Bind package for pfsense 2.1

pfsense123

Hello,

we want to work with bind in pfsense. but i cant find any good manual for the pfsense version. i hope someone can help me!

i make this settings

Enable bind: checked
listen-on: LAN
rest defaults

Zone One (Foward):
Zone name: test.intern
Type: Master
Name Server: pfsense.test.intern (PFSense Hostname)
Base Domain IP: 192.168.1.1 (PFSense IP)
Records

NS - pfsense.test.intern
pfsense - A - 192.168.1.1
testserver - A - 192.168.1.30

Zone Two (Reverse):
Zone Name: 1.1.168.192
Type: Master
Reverse Zone: checked
Name Server: pfsense.test.intern (PFSense Hostname)
Base Domain IP: 192.168.1.1 (PFSense IP)
Records

NS - 192.168.1.1
1 - PTR - pfsense.test.intern
30 - PTR - testserver.test.intern

Test with Notebook:
IP: 192.168.1.5
GW: 192.168.1.1 (PFSense IP)
DNS: 192.168.1.1 (PFSense IP)

nslookup 192.168.1.1
Server: UnKnown
Adress: 192.168.1.1
not exist

nslookup testserver
Server: UnKnown
Adress: 192.168.1.1
not exist

What is wrong? :o

any ideas please? How can i get it work

peffyes

What is the notebook computer using for a DNS server? If you use DHCP to configure IP services, make sure your DHCP server is telling the clients the proper address to use for DNS lookups. Looks like that should be 192.168.1.1 in your example.

Try nslookup 192.168.1.5 192.168.1.1 and see if you get an answer. If so, your client is probably not looking at the correct address for DNS resolution.

marcelloc

pfsense 123, do you have a zone to configure on it?
If it's just a forward dns, why don't you use built in dns forwarder package?

pfsense123

we have an exist bind on an old ubuntu, i want turn this machine off when bind on pfsense works.

the zone in this "test" is test.intern. I need a forward and a reverse lookup, is there any wrong parameter in my config?

@smarc the IP Config on the Client is static, the DNS is the same like the pfsense server.

peffyes

@pfsense123:

nslookup 192.168.1.1
Server: UnKnown
Adress: 192.168.1.1
not exist

nslookup testserver
Server: UnKnown
Adress: 192.168.1.1
not exist

I don't think your client machine knows about the bind server.

marcelloc

Did you…

configured a firewall rule to allow dns requests?
disabled dns forwarder to do not conflict with bind?

shad0w

Sorry for asking(maybe it's already answered before) but how exactly do you run bind(named) on startup? Thanks

marcelloc

@shad0w:

Sorry for asking(maybe it's already answered before) but how exactly do you run bind(named) on startup? Thanks

Pfsense starts all installed services during startup.

shad0w

Thanks for your response.

Hmm i had installed bind package(before latest upgrade) and wasn't any service in web interface. Now after latest upgrade and reinstallation works ok. Thanks

rondex

Hello everyone,

I already have primary and secondary dns servers running on linux boxes. I'm configuring bind on 2 pfSense do replace both, primary and secondary linux, but I did not find a correct SVR entry, as it asks for a prio, weight and port. Generated conf file does not show a correct line for this entry, missing those parameters.

Any solution, or temporary workaround?

Thanks

marcelloc

@rondex:

Any solution, or temporary workaround?

you can use custom options to define your settings.

paste what is wrong and how it should be.

If you know php, you can edit bind.inc to fix the code to work the way you need.

rondex

@marcelloc:

If you know php, you can edit bind.inc to fix the code to work the way you need.

I don't really know that much php, but I made some modifications to make records SRV work correctly. Here is part of the code of bind.inc file:

for ($y=0; $y<sizeof($zone['row']); $y++)<br=""> {
$hostname = (preg_match("/(MX|NS)/",$zone['row'][$y]['hosttype'])?"@":$zone['row'][$y]['hostname']);
$hosttype = $zone['row'][$y]['hosttype'];
$hostdst = $zone['row'][$y]['hostdst'];
if (preg_match("/[a-zA-Z]/",$hostdst) && !preg_match("/(TXT|SPF|AAAA)/",$hosttype))
$hostdst .= ".";
$hostvalue = $zone['row'][$y]['hostvalue'];
$hostweight = $zone['row'][$y]['hostweight'];
$hostport = $zone['row'][$y]['hostport'];

$zone_conf .= "$hostname \t IN $hosttype $hostvalue \t$hostweight \t$hostport \t$hostdst\n";
}

I just added 2 variables to fit requirement of SRV records: $hostweight and $hostport. Then added it to $zone_conf output variable.
See attachment also. Added 2 fields to xml file to be used by SRV, weight and port.

I can see on output bind config file, that $zone_conf is correct, but it's not getting the values of weight and port from GUI.

Anyone can help me with this issue? I'm sure I'm missing some small detail to get those variables read.

Thanks in advance.</sizeof($zone['row']);>

rondex

Hi,

It's almost ready, I just have to adjust one thing: it's not saving priority value, probably due to previous rule on php. I'll keep on search were it is, and as soon as I find it, I'll make it available, if anyone else is interested. Again, I'm not a php programer =) so any help is appreciated.

rondex

:D Job done!

If someone else is interested, just let me know, then I'll make it available.
As soon I have more free time to deal with it, I'll enhance the algorithm to include more options and better warnings/erros on GUI.

fonzy2013

Hi, i am interested! Will the maintainer add this to the uppstramning release?
Also i am interested in some expert Help which i am willing to pay for. You can drop me a Line on niklas at vireone.com if you know this package, pfsense and bind9 in depth.

periko

Try to setup, buy i have this errors related to crypto stuff.

Jul 25 14:56:53 firewall named[47298]: built with '–localstatedir=/var' '--disable-linux-caps' '--disable-symtable' '--with-randomdev=/dev/random' '--with-libxml2=/usr/pbi/bind-amd64' '--without-python' '--enable-filter-aaaa' '--disable-fixed-rrset' '--without-gssapi' '--without-idn' '--enable-ipv6' '--enable-largefile' '--disable-newstats' '--disable-rpz-nsdname' '--disable-rpz-nsip' '--enable-rrl' 'STD_CDEFINES=-DDIG_SIGCHASE=1' '--with-openssl=/usr/pbi/bind-amd64' '--with-dlz-filesystem=yes' '--enable-threads' '--sysconfdir=/usr/pbi/bind-amd64/etc' '--prefix=/usr/pbi/bind-amd64' '--mandir=/usr/pbi/bind-amd64/man' '--infodir=/usr/pbi/bind-amd64/info/' '--build=x86_64-portbld-freebsd8.3' 'build_alias=x86_64-portbld-freebsd8.3' 'CC=cc' 'CFLAGS=-O2 -pipe -fno-strict-aliasing' 'LDFLAGS= -Wl,-rpath,/usr/pbi/bind-amd64/lib' 'CPPFLAGS=' 'CPP=cpp'
Jul 25 14:56:53 firewall named[47298]: –--------------------------------------------------
Jul 25 14:56:53 firewall named[47298]: BIND 9 is maintained by Internet Systems Consortium,
Jul 25 14:56:53 firewall named[47298]: Inc. (ISC), a non-profit 501(3) public-benefit
Jul 25 14:56:53 firewall named[47298]: corporation. Support and training for BIND 9 are
Jul 25 14:56:53 firewall named[47298]: available at https://www.isc.org/support
Jul 25 14:56:53 firewall named[47298]: –--------------------------------------------------
Jul 25 14:56:53 firewall named[47298]: found 2 CPUs, using 2 worker threads
Jul 25 14:56:53 firewall named[47298]: using 2 UDP listeners per interface
Jul 25 14:56:53 firewall named[47298]: using up to 4096 sockets
Jul 25 14:56:53 firewall named[47298]: ENGINE_by_id failed (crypto failure)
Jul 25 14:56:53 firewall named[47298]: error:25070067:DSO support routines:DSO_load:could not load the shared library:dso_lib.c:244:
Jul 25 14:56:53 firewall named[47298]: error:260B6084:engine routines:DYNAMIC_LOAD:dso not found:eng_dyn.c:450:
Jul 25 14:56:53 firewall named[47298]: error:2606A074:engine routines:ENGINE_by_id:no such engine:eng_list.c:418:id=gost
Jul 25 14:56:53 firewall named[47298]: initializing DST: crypto failure
Jul 25 14:56:53 firewall named[47298]: exiting (due to fatal error)

I reinstall the package but same error, maybe need to reinstall the whole system again?

periko

Setup vbox, same error, both installation running x64 version, could be the issue?
I'm going to try x32 and let u know.

KOM

Search the forums. I answered this one three days ago in the DNS forum:

https://forum.pfsense.org/index.php?topic=79714.0

periko

I had try this under x32/x64 bits and the correction from KOM works.

Marcelloc if u have time the fix this will be great, looks like is not difficult to add.

I tested on 3 different machines.

Thanks again KOM.

KOM

They are very busy with the upcoming pfSense 2.2 based on FreeBSD 10. There are snapshots you can try, but a production version is still many months away.