              ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 43097
              ;; flags: qr aa rd; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1
              ;; WARNING: recursion requested but not available
              
              ;; OPT PSEUDOSECTION:
              ; EDNS: version: 0, flags:; udp: 1232
              ; COOKIE: aac3a9f0cfce85720100000061544bef45e90e4342d1cfd8 (good)
              ;; QUESTION SECTION:
              ;www.example.com.               IN      SOA
              
              ;; AUTHORITY SECTION:
              example.com.            3600    IN      SOA     ns.example.com. zonemaster.example.com. 2632914345 86400 7200 2419200 3600
              
              ;; Query time: 0 msec
              ;; SERVER: 192.168.200.1#53(192.168.200.1)
              ;; WHEN: Wed Sep 29 06:20:15 CDT 2021
              ;; MSG SIZE  rcvd: 122
              
              [21.05.1-RELEASE][admin@sg4860.local.lan]/root: 
              

              And still running unbound as well - just have bind on different interface that unbound is not running on.. And change the control port of bind.

              DHCP Server and BIND DNS Server not being able to run concurrently.

              They have nothing to do with each other.. Look both running..

              dhcp.jpg

              An intelligent man is sometimes forced to be drunk to spend time with his fools
              If you get confused: Listen to the Music Play
              Please don't Chat/PM me for help, unless mod related
              SG-4860 24.11 | Lab VMs 2.8, 24.11

              N 1 Reply Last reply Reply Quote 0
              • N
                noGoSubnet @johnpoz
                last edited by noGoSubnet

                @johnpoz Thanks, - time for a complete reset, then, I guess, as it would appear that something has been set wrong somewhere.

                Is there a way to access the shell via the webConfigurator?

                johnpozJ 1 Reply Last reply Reply Quote 0
                • johnpozJ
                  johnpoz LAYER 8 Global Moderator @noGoSubnet
                  last edited by johnpoz

                  @nogosubnet Not sure how you could mis configure either of those that would prevent the other from running since they have zero in common.. They do not use the same ports.. They are completely different protocols..

                  Is there a way to access the shell via the webConfigurator?

                  You can run commands via Diagnostics / Command Prompt

                  If you want a shell - enable ssh and ssh to pfsense.

                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                  If you get confused: Listen to the Music Play
                  Please don't Chat/PM me for help, unless mod related
                  SG-4860 24.11 | Lab VMs 2.8, 24.11

                  N 1 Reply Last reply Reply Quote 0
                  • N
                    noGoSubnet @johnpoz
                    last edited by noGoSubnet

                    @johnpoz No idea, - I spent hours looking for information on the subject in order to ensure that every had been added correctly, - found absolutely nothing; so I do not know what to do with this now.

                    johnpozJ 1 Reply Last reply Reply Quote 0
                    • johnpozJ
                      johnpoz LAYER 8 Global Moderator @noGoSubnet
                      last edited by johnpoz

                      @nogosubnet said in Adding a Subnet to an Interface:

                      I spent hours looking for information on the subject

                      What subject? Pfsense provides a gui to bind - you have to understand how to use bind if you want to run it.. Again - took all of 2 minutes to get it up and running..

                      Here is pretty much everything there is to know about bind

                      https://kb.isc.org/docs/aa-01031

                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                      If you get confused: Listen to the Music Play
                      Please don't Chat/PM me for help, unless mod related
                      SG-4860 24.11 | Lab VMs 2.8, 24.11

                      N 1 Reply Last reply Reply Quote 0
                      • N
                        noGoSubnet @johnpoz
                        last edited by noGoSubnet

                        @johnpoz I understand BIND command-line and nano, not GUI.

                        Diagnostics > Command Prompt > dig shows no instances of my /29 at all, so BIND is not working ...but BIND is enabled.

                        BIND is also not shown under Status > Services, either; so, first things first, why is BIND not working?

                        There is a mention of /usr/local/etc/rc.d/named script. What is the point of this? - I tried to use / access it in shell and got nothing but command parameters that are unusable and not recognized.

                        johnpozJ bingo600B 2 Replies Last reply Reply Quote 0
                        • johnpozJ
                          johnpoz LAYER 8 Global Moderator @noGoSubnet
                          last edited by johnpoz

                          @nogosubnet said in Adding a Subnet to an Interface:

                          dig shows no instances of my /29 at all, so BIND is not working.

                          That makes no sense at all.. Have no idea what you did or what your trying to do.. What interface did you set bind to listen on, did you disable unbound or the forward from running and or listening on the same IP?

                          The gui is just an interface to the same commands you would do via conf - if you understand how bind works.. Then the gui is childs play.. If all your doing is copy stuff you find on the internet until something works - then yeah your going to have a hard time..

                          The gui will even show you your conf

                          $TTL 43200
                          ;
                          $ORIGIN example.com.
                          
                          ;	Database file example.com.DB for example.com zone.
                          ;	Do not edit this file!!!
                          ;	Zone version 2632914345
                          ;
                          example.com.	 IN  SOA ns.example.com. 	 zonemaster.example.com. (
                          		2632914345 ; serial
                          		1d ; refresh
                          		2h ; retry
                          		4w ; expire
                          		1h ; default_ttl
                          		)
                          
                          ;
                          ; Zone Records
                          ;
                          @ 	 IN NS 	ns.example.com.
                          @ 	 IN A 	192.168.200.1
                          ns 	 IN A  	192.168.200.1
                          www 	 IN A  	192.168.200.200
                          
                          

                          There is mine for example that I just set up.

                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                          If you get confused: Listen to the Music Play
                          Please don't Chat/PM me for help, unless mod related
                          SG-4860 24.11 | Lab VMs 2.8, 24.11

                          N 1 Reply Last reply Reply Quote 0
                          • N
                            noGoSubnet @johnpoz
                            last edited by noGoSubnet

                            @johnpoz OK, fine, - it works on your setup; but it looks as though the service needs to be started using that damned script, so how do I get that working? - Telling people to run the script when the script, straight-out, will not run is a bit pointless.

                            1 Reply Last reply Reply Quote 0
                            • bingo600B
                              bingo600 @noGoSubnet
                              last edited by

                              @nogosubnet
                              AFAIK it's not adviceable to use nano to configure bind in pfSense.
                              You have to use the gui.
                              pfSense often expect the settings to be present in the pfSense config file, and will populate the different packet config files from pfSense config file.

                              /Bingo

                              If you find my answer useful - Please give the post a šŸ‘ - "thumbs up"

                              pfSense+ 23.05.1 (ZFS)

                              QOTOM-Q355G4 Quad Lan.
                              CPUĀ  : Core i5 5250U, Ram : 8GB Kingston DDR3LV 1600
                              LANĀ  : 4 x Intel 211, DiskĀ  : 240G SAMSUNG MZ7L3240HCHQ SSD

                              N johnpozJ 2 Replies Last reply Reply Quote 0
                              • N
                                noGoSubnet @bingo600
                                last edited by noGoSubnet

                                @bingo600 Thanks, have done; but the point I am making (my apologies if not clear) is that the BIND daemon does not appear to actually be running, - the GUI frontend may be, but there appears that there is an issue with the underlying process; hence my reason for trying to figure out what I need to do, command-line, with that rc.d/named script.

                                1 Reply Last reply Reply Quote 0
                                • johnpozJ
                                  johnpoz LAYER 8 Global Moderator @bingo600
                                  last edited by johnpoz

                                  ^ exactly!

                                  Pfsense is meant to be completely managed from the gui, for pretty much all things. If your trying to configure anything on it, even packages via direct edits your going to have issues.

                                  Yes you can do some stuff via shell, but if your trying to hand edit conf for bind - its going to fail.. If you want create conf and manage bind that way - then run it on something else.

                                  BIND daemon does not appear to actually be running

                                  Did you actually enable it? Did you turn off unbound or dnsmasq.. Again they will be using the port, and unbound likes to use the same control port bind 8953.. So that also conflicts.. If you want to run bind and unbound at the same time you need to properly configure both of them so they do not conflict with each other..

                                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                                  If you get confused: Listen to the Music Play
                                  Please don't Chat/PM me for help, unless mod related
                                  SG-4860 24.11 | Lab VMs 2.8, 24.11

                                  N 1 Reply Last reply Reply Quote 0
                                  • N
                                    noGoSubnet @johnpoz
                                    last edited by noGoSubnet

                                    @johnpoz just turned off DHCP Server and the named daemon is now showing as being up and running; so: no dnsmasq, unbound, or DHCP Server.

                                    ...unfortunately, dig still shows this setup to be a complete fail.

                                    johnpozJ 1 Reply Last reply Reply Quote 0
                                    • johnpozJ
                                      johnpoz LAYER 8 Global Moderator @noGoSubnet
                                      last edited by johnpoz

                                      @nogosubnet dude dhcp and dns have ZERO to do with each other - ZERO!!!

                                      Here both bind and unbound running - because I don't have then conflicting trying to use the same IP and the same port

                                      here.jpg

                                      Here is dhcp - completely different port.. How would they have anything to do with each other trying to run???

                                      dhcp.jpg

                                      dig still shows this setup to be a complete fail.

                                      Do something basic like I did - get that working before you try whatever it is your trying to do..

                                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                                      If you get confused: Listen to the Music Play
                                      Please don't Chat/PM me for help, unless mod related
                                      SG-4860 24.11 | Lab VMs 2.8, 24.11

                                      N 1 Reply Last reply Reply Quote 0
                                      • N
                                        noGoSubnet @johnpoz
                                        last edited by noGoSubnet

                                        @johnpoz This is sort-of working now (basic configuration), provided I use +trace; otherwise it fails. However no output for the zone files is being generated in the Resulting Zone Config File windows, which I know does work (usually), so I have no idea what the problem is there.

                                        1 Reply Last reply Reply Quote 0
                                        • P
                                          Patch @noGoSubnet
                                          last edited by Patch

                                          @nogosubnet said in Adding a Subnet to an Interface:

                                          As to the drawing, - it is here (but I completely fail to see how it should enlighten anyone):

                                          Please add

                                          • IP addresses to each block shown (full internal, masking of most significant portion of external if required)

                                          • port forwarding or 1:1 NAT or bridging on ISP router and pfSense

                                          • intervening managed switches

                                          • position of network service such as bind, unbound, domain name resolver/forwarder etc

                                          • firewall rules on at least pfSense WAN & OPT1, ISP router, web server.

                                          johnpozJ N 2 Replies Last reply Reply Quote 1
                                          • johnpozJ
                                            johnpoz LAYER 8 Global Moderator @Patch
                                            last edited by johnpoz

                                            However no output for the zone files is being generated in the Resulting Zone Config File windows

                                            Then its NOT setup.. What is the output of +trace you did..

                                            provided I use +trace;

                                            Then show what - was just dig talking to roots and zero to do with your own bind server.

                                            Dude I am pretty much done here - I am thinking you are a troll.. Nobody can be this dense - nobody..

                                            dhcp can't run with bind, etc.. You have just been trolling us I think..

                                            Can not even setup bind via a simple gui where you fill in info to specific form blocks needed to get it running. Either your a troll, or your so far over your head with just basic concepts your never going to get anything to work.. Your a random button clicker, copy paste guy that doesn't actually understand how any of it works from even a basic level..

                                            If your not a troll - I do want to help, but really at my end of my patience..

                                            How could you think bind is setup in pfsense, if it not showing you the conf it setup - I even posted example of what I am seeing... If your not seeing sim, then its clearly not setup - and no would never work..

                                            conf.jpg

                                            If your not seeing that in your zone you setup - how would you think it could be setup to work?

                                            An intelligent man is sometimes forced to be drunk to spend time with his fools
                                            If you get confused: Listen to the Music Play
                                            Please don't Chat/PM me for help, unless mod related
                                            SG-4860 24.11 | Lab VMs 2.8, 24.11

                                            N 1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.