From owner-freebsd-questions@FreeBSD.ORG Mon Aug 19 06:36:40 2013 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTP id E910834A for ; Mon, 19 Aug 2013 06:36:39 +0000 (UTC) (envelope-from cscoman@gmail.com) Received: from mail-vb0-x235.google.com (mail-vb0-x235.google.com [IPv6:2607:f8b0:400c:c02::235]) (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)) (No client certificate requested) by mx1.freebsd.org (Postfix) with ESMTPS id A9F212597 for ; Mon, 19 Aug 2013 06:36:39 +0000 (UTC) Received: by mail-vb0-f53.google.com with SMTP id i3so2884119vbh.40 for ; Sun, 18 Aug 2013 23:36:38 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; bh=nGxpGMSQO01oZcQ5OFMjf5UjzpBcuYP0nkFvpWoTrmg=; b=pFG3m5Vt65o+LtDXe3jRT2K7xs0jwXTXTbsbnu3bUswOVp5hOSJRsFcKXdPDSgnszL zY/BdtqWYtwqsSSArf8fUGveyqmNZLkGs50KQE9oxbKYvkTi17jAbFR+J8PLEYiJVyV2 fGPp4ZkbGtlUsACGgo8TIycDfAYm4eqYnDA4p0Qmx87hRpuD40SCMUYD9fIUqtlWAYRk c4MMHD89zSFYeC1JtK0o9ZN9Qd3UhJY2sizrx5IL4v5hio/fQWT+KEpBT3O30ygphBxy nsRB+jgucxtIOER+NLhjQ19qfTvPKieVqPwc27IrYRmhbbcleQDnxhOxgqXZsGBr5uyz KQTQ== MIME-Version: 1.0 X-Received: by 10.58.217.167 with SMTP id oz7mr11955254vec.15.1376894198723; Sun, 18 Aug 2013 23:36:38 -0700 (PDT) Received: by 10.58.163.39 with HTTP; Sun, 18 Aug 2013 23:36:38 -0700 (PDT) In-Reply-To: <5211B5E1.6040000@blackfoot.net> References: <5211B5E1.6040000@blackfoot.net> Date: Sun, 18 Aug 2013 23:36:38 -0700 Message-ID: Subject: Re: ipfw confusion From: Jason Cox To: Gary Aitken Content-Type: text/plain; charset=UTF-8 X-Content-Filtered-By: Mailman/MimeDel 2.1.14 Cc: FreeBSD Mailing List X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 19 Aug 2013 06:36:40 -0000 Are you sure that your DNS requests are over TCP? DNS primarily uses UDP to serve requests. TCP is used when the response data size exceeds 512 bytes (I think), or for tasks such as zone transfers. I know a few resolver implementations use TCP for all queries, but most I have used not. You might want to add rules to allow UDP as well. On Sun, Aug 18, 2013 at 11:06 PM, Gary Aitken wrote: > I'm having some weird ipfw behavior, or it seems weird to me, and am > looking > for an explaination and then a way out. > > ipfw list > ... > 21109 allow tcp from any to 12.32.44.142 dst-port 53 in via tun0 setup > keep-state > 21129 allow tcp from any to 12.32.36.65 dst-port 53 in via tun0 setup > keep-state > ... > 65534 deny log logamount 5 ip from any to any > > tail -f messages > Aug 18 23:33:06 nightmare named[914]: client 188.231.152.46#63877: error > sending response: permission denied > > 12.32.36.65 is the addr of the internal interface (xl0) on the firewall > and is the public dns server. > 12.32.44.142 is the addr of the external interface (tun0) which is bridged > on a > dsl line. > > It appears that a dns request was allowed in, but the response was not > allowed > back out. It seems to me the above rules 21109 and 21129 should have > allowed > the request in and the response back out. > > It's possible a request could come in on 12.32.44.142, > which is why 21109 is present; > although I know I am getting failures to reply to refresh requests > from a secondary addressed to 12.32.36.65 > > What am I missing? > > Is there a problem if the incoming rule is for tun0, > which gets passed to named > since 12.32.44.142 is on the physical machine running named, > but named pumps its response out on 12.32.36.65, > relying on routing to get it to the right place, > and that fails to match the state tracking mechanism > which started with 12.32.44.142? > _______________________________________________ > freebsd-questions@freebsd.org mailing list > http://lists.freebsd.org/mailman/listinfo/freebsd-questions > To unsubscribe, send any mail to " > freebsd-questions-unsubscribe@freebsd.org" > -- Jason Cox