[ Prev ] [ Index ] [ Next ]

install and use bind instead of Unbound

Created Thursday 12 October 2023

REF: https://geekistheway.com/2023/03/18/configuring-dns-bind9-on-your-pfsense/

Configuring DNS Bind9 on your pfSense

Posted on March 18, 2023 by Thiago Crepaldi
Last Updated on March 18, 2023 by Thiago Crepaldi

If there is one annoying thing on pfSense that seems to be never fixed is its DNS Resolver service called Unbound. Release after release, the Netgate folks still struggle to identify and fix the random crashes, unexpected restarts and whatnot. In this post, we are going to install Bind9, a very solid DNS server, to replace Unbound.

pfBlockerNG depends on Unbound, so don’t replace it with Bind if you still want to block stuff with it.

On our setup, we are going forward recursive queries to external name servers, such as 1.1.1.1 and 1.0.0.1. The internal names/IPs will be resolved by bind through zone records of our own. For this example, I am going to assume there is a webserver.lan.example.com that must resolve to 192.168.0.100.

To get started, first access your pfSense using its IP instead of the FQDN. That is because we are going to disable the DNS Resolver before we can enable Bind. Next, go to System >> Package Manager >> Available Packages, find bind in the list and click on Install.

Once installation finishes, go to Service >> BIND DNS Server and do as follows:

Click on Save and Apply settings as usual.

You can test your settings by trying to resolve internal and external names and IPs using dig. Below is an example on how to test external name resolution: 

$ dig disney.com

; <<>> DiG 9.16.1-Ubuntu <<>> disney.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 56230
;; flags: qr rd ad; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0
;; WARNING: recursion requested but not available

;; QUESTION SECTION:
;disney.com.                    IN      A

;; ANSWER SECTION:
disney.com.             0       IN      A       130.211.198.204

;; Query time: 220 msec
;; SERVER: 172.18.240.1#53(172.18.240.1)
;; WHEN: Fri Mar 17 23:51:17 EDT 2023
;; MSG SIZE  rcvd: 54

In order to resolve the reverse IP mapping of an external server, run: 

$ dig -x 1.1.1.1

; <<>> DiG 9.16.1-Ubuntu <<>> -x 1.1.1.1
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 26423
;; flags: qr rd ad; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0
;; WARNING: recursion requested but not available

;; QUESTION SECTION:
;1.1.1.1.in-addr.arpa.          IN      PTR

;; ANSWER SECTION:
1.1.1.1.in-addr.arpa.   0       IN      PTR     one.one.one.one.

;; Query time: 20 msec
;; SERVER: 172.18.240.1#53(172.18.240.1)
;; WHEN: Fri Mar 17 23:53:29 EDT 2023
;; MSG SIZE  rcvd: 87

I hope this helps, have fun!

Bind on backup server


This sort of works well in a way. Looks like the dynamic zone files are cleared on every reboot though. So not sure if this will worrk well as a master-slave setup. Probably the best way for this to work is all slaves and the master is on a different system such as a Samba 4 DC.

on the sync tab, just add the IP address of all the backup PFSense servers along with the username and password the same as the HA setup. The config files wi l then sync across. Make sure you enable the DNS TCP/UPD port 53 on the sync network too.

just a test line