Previous Step

Infrastructure-as-Code with Proxmox: Manual Templating

In this module, we will hand-build a VM and LXC template in Proxmox VE that we will later clone and use as a base image for additional servers in our lab while we work our way up to deploying with Infrastructure-as-Code.

0xBEN0xBEN

How DDNS Works in the Lab

Staging the Environment

Adding the VLAN for BIND

Add the VLAN to pfSense

Configure the Interface

Configure DHCP

Configure Firewall Rules

Interface-Specific Rules

Select the interface name of the VLAN to configure interface-specific rules.

Configure Managed Switch(es)

1. Log into managed switch(es)
2. Add VLAN 53 to 802.1q VLANs
3. Tag each interface where VLAN 53 is expected to flow across the wire

Configure Proxmox Networking

Classic Networking

1. Log into Proxmox VE
2. Select a PVE node
3. Click Network > Create > OVS IntPort

SDN

Add VLAN Zone

1. Log into Proxmox VE
2. Select Datacenter > SDN
3. Select Zones

Add VLAN Tag

1. Log into Proxmox VE
2. Select Datacenter > SDN
3. Select VNets

Add a DNS Record for BIND Server

Install and Configure BIND9

Create the Linux Container

1. Log into Proxmox VE
2. Clone the Debian 13 template Linux Container created previously
3. Migrate the clone to your desired PVE node

Install BIND9

apt update && apt install -y bind9 bind9utils bind9-doc

systemctl enable named

Generate Dynamic DNS Key

This key will be used by the pfSense DHCP service to add / update / remove DNS records in specific home.internal subdomains as clients come online. For this to work, you'll need to note:

• Key name
• Secret

tsig-keygen -a HMAC-SHA256 pfsense-key > /etc/bind/pfsense.key

chown root:bind /etc/bind/pfsense.key

chmod 640 /etc/bind/pfsense.key

Configure BIND

Options

nano /etc/bind/named.conf.options

acl "trusted_net" {
        127.0.0.0/8;    # Allow to self
        10.53.53.2/32;  # Allow self
        10.53.53.1/32;  # Allow queries from pfSense for domain overrides
};

options {
        directory "/var/cache/bind";

        recursion yes;
        allow-query { trusted_net; };

        # Forward unknown to gateway
        forwarders {
                10.53.53.1;
        };

        dnssec-validation auto;
        listen-on-v6 { none; };
};

Referencing the diagram:

• A host asks the default gateway (pfSense) for test.lab.home.internal
• pfSense observes domain override for lab.home.internal
• pfSense asks 10.53.53.2 for the IP address of lab.home.internal
• pfSense relays back to host

Therefore, adding 10.53.53.1 in the ACL is sufficient for this to work.

• 10.53.53.2 is set as the lookup server for lab.home.internal
• pfSense has 10.53.53.0/30 in its routing table on igb1.53
• pfSense will always send packets destined for 10.53.53.2 out that interface, which is configured with 10.53.53.1

Zones and Zone Files

nano /root/generate-zones.sh

For the sake of this tutorial, I'm focusing on the internal domain of lab.home.internal. If you'd like to add dynamic DDNS to other subnets in your home lab, feel free to add them to the ZONES list in the script.

#!/bin/bash

# Configuration
LOCAL_DOMAIN="home.internal"
BIND_DIR="/etc/bind"
ZONE_DIR="/var/lib/bind"
TSIG_KEY_FILE="$BIND_DIR/pfsense.key"
NS_IP="10.53.53.2"
ADMIN_EMAIL="administrator.${LOCAL_DOMAIN}."
SERIAL=$(date +%Y%m%d01)
TTL=60
NUM_MIN=$(($TTL/60))

if [ "$NUM_MIN" -gt 1 ] ; then
    MIN_QUANTIFIER="minutes"
else
    MIN_QUANTIFIER="minute"
fi

# Forward Zones
ZONES=(
    "example1.${LOCAL_DOMAIN}"
    "example2.${LOCAL_DOMAIN}"
)

# Zone Files
# First-time config, initialze file with include directive
if ! [ -f "$BIND_DIR/named.conf.local" ] ; then
    echo "include \"$TSIG_KEY_FILE\";" > "$BIND_DIR/named.conf.local"
fi

# Append each zone to the local config
for ZONE in "${ZONES[@]}"; do

    cat << EOF >> "$BIND_DIR/named.conf.local"

zone "$ZONE" {
    type master;
    file "$ZONE_DIR/db.$ZONE";
    allow-update { key "pfsense-key"; };
    allow-query { "trusted_net"; };
};
EOF

# Zone Databases
    cat <<EOF > "$ZONE_DIR/db.$ZONE"
\$ORIGIN .
\$TTL $TTL ; $NUM_MIN $MIN_QUANTIFIER
$ZONE       IN SOA  ns1.$ZONE. $ADMIN_EMAIL (
                                $SERIAL ; serial
                                $TTL         ; refresh
                                $TTL         ; retry
                                $TTL         ; expire
                                $TTL         ; minimum
                                )
                        NS      ns1.$ZONE.

\$ORIGIN $ZONE.
ns1                     A       $NS_IP
EOF

done

chown -R bind:bind "$ZONE_DIR"
chmod 750 "$ZONE_DIR"
chmod -R 640 "$ZONE_DIR/*.jnl" 2>/dev/null

bash /root/generate-zones.sh

Configure pfSense

DHCP

Internal Domains

Dynamic DNS

1. Log into pfSense
2. Click Services > DHCP Server

DNS Resolver

Add the Private Domain

1. Log into pfSense
2. Click Services > DNS Resolver

server:
    private-domain: home.internal
    local-zone: "lab.home.internal." transparent
    domain-insecure: home.internal

• private-domain — indicates this domain returns private IP addresses
• local-zone — tells unbound not to attempt outside lookup
• domain-insecure — tells unbound to ignore DNSSEC failures for local, private domain

Click Save and Apply Changes.

Add the Domain Override

1. Log into pfSense
2. Click Services > DNS Resolver
3. Scroll down to the bottom to Domain Overrides

Testing Dynamic DNS

Adding Static IPs to Dynamic DNS

Problem

There are some instances where a host has been set with a static IP configuration. One such example is my Proxmox VE nodes. In my case, the following is true:

• Proxmox VE has been set with a static IP address on vmbr0_mgmt, which is an OVS IntPort
• I've logged into pfSense and added a DHCP reservation for those addresses that are statically configured, so that DHCP won't hand them out
• The Proxmox VE nodes are members of a VLAN configured with lab.home.internal and this VLAN has been configured with DHCP Dynamic DNS

Solution

1. SSH or pct enter into the BIND server
2. Use some configuration file and cron trickery to add the records

nano /etc/bind/static-records.txt

server 127.0.0.1
debug yes

; Update Lab Zone
zone lab.home.internal.
update add proxmox.lab.home.internal. 60 A 172.16.100.6
update add proxmox-hx90.lab.home.internal. 60 A 172.16.100.12
update add proxmox-um690s.lab.home.internal. 60 A 172.16.100.15
update add proxmox-um690.lab.home.internal. 60 A 172.16.100.14
show
send

/usr/bin/nsupdate -k /etc/bind/pfsense.key -v /etc/bind/static-records.txt

crontab -e

# Dynamic DNS update to add static IP configurations
# Run every twelve hours to keep in BIND cache
0 */12 * * * /usr/bin/nsupdate -k /etc/bind/pfsense.key -v /etc/bind/static-records.txt

Overriding pfSense DDNS TTL

By default pfSense will push DHCP Dynamic DNS records with a TTL of 3600 — or 1 hour — and BIND will accept the TTL pushed by the DDNS client. In my testing, this had caused a problem with a stale record.

Synopsis of the problem

1. You build a VM / LXC with a specific hostname and its DHCP address gets pushed by Dynamic DNS – say test.lab.home.internal.
2. A host on the network queries test.lab.home.internal and Unbound returns the record from BIND. It's now cached with a TTL of 3600.
3. A few minutes later, you give the host a static IP configuration at a different IP address and refresh its DHCP lease, which is pushed to BIND.
4. Unbound still has the old record cached, because the TTL has not yet lapsed, so the new IP address of this host is not returned.

ssh admin@pfsense

nano /etc/inc/services.inc

2924                 if (isset($dhcpifconf['ddnsupdate'])) {
2925                         $need_ddns_updates = true;
2926                         $newzone = array();
2927                         if ($dhcpifconf['ddnsdomain'] <> "") {
2928                                 $newzone['domain-name'] = $dhcpifconf['ddnsdomain'];
2929                                 $dnscfg .= "    ddns-domainname \"{$dhcpifconf['ddnsdomain']}\";\n";
2930                         } else {
2931                                 $newzone['domain-name'] = config_get_path('system/domain');
2932                         }

2924                 if (isset($dhcpifconf['ddnsupdate'])) {
2925                         $need_ddns_updates = true;
2926                         $newzone = array();
2927                         if ($dhcpifconf['ddnsdomain'] <> "") {
2928                                 $newzone['domain-name'] = $dhcpifconf['ddnsdomain'];
2929                                 $dnscfg .= "    ddns-domainname \"{$dhcpifconf['ddnsdomain']}\";\n";
2930                                 $dnscfg .= "    ddns-ttl 60;\n";
2931                         } else {
2932                                 $newzone['domain-name'] = config_get_path('system/domain');
2933                         }

Next Step

Infrastructure-as-Code with Proxmox: Public Key Infrastructure (PKI)

In this module, we will install two Smallstep CA instances, an offline Root CA and an online intermediate CA. The Intermediate CA will also serve as an ACME provisioner for clients in select VLANs.

0xBEN0xBEN