mirror of https://github.com/opnsense/docs
You cannot select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
84 lines
2.9 KiB
ReStructuredText
84 lines
2.9 KiB
ReStructuredText
===========
|
|
BIND Plugin
|
|
===========
|
|
|
|
-------
|
|
History
|
|
-------
|
|
|
|
The history of the Bind plugin was a user request on OPNsense subreddit to create a
|
|
plugin with a full-featured DNS server, also able to manage zonefiles with the most
|
|
popular resource records. In the beginning the plugin was built with only general
|
|
features so the community can contribute and adding wished features with a friendly
|
|
review of the OPNsense team.
|
|
|
|
At the time of writing the plugin is able to be used as a local resolver and as a
|
|
nice replacement for pfBlockerNG or PiHole, since it is offering a DNSBL feature
|
|
via BIND Reverse Policy Zones.
|
|
|
|
------------
|
|
Installation
|
|
------------
|
|
|
|
First of all, go to :menuselection:`System --> Firmware --> Plugins` and install **os-bind**.
|
|
You will finde the plugin at :menuselection:`Services --> BIND`.
|
|
|
|
----------------
|
|
General Settings
|
|
----------------
|
|
|
|
:Enable BIND Daemon:
|
|
Enable the BIND service.
|
|
:Listen IPs:
|
|
Set the IP addresses the daemon should listen on.
|
|
:Listen IPv6:
|
|
Set the IPv6 addresses the daemon should listen on.
|
|
:Listen Port:
|
|
Set the port the daemon should listen on. Per default the port is 53530 to not
|
|
interfere with existing Unbound/Dnsmasq setups. If you want to switch to BIND
|
|
only, make sure to stop Unbound/Dnsmasq and switch to port 53 with both
|
|
0.0.0.0 and :: as listening addresses set up.
|
|
|
|
|
|
:DNS Forwarders:
|
|
A list of IP addresses BIND will forward unknown DNS request to. If empty BIND
|
|
tries to resolve directly via the root servers.
|
|
:Logsize in MB:
|
|
The amount for each logfile it can grow.
|
|
:Maximum Cache Size:
|
|
This is the amount of RAM (in percent) the daemon can use for caching.
|
|
:Recursion:
|
|
You have to set a list of networks via **ACL** tab to allow them using recursion
|
|
against BIND.
|
|
:DNSSec Validation:
|
|
Whether to enable or disable DNSSec validation.
|
|
|
|
|
|
-----
|
|
DNSBL
|
|
-----
|
|
|
|
:Enable DNSBL:
|
|
Enable the DNSBL service. BIND will be configured for Reverse Policy Zones to
|
|
blacklist domains. Choose below the lists to use for blacklist categories.
|
|
:Type of DNSBL:
|
|
Here you can select the lists to use. Do not just select all and save. There are
|
|
websites not loading content when nested ads are not loaded.
|
|
:Whitelist Domains:
|
|
When a website is blocked due to a false positive you can enter the domain name here
|
|
so it is whitelisted before the blacklists come into play.
|
|
|
|
The Blacklists are downloaded and updated with every **Save** within BIND configuration.
|
|
For production use you can go to :menuselection:`System --> Settings --> Cron` and add a cronjob. On the
|
|
dropdown list you'll find the corret task under **Command**. Set the refresh interval
|
|
as you wish and save. This will trigger an update of the selected lists and reload
|
|
BIND.
|
|
|
|
|
|
----
|
|
ACLs
|
|
----
|
|
|
|
On tab ACLs you can create ACLs used for configuration options like **Recursion**. Add
|
|
a new ACL via **+**, give it a **Name** and add as many networks as you wish in **Network List**.
|