diff --git a/dns/bind/src/opnsense/mvc/app/controllers/OPNsense/Bind/forms/dialogEditBindForwardDomain.xml b/dns/bind/src/opnsense/mvc/app/controllers/OPNsense/Bind/forms/dialogEditBindForwardDomain.xml index 4ca30f87c6..18a114dfb3 100644 --- a/dns/bind/src/opnsense/mvc/app/controllers/OPNsense/Bind/forms/dialogEditBindForwardDomain.xml +++ b/dns/bind/src/opnsense/mvc/app/controllers/OPNsense/Bind/forms/dialogEditBindForwardDomain.xml @@ -9,14 +9,39 @@ domain.domainname text - Set the name for this zone. Both forward and reverse zones may be specified, i.e. example.com or 0.168.192.in-addr.arpa. + Both forward and reverse zones may be specified. +
Examples include: +
example.com +
0.168.192.in-addr.arpa + ]]> + + + domain.forwardonly + + checkbox + The default is to attempt forwarders first and only perform +
recursive lookups if forwarding fails. This setting is only +
meaningful if the list of forwarders is not empty. +
Can be used to override global forwarding behaviour for this +
domain by specifying the same servers below. +
This directive is explictily set to either forward only; or +
forward first; to avoid any furtherance of doubt. + ]]> domain.forwardserver - + select_multiple true - Set the IP address of server to forward requests to. + forward queries to for this domain. +
Used to override global forwarders for this domain. + ]]> diff --git a/dns/bind/src/opnsense/mvc/app/controllers/OPNsense/Bind/forms/general.xml b/dns/bind/src/opnsense/mvc/app/controllers/OPNsense/Bind/forms/general.xml index 23e9c92026..cf3d33089c 100644 --- a/dns/bind/src/opnsense/mvc/app/controllers/OPNsense/Bind/forms/general.xml +++ b/dns/bind/src/opnsense/mvc/app/controllers/OPNsense/Bind/forms/general.xml @@ -5,33 +5,52 @@ checkbox This will activate the BIND daemon. + + header + + general.disablev6 checkbox - This will run BIND in IPv4-only mode. + This will cause BIND to run in IPv4-only mode. general.listenv4 - - + select_multiple - true - Set the IPv4 addresses the service should listen to. + The default is all IPv4 addresses on the host, i.e. { any; }. + ]]> general.listenv6 - - + select_multiple - true - Set the IPv6 addresses the service should listen to. + The default is all IPv6 addresses on the host, i.e. { any; } except when IPv6 is disabled which uses { none; }. + ]]> general.port - + text - Set the port the service should listen to. + Set the port the BIND service should listen on. + + + header + + + + general.allowquery + + select_multiple + The default is { any; }. + ]]> general.querysource @@ -47,6 +66,74 @@ true Specify the IPv6 address used as a source for outbound queries. + + header + + + + general.enablerecursion + + checkbox + This will enable recursive resolution (default). Disable for public authoritative DNS servers. + + + general.recursionallowedacls + + select_multiple + For public authoritative DNS servers, recursion should be disabled and this field left empty. +
For private recursive DNS servers, this is usually an ACL representing your local LAN. +
When recursion is enabled and no ACL is defined here or for allow-query-cache or allow-query, the +
builtin { localnets; localhost; } address list is used. Otherwise this field will default to the value +
found in allow-query-cache, or failing that, allow-query. + ]]> + + + general.allowcachequeries + + true + select_multiple + For public authoritative DNS servers, recursion should be disabled, and this field defaults to using {none;}. +
For private recursive DNS servers, use this field to override the defaults. +
When recursion is enabled and allow-recursion has an ACL set, the default will be the same ACL. +
Otherwise if allow-recursion has no ACL set, the default will be the { localnets; localhost; } address list. + ]]> + + + general.forwardonly + + checkbox + true + The default is to attempt forwarders first and perform recursive lookups if forwarding fails. +
Only meaningful if the list of forwarders is not empty. + ]]> + + + general.forwarders + + + select_multiple + true + Set any combination of IPv4 and IPv6 addresses to forward queries to when the answer is unknown. + + + header + + + + general.allowtransfer + + select_multiple + The default is { any; }. + ]]> + general.transfersource @@ -62,75 +149,73 @@ Specify the IPv6 address used as a source for zone transfers. - general.forwarders - - - select_multiple - true - Set one or more hosts to send your DNS queries if the request is unknown. + header + + + + general.dnssecvalidation + + dropdown + Set to "Auto" to use the default trust anchor for the DNS root zone. +
The "yes" and "trust-anchors" options are not supported. +
Consider legacy AAAA record filtering needs before enabling this feature as +
signed responses will not have AAAA records filtered when this is set to "Auto". + ]]> + + + header + general.filteraaaav4 checkbox - This will filter AAAA records on IPv4 Clients. Set "DNSSEC Validation" to "No" and AAAA records will be omitted even if they are signed. + Set "DNSSEC Validation" to "No" and AAAA records will be omitted even if they are signed. + ]]> general.filteraaaav6 checkbox - This will filter AAAA records on IPv6 Clients. Set "DNSSEC Validation" to "No" and AAAA records will be omitted even if they are signed. + Set "DNSSEC Validation" to "No" and AAAA records will be omitted even if they are signed. + ]]> general.filteraaaaacl - - + select_multiple - true - Specifies a list of client addresses for which AAAA filtering is to be applied. + Set ACLs for which AAAA filtering is to be applied. The default is { any; }. + + + header + general.logsize text - Set the amount how big a logfile can growth. For Query and Blocked logs. + Set the maximum logfile size. For Query and Blocked logs. general.general_log_level dropdown - Select General Log level. Log levels are listed in the order of increasing verbosity. Setting a certain log level will cause all messages of the specified and more severe log levels to be logged. - - - general.maxcachesize - - text - How much memory in percent the cache can use from the system. Default is 80%. + Setting a certain log level will cause all messages of the specified and more severe log levels to be logged. + ]]> - general.recursion - - select_multiple - Define an ACL where you allow which clients can resolve via this service. Usually use your local LAN. - - - general.allowtransfer - - select_multiple - Define the ACLs where you allow which server can retrieve zones. - - - general.allowquery - - select_multiple - Define the ACLs where you allow which client are allowed to query this server. - - - general.dnssecvalidation - - dropdown - Default is "No". Set to "Auto" to use the static trust anchor configuration by the system. + header + + true general.hidehostname @@ -146,6 +231,18 @@ true This will hide the local BIND version in DNS queries. + + header + + true + + + general.maxcachesize + + text + true + How much memory in percent the cache can use from the system. The default is 80%. + general.disableprefetch @@ -153,32 +250,147 @@ true This will disable prefetching of domains before they time out. + + header + + true + general.enableratelimiting checkbox true - This will enable rate-limiting for DNS replies. + This will enable rate-limiting for DNS responses. - general.ratelimitcount - + general.ratelimitrespps + text true - Set how many replies per second are allowed. + The default is 0 or no limit. + ]]> - general.ratelimitexcept - - + general.ratelimitwindow + + text + true + Set the number of second during which responses are tracked. The default is 15 seconds. + + + general.ratelimitexempt + select_multiple - true true - Except a list of IPs from rate-limiting like ::1 + Set ACLs where rate-limiting should not apply. + + + general.ratelimitipv4prefixlength + + text + true + Set the number of bits of the address block. Used to distinquish clients into a rate-limited group. The default is 24. + + + general.ratelimitipv6prefixlength + + text + true + Set the number of bits of the address block. Used to distinquish clients into a rate-limited group. The default is 56. + + + general.ratelimitnodataps + + text + true + The default is equal to the Responses Per Second value. + ]]> + + + general.ratelimitnxdomsps + + text + true + The default is equal to the Responses Per Second value. + ]]> + + + general.ratelimitrefsps + + text + true + The default is equal to the Responses Per Second value. + ]]> + + + general.ratelimiterrsps + + text + true + The default is equal to the Responses Per Second value. + ]]> + + + general.ratelimitallps + + text + true + If used, this should be set to 4 times the size of other per second limits. + ]]> + + + general.ratelimitslip + + text + true + Set how many responses to "slip", reducing the use of forged source addresses in attacks. The default is 2. + + + general.ratelimitscale + + text + true + The formula is (qps-scale/total-query-rate)*responses-per-second to produce the new value. + ]]> + + + general.ratelimitmaxtbl + + text + true + Set the maximum number of table entries used to track requests and rate-limit responses. The default is 20,000. + + + general.ratelimitmintbl + + text + true + Set the minimum number of table entries used to track requests and rate-limit responses. The default is 500. + + + general.ratelimittry + + checkbox + true + Enable to test rate-limiting parameters without actually dropping any requests. header - + true diff --git a/dns/bind/src/opnsense/mvc/app/models/OPNsense/Bind/Domain.xml b/dns/bind/src/opnsense/mvc/app/models/OPNsense/Bind/Domain.xml index 6743b66ae4..13d3c9af44 100644 --- a/dns/bind/src/opnsense/mvc/app/models/OPNsense/Bind/Domain.xml +++ b/dns/bind/src/opnsense/mvc/app/models/OPNsense/Bind/Domain.xml @@ -21,6 +21,10 @@ Y + + 0 + Y + Y diff --git a/dns/bind/src/opnsense/mvc/app/models/OPNsense/Bind/General.xml b/dns/bind/src/opnsense/mvc/app/models/OPNsense/Bind/General.xml index 238c9dc248..08e6945eb4 100644 --- a/dns/bind/src/opnsense/mvc/app/models/OPNsense/Bind/General.xml +++ b/dns/bind/src/opnsense/mvc/app/models/OPNsense/Bind/General.xml @@ -15,16 +15,40 @@ 1 Y - - 0.0.0.0 - Y - Y + + + + + Y - - :: - Y - Y + + + + + Y + + 53530 + Y + + + + + + Y + ipv4 N @@ -33,6 +57,49 @@ ipv6 N + + 1 + Y + + + + + + Y + Choose an ACL. + + + + + + Y + Choose an ACL. + + + 0 + Y + + + Y + + + + + + Y + ipv4 N @@ -41,13 +108,14 @@ ipv6 N - - 53530 + + + No + Auto + + no Y - - - Y - + 0 Y @@ -56,8 +124,15 @@ 0 Y - - Y + + + + + Y 5 @@ -79,52 +154,6 @@ Y info - - 80 - Y - 1 - 99 - Choose a value between 1 and 99. - - - - - - Y - Choose an ACL. - - - - - - Y - - - - - - Y - - - - No - Auto - - no - Y - 0 Y @@ -133,6 +162,13 @@ 0 Y + + 80 + Y + 1 + 99 + Choose a value between 1 and 99. + 0 Y @@ -141,16 +177,86 @@ 0 Y - + 1 1000 Choose a value between 1 and 1000. - - - 0.0.0.0,:: - Y - Y - + + + 1 + 3600 + Choose a value between 1 and 3600. + + + + + + Y + Choose an ACL. + + + 1 + 32 + Choose a value between 1 and 32. + + + 1 + 128 + Choose a value between 1 and 128. + + + 1 + 1000 + Choose a value between 1 and 1000. + + + 1 + 1000 + Choose a value between 1 and 1000. + + + 1 + 1000 + Choose a value between 1 and 1000. + + + 1 + 1000 + Choose a value between 1 and 1000. + + + 1 + 1000 + Choose a value between 1 and 1000. + + + 0 + 10 + Choose a value between 0 and 10. + + + 1 + 1000 + Choose a value between 1 and 1000. + + + 1 + 100000 + Choose a value between 1 and 100,000. + + + 1 + 100000 + Choose a value between 1 and 100,000. + + + 0 + N + Y hmac-sha256 diff --git a/dns/bind/src/opnsense/mvc/app/views/OPNsense/Bind/general.volt b/dns/bind/src/opnsense/mvc/app/views/OPNsense/Bind/general.volt index 30d3fcc1d3..4f52452f9c 100644 --- a/dns/bind/src/opnsense/mvc/app/views/OPNsense/Bind/general.volt +++ b/dns/bind/src/opnsense/mvc/app/views/OPNsense/Bind/general.volt @@ -99,8 +99,8 @@ {{ lang._('Retry') }} {{ lang._('Expire') }} {{ lang._('Negative TTL') }} + {{ lang._('Commands') }} {{ lang._('ID') }} - {{ lang._('Commands') }} @@ -200,6 +200,7 @@ {{ lang._('Enabled') }} {{ lang._('Zone') }} + {{ lang._('Forward Only') }} {{ lang._('Forwarder IPs') }} {{ lang._('ID') }} {{ lang._('Commands') }} @@ -427,8 +428,8 @@ $(document).ready(function() { }).on("loaded.rs.jquery.bootgrid", function(e) { // Checkzone button $("#grid-primary-domains").find(".command-bind-checkzone").off("click").on("click", function(ev) { - if (!$(this).closest("tr").hasClass("text-muted")) { - let zonename = $(this).closest('tr').find('td.zonename').text(); + if (!$(this).closest(".tabulator-row").hasClass("text-muted")) { + let zonename = $(this).closest(".tabulator-row").find("[tabulator-field='domainname']").text(); zone_test(zonename); } else { BootstrapDialog.show({ diff --git a/dns/bind/src/opnsense/service/templates/OPNsense/Bind/named.conf b/dns/bind/src/opnsense/service/templates/OPNsense/Bind/named.conf index 9196b5de3e..83399f9389 100644 --- a/dns/bind/src/opnsense/service/templates/OPNsense/Bind/named.conf +++ b/dns/bind/src/opnsense/service/templates/OPNsense/Bind/named.conf @@ -10,28 +10,47 @@ acl "{{ acl_list.name }}" { {{ acl_list.networks.replace(',', '; ') }}; }; options { - directory "/usr/local/etc/namedb/working"; - pid-file "/var/run/named/pid"; - dump-file "/var/dump/named_dump.db"; - statistics-file "/var/stats/named.stats"; + directory "/usr/local/etc/namedb/working"; + pid-file "/var/run/named/pid"; + dump-file "/var/dump/named_dump.db"; + statistics-file "/var/stats/named.stats"; -{% for listenv4 in OPNsense.bind.general.listenv4.split(',') %} - listen-on port {{ OPNsense.bind.general.port }} { {% if listenv4 == '0.0.0.0' %}any{% else %}{{ listenv4 }}{% endif %}; }; -{% endfor %} -{% for listenv6 in OPNsense.bind.general.listenv6.split(',') %} - listen-on-v6 port {{ OPNsense.bind.general.port }} { {% if listenv6 == '::' %}any{% else %}{{ listenv6 }}{% endif %}; }; -{% endfor %} +{% if helpers.exists('OPNsense.bind.general.listenv4') and OPNsense.bind.general.listenv4 != '' %} + listen-on port {{ OPNsense.bind.general.port }} { +{% for acl in OPNsense.bind.general.listenv4.split(',') %} +{% set listenv4_acl = helpers.getUUID(acl) %} + {{ listenv4_acl.name }}; +{% endfor %} + }; +{% else %} + listen-on port {{ OPNsense.bind.general.port }} { any; } +{% endif %} + +{% if helpers.exists('OPNsense.bind.general.disablev6') and OPNsense.bind.general.disablev6 != '1' %} +{% if helpers.exists('OPNsense.bind.general.listenv6') and OPNsense.bind.general.listenv6 != '' %} + listen-on-v6 port {{ OPNsense.bind.general.port }} { +{% for acl in OPNsense.bind.general.listenv6.split(',') %} +{% set listenv6_acl = helpers.getUUID(acl) %} + {{ listenv6_acl.name }}; +{% endfor %} + }; +{% else %} + listen-on-v6 port {{ OPNsense.bind.general.port }} { any; } +{% endif %} +{% else %} + listen-on-v6 { none; }; +{% endif %} {% if helpers.exists('OPNsense.bind.general.querysource') and OPNsense.bind.general.querysource != '' %} - query-source {{ OPNsense.bind.general.querysource }}; + query-source {{ OPNsense.bind.general.querysource }}; {% endif -%} {% if helpers.exists('OPNsense.bind.general.querysourcev6') and OPNsense.bind.general.querysourcev6 != '' %} - query-source-v6 {{ OPNsense.bind.general.querysourcev6 }}; + query-source-v6 {{ OPNsense.bind.general.querysourcev6 }}; {% endif -%} {% if helpers.exists('OPNsense.bind.general.transfersource') and OPNsense.bind.general.transfersource != '' %} - transfer-source {{ OPNsense.bind.general.transfersource }}; + transfer-source {{ OPNsense.bind.general.transfersource }}; {% endif -%} {% if helpers.exists('OPNsense.bind.general.transfersourcev6') and OPNsense.bind.general.transfersourcev6 != '' %} @@ -39,21 +58,36 @@ options { {% endif -%} {% if helpers.exists('OPNsense.bind.general.forwarders') and OPNsense.bind.general.forwarders != '' %} - forwarders { {{ OPNsense.bind.general.forwarders.replace(',', '; ') }}; }; +{% if helpers.exists('OPNsense.bind.general.forwardonly') and OPNsense.bind.general.forwardonly == '1' %} + forward only +{% endif -%} + forwarders { {{ OPNsense.bind.general.forwarders.replace(',', '; ') }}; }; {% endif -%} {% if helpers.exists('OPNsense.bind.dnsbl.enabled') and OPNsense.bind.dnsbl.enabled == '1' %} - response-policy { {% if helpers.exists('OPNsense.bind.dnsbl.type') and OPNsense.bind.dnsbl.type != '' %}zone "whitelist.localdomain"; zone "blacklist.localdomain";{% endif %}{% if helpers.exists('OPNsense.bind.dnsbl.forcesafegoogle') and OPNsense.bind.dnsbl.forcesafegoogle == '1' %}zone "rpzgoogle";{% endif %}{% if helpers.exists('OPNsense.bind.dnsbl.forcesafeduckduckgo') and OPNsense.bind.dnsbl.forcesafeduckduckgo == '1' %}zone "rpzduckduckgo";{% endif %}{% if helpers.exists('OPNsense.bind.dnsbl.forcesafeyoutube') and OPNsense.bind.dnsbl.forcesafeyoutube == '1' %}zone "rpzyoutube";{% endif %}{% if helpers.exists('OPNsense.bind.dnsbl.forcestrictbing') and OPNsense.bind.dnsbl.forcestrictbing == '1' %}zone "rpzbing";{% endif %} }; -{% endif %} + response-policy { {% if helpers.exists('OPNsense.bind.dnsbl.type') and OPNsense.bind.dnsbl.type != '' %}zone "whitelist.localdomain"; zone "blacklist.localdomain";{% endif %}{% if helpers.exists('OPNsense.bind.dnsbl.forcesafegoogle') and OPNsense.bind.dnsbl.forcesafegoogle == '1' %}zone "rpzgoogle";{% endif %}{% if helpers.exists('OPNsense.bind.dnsbl.forcesafeduckduckgo') and OPNsense.bind.dnsbl.forcesafeduckduckgo == '1' %}zone "rpzduckduckgo";{% endif %}{% if helpers.exists('OPNsense.bind.dnsbl.forcesafeyoutube') and OPNsense.bind.dnsbl.forcesafeyoutube == '1' %}zone "rpzyoutube";{% endif %}{% if helpers.exists('OPNsense.bind.dnsbl.forcestrictbing') and OPNsense.bind.dnsbl.forcestrictbing == '1' %}zone "rpzbing";{% endif %} }; +{% endif -%} -{% if helpers.exists('OPNsense.bind.general.recursion') and OPNsense.bind.general.recursion != '' %} +{% if helpers.exists('OPNsense.bind.general.enablerecursion') and OPNsense.bind.general.enablerecursion == '1' %} recursion yes; +{% if helpers.exists('OPNsense.bind.general.recursionallowedacls') and OPNsense.bind.general.recursionallowedacls != '' %} allow-recursion { -{% for acl in OPNsense.bind.general.recursion.split(',') %} -{% set recursion_acl = helpers.getUUID(acl) %} - {{ recursion_acl.name }}; +{% for acl in OPNsense.bind.general.recursionallowedacls.split(',') %} +{% set recursionallowedacls_acl = helpers.getUUID(acl) %} + {{ recursionallowedacls_acl.name }}; +{% endfor %} + }; +{% endif %} +{% if helpers.exists('OPNsense.bind.general.allowcachequeries') and OPNsense.bind.general.allowcachequeries != '' %} + allow-query-cache { +{% for acl in OPNsense.bind.general.allowcachequeries.split(',') %} +{% set allowcachequeries_acl = helpers.getUUID(acl) %} + {{ allowcachequeries_acl.name }}; {% endfor %} }; +{% endif %} +{% else %} + recursion no; {% endif %} {% if helpers.exists('OPNsense.bind.general.allowtransfer') and OPNsense.bind.general.allowtransfer != '' %} @@ -75,26 +109,70 @@ options { {% endif %} {% if helpers.exists('OPNsense.bind.general.maxcachesize') and OPNsense.bind.general.maxcachesize != '' %} - max-cache-size {{ OPNsense.bind.general.maxcachesize }}%; + max-cache-size {{ OPNsense.bind.general.maxcachesize }}%; {% endif %} {% if helpers.exists('OPNsense.bind.general.dnssecvalidation') and OPNsense.bind.general.dnssecvalidation != '' %} - dnssec-validation {{ OPNsense.bind.general.dnssecvalidation }}; + dnssec-validation {{ OPNsense.bind.general.dnssecvalidation }}; {% endif %} {% if helpers.exists('OPNsense.bind.general.hidehostname') and OPNsense.bind.general.hidehostname == '1' %} - hostname none; + hostname none; {% endif %} {% if helpers.exists('OPNsense.bind.general.hideversion') and OPNsense.bind.general.hideversion == '1' %} - version none; + version none; {% endif %} {% if helpers.exists('OPNsense.bind.general.disableprefetch') and OPNsense.bind.general.disableprefetch == '1' %} prefetch 0; {% endif %} {% if helpers.exists('OPNsense.bind.general.enableratelimiting') and OPNsense.bind.general.enableratelimiting == '1' %} -{% if helpers.exists('OPNsense.bind.general.ratelimitcount') and OPNsense.bind.general.ratelimitcount != '' %} +{% if helpers.exists('OPNsense.bind.general.ratelimitrespps') and OPNsense.bind.general.ratelimitrespps != '' %} rate-limit { - responses-per-second {{ OPNsense.bind.general.ratelimitcount }}; -{% if helpers.exists('OPNsense.bind.general.ratelimitexcept') and OPNsense.bind.general.ratelimitexcept != '' %} - exempt-clients { {{ OPNsense.bind.general.ratelimitexcept.replace(',', '; ') }}; }; + responses-per-second {{ OPNsense.bind.general.ratelimitrespps }}; +{% if helpers.exists('OPNsense.bind.general.ratelimitwindow') and OPNsense.bind.general.ratelimitwindow != '' %} + window {{ OPNsense.bind.general.ratelimitwindow }}; +{% endif %} +{% if helpers.exists('OPNsense.bind.general.ratelimitipv4prefixlength') and OPNsense.bind.general.ratelimitipv4prefixlength != '' %} + ipv4-prefix-length {{ OPNsense.bind.general.ratelimitipv4prefixlength }}; +{% endif %} +{% if helpers.exists('OPNsense.bind.general.ratelimitipv6prefixlength') and OPNsense.bind.general.ratelimitipv6prefixlength != '' %} + ipv6-prefix-length {{ OPNsense.bind.general.ratelimitipv6prefixlength }}; +{% endif %} +{% if helpers.exists('OPNsense.bind.general.ratelimitnodataps') and OPNsense.bind.general.ratelimitnodataps != '' %} + nodata-per-second {{ OPNsense.bind.general.ratelimitnodataps }}; +{% endif %} +{% if helpers.exists('OPNsense.bind.general.ratelimitnxdomsps') and OPNsense.bind.general.ratelimitnxdomsps != '' %} + nxdomains-per-second {{ OPNsense.bind.general.ratelimitnxdomsps }}; +{% endif %} +{% if helpers.exists('OPNsense.bind.general.ratelimitrefsps') and OPNsense.bind.general.ratelimitrefsps != '' %} + referrals-per-second {{ OPNsense.bind.general.ratelimitrefsps }}; +{% endif %} +{% if helpers.exists('OPNsense.bind.general.ratelimiterrsps') and OPNsense.bind.general.ratelimiterrsps != '' %} + errors-per-second {{ OPNsense.bind.general.ratelimiterrsps }}; +{% endif %} +{% if helpers.exists('OPNsense.bind.general.ratelimitallps') and OPNsense.bind.general.ratelimitallps != '' %} + all-per-second {{ OPNsense.bind.general.ratelimitallps }}; +{% endif %} +{% if helpers.exists('OPNsense.bind.general.ratelimitslip') and OPNsense.bind.general.ratelimitslip != '' %} + slip {{ OPNsense.bind.general.ratelimitslip }}; +{% endif %} +{% if helpers.exists('OPNsense.bind.general.ratelimitscale') and OPNsense.bind.general.ratelimitscale != '' %} + qps-scale {{ OPNsense.bind.general.ratelimitscale }}; +{% endif %} +{% if helpers.exists('OPNsense.bind.general.ratelimitmaxtbl') and OPNsense.bind.general.ratelimitmaxtbl != '' %} + max-table-size {{ OPNsense.bind.general.ratelimitmaxtbl }}; +{% endif %} +{% if helpers.exists('OPNsense.bind.general.ratelimitmintbl') and OPNsense.bind.general.ratelimitmintbl != '' %} + min-table-size {{ OPNsense.bind.general.ratelimitmintbl }}; +{% endif %} +{% if helpers.exists('OPNsense.bind.general.ratelimitexempt') and OPNsense.bind.general.ratelimitexempt != '' %} + exempt-clients { +{% for acl in OPNsense.bind.general.ratelimitexempt.split(',') %} +{% set ratelimitexempt_acl = helpers.getUUID(acl) %} + {{ ratelimitexempt_acl.name }}; +{% endfor %} + }; +{% endif %} +{% if helpers.exists('OPNsense.bind.general.ratelimittry') and OPNsense.bind.general.ratelimittry != '' %} + log-only {{ OPNsense.bind.general.ratelimittry }}; {% endif %} }; {% endif %} @@ -104,8 +182,9 @@ options { {% if helpers.exists('OPNsense.bind.general.rndcalgo') and helpers.exists('OPNsense.bind.general.rndcsecret') %} key "rndc-key" { algorithm "{{ OPNsense.bind.general.rndcalgo }}"; - secret "{{ OPNsense.bind.general.rndcsecret }}"; + secret "{{ OPNsense.bind.general.rndcsecret }}"; }; + controls { inet 127.0.0.1 port 9530 allow { 127.0.0.1; } keys { "rndc-key"; }; @@ -154,6 +233,11 @@ zone "rpzbing" { type primary; file "/usr/local/etc/namedb/primary/bing.db"; not zone "{{ domain.domainname }}" { type {{ domain.type }}; {% if domain.type == 'forward' %} +{% if domain.forwardonly == '1' %} + forward only; +{% else %} + forward first; +{% endif %} forwarders { {{ domain.forwardserver.replace(',', '; ') }}; }; {% elif domain.type == 'secondary' %} {% if domain.transferkey is defined %} @@ -261,7 +345,12 @@ plugin query "/usr/local/lib/bind/filter-aaaa.so" { {% endif %} {% endif %} {% if helpers.exists('OPNsense.bind.general.filteraaaaacl') and OPNsense.bind.general.filteraaaaacl != '' %} - filter-aaaa { {{ OPNsense.bind.general.filteraaaaacl.replace(',', '; ') }}; }; + filter-aaaa { +{% for acl in OPNsense.bind.general.filteraaaaacl.split(',') %} +{% set filteraaaa_acl = helpers.getUUID(acl) %} + {{ filteraaaa_acl.name }}; +{% endfor %} + }; {% endif %} }; {% endif %}