From owner-freebsd-pf@FreeBSD.ORG Sat Dec 29 12:02:53 2012 Return-Path: Delivered-To: freebsd-pf@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52]) by hub.freebsd.org (Postfix) with ESMTP id AE2B3961 for ; Sat, 29 Dec 2012 12:02:53 +0000 (UTC) (envelope-from cyberleo@cyberleo.net) Received: from paka.cyberleo.net (mtumishi.cyberleo.net [216.226.128.201]) by mx1.freebsd.org (Postfix) with ESMTP id 7E2DD8FC0C for ; Sat, 29 Dec 2012 12:02:52 +0000 (UTC) Received: from [172.16.44.4] (den.cyberleo.net [216.80.73.130]) by paka.cyberleo.net (Postfix) with ESMTPSA id AAC7C11EE79; Sat, 29 Dec 2012 06:54:41 -0500 (EST) Message-ID: <50DEDA01.4060103@cyberleo.net> Date: Sat, 29 Dec 2012 05:54:41 -0600 From: CyberLeo Kitsana User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:10.0.11) Gecko/20121201 Thunderbird/10.0.11 MIME-Version: 1.0 To: Michael Grimm Subject: Re: nc: connect to b:b:b:b::1:1 port 53 (tcp) failed: Operation timed out References: <14C709A3-B608-44C3-B12F-5F6790AA60DC@odo.in-berlin.de> In-Reply-To: <14C709A3-B608-44C3-B12F-5F6790AA60DC@odo.in-berlin.de> X-Enigmail-Version: 1.3.5 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Cc: freebsd-pf@freebsd.org X-BeenThere: freebsd-pf@freebsd.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: "Technical discussion and general questions about packet filter \(pf\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 29 Dec 2012 12:02:53 -0000 On 12/28/2012 05:59 AM, Michael Grimm wrote: > Hi -- > > I do run both my primary and secondary nameservers (distinct servers) in FreeBSD jails1 and jail2 as outlined below: > I do see using tcpdump at server1: > > | 00:00:02.066251 xx:xx:xx:xx:xx > yy:yy:yy:yy:yy, ethertype IPv6 (0x86dd), length 94: (flowlabel 0xa3c71, hlim 63, next-header TCP (6) payload length: 40) b:b:b:b::1.64158 > a:a:a:a:1::1.53: Flags [S], > cksum 0x959b (incorrect -> 0x58f9), seq 3833155181, win 65535, options [mss 1440,nop,wscale 6,sackOK,TS val 495939599 ecr 0], length 0 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ 9.1's PF appears to be either corrupting or not updating the packet checksum when it touches IPv6 packets. I was not able to figure out how or why in my brief perusal of the source, but it seems to affect more than just NAT66. http://freebsd.1045724.n5.nabble.com/PF-IPv6-NAT-and-The-Curse-of-The-Invalid-Checksum-td5769669.html -- Fuzzy love, -CyberLeo Furry Peace! - http://www.fur.com/peace/