DNSSEC on pfSense

mromero

So far good nuff for me for maybe a snapshot junkie upgrading almost everyday. I would hope the developers are giving this attention so as not to make for a buggy RC1 ::)

@adrianhensler:

@ToxIcon:

sorry guys I seem to be having a problem loosing access to the internet when I enable Unbound it work for about 20 minutes then I loose all internet connection cannot access any webpages then I have to disable Unbound and reboot the firewall to restore internet access.

I can confirm that unbound has crapped out for me at least twice in the past 4 days. I haven't had time to look at it at all, but restarting it from services page fixed it for me both times.

Hopefully next time it happens I'll have a minute to take a look at the logs.

wagonza

@ResIpsa:

Thank you, I saw that entry. I don't think that I was clear enough in my question. Where do I enter the host names and corresponding IP addresses? Will Unbound pull them from the DNS forwarder page or do I need to re-enter them somewhere else?

It pulls them from the DNS forwarder page. So configure them there and once you have completed them, restart Unbound and it will then answer for those entries.

wagonza

@johnpoz:

"Will Unbound pull them from the DNS forwarder page or do I need to re-enter them somewhere else?"

Yes it pulls them from the forwarder page, this is where I entered all my local host names it unbound resolves them. Have not tried the domain over ride yet.. But hosts work just fine.

Domain overrides will work as well. There was problems in the beginning with them but those have been ironed out. Please let me know if you come across any other problems.

wagonza

@ToxIcon:

sorry guys I seem to be having a problem loosing access to the internet when I enable Unbound it work for about 20 minutes then I loose all internet connection cannot access any webpages then I have to disable Unbound and reboot the firewall to restore internet access.

Here is my settings

Enable Unbound

lan Lan1

Enable DNSSEC

Enable forwarding mode

Private Address support

Register DHCP static mappings

Enable DNS forwarder disable

I see you have forwarding enabled. So when this problem happens can you then query your name servers that have been defined in General. If those answer can you then query Unbound (using dig) and see what it's response is i.e. dig @pfsense_ip www.pfsense.org

Then let me know what it sees. Also have a log at /var/log/unbound/log (cmd is clog /var/log/unbound.log).

wagonza

@adrianhensler:

I can confirm that unbound has crapped out for me at least twice in the past 4 days. I haven't had time to look at it at all, but restarting it from services page fixed it for me both times.

Hopefully next time it happens I'll have a minute to take a look at the logs.

If you could do the same please - when it happens try query, using dig, and see what its answers with. Then when you do have time see if /var/log/unbound.log contains anything useful.

jlepthien

I tried using Unbound again and everything seems to be working fine except one small thing…
I have one domain override configured but I cannot resolve the hostname. Not on the pfSense box itself and not on any LAN/WLAN interface. Any info on how/what to test?

Here is the part of the config:

# Domain overrides
stub-zone:
	name: "ip"
	stub-addr: 192.168.2.1
	stub-prime: no

And there should be my modem with a dns name of speedport.ip which is on vr1 (my external interface). This works with dnsmasq but not with Unbound yet…

Edit: the speedport.ip entry also is missing from /etc/hosts on my pfSense box...

johnpoz

I just tried putting in a domain override, and restarted unbound - and its not showing up in the unbound config.

Domain overrides

Remote Control Config

So I have the below domain set to override and use 192.168.1.4, I even stopped and restarted unbound service - just not showing up in the config??

But to your question, for a host to resolve with your domain .ip the nameserver you point to for .ip would have to have that host record.

overridedomain.jpg_thumb

jlepthien

@johnpoz:

I just tried putting in a domain override, and restarted unbound - and its not showing up in the unbound config.

Domain overrides

Remote Control Config

So I have the below domain set to override and use 192.168.1.4, I even stopped and restarted unbound service - just not showing up in the config??

But to your question, for a host to resolve with your domain .ip the nameserver you point to for .ip would have to have that host record.

For me it shows up in the config. And it hasn't to be the hostname, just the domain. That way it works with dnsmasq. Try just setting the domain there.

johnpoz

What modem you have? When I do a search for speedport.ip I see stuff about this modem

Speedport W 701V

Thanks just your modem resolving to itself is all, thats not what you would do to if you want unbound to resolve speedport.ip to the 192.168.2.1 address of your modem.

From the manual of that modem, its in german but translates too

Type in the address bar of Internet browsing, "speedport.ip" or "192.168.2.1"and confirm.

This just means that if using your modem (really a router) as your dns, that would resolve speedport.ip to itself. And then would work if you were forwarding dns to the router, ie 192.168.2.1 – but with unbound its doing the actual dns lookups, speedport.ip is never going to resolve in the real world.. You would have to have a dns server that thinks owner of the .ip tld and then a A record for speedport in it.

If you want to resolve speedport.ip using unbound, just add a host record for that, and then it will resolve it to whatever IP you want.

so for example. I add it in mine to speedport.ip to 192.168.2.1

As you can see from the attachments -- but even with restart its not reading that entry in?? but it has all my other entries?? Im not on the current snap - but don't want to upgrade while not there.. So will have to do when I get back.. But that is what take your problem is for this speedport.ip.

It resolves my other local hosts just fine
;; QUESTION SECTION:
;quad-w7.local.lan. IN A

;; ANSWER SECTION:
quad-w7.local.lan. 3600 IN A 192.168.1.100

;; Query time: 4 msec
;; SERVER: 192.168.1.253#53(192.168.1.253)
;; WHEN: Mon Jan 10 15:44:50 2011
;; MSG SIZE rcvd: 51

But his new one I just added for speedport.ip its not??

;; QUESTION SECTION:
;speedport.ip. IN A

;; AUTHORITY SECTION:
. 86400 IN SOA a.root-servers.net. nstld.verisi gn-grs.com. 2011011000 1800 900 604800 86400

;; Query time: 52 msec
;; SERVER: 192.168.1.253#53(192.168.1.253)
;; WHEN: Mon Jan 10 15:44:37 2011
;; MSG SIZE rcvd: 105

When I look at the status tab is not showing that new entry, even upon start and stop of unbound service.. Will update the snap when I get home and see if that fixes it, currently on
2.0-BETA5 (i386)
built on Sat Jan 8 01:01:27 EST 2011

edithost.jpg_thumb

myhosts.jpg_thumb

jlepthien

Yeah okay. But I wanted to add that whole .ip domain so I added a whole domain overwrite, not just for the host…

johnpoz

If you want that resolve whole .ip domain – then you need another nameserver that would be authoritative for the .ip tld -- and this nameserver would have to house all the records of hosts in that domain.

example

speedport.ip
hostA.ip
hostB.ip
etc..

So does your modem at 2.1 allow you to put in other hosts that would resolve to with .ip domain?

A domain override would be used if you want to have some other nameserver resolve for say yourdomain.com vs root servers point to for example. Or you have some nameserver that is authoritative for an invalid tld like .ip

jlepthien

I know. The point is that it works that way with dnsmasq so why not now with Unbound?

jlepthien

Ok now I changed it the way you used it and it works…

johnpoz

Because to be honest I doubt that speedport router is actually a nameserver that would resolve speedport.ip like a normal nameserver would

Simple enough to test, using either nslookup or dig – do a query to that ip 192.168.2.1

nslookup

server 192.168.2.1
speedport.ip

does that work? I doubt it

Or with dig

dig @192.168.2.1 speedport.ip

If those work then your domain override should work, if not then no it would never work. So just having your unbound resolve speedport.ip to whatever IP you want is the way to do it.

Now currently mine does not seem to be reading in the additions I make to either hosts or domain overrides - but once it does, then I will point it to my other nameserver and verify it works like it should. But for now, if you don't mine do either the nslookup or dig test and post the results.. If that works then your right the override for .ip to go ask 192.168.2.1 should resolve speedport.ip for you.

ToxIcon

wagonza

I tried with forwarding enabled and disable and both times lost connection
internally but the pfsense still can reach the outside, I test it by updating
snort and squidguard but the systems behind pfsense cannot reach the internet.

here are the logs

$ dig zone @192.168.2.9

; <<>> DiG 9.6.2-P2 <<>> zone @192.168.2.9
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 1390
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0

;; QUESTION SECTION:
;zone. IN A

;; AUTHORITY SECTION:
. 86400 IN SOA a.root-servers.net. nstld.verisign-grs.com. 2011011000 1800 900 604800 86400

;; Query time: 81 msec
;; SERVER: 192.168.2.9#53(192.168.2.9)
;; WHEN: Mon Jan 10 21:26:00 2011
;; MSG SIZE rcvd: 97

$ dig @192.168.2.9 www.pfsense.org

; <<>> DiG 9.6.2-P2 <<>> @192.168.2.9 www.pfsense.org
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 3625
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 2, ADDITIONAL: 0

;; QUESTION SECTION:
;www.pfsense.org. IN A

;; ANSWER SECTION:
www.pfsense.org. 3600 IN CNAME pfsense.org.
pfsense.org. 3600 IN A 69.64.6.21

;; AUTHORITY SECTION:
pfsense.org. 3600 IN NS ns17.domaincontrol.com.
pfsense.org. 3600 IN NS ns18.domaincontrol.com.

;; Query time: 177 msec
;; SERVER: 192.168.2.9#53(192.168.2.9)
;; WHEN: Mon Jan 10 21:22:18 2011
;; MSG SIZE rcvd: 118

clog.txt

johnpoz

OK so I updated my snap, and now its showing my domain overrides.

Domain overrides

stub-zone:
name: "test.ip"
stub-addr: 192.168.1.4
stub-prime: no

But I agree its not working like it should.. So there is a server at 192.168.1.4 running bind with a zone for test.ip

see – if I query it directly authoritative for the host3 record I created.

; <<>> DiG 9.7.2-P3 <<>> @192.168.1.4 host3.test.ip
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 15037
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 1

;; QUESTION SECTION:
;host3.test.ip. IN A

;; ANSWER SECTION:
host3.test.ip. 21600 IN A 192.168.1.101

;; AUTHORITY SECTION:
test.ip. 21600 IN NS p4-28g.local.lan.

;; ADDITIONAL SECTION:
p4-28g.local.lan. 21600 IN A 192.168.1.4

;; Query time: 5 msec
;; SERVER: 192.168.1.4#53(192.168.1.4)
;; WHEN: Mon Jan 10 23:32:39 2011
;; MSG SIZE rcvd: 93

Now if I ask the pfsense box that has an override set to ask 192.168.1.4 for the domain test.ip it also gives me back servfail

; <<>> DiG 9.7.2-P3 <<>> @192.168.1.253 host3.test.ip
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 49426
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;host3.test.ip. IN A

;; Query time: 11 msec
;; SERVER: 192.168.1.253#53(192.168.1.253)
;; WHEN: Mon Jan 10 23:40:03 2011
;; MSG SIZE rcvd: 31

So seems domain override is not working??

Currently running
2.0-BETA5 (i386)
built on Mon Jan 10 13:14:45 EST 2011

serangku

hey … something error on unbound packages when updated to latest pf20 i386

Jan 11 14:10:09 php: /pkg_edit.php: The command '/usr/local/sbin/unbound-control start' returned exit code '1', the output was '[1294729809] unbound[8280:0] error: unknown size specifier: '-1m' /usr/local/etc/unbound/unbound.conf:17: error: buffer size expected read /usr/local/etc/unbound/unbound.conf failed: 1 errors in configuration file [1294729809] unbound[8280:0] fatal error: Could not read config file: /usr/local/etc/unbound/unbound.conf'

somethink error on pfsense or unbound it self ?
back again to dnsmasq

wagonza

@ToxIcon:

$ dig @192.168.2.9 www.pfsense.org

;; QUESTION SECTION:
;www.pfsense.org. IN A

;; ANSWER SECTION:
www.pfsense.org. 3600 IN CNAME pfsense.org.
pfsense.org. 3600 IN A 69.64.6.21

;; AUTHORITY SECTION:
pfsense.org. 3600 IN NS ns17.domaincontrol.com.
pfsense.org. 3600 IN NS ns18.domaincontrol.com.

This shows that it is answering correctly unless www.pfsense.org was cached. Trying another website not resolved yet something like www.food.com?

wagonza

@jlepthien:

Yeah okay. But I wanted to add that whole .ip domain so I added a whole domain overwrite, not just for the host…

Yeah I hear what you saying. Your modem would have to be running its own name server as @johnpoz mentioned.

wagonza

@serangku:

hey … something error on unbound packages when updated to latest pf20 i386

Jan 11 14:10:09 php: /pkg_edit.php: The command '/usr/local/sbin/unbound-control start' returned exit code '1', the output was '[1294729809] unbound[8280:0] error: unknown size specifier: '-1m' /usr/local/etc/unbound/unbound.conf:17: error: buffer size expected read /usr/local/etc/unbound/unbound.conf failed: 1 errors in configuration file [1294729809] unbound[8280:0] fatal error: Could not read config file: /usr/local/etc/unbound/unbound.conf'

somethink error on pfsense or unbound it self ?
back again to dnsmasq

What is kern.ipc.maxsockbuf set to on your pfSense box (sysctl kern.ipc.maxsockbuf)?

I have committed a fix for this but still interested to know what your kern.ipc.maxsockbuf is set to.