DNSSEC on pfSense

adrianhensler

If you are using squid, go to the config page for squid then add your pfsense IP to this line:

"Use alternate DNS-servers for the proxy-server"

Fixed it for me, no more sad Picard.

wagonza

Also check http://doc.pfsense.org/index.php/Unbound_package for a bit more detail on the setup of Unbound.
Please let me know if you spot any mistakes/grammer errors or have suggestions.

thx

mromero

THANKS! This did the trick. I am still getting errors as per below but Unbound is now giving me the Borat Smile.

This on AMD 64of today. Will work on the other i386 box now.

Jan 8 18:31:59 php: : SQUID is installed but not started. Not installing "nat" rules.
Jan 8 18:32:00 php: : SQUID is installed but not started. Not installing "filter" rules.
Jan 8 18:32:04 php: : Creating rrd update script
Jan 8 18:32:04 php: : Resyncing configuration for all packages.
Jan 8 18:32:09 php: : Starting Squid
Jan 8 18:32:09 squid[22968]: Squid Parent: child process 23503 started
Jan 8 18:32:09 check_reload_status: reloading filter
Jan 8 18:32:09 php: : The command '/usr/local/sbin/unbound-control start' returned exit code '1', the output was '[1294511529] unbound[31067:0] error: bind: address already in use [1294511529] unbound[31067:0] fatal error: could not open ports'
Jan 8 18:32:10 login: login on ttyv0 as root
Jan 8 18:32:10 sshlockout[38992]: sshlockout/webConfigurator v3.0 starting up
Jan 8 18:32:14 Squid_Alarm[45562]: Squid has exited. Reconfiguring filter.
Jan 8 18:32:14 Squid_Alarm[45854]: Attempting restart…
Jan 8 18:32:14 squid[46948]: Squid Parent: child process 47334 started
Jan 8 18:32:17 Squid_Alarm[47945]: Reconfiguring filter…
Jan 8 18:32:17 Squid_Alarm[56094]: Squid has resumed. Reconfiguring filter.

@adrianhensler:

If you are using squid, go to the config page for squid then add your pfsense IP to this line:

"Use alternate DNS-servers for the proxy-server"

Fixed it for me, no more sad Picard.

mromero

O.K. I upgraded to today's snapshot on another box with i386 and it wiped out my Squid. Reinstalled Squid and Squid and Unbound working now with Borat Smiling.

I guess the kinks will be worked out eventually…

ToxIcon

wagonza thanks for giving us Unbound

igor thanks for the squid tip
adrianhensler thanks for pointing me to the squid then add your pfsense IP to this line:
"Use alternate DNS-servers for the proxy-server"
Fixed it for me also

Yes, you are using DNSSEC

serangku

great job … :)

have tested on pf 2.0 32 bit and 64 bit
on new package now have a bit custom on gui ...
really appreciate ...

mromero

Thanks wagonza, adrianhensler and jimp and all the other techno Gods on PFSENSE for making this work ;D

Have just upgraded to today's second snapshot build on i386 and it took very long to go through the process. Apparently de-installed Squid and Unbound and re-installed them but in the end everything ran through smoothly.

I did not have to manually install any package or anything like that.

Still get the Unbound error on the logs but Squid and Unbound are working fine and Borat is smiling.

From the console I glimpsed something like Unbound log in already exists or something like that.

Where I am ALL the ISPs we tested including satellite are not running DNSSEC thus I am humbled by maybe being the first :o

P.S. Working good also on Saturday's second snapshot on 64 bit.

@serangku:

great job … :)

have tested on pf 2.0 32 bit and 64 bit
on new package now have a bit custom on gui ...
really appreciate ...

ResIpsa

Does Unbound have an equivalent to the host override section of DNS Forwarder?

johnpoz

Check the private address section

"Note: Domain Overrides and Host entries will be allowed to return answers if this option is enabled. "

It returns local hosts for sure.

; <<>> DiG 9.7.2-P3 <<>> quad-w7.local.lan
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 14529
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;quad-w7.local.lan. IN A

;; ANSWER SECTION:
quad-w7.local.lan. 3600 IN A 192.168.1.100

;; Query time: 8 msec
;; SERVER: 192.168.1.253#53(192.168.1.253)
;; WHEN: Sun Jan 09 10:11:52 2011
;; MSG SIZE rcvd: 51

ResIpsa

Thank you, I saw that entry. I don't think that I was clear enough in my question. Where do I enter the host names and corresponding IP addresses? Will Unbound pull them from the DNS forwarder page or do I need to re-enter them somewhere else?

ToxIcon

sorry guys I seem to be having a problem loosing access to the internet when I enable Unbound it work for about 20 minutes then I loose all internet connection cannot access any webpages then I have to disable Unbound and reboot the firewall to restore internet access.

Here is my settings

Enable Unbound

lan Lan1

Enable DNSSEC

Enable forwarding mode

Private Address support

Register DHCP static mappings

Enable DNS forwarder disable

This webpage is not available
The webpage at http://www.google.com/search?sourceid=chrome&ie=UTF-8&q=linksys+forum might be temporarily down or it may have moved permanently to a new web address.
Here are some suggestions:
Reload this web page later.
Error 105 (net::ERR_NAME_NOT_RESOLVED): The server could not be found.

This webpage is not available
The webpage at http://www.helpsintl.org/programs/education.php might be temporarily down or it may have moved permanently to a new web address.
Here are some suggestions:
Reload this web page later.
Error 105 (net::ERR_NAME_NOT_RESOLVED): The server could not be found.

johnpoz

"Will Unbound pull them from the DNS forwarder page or do I need to re-enter them somewhere else?"

Yes it pulls them from the forwarder page, this is where I entered all my local host names it unbound resolves them. Have not tried the domain over ride yet.. But hosts work just fine.

adrianhensler

@ToxIcon:

sorry guys I seem to be having a problem loosing access to the internet when I enable Unbound it work for about 20 minutes then I loose all internet connection cannot access any webpages then I have to disable Unbound and reboot the firewall to restore internet access.

I can confirm that unbound has crapped out for me at least twice in the past 4 days. I haven't had time to look at it at all, but restarting it from services page fixed it for me both times.

Hopefully next time it happens I'll have a minute to take a look at the logs.

ResIpsa

Thank you for the help. I'm now using DNSSEC - Borat is my friend.

mromero

So far good nuff for me for maybe a snapshot junkie upgrading almost everyday. I would hope the developers are giving this attention so as not to make for a buggy RC1 ::)

@adrianhensler:

@ToxIcon:

sorry guys I seem to be having a problem loosing access to the internet when I enable Unbound it work for about 20 minutes then I loose all internet connection cannot access any webpages then I have to disable Unbound and reboot the firewall to restore internet access.

I can confirm that unbound has crapped out for me at least twice in the past 4 days. I haven't had time to look at it at all, but restarting it from services page fixed it for me both times.

Hopefully next time it happens I'll have a minute to take a look at the logs.

wagonza

@ResIpsa:

Thank you, I saw that entry. I don't think that I was clear enough in my question. Where do I enter the host names and corresponding IP addresses? Will Unbound pull them from the DNS forwarder page or do I need to re-enter them somewhere else?

It pulls them from the DNS forwarder page. So configure them there and once you have completed them, restart Unbound and it will then answer for those entries.

wagonza

@johnpoz:

"Will Unbound pull them from the DNS forwarder page or do I need to re-enter them somewhere else?"

Yes it pulls them from the forwarder page, this is where I entered all my local host names it unbound resolves them. Have not tried the domain over ride yet.. But hosts work just fine.

Domain overrides will work as well. There was problems in the beginning with them but those have been ironed out. Please let me know if you come across any other problems.

wagonza

@ToxIcon:

sorry guys I seem to be having a problem loosing access to the internet when I enable Unbound it work for about 20 minutes then I loose all internet connection cannot access any webpages then I have to disable Unbound and reboot the firewall to restore internet access.

Here is my settings

Enable Unbound

lan Lan1

Enable DNSSEC

Enable forwarding mode

Private Address support

Register DHCP static mappings

Enable DNS forwarder disable

I see you have forwarding enabled. So when this problem happens can you then query your name servers that have been defined in General. If those answer can you then query Unbound (using dig) and see what it's response is i.e. dig @pfsense_ip www.pfsense.org

Then let me know what it sees. Also have a log at /var/log/unbound/log (cmd is clog /var/log/unbound.log).

wagonza

@adrianhensler:

I can confirm that unbound has crapped out for me at least twice in the past 4 days. I haven't had time to look at it at all, but restarting it from services page fixed it for me both times.

Hopefully next time it happens I'll have a minute to take a look at the logs.

If you could do the same please - when it happens try query, using dig, and see what its answers with. Then when you do have time see if /var/log/unbound.log contains anything useful.

jlepthien

I tried using Unbound again and everything seems to be working fine except one small thing…
I have one domain override configured but I cannot resolve the hostname. Not on the pfSense box itself and not on any LAN/WLAN interface. Any info on how/what to test?

Here is the part of the config:

# Domain overrides
stub-zone:
	name: "ip"
	stub-addr: 192.168.2.1
	stub-prime: no

And there should be my modem with a dns name of speedport.ip which is on vr1 (my external interface). This works with dnsmasq but not with Unbound yet…

Edit: the speedport.ip entry also is missing from /etc/hosts on my pfSense box...