Date: Mon, 29 Feb 2016 13:28:11 -0500 From: Jon Radel <jon@radel.com> To: Sergei G <sergeig.public@gmail.com>, FreeBSD Questions <freebsd-questions@freebsd.org> Subject: Re: DNS with host works, but not with mysql or ping Message-ID: <56D48DBB.5090305@radel.com> In-Reply-To: <CAFLLzCM-fjeLKt3twK_ijiheVBX2BQjfx_8qrRNFi_1mAo-aLA@mail.gmail.com> References: <CAFLLzCMntj4X2vLWd1VG=heE5S5sNVFsiSPNqyc8MAwPiWbMOw@mail.gmail.com> <CAFLLzCM-fjeLKt3twK_ijiheVBX2BQjfx_8qrRNFi_1mAo-aLA@mail.gmail.com>
next in thread | previous in thread | raw e-mail | index | archive | help
[-- Attachment #1 --] On 2/29/16 1:10 PM, Sergei G wrote: > It appears that host is suffering from the same problem: > > host yahoo.com > yahoo.com has address 206.190.36.45 > yahoo.com has address 98.138.253.109 > yahoo.com has address 98.139.183.24 > yahoo.com has IPv6 address 2001:4998:44:204::a7 > yahoo.com has IPv6 address 2001:4998:58:c02::a9 > yahoo.com has IPv6 address 2001:4998:c:a06::2:4008 > yahoo.com mail is handled by 1 mta7.am0.yahoodns.net. > yahoo.com mail is handled by 1 mta6.am0.yahoodns.net. > yahoo.com mail is handled by 1 mta5.am0.yahoodns.net. > > > fetch http://206.190.36.45 (yahoo) > times out Well, actually that's a different problem as that's not using the FQDN. > > On Mon, Feb 29, 2016 at 9:57 AM, Sergei G <sergeig.public@gmail.com> wrote: > >> If I use host command to resolve name to IP, then I get a correct IP. >> >> If I use ping, mysql, fetch commands, then DNS fails to resolve. I can't >> quite figure out what the difference is. DNS fails to resolve or the connection times out? I suspect the latter. >> block drop in log on bce0 all >> ... >> pass in quick on bce0 inet proto udp from 10.0.1.0/24 to 10.0.1.10 port = >> domain keep state >> pass in quick on bce0 inet proto udp from 192.168.3.0/24 to 10.0.1.10 >> port = domain keep state >> ... >> pass out quick on bce0 inet proto udp from any to any port = domain keep >> state >> ... I didn't analyze line-by-line in excruciating detail, but.... I rather suspect that the lack of a line that allows for outbound HTTP traffic that sets up state for the return packets means that all the HTTP return packets get zapped by your default drop. DNS works so much better as you have a "pass out quick" for DNS that keeps state. Since you log all that blockage, how about looking in your logs??????? BTW, given that your DNS pass statements are setup to allow only UDP, DNS is still broken, but only in an intermittent fashion that will eventually drive you insane. You might want to fix that too. --Jon Radel jon@radel.com [-- Attachment #2 --] 0 *H 010 `He 0 *H 00 #SanzTgk!0 *H 0o1 0 USE10U AddTrust AB1&0$U AddTrust External TTP Network1"0 UAddTrust External CA Root0 141222000000Z 200530104838Z01 0 UGB10UGreater Manchester10USalford10U COMODO CA Limited1A0?U8COMODO SHA-256 Client Authentication and Secure Email CA0"0 *H 0 zSNpR V&IQZI`zQBy"aNv# J n=ٺ.CRC|2PȦOZϓ%{0dV*$3DiFK3@@:*S= a<UNv%!)|qvO_T{5R"=,0-1YR73i-C֥wgQ'뼥8v8ߌIs:2:=F:WtaP@?⟢! 00 U #0z4&&T$T0 U akᢠOg£ 0U 0U 0 0 U %0++0U 00U 0DU =0;09753http://crl.usertrust.com/AddTrustExternalCARoot.crl05+)0'0%+0http://ocsp.usertrust.com0 *H *nU:Uka+ #fjow^a } [jr AX&MX"cR6}Xޫ;cs{B#ʶM>K-ػBKiۦ74{:ǟO4ne6d)5ֱqC>2Svʆ4, Jؙ ␒ZBj#!eջ~ꌅ b:,Yř38z yJ&|00sT<}k `i 0 *H 01 0 UGB10UGreater Manchester10USalford10U COMODO CA Limited1A0?U8COMODO SHA-256 Client Authentication and Secure Email CA0 150330000000Z 180329235959Z01 0 UUS10 U221501 0 UVA10U Springfield10U 6917 Ridgeway Dr.10U Jon T. Radel1200U )Issued through Jon T. Radel E-PKI Manager1 0 U Corporate Secure Email10U Jon Radel1 0 *H jon@radel.com0"0 *H 0 aЩ@@g3eGރ͛; d#>q7&Hf :3vL" jV#Xݷ>U-H[$SUڻ{Ϝ,z¶IchO=rcyr n v.Vh7k;%ueYuӬnz 6!| !Aȡ+,u+ CAպF-un#vjUJWnk%j] 2JPkl 00 U #0akᢠOg£ 0 U E|GDp/ʚB0U 0 U 0 0 U %0++0FU ?0=0; +10+0)+ https://secure.comodo.net/CPS0]U V0T0RPNLhttp://crl.comodoca.com/COMODOSHA256ClientAuthenticationandSecureEmailCA.crl0+00X+0Lhttp://crt.comodoca.com/COMODOSHA256ClientAuthenticationandSecureEmailCA.crt0$+0http://ocsp.comodoca.com0U 0 jon@radel.com0 *H KS `?H_D`8G߿ VbĘ<tB-Ӈї|{'Ũݹg0Gp$%F(;*MO*gt$@ t6,?0|#ăz,&! {j2i[%b7ߪP+9G㲍["y<?8rZ'[UR6%L̤ w"=:L~Ƨ^jf36 OP1.}(e1A0=001 0 UGB10UGreater Manchester10USalford10U COMODO CA Limited1A0?U8COMODO SHA-256 Client Authentication and Secure Email CAsT<}k `i 0 `He a0 *H 1 *H 0 *H 1 160229182811Z0/ *H 1" R X:$tN-aY;@P M^0l *H 1_0]0 `He*0 `He0 *H 0*H 0 *H @0+0 *H (0 +71001 0 UGB10UGreater Manchester10USalford10U COMODO CA Limited1A0?U8COMODO SHA-256 Client Authentication and Secure Email CAsT<}k `i 0 *H 101 0 UGB10UGreater Manchester10USalford10U COMODO CA Limited1A0?U8COMODO SHA-256 Client Authentication and Secure Email CAsT<}k `i 0 *H <O_;VJ(X +9Sc܍\d7v*WC"FE9^ϡ:Rc8i,65ꊌ:(X|^dSM-YVj NpDȍʷUB9 8PL VbpæMK[ F}Ȋ|YwWMQ`k,B :j# u"+rY;,H;GrK W~Էۄz"U F/o,ix )Vq!0't %9;+
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?56D48DBB.5090305>