Bind package for pfsense 2.1



  • Hi,

    If you need a full dns server  on pfsense,  you can try bind.

    This first version has acls, views,zones,chroot and response rate limit gui options.

    Give it a try  and let me know if some powerful functionality of bind was left behind :)

    Dnssec is on todo list.



  • marcelloc,

    I will test this coming days. Will let you know how it comes out.



  • Marcelloc,

    Thanks for the bind package! A couple issues I found so far.

    1. Saving config changes doesn't update /conf/named/etc/namedb/named.conf
      config.xml would update but named.conf wouldn't pick up the new changes.  I did notice it regenerated named.conf after a reboot but still wouldn't regenerate it after clicking save in the UI

    2. Fails to start bind and throws errors multiple errors
      Most seem to be failure to write / Read-only file system

    here is a syslog snippet when trying to save config changes

    
    Oct 13 10:37:17 router.hex.divide named[36871]: starting BIND 9.9.4 -c /etc/namedb/named.conf -u bind -t /conf/named/
    Oct 13 10:37:17 router.hex.divide named[36871]: built with '--localstatedir=/var' '--disable-linux-caps' '--disable-symtable' '--with-randomdev=/dev/random' '--without-python' '--with-openssl=/usr' '--with-libxml2=/usr/pbi/bind-i386' '--without-idn' 'STD_CDEFINES=-DDIG_SIGCHASE=1' '--enable-ipv6' '--enable-filter-aaaa' '--enable-rrl' '--with-dlz-filesystem=yes' '--enable-threads' '--without-gssapi' '--prefix=/usr/pbi/bind-i386' '--mandir=/usr/pbi/bind-i386/man' '--infodir=/usr/pbi/bind-i386/info/' '--build=i386-portbld-freebsd8.3' 'build_alias=i386-portbld-freebsd8.3' 'CC=cc' 'CFLAGS=-O2 -pipe -fno-strict-aliasing' 'LDFLAGS= -Wl,-rpath=/usr/lib:/usr/pbi/bind-i386/lib' 'CPPFLAGS=' 'CPP=cpp'
    Oct 13 10:37:17 router.hex.divide named[36871]: ----------------------------------------------------
    Oct 13 10:37:17 router.hex.divide named[36871]: BIND 9 is maintained by Internet Systems Consortium,
    Oct 13 10:37:17 router.hex.divide named[36871]: Inc. (ISC), a non-profit 501(c)(3) public-benefit
    Oct 13 10:37:17 router.hex.divide named[36871]: corporation.  Support and training for BIND 9 are
    Oct 13 10:37:17 router.hex.divide named[36871]: available at https://www.isc.org/support
    Oct 13 10:37:17 router.hex.divide named[36871]: ----------------------------------------------------
    Oct 13 10:37:17 router.hex.divide named[36871]: found 1 CPU, using 1 worker thread
    Oct 13 10:37:17 router.hex.divide named[36871]: using 1 UDP listener per interface
    Oct 13 10:37:17 router.hex.divide named[36871]: using up to 4096 sockets
    Oct 13 10:37:17 router.hex.divide named[36871]: loading configuration from '/etc/namedb/named.conf'
    Oct 13 10:37:17 router.hex.divide named[36871]: using default UDP/IPv4 port range: [49152, 65535]
    Oct 13 10:37:17 router.hex.divide named[36871]: using default UDP/IPv6 port range: [49152, 65535]
    Oct 13 10:37:17 router.hex.divide named[36871]: listening on IPv4 interface rl1, 192.168.224.1#53
    Oct 13 10:37:17 router.hex.divide named[36871]: Could not open '/var/run/named/pid'.
    Oct 13 10:37:17 router.hex.divide named[36871]: Please check file and directory permissions or reconfigure the filename.
    Oct 13 10:37:17 router.hex.divide named[36871]: could not open file '/var/run/named/pid': Read-only file system
    Oct 13 10:37:17 router.hex.divide named[36871]: unlink '/var/run/named/pid': failed
    Oct 13 10:37:17 router.hex.divide named[36871]: generating session key for dynamic DNS
    Oct 13 10:37:17 router.hex.divide named[36871]: Could not open '/var/run/named/session.key'.
    Oct 13 10:37:17 router.hex.divide named[36871]: Please check file and directory permissions or reconfigure the filename.
    Oct 13 10:37:17 router.hex.divide named[36871]: could not open file '/var/run/named/session.key': Read-only file system
    Oct 13 10:37:17 router.hex.divide named[36871]: could not create /var/run/named/session.key
    Oct 13 10:37:17 router.hex.divide named[36871]: failed to generate session key for dynamic DNS: permission denied
    Oct 13 10:37:17 router.hex.divide named[36871]: file.c:356: unexpected error:
    Oct 13 10:37:17 router.hex.divide named[36871]: unable to convert errno to isc_result: 30: Read-only file system
    Oct 13 10:37:17 router.hex.divide named[36871]: sizing zone task pool based on 0 zones
    Oct 13 10:37:17 router.hex.divide named[36871]: /etc/namedb/named.conf:9: using specific query-source port suppresses port randomization and can be insecure.
    Oct 13 10:37:17 router.hex.divide named[36871]: set up managed keys zone for view _default, file 'managed-keys.bind'
    Oct 13 10:37:17 router.hex.divide named[36871]: automatic empty zone: 10.IN-ADDR.ARPA
    Oct 13 10:37:17 router.hex.divide named[36871]: automatic empty zone: 16.172.IN-ADDR.ARPA
    Oct 13 10:37:17 router.hex.divide named[36871]: automatic empty zone: 17.172.IN-ADDR.ARPA
    
    ... trimmed ...
    
    Oct 13 10:37:17 router.hex.divide named[36871]: automatic empty zone: 8.B.D.0.1.0.0.2.IP6.ARPA
    Oct 13 10:37:17 router.hex.divide named[36871]: /etc/namedb/named.conf:9: using specific query-source port suppresses port randomization and can be insecure.
    Oct 13 10:37:17 router.hex.divide named[36871]: open: /usr/pbi/bind-i386/etc/rndc.key: file not found
    Oct 13 10:37:17 router.hex.divide named[36871]: couldn't add command channel 127.0.0.1#953: file not found
    Oct 13 10:37:17 router.hex.divide named[36871]: open: /usr/pbi/bind-i386/etc/rndc.key: file not found
    Oct 13 10:37:17 router.hex.divide named[36871]: couldn't add command channel ::1#953: file not found
    Oct 13 10:37:17 router.hex.divide named[36871]: could not open entropy source /dev/random: file not found
    Oct 13 10:37:17 router.hex.divide named[36871]: using pre-chroot entropy source /dev/random
    Oct 13 10:37:17 router.hex.divide named[36871]: the working directory is not writable
    Oct 13 10:37:17 router.hex.divide named[36871]: stdio.c:36: unexpected error:
    Oct 13 10:37:17 router.hex.divide named[36871]: unable to convert errno to isc_result: 30: Read-only file system
    Oct 13 10:37:17 router.hex.divide named[36871]: isc_stdio_open '/var/log/named.log' failed: unexpected error
    Oct 13 10:37:17 router.hex.divide named[36871]: configuring logging: unexpected error
    Oct 13 10:37:17 router.hex.divide named[36871]: loading configuration: unexpected error
    Oct 13 10:37:17 router.hex.divide named[36871]: exiting (due to fatal error)
    Oct 13 10:37:17 router.hex.divide php: /pkg_edit.php: The command '/usr/local/etc/rc.d/named.sh restart' returned exit code '1', the output was ''
    
    


  • What pfsense version are you using?
    I have tested it on 2.1 amd64 and i386.



  • @marcelloc:

    What pfsense version are you using?
    I have tested it on 2.1 amd64 and i386.

    2.1-RELEASE (i386)
    built on Wed Sep 11 18:16:44 EDT 2013
    FreeBSD 8.3-RELEASE-p11

    nanobsd (4g)



  • @dividehex:

    Marcelloc,

    Thanks for the bind package!

    Firt code files as contributions from Juliano Oliveira/Adriano Brancher.
    I've started some modifications from this point.

    @dividehex:

    A couple issues I found so far.

    Ok. I'll update it to include missing conf mount rw and ro.


  • LAYER 8 Global Moderator

    Sweet I have to try this out!!  Something new to play with - the ability to do zone xfers to other bind/dns boxes on my network.. Have you included that in your gui?  This would be a must have functionality in the gui I would think!



  • @johnpoz:

    Sweet I have to try this out!!  Something new to play with - the ability to do zone xfers to other bind/dbns boxes on my network.. Have you included that in your gui?  This would be a must have functionality in the gui I would think!

    You can configure master or slave zones with notify.



  • @marcelloc:

    Ok. I'll update it to include missing conf mount rw and ro.

    Code updated with no version change. Just reinstall the package in 15 minutes.


  • LAYER 8 Global Moderator

    I don't think this quite ready for prime time?

    Running
    2.1-RELEASE (i386)
    built on Wed Sep 11 18:16:50 EDT 2013
    FreeBSD 8.3-RELEASE-p11

    But says it loading /etc/namedb/named.conf

    Oct 14 23:33:49 named[69425]: starting BIND 9.9.4 -c /etc/namedb/named.conf -u bind -t /conf/named/
    Oct 14 23:33:49 named[69425]: loading configuration from '/etc/namedb/named.conf'

    But I looked and there is no named.conf in that folder.. There is not even a folder called that
    [2.1-RELEASE][admin@pfsense.local.lan]/etc(16): pwd
    /etc
    [2.1-RELEASE][admin@pfsense.local.lan]/etc(17): cd namedb
    namedb: No such file or directory.

    Nor is there any log file in /var/log for named?

    And you see these errors
    Oct 14 23:33:49 named[69425]: the working directory is not writable
    Oct 14 23:33:49 named[69425]: using pre-chroot entropy source /dev/random
    Oct 14 23:33:49 named[69425]: could not open entropy source /dev/random: file not found
    Oct 14 23:33:49 named[69425]: couldn't add command channel ::1#953: file not found
    Oct 14 23:33:49 named[69425]: open: /usr/pbi/bind-i386/etc/rndc.key: file not found
    Oct 14 23:33:49 named[69425]: couldn't add command channel 127.0.0.1#953: file not found
    Oct 14 23:33:49 named[69425]: open: /usr/pbi/bind-i386/etc/rndc.key: file not found
    Oct 14 23:33:49 named[69425]: /etc/namedb/named.conf:9: using specific query-source port suppresses port randomization and can be insecure.

    where the one is
    Oct 14 23:33:49 named[69425]: the working directory is not writable

    Now I can query it and finds google.com ok, but can not seem to get it to load any of my zones..

    And zone name is a bit misleading.. Is that the actual zone, so say local.lan and then my A records just need be say pfsense and the IP 192.168.1.2 – when you say NAME of the zone do you mean the actual zone, or the name I want to use to know what it is?

    For reverse to I need to use the IN-ADDR.ARPA or can I put in say 192.168.1 for 1.168.192.IN-ADDR.ARPA ?



  • The in-addr.arpa is automatic with reverse zone checkbox.


  • LAYER 8 Global Moderator

    but it doesn't change the name?  So the box where you put the name is a bit unclear.

    What about the lack of creation of the namedb dir and named.conf file?



  • @johnpoz:

    but it doesn't change the name?  So the box where you put the name is a bit unclear.

    What about the lack of creation of the namedb dir and named.conf file?

    I'll try to create a nanobsd image on virtual box to test it. On full install it's working fine.


  • LAYER 8 Global Moderator

    I am on a full install not a nano anything - I installed the package, and it created the menu items and such..  I created zones, but it never creates this namedb folder as you can see.  So no its not working fine via a full version of pfsense.



  • marcelloc,

    Thanks for your work in creating the bind package. I'm looking forward to using it for name service over IPv6 transport. The GUI for tinydns won't instruct the software to bind to an IPv6 address. I'm hoping your GUI for bind has better IPv6 support.

    I'm also seeing the same behavior as johnpoz, so I can't test bind with IPv6 yet.



  • Hi there, just started using this package :)

    A few things to mention:

    • When creating a "Reverse Zone" the "in-addr.arpa" is added but the IP octets are not reversed
      ie. Adding "192.168.1", creates zone: "192.168.1.in-addr.arpa", which should be "1.168.192.in-addr-arpa"

    • When creating a "slave" zone, the GUI still requires a record to be created at the bottom of the page.

    • When creating a slave, entering the "IP Master Zone" doesn't add a semi-colon ( ; ) to the config for the list of masters, ie. "masters { 192.168.1.1 };" which should be "masters { 192.168.1.1; };"

    Feature Request: Ability to view the current records on a slave zone (or point me to where the records should be on the filesystem as I can't seem to find them)


  • LAYER 8 Global Moderator

    stalks – what flavor of pfsense are you running?  And your etc/namedb/named.conf got created?

    Where were your zone files created?  I could not find the named.conf file that it was saying it was loading to look to see what it was even calling the forwards or reverse zones.



  • @marcelloc:

    @marcelloc:

    Ok. I'll update it to include missing conf mount rw and ro.

    Code updated with no version change. Just reinstall the package in 15 minutes.

    Marcelloc,
    Thanks.  I reinstalled the package and this fixed the issues I was having.  I'll keep poking at it for other bugs.



  • @stalks:

    When creating a "Reverse Zone" the "in-addr.arpa" is added but the IP octets are not reversed
    ie. Adding "192.168.1", creates zone: "192.168.1.in-addr.arpa", which should be "1.168.192.in-addr-arpa"

    @stalks:

    When creating a "slave" zone, the GUI still requires a record to be created at the bottom of the page.

    @stalks:

    When creating a slave, entering the "IP Master Zone" doesn't add a semi-colon ( ; ) to the config for the list of masters, ie. "masters { 192.168.1.1 };" which should be "masters { 192.168.1.1; };"


  • LAYER 8 Global Moderator

    Ok I have reinstalled the package, both pkg button and xml button.  I go in disable dns forwarder, enable bind in its menu item that is created.

    Go in and double check that zones are there, hit save, restart service, etc.

    And there is still no etc/namedb folder

    [2.1-RELEASE][root@pfsense.local.lan]/root(1): cd /etc/
    [2.1-RELEASE][root@pfsense.local.lan]/etc(2): cd namedb
    namedb: No such file or directory.
    [2.1-RELEASE][root@pfsense.local.lan]/etc(3):

    but the log says that is where its loading its conf file from

    Oct 16 13:38:26 named[97452]: loading configuration from '/etc/namedb/named.conf'

    But I also get this error
    Oct 16 13:38:26 named[97452]: the working directory is not writable

    I can query bind..

    ; <<>> DiG 9.9.2-P1 <<>> chaos txt version.bind @192.168.1.253
    ;; global options: +cmd
    ;; Got answer:
    ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 29640
    ;; flags: qr aa rd; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 1
    ;; WARNING: recursion requested but not available

    ;; OPT PSEUDOSECTION:
    ; EDNS: version: 0, flags:; udp: 4096
    ;; QUESTION SECTION:
    ;version.bind.                  CH      TXT

    ;; ANSWER SECTION:
    version.bind.          0      CH      TXT    "9.9.4"

    ;; AUTHORITY SECTION:
    version.bind.          0      CH      NS      version.bind.

    ;; Query time: 3 msec
    ;; SERVER: 192.168.1.253#53(192.168.1.253)
    ;; WHEN: Wed Oct 16 13:43:05 2013
    ;; MSG SIZE  rcvd: 73

    And it looks up stuff from net  - but it does not serve up zones I created

    budman@ubuntu:~$ dig @192.168.1.253 www.pfsense.org +short
    192.207.126.26
    budman@ubuntu:~$

    ;; QUESTION SECTION:
    ;local.lan.                    IN      SOA

    ;; AUTHORITY SECTION:
    .                      0      IN      SOA    a.root-servers.net. nstld.verisign-grs.com. 2013101601 1800 900 604800 86400

    ;; Query time: 43 msec
    ;; SERVER: 192.168.1.253#53(192.168.1.253)
    ;; WHEN: Wed Oct 16 13:44:32 2013
    ;; MSG SIZE  rcvd: 113

    Something is not right with this package..  Running on

    2.1-RELEASE (i386)
    built on Wed Sep 11 18:16:50 EDT 2013
    FreeBSD 8.3-RELEASE-p11



  • @johnpoz:

    stalks – what flavor of pfsense are you running?  And your etc/namedb/named.conf got created?

    Where were your zone files created?  I could not find the named.conf file that it was saying it was loading to look to see what it was even calling the forwards or reverse zones.

    HDD install i386

    named.conf was created, can see zone "domain.com" { .. etc .. but the actual zone files, don't know where they are going

    @johnpoz

    $: find / -name 'named.conf'
    /usr/local/etc/named.conf
    /usr/pbi/bind-i386/etc/named.conf
    /cf/conf/named/etc/namedb/named.conf


  • LAYER 8 Global Moderator

    ok yup I can view that

    cat /cf/conf/named/etc/namedb/named.conf
    #Bind pfsense configuration
    #Do not edit this file!!!

    options {
                    directory "/etc/namedb";
                    pid-file "/var/run/named/pid";

    but notice it points to /etc/namedb – which isn't there!

    Those other locations get shown in the find - but they are not really there.  Why does the log say its loading /etc/namedb/named.conf ??



  • named runs in a jail so it has its own folder structure seperate from /


  • LAYER 8 Global Moderator

    ok - where is it suppose to be loading the zone files from, because they are not loading.. And lots of errors get put into the system log.

    shouldn't they be in
    /cf/conf/named/etc/namedb

    I only show named.conf and named.root in there



  • Thats what I can't find as well :)


  • LAYER 8 Global Moderator

    but your saying your zones resolve?  I have a forward zone and none of the entries resolve.  Even though bind comes up and I an resolve outside stuff, my local zone is not working.

    I don't think they are getting created - and clearly there is something not quite right when the log says it is loading /etc/named/named.conf – but its really in /cf/conf/named/etc/namedb/named.conf and in that .conf it says working directory is /etc/namedb -- when it should point to /cf/conf/named/etc/namedb/

    Not a real jail expert, but this does not seem right to me.

    Would love to start playing with it and looking for more bugs, etc.  But if I can not even get it to resolve my pfsense.local.lan -- how can I use it?



  • version 0.1.4 is out.

    zone tab now shows result config.
    fixed slave zone fields checks
    fixed master zone ip missing ";"
    changed folder check/creation from /conf symlink to /cf dir.

    I've testes several times folder creation and it's fine under /cf/named



  • @marcelloc:

    version 0.1.4 is out.

    zone tab now shows result config.
    fixed slave zone fields checks
    fixed master zone ip missing ";"
    changed folder check/creation from /conf symlink to /cf dir.

    I've testes several times folder creation and it's fine under /cf/named

    The zone files are not being created because the permissions of the directories are not allowing the user "bind" to write.

    I created a view called "default", and the permissions of /cf/named/etc/namedb/slave/default are "drwxr-xr-x root wheel"

    I then ran the following command: chgrp bind /cf/named/etc/namedb/slave/default; chmod g+w /cf/named/etc/namedb/slave/default;

    The new permissions are then "drwxrwxr-x root bind"

    Then restarted bind using the web interface, and the files are all created, and the resulting config can be seen in the web interface.



  • Feature request: forward zones

    Woudl be similar to slave zones, but even more simple.

    Example of forward zone config:

    zone "example.com" { type forward; forward only; forwarders { 192.168.1.1; 192.168.1.2; }; };



  • Check version 0.1.5

    main changes

    • Add forward zone option

    • Add rndc config to named.conf

    • Add widget to dashboard

    • Include dev/random,null and zero on named chroot dir

    • Check slave zone dir permissions



  • and on pkg 0.2

    • dnssec

    :)



  • This is awesome :) All seems to be working great, nice work indeed.


  • LAYER 8 Global Moderator

    Ok – wtf, now getting refused..

    C:>dig pfsense.local.lan

    ; <<>> DiG 9.9.4 <<>> pfsense.local.lan
    ;; global options: +cmd
    ;; Got answer:
    ;; ->>HEADER<<- opcode: QUERY, status: REFUSED, id: 16069
    ;; flags: qr rd; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1
    ;; WARNING: recursion requested but not available

    ;; OPT PSEUDOSECTION:
    ; EDNS: version: 0, flags:; udp: 4096
    ;; QUESTION SECTION:
    ;pfsense.local.lan.            IN      A

    ;; Query time: 4 msec
    ;; SERVER: 192.168.1.253#53(192.168.1.253)
    ;; WHEN: Fri Oct 18 07:48:22 Central Daylight Time 2013
    ;; MSG SIZE  rcvd: 46

    I have edited the ACL every which way I can think of, I see the configs in the zones.. Gone and updated them - restared.. Let me take a look at the named.conf and see what it says for acls, etc..

    This package is looking like one sweet deal -- just not able to get it work ;)

    edit:  YEAH!!!  Its working!!!  have to actually highlight the lists in vies section.

    ; <<>> DiG 9.9.4 <<>> pfsense.local.lan
    ;; global options: +cmd
    ;; Got answer:
    ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 31349
    ;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 1

    ;; OPT PSEUDOSECTION:
    ; EDNS: version: 0, flags:; udp: 4096
    ;; QUESTION SECTION:
    ;pfsense.local.lan.            IN      A

    ;; ANSWER SECTION:
    pfsense.local.lan.      86400  IN      A      192.168.1.253

    ;; AUTHORITY SECTION:
    local.lan.              86400  IN      NS      pfsense.local.lan.

    ;; Query time: 4 msec
    ;; SERVER: 192.168.1.253#53(192.168.1.253)
    ;; WHEN: Fri Oct 18 07:53:50 Central Daylight Time 2013
    ;; MSG SIZE  rcvd: 76

    Got my PTR zones working -- yeah this seems to ROCK!!!!  Will have to test out the dnssec stuff today..  But THANK YOU!  This has been a long awaited addition to pfsense...



  • Is there a setup tutorial for this that I can follow?


  • LAYER 8 Global Moderator

    Might not be a bad idea - seems you have to have a view setup, and ACLs - and you have to highlight them in the zone or it doesn't like to work.

    I just broke mine again with trying to enable the dnssec, had to delete the zone files and then go back in into the zones so they were recreated, etc.

    Might be nice to allow checkconf from the gui to see its output.. But there is clearly some stuff with the chroot that I don't quite get..  still looks like /etc/namedb/named.conf - but this is really in /cf/named/etc/namedb but there there is also something to do with /usr/pbi/bind-i386/etc/named.conf ???

    Some info on how this chroot stuff works for this package would be just fantastic!!!



  • @AhnHEL:

    Is there a setup tutorial for this that I can follow?

    Just follow package tabs from left to right.

    All you need is there :)



  • @johnpoz:

    Might not be a bad idea - seems you have to have a view setup, and ACLs - and you have to highlight them in the zone or it doesn't like to work.

    These are all bind requirementes but I've included more info on acl options to get it clear.

    @johnpoz:

    I just broke mine again with trying to enable the dnssec, had to delete the zone files and then go back in into the zones so they were recreated, etc.

    what erros? I'm testing it massively and getting no errors.

    @johnpoz:

    Might be nice to allow checkconf from the gui to see its output.. But there is clearly some stuff with the chroot that I don't quite get..  still looks like /etc/namedb/named.conf - but this is really in /cf/named/etc/namedb but there there is also something to do with /usr/pbi/bind-i386/etc/named.conf ???

    Some info on how this chroot stuff works for this package would be just fantastic!!!

    Just take a look on named process:
    ps ax | grep -i named
    83446  ??  Is    0:00.02 /usr/pbi/bind-amd64/sbin/named -c /etc/namedb/named.conf -u bind -t /cf/named/

    Join chroot dir and conf dir to understand how it works.


  • LAYER 8 Global Moderator

    I get SERVFAIL - thought I posted up a screenie before, anyway can repeat the error.

    So as you can see working fine - did a query for pfsense.local.lan get an answer all is good.

    Then I go into the zone, click "Enable inline DNSSEC Signing for this zones. "  hit save in the zone, then on the overall zone tab hit save again.  Do my query again and get SERVFAIL

    Going back into the zone and unchecking it and resaving does not correct the problem.. Have to delete all the files for that zone in the zone file area - for me its /cf/named/etc/namedb/master/everyone and then resave then it its back to working.  Because I call my view everyone.

    My point about having to highlight, I understand those are requirements for the configuration.  But it doesn't auto use if there is only 1.. You still have to actually click on it so its highlighted on the gui page, or its not used in the config.  Was like what the hell.  It says its using my all acl allow..  No not really have to highlight them for it to work - see second pic

    So notes about having to highlight might be good thing to add to documentation on the section, etc.






  • @johnpoz:

    Then I go into the zone, click "Enable inline DNSSEC Signing for this zones. "  hit save in the zone, then on the overall zone tab hit save again.  Do my query again and get SERVFAIL

    I'm not a DNSSEC specialist but if IRC, you need a parent zone to validate your dnssec zone(DS record on parent/root domain).

    take a look on this whitepaper.

    page 3
    The Chain of trust
    "…Surely the
    public key isn’t just signed by the zone’s private key, which would mean that the public key would validate itself..."

    "...No, the public key’s validity is established by the zone’s parent. For example, if our signed zone is called infoblox.
    com, it’s the com zone that vouches for the infoblox.com zone’s public key..."

    "...after the infoblox.com zone has been signed, the administrator sends a copy of his public key to the administrator of the com zone..."

    @johnpoz:

    Going back into the zone and unchecking it and resaving does not correct the problem

    I'll test it here.

    Other point. I've updated field info for zone acl. Transfer and updated acl should be restricted, not allowed to everyone. If you do not select any acl on it, means no access. That's why the package does not select automatically when only one acl is defined.


  • LAYER 8 Global Moderator

    This goes back to the request for documentation/guide on using the package, etc.

    From what I can tell so far you have put created one hell of a package!!!  Freaking should be part of pfsense base install for bind support..  Dude this package just ROCKS!!!  Ability for user to run full bind with a simple gui interface is fantastic!!!  I can not say that enough.

    But it needs a bit of documentation on its use is all - bind is a very complicated product, so to let users use it with a simple gui interface is going to put pfsense way above all other sim distro's for sure!!!  So its going to draw in more and more users than just don't even understand the basics.  Which is why it needs to be documented very well.

    Let me know how I can help is what I am saying.. I am on the road but when I get some free time will dive into testing this package more - love the fact that you show the actual config file, etc..

    I have never gotten into details of the jail stuff, so some basics on how that works would really help in the documentation..  Because looking at the logs saying conf is in loaded from /etc/namedb when that is not really the case is confusing.

    And then details of how to get dnssec to work will help - what I can tell you from limited play time with the package so far is if I click on that setting is it breaks bind..  If there is something need to do – that needs to be documented, etc..

    please let me know how I can help - this package is just pure gold and want to see it become part of the base install options, etc..  What I see so far is gold.. just needs some documentation and a few tweaks and it will be ready for prime time!!

    thank you for all the work you have put into this!!


Log in to reply