Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Bind package for pfsense 2.1

    pfSense Packages
    44
    153
    64.0k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • KOMK
      KOM
      last edited by

      They are very busy with the upcoming pfSense 2.2 based on FreeBSD 10.  There are snapshots you can try, but a production version is still many months away.

      1 Reply Last reply Reply Quote 0
      • R
        router_wang
        last edited by

        @periko:

        Try to setup, buy i have this errors related to crypto stuff.

        Jul 25 14:56:53 firewall named[47298]: built with '–localstatedir=/var' '--disable-linux-caps' '--disable-symtable' '--with-randomdev=/dev/random' '--with-libxml2=/usr/pbi/bind-amd64' '--without-python' '--enable-filter-aaaa' '--disable-fixed-rrset' '--without-gssapi' '--without-idn' '--enable-ipv6' '--enable-largefile' '--disable-newstats' '--disable-rpz-nsdname' '--disable-rpz-nsip' '--enable-rrl' 'STD_CDEFINES=-DDIG_SIGCHASE=1' '--with-openssl=/usr/pbi/bind-amd64' '--with-dlz-filesystem=yes' '--enable-threads' '--sysconfdir=/usr/pbi/bind-amd64/etc' '--prefix=/usr/pbi/bind-amd64' '--mandir=/usr/pbi/bind-amd64/man' '--infodir=/usr/pbi/bind-amd64/info/' '--build=x86_64-portbld-freebsd8.3' 'build_alias=x86_64-portbld-freebsd8.3' 'CC=cc' 'CFLAGS=-O2 -pipe -fno-strict-aliasing' 'LDFLAGS= -Wl,-rpath,/usr/pbi/bind-amd64/lib' 'CPPFLAGS=' 'CPP=cpp'
        Jul 25 14:56:53 firewall named[47298]: –--------------------------------------------------
        Jul 25 14:56:53 firewall named[47298]: BIND 9 is maintained by Internet Systems Consortium,
        Jul 25 14:56:53 firewall named[47298]: Inc. (ISC), a non-profit 501©(3) public-benefit
        Jul 25 14:56:53 firewall named[47298]: corporation.  Support and training for BIND 9 are
        Jul 25 14:56:53 firewall named[47298]: available at https://www.isc.org/support
        Jul 25 14:56:53 firewall named[47298]: –--------------------------------------------------
        Jul 25 14:56:53 firewall named[47298]: found 2 CPUs, using 2 worker threads
        Jul 25 14:56:53 firewall named[47298]: using 2 UDP listeners per interface
        Jul 25 14:56:53 firewall named[47298]: using up to 4096 sockets
        Jul 25 14:56:53 firewall named[47298]: ENGINE_by_id failed (crypto failure)
        Jul 25 14:56:53 firewall named[47298]: error:25070067:DSO support routines:DSO_load:could not load the shared library:dso_lib.c:244:
        Jul 25 14:56:53 firewall named[47298]: error:260B6084:engine routines:DYNAMIC_LOAD:dso not found:eng_dyn.c:450:
        Jul 25 14:56:53 firewall named[47298]: error:2606A074:engine routines:ENGINE_by_id:no such engine:eng_list.c:418:id=gost
        Jul 25 14:56:53 firewall named[47298]: initializing DST: crypto failure
        Jul 25 14:56:53 firewall named[47298]: exiting (due to fatal error)

        I reinstall the package but same error, maybe need to reinstall the whole system again?

        Same problem here…. I guess I'll go run the fix.... :(

        1 Reply Last reply Reply Quote 0
        • M
          MnM
          last edited by

          Just like others before me:

          Installed bind, configured it. Have couple of zones (allowing DHCP to populate as well)
          I can resolve external addresses but nothing from my zones. I cant work it out why. DNS forwarder is off, I have aaded a temp rule to any, any any. Same result.

          From a host on my network:

          xbox360
          Server:        192.168.0.254
          Address:        192.168.0.254#53

          ** server can't find xbox360: NXDOMAIN

          xbox360
          Server:        192.168.0.254
          Address:        192.168.0.254#53

          ** server can't find xbox360: NXDOMAIN

          or after adding the domain part:

          xbox360.domain.local
          ;; Got SERVFAIL reply from 192.168.0.254, trying next server
          ;; connection timed out; trying next origin
          Server:        192.168.0.254
          Address:        192.168.0.254#53

          ** server can't find xbox360.domain.local: NXDOMAIN

          The logs are:

          Aug 25 22:21:43 named[23629]: resolver: debug 3: fctx 0x803392000(xbox360/A): destroy
          Aug 25 22:21:43 named[23629]: resolver: debug 3: fctx 0x803392000(xbox360/A): unlink
          Aug 25 22:21:43 named[23629]: resolver: debug 3: fctx 0x803392000(xbox360/A): cancelqueries
          Aug 25 22:21:43 named[23629]: resolver: debug 3: fctx 0x803392000(xbox360/A): stopeverything
          Aug 25 22:21:43 named[23629]: resolver: debug 3: fctx 0x803392000(xbox360/A): doshutdown
          Aug 25 22:21:43 named[23629]: resolver: debug 3: fctx 0x803392000(xbox360/A): shutdown
          Aug 25 22:21:43 named[23629]: resolver: debug 3: fetch 0x802e3aa00 (fctx 0x803392000(xbox360/A)): destroyfetch
          Aug 25 22:21:43 named[23629]: client: debug 3: client 192.168.0.177#58120 (xbox360): view LAN: endrequest
          Aug 25 22:21:43 named[23629]: client: debug 3: client 192.168.0.177#58120 (xbox360): view LAN: next
          Aug 25 22:21:43 named[23629]: client: debug 3: client 192.168.0.177#58120 (xbox360): view LAN: senddone
          Aug 25 22:21:43 named[23629]: client: debug 3: client 192.168.0.177#58120 (xbox360): view LAN: sendto
          Aug 25 22:21:43 named[23629]: client: debug 3: client 192.168.0.177#58120 (xbox360): view LAN: send

          1 Reply Last reply Reply Quote 0
          • M
            mrwizardno2
            last edited by

            I think I may have found an issue with IPV6 reverse zones.

            When creating a reverse zone, I enter the nibble format of  2001:470:1f11:1062::/64, which is 1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.6.0.1.1.1.f.1.0.7.4.0.1.0.0.2 as the Zone Name. Based off the directions given (and the grouchiness of the service if you enter anything after that!) I omit the .ip6.arpa. bit.

            This results in a zone file that contains what I think might be an invalid ORIGIN.

            $ORIGIN 2.6.0.1.1.1.f.1.0.7.4.0.1.0.0.2.in-addr.arpa.

            Should it not be $ORIGIN 2.6.0.1.1.1.f.1.0.7.4.0.1.0.0.2.ip6.arpa. ?

            When I try to do a lookup, I never get a response because it's looking for a different zone.

            Jimmies-MacBook:~ jimmie$ dig @2607:fcc8:ffc0:6a:2cba:30be:e115:969d -x 2001:470:1f11:1062::1

; <<>> DiG 9.8.3-P1 <<>> @2607:fcc8:ffc0:6a:2cba:30be:e115:969d -x 2001:470:1f11:1062::1
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 9412
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.6.0.1.1.1.f.1.0.7.4.0.1.0.0.2.ip6.arpa. IN PTR

;; Query time: 3007 msec
;; SERVER: 2607:fcc8:ffc0:6a:2cba:30be:e115:969d#53(2607:fcc8:ffc0:6a:2cba:30be:e115:969d)
;; WHEN: Fri Sep  5 23:53:54 2014
;; MSG SIZE  rcvd: 90

            Also, this is in the log file at service refresh.

            named[31510]: general: warning: /etc/namedb/master/Internal/2.6.0.1.1.1.f.1.0.7.4.0.1.0.0.2.DB:21: ignoring out-of-zone data (1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.6.0.1.1.1.f.1.0.7.4.0.1.0.0.2.ip6.arpa)
            1 Reply Last reply Reply Quote 0
            • C
              Caboosey
              last edited by

              @periko:

              Try to setup, buy i have this errors related to crypto stuff.

              Jul 25 14:56:53 firewall named[47298]: built with '–localstatedir=/var' '--disable-linux-caps' '--disable-symtable' '--with-randomdev=/dev/random' '--with-libxml2=/usr/pbi/bind-amd64' '--without-python' '--enable-filter-aaaa' '--disable-fixed-rrset' '--without-gssapi' '--without-idn' '--enable-ipv6' '--enable-largefile' '--disable-newstats' '--disable-rpz-nsdname' '--disable-rpz-nsip' '--enable-rrl' 'STD_CDEFINES=-DDIG_SIGCHASE=1' '--with-openssl=/usr/pbi/bind-amd64' '--with-dlz-filesystem=yes' '--enable-threads' '--sysconfdir=/usr/pbi/bind-amd64/etc' '--prefix=/usr/pbi/bind-amd64' '--mandir=/usr/pbi/bind-amd64/man' '--infodir=/usr/pbi/bind-amd64/info/' '--build=x86_64-portbld-freebsd8.3' 'build_alias=x86_64-portbld-freebsd8.3' 'CC=cc' 'CFLAGS=-O2 -pipe -fno-strict-aliasing' 'LDFLAGS= -Wl,-rpath,/usr/pbi/bind-amd64/lib' 'CPPFLAGS=' 'CPP=cpp'
              Jul 25 14:56:53 firewall named[47298]: –--------------------------------------------------
              Jul 25 14:56:53 firewall named[47298]: BIND 9 is maintained by Internet Systems Consortium,
              Jul 25 14:56:53 firewall named[47298]: Inc. (ISC), a non-profit 501©(3) public-benefit
              Jul 25 14:56:53 firewall named[47298]: corporation.  Support and training for BIND 9 are
              Jul 25 14:56:53 firewall named[47298]: available at https://www.isc.org/support
              Jul 25 14:56:53 firewall named[47298]: –--------------------------------------------------
              Jul 25 14:56:53 firewall named[47298]: found 2 CPUs, using 2 worker threads
              Jul 25 14:56:53 firewall named[47298]: using 2 UDP listeners per interface
              Jul 25 14:56:53 firewall named[47298]: using up to 4096 sockets
              Jul 25 14:56:53 firewall named[47298]: ENGINE_by_id failed (crypto failure)
              Jul 25 14:56:53 firewall named[47298]: error:25070067:DSO support routines:DSO_load:could not load the shared library:dso_lib.c:244:
              Jul 25 14:56:53 firewall named[47298]: error:260B6084:engine routines:DYNAMIC_LOAD:dso not found:eng_dyn.c:450:
              Jul 25 14:56:53 firewall named[47298]: error:2606A074:engine routines:ENGINE_by_id:no such engine:eng_list.c:418:id=gost
              Jul 25 14:56:53 firewall named[47298]: initializing DST: crypto failure
              Jul 25 14:56:53 firewall named[47298]: exiting (due to fatal error)

              I reinstall the package but same error, maybe need to reinstall the whole system again?

              I am same issue. The x64 fix will do nothing for me since my pfsense is x86.

              My hardware is a Watchguard Firebox X700 running pfSense 2.1.5 (i386).

              1 Reply Last reply Reply Quote 0
              • M
                madforic
                last edited by

                Try this, to fix ip6.arpa issue

                https://forum.pfsense.org/index.php?topic=67917.msg383934#msg383934

                1 Reply Last reply Reply Quote 0
                • N
                  nadir.latif
                  last edited by

                  Hi,

                  We are using bind package for pfsense. One drawback of the package is that it does not allow fine grained control over the configuration. For example it is not possible to configure keys in acls. Also it is not possible to use negation operator in acls. Both these are needed in Bind multi view replication. It would be useful to be able to make these changes in bind from the pfsense gui.

                  Thanks,

                  Nadir Latif

                  1 Reply Last reply Reply Quote 0
                  • Q
                    qseb
                    last edited by

                    Hi
                    thank you so much for your great job on bind package!

                    It's related to read-only filesystem. I'm:

                    • on 2.1-RELEASE (i386) built on Wed Sep 11 18:16:22 EDT 2013 FreeBSD 8.3-RELEASE-p11 nanobsd 4Go
                    • with bind 9.9.5P1_5 pkg v 0.3.6

                    extracts from logs when I try to notify a slave zone hosted on pfsense:

                    Feb  3 22:43:34 pf02 named[60496]: notify: info: client 172.16.0.5#36109: view test_view: received notify for zone 'zonecompany.al'
Feb  3 22:43:34 pf02 named[60496]: general: debug 1: queue_soa_query: zone zonecompany.al/IN/test_view: enter
Feb  3 22:43:34 pf02 named[60496]: general: debug 1: soa_query: zone zonecompany.al/IN/test_view: enter
Feb  3 22:43:34 pf02 named[60496]: general: debug 1: refresh_callback: zone zonecompany.al/IN/test_view: enter
Feb  3 22:43:34 pf02 named[60496]: general: debug 1: refresh_callback: zone zonecompany.al/IN/test_view: serial: new 2015020301, old 2014122901
Feb  3 22:43:34 pf02 named[60496]: general: debug 1: queue_xfrin: zone zonecompany.al/IN/test_view: enter
Feb  3 22:43:34 pf02 named[60496]: general: info: zone zonecompany.al/IN/test_view: Transfer started.
Feb  3 22:43:34 pf02 named[60496]: general: debug 1: zone zonecompany.al/IN/test_view: requesting IXFR from 172.16.0.5#53
Feb  3 22:43:34 pf02 named[60496]: xfer-in: info: transfer of 'zonecompany.al/IN/test_view' from 172.16.0.5#53: connected using 10.0.17.2#16732
Feb  3 22:43:34 pf02 named[60496]: general: debug 1: zone_needdump: zone zonecompany.al/IN/test_view: enter
Feb  3 22:43:34 pf02 named[60496]: general: debug 1: zone_settimer: zone zonecompany.al/IN/test_view: enter
Feb  3 22:43:34 pf02 named[60496]: database: debug 1: calling free_rbtdb(zonecompany.al)
Feb  3 22:43:34 pf02 named[60496]: database: debug 1: adjust_quantum -> 325
Feb  3 22:43:34 pf02 named[60496]: general: debug 1: zone zonecompany.al/IN/test_view: zone transfer finished: success
Feb  3 22:43:34 pf02 named[60496]: general: info: zone zonecompany.al/IN/test_view: transferred serial 2015020301
Feb  3 22:43:34 pf02 named[60496]: general: error: file.c:192: unexpected error:
Feb  3 22:43:34 pf02 named[60496]: general: error: unable to convert errno to isc_result: 30: Read-only file system
Feb  3 22:43:34 pf02 named[60496]: general: error: zone zonecompany.al/IN/test_view: transfer: could not set file modification time of '/etc/namedb/slave/test_view/zonecompany.al.DB': unexpected error
Feb  3 22:43:34 pf02 named[60496]: general: debug 1: zone_settimer: zone zonecompany.al/IN/test_view: enter
Feb  3 22:43:34 pf02 named[60496]: xfer-in: info: transfer of 'zonecompany.al/IN/test_view' from 172.16.0.5#53: Transfer completed: 1 messages, 227 records, 5805 bytes, 0.103 secs (56359 bytes/sec)
Feb  3 22:43:34 pf02 named[60496]: database: debug 1: done free_rbtdb(zonecompany.al)
Feb  3 22:43:34 pf02 named[60496]: general: debug 1: zone_timer: zone zonecompany.al/IN/test_view: enter
Feb  3 22:43:34 pf02 named[60496]: general: debug 1: zone_maintenance: zone zonecompany.al/IN/test_view: enter
Feb  3 22:43:34 pf02 named[60496]: general: debug 1: zone_dump: zone zonecompany.al/IN/test_view: enter
Feb  3 22:43:34 pf02 named[60496]: general: debug 1: zone_settimer: zone zonecompany.al/IN/test_view: enter
Feb  3 22:43:34 pf02 named[60496]: general: debug 1: zone_gotwritehandle: zone zonecompany.al/IN/test_view: enter
Feb  3 22:43:34 pf02 named[60496]: general: error: file.c:323: unexpected error:
Feb  3 22:43:34 pf02 named[60496]: general: error: unable to convert errno to isc_result: 30: Read-only file system
Feb  3 22:43:34 pf02 named[60496]: general: error: dumping master file: /etc/namedb/slave/test_view/tmp-YMLXyK5eB7: open: unexpected error

                    to make it working, I have to play with /etc/rc.conf_mount_rw before a notify and with /etc/rc.conf_mount_ro after…
                    On first page I saw some errors solved with an update, but maybe is there still some bugs  ;)

                    1 Reply Last reply Reply Quote 0
                    • S
                      stevew
                      last edited by

                      BIND slave zone is not updated.

                      I configured a BIND slave zone, all DNS entries on master zone has been synced to slave zone. But after that, any new DNS entries on master zone are not updated to slave zone.

                      "Enable Notify" is enabled on master server. "Allow-transfer" has set the slave server IP.

                      I didn't find any place to define a slave on master zone. I tried pfSense v2.1.x and v2.2.x.

                      Anything else needed to config?

                      Thanks!

                      1 Reply Last reply Reply Quote 0
                      • S
                        Scissorfish
                        last edited by

                        https://forum.pfsense.org/index.php?topic=103157.0

                        1 Reply Last reply Reply Quote 0
                        • H
                          hazza
                          last edited by

                          Running BIND 0.4.3 on pfSense 2.2.5.

                          I got BIND up and running as a master, syncing to third-party slaves. I set up an ACL so only these two slaves can initiate AXFR. pfSense sends a notify to the servers when the zone changes, and they respond accordingly. All working, hunky dory.

                          Later I changed the ACL to include some additional IP addresses that I wanted to use a yet more slave servers. However, BIND seems to be ignoring my changes  - it's only sending notifys to the original two nameservers (2x IPv4, 2x IPv6).

                          No matter what changes I make, BIND keeps using the old ACL values. It's sending notify requests to IPv6 addresses that are no longer in the ACL! I've even tried deleting the original ACL and creating a new one!

                          I've tried everything I can think of, short of wiping BIND and starting from scratch: Restarting the service, recreating the ACL with a different name, clearing out the zone files in ../master/[view]/[zone]/; nothing seems to work.

                          The correct ACL values are present in the GUI, the zone is set to the correct ACL in the GUI, and I've verified these values as present in /cf/named/etc/named/named.conf.

                          Does anyone have any suggestions?

                          EDIT: I've also tried disabling the notify function within the settings tab - and BIND still sends notify messages!

                          1 Reply Last reply Reply Quote 0
                          • marcellocM
                            marcelloc
                            last edited by

                            @hazza:

                            . However, BIND seems to be ignoring my changes  - it's only sending notifys to the original two nameservers (2x IPv4, 2x IPv6).

                            Delete or update the serial and save to get zone files updated. The package did not have this behavior when serial was automatically incremented, but it was changed on some community contribution to the code.

                            Treinamentos de Elite: http://sys-squad.com

                            Help a community developer! ;D

                            1 Reply Last reply Reply Quote 0
                            • H
                              hazza
                              last edited by

                              @marcelloc:

                              Delete or update the serial and save to get zone files updated. The package did not have this behavior when serial was automatically incremented, but it was changed on some community contribution to the code.

                              I've been updating the serial every time I make a change, but to no avail.
                              However, that raises another minor annoyance that I have encountered - I use unix time as my serial, but whenever I update it, the SOA served to clients is the previous serial incremented by 1, rather than the somewhat larger new timestamp. Is there any way to force BIND to serve the serial I specify, rather than incrementing?

                              By which I don't mean deleting all the files in /cf/named/etc/named/master/[view]/ and regenerating the zone ;D

                              I'm using DNSSEC on my domain, if that's of any use diagnosing the situation.

                              1 Reply Last reply Reply Quote 0
                              • K
                                khosrov
                                last edited by

                                Hello Sir,
                                We currently use the bind pfsense.
                                We are satisfied with the product, but we still have some things to clarify.

                                I wish to make the declaration of a zone reverse type:

                                For example:

                                zone "80/20.30.40.90.in-addr.arpa" {
                                xxxx,
                                }

                                But unfortunately the pfsense bind interface does not accept this kind of statement with a "/" and returns me an error message (syntax error?)
                                How I should do this type of statement without getting an error message?

                                Sincerly,

                                k. Shekohivand

                                1 Reply Last reply Reply Quote 0
                                • First post
                                  Last post