Aliases Not Resolving to IPv6

Matthias · Aug 11, 2011, 12:16 AM

I'm having trouble with a firewall rule for irc. I cannot connect to servers via IPv6 with this rule. Here it is pictured below:

The IRCNetworks Alias has a list of irc server names such as chat.freenode.net and irc.p2p-network.net etc. The firewall seems to be blocking the connections. If I replace the domain name with the actual IPv6 address it works fine. It would appear that the server name is not resolving properly to it's IPv6 address.

I've uesd the packet capture and it seems to be hitting the internal LAN interface but not exiting through the IPv6 Gateway.

Here it is in the firewall logs:

The resulting message is:

The rule that triggered this action is:

@3 scrub in on gif0 all fragment reassemble
@3 block drop in log inet6 all label "Default deny rule IPv6"

wallabybob · Aug 11, 2011, 11:53 AM

Did you reset firewall states after adding the rule? See Diagnostics -> States, click on Reset states tab and read the explanation.

Does the source address shown in the firewall log match the Lan net address set in the rule?

Matthias · Aug 11, 2011, 10:47 PM

Yes I reset the state table and yes the source address matches the LAN net address.

jimp · Aug 12, 2011, 2:09 PM

What does your IRCNetworks alias look like?

I'm not sure if the underlying tool that resolves hostnames (filterdns) is 100% ready for IPv6, since it could be a bit tricky on the backend. IIRC pf doesn't support mixing IPv4 and IPv6 entries in the same table, so there will probably need to be even more logic to make sure things aren't getting mixed up, and to make sure that an IPv4 table isn't made for an IPv6 rule and vice versa.

You're getting into areas that probably won't be completely ironed out until well after 2.0 releases and we can focus more on 2.1 and IPv6 in general.

johnpoz · Aug 12, 2011, 2:39 PM

Yeah I would think there would have to be something that says if set for ipv6 rule that aliases only do AAAA or something like.. I know when I query say chat.freenode.net I only get ipv4 unless I do a specific AAAA query. Do the irc servers have specific fqdn that only resolve ipv6, something like ipv6.google.com for example?

here you go
http://freenode.net/irc_servers.shtml

looks like you can do ipv6.chat.freenode.net, maybe that would help with your aliases?

databeestje · Aug 12, 2011, 3:49 PM

aliases can have mixed ipv4 and ipv6 entries, it understands that atleast. Filterdns probably doesn't yet.

So hostnames will always be resolved with their v4 address currently iirc. But if the alias contains a ipv6 address it's fine.

What then applies is the inet/inet6 toggle on the filter rules page to decide what it applies to.

Matthias · Aug 12, 2011, 5:08 PM

@jimp:

I'm not sure if the underlying tool that resolves hostnames (filterdns) is 100% ready for IPv6

@databeestje:

aliases can have mixed ipv4 and ipv6 entries, it understands that atleast. Filterdns probably doesn't yet.
So hostnames will always be resolved with their v4 address currently iirc. But if the alias contains a ipv6 address it's fine.

This is what I suspected as replacing the IRCNetworks alias with any (*) in the firewall rule or replacing the hostname with it's ipv6 address will work. However, it will not work properly with the p2p-network irc network as doing an nslookup on any of their hostnames returns all 5 of their ipv6 addresses and they don't return in the same order every time. This means I would have to enter all 5 of their addresses in the alias or have a 1 in 5 chance of connecting to the correct IP address on the first try. The other way would be to enter the same addresses into the alias and into mIRC instead of a hostname.

@johnpoz:

I know when I query say chat.freenode.net I only get ipv4 unless I do a specific AAAA query.

Our settings must be different because when I do a plain nslookup on chat.freenode.net or irc.p2p-network.net I get this:

C:\Users\Matt>nslookup irc.p2p-network.net
Server:  pf.int.*****.info
Address:  192.168.1.1

Non-authoritative answer:
Name:    irc.p2p-network.net
Addresses:  2001:470:1f11:cda::6667
          2001:470:d:1c2:1:1:0:6667
          2001:470:1c:188::6667
          2001:1af8:4100:a008:1::6667
          2607:f128:40:f00:fe31::5
          67.220.66.113
          216.86.158.123
          72.20.40.52
          67.43.228.226

C:\Users\Matt>nslookup chat.freenode.net
Server:  pf.int.*****.info
Address:  192.168.1.1

Non-authoritative answer:
Name:    chat.freenode.net
Addresses:  2001:1418:13:1::25
          2a01:270:0:666f::1
          2001:6b0:e:2018::172
          78.40.125.4
          82.96.64.4
          86.65.39.15
          89.16.176.16
          93.152.160.101
          128.237.157.136
          130.239.18.172
          140.211.167.98
          140.211.167.99
          174.143.119.91
          213.92.8.4
          213.179.58.83
          213.232.93.3
          216.155.130.130
          38.229.70.20

mIRC always takes the IPv6 address over the IPv4 address when connecting to a server.

johnpoz · Aug 12, 2011, 7:00 PM

you did your queries from a windows box..

But the pfsense box would be the one that would query chat.freenode.net to find the ip for the alias.

here I did a nslookup from the pfsense shell

nslookup

chat.freenode.net
Server: 127.0.0.1
Address: 127.0.0.1#53

Non-authoritative answer:
Name: chat.freenode.net
Address: 213.232.93.3
Name: chat.freenode.net
Address: 128.237.157.136
Name: chat.freenode.net
Address: 82.96.64.4
Name: chat.freenode.net
Address: 130.239.18.172
Name: chat.freenode.net
Address: 140.211.167.98
Name: chat.freenode.net
Address: 86.65.39.15
Name: chat.freenode.net
Address: 216.155.130.130
Name: chat.freenode.net
Address: 89.16.176.16
Name: chat.freenode.net
Address: 140.211.167.99
Name: chat.freenode.net
Address: 174.143.119.91
Name: chat.freenode.net
Address: 78.40.125.4
Name: chat.freenode.net
Address: 213.92.8.4
Name: chat.freenode.net
Address: 38.229.70.20
Name: chat.freenode.net
Address: 213.179.58.83
Name: chat.freenode.net
Address: 93.152.160.101

And then a dig from same shell

; <<>> DiG 9.6.2-P2 <<>> chat.freenode.net
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 27359
;; flags: qr rd ra; QUERY: 1, ANSWER: 15, AUTHORITY: 4, ADDITIONAL: 1

;; QUESTION SECTION:
;chat.freenode.net. IN A

;; ANSWER SECTION:
chat.freenode.net. 60 IN A 213.232.93.3
chat.freenode.net. 60 IN A 216.155.130.130
chat.freenode.net. 60 IN A 38.229.70.20
chat.freenode.net. 60 IN A 78.40.125.4
chat.freenode.net. 60 IN A 82.96.64.4
chat.freenode.net. 60 IN A 86.65.39.15
chat.freenode.net. 60 IN A 89.16.176.16
chat.freenode.net. 60 IN A 93.152.160.101
chat.freenode.net. 60 IN A 128.237.157.136
chat.freenode.net. 60 IN A 130.239.18.172
chat.freenode.net. 60 IN A 140.211.167.98
chat.freenode.net. 60 IN A 140.211.167.99
chat.freenode.net. 60 IN A 174.143.119.91
chat.freenode.net. 60 IN A 213.92.8.4
chat.freenode.net. 60 IN A 213.179.58.83

;; AUTHORITY SECTION:
freenode.net. 86400 IN NS auth1.ns.sargasso.net.
freenode.net. 86400 IN NS ns0.tunk.net.
freenode.net. 86400 IN NS ns.bofh.it.
freenode.net. 86400 IN NS ns4086.freenode.net.

;; ADDITIONAL SECTION:
ns4086.freenode.net. 86400 IN A 140.211.167.99

;; Query time: 181 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Fri Aug 12 13:57:27 2011
;; MSG SIZE rcvd: 391

But sure if I do it from a windows box, he likes the IPv6 stuff

Default Server: pfsense.ipv6.xxxx.net
Address: 2001:470:xxxx:b85::1

chat.freenode.net
Server: pfsense.ipv6.xxxx.net
Address: 2001:470:xxxx:b85::1

Non-authoritative answer:
Name: chat.freenode.net
Addresses: 2001:1418:13:1::25
2001:6b0:e:2018::172
2a01:270:0:666f::1
128.237.157.136
130.239.18.172
140.211.167.98
140.211.167.99
174.143.119.91
213.92.8.4
213.179.58.83
213.232.93.3
216.155.130.130
38.229.70.20
78.40.125.4
82.96.64.4
86.65.39.15
89.16.176.16
93.152.160.101

databeestje · Aug 29, 2011, 2:25 PM

Works for me.

[2.1-DEVELOPMENT][root@thingy.org]/root/pfsense-ipv6(80): host chat.freenode.net
chat.freenode.net has address 213.92.8.4
chat.freenode.net has address 213.232.93.3
chat.freenode.net has address 193.219.128.49
chat.freenode.net has address 213.179.58.83
chat.freenode.net has address 86.65.39.15
chat.freenode.net has address 140.211.167.98
chat.freenode.net has address 128.237.157.136
chat.freenode.net has address 140.211.167.99
chat.freenode.net has address 130.239.18.172
chat.freenode.net has address 89.16.176.16
chat.freenode.net has address 78.40.125.4
chat.freenode.net has address 93.152.160.101
chat.freenode.net has address 216.155.130.130
chat.freenode.net has address 174.143.119.91
chat.freenode.net has address 38.229.70.20
chat.freenode.net has IPv6 address 2001:1418:13:1::25
chat.freenode.net has IPv6 address 2001:6b0:e:2018::172
chat.freenode.net has IPv6 address 2a01:270:0:666f::1

johnpoz · Aug 29, 2011, 4:30 PM

I see that, is that the method that firewall uses to resolve aliases?

databeestje · Aug 29, 2011, 7:14 PM

Well, normall filterdns does that, but some other parts of the system might use host instead.

Filterdns definitely used for the aliases and firewall rules though.
But resolving from the firewall is not the issues that others are seeing, with dig or otherwise.