Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    IPv6 and DNS Lead to Some Slow Websites

    Scheduled Pinned Locked Moved IPv6
    20 Posts 4 Posters 2.8k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • W
      wre136
      last edited by

      I have a Dell Optiplex 990 computer with a Quad-port 82575GB Gigabit Network Connection NIC running PFsense 2.4.4. It is configured with IPv4 and IPv6 from my WAN provider in which it is providing an IPv6 prefix for my internal network. I am also using DNS Resolver for local DNS on my network. I have configured my PFsense box to have Google DNS and One DNS but have also allowed ISP to override them.

      Most websites I access come up just fine. However, I have a hand full of websites that are incredibly slow to bring up or do not bring up completely (missing CSS, pictures, ads and more). I connected my PC directly to my modem and the sites pull up just fine. I connected my router back up. Then on my host, I assigned DNS to Google's DNS server and still slow. Then I disabled IPv6 on my host and BOOM, it works! Any combination of the two does not work unless DNS on my host is to something other than PFSense and IPv6 is disabled on my host.

      At this point, I am unaware of where to go next. Should I turn IPv6 off on my PFSense box and not use DNS Resolver? I rather not since I like to have IPv6 functionality and DNS Resolver offers internal DNS for my hosts and devices. Is there any logs I can check further into or any options that might help?

      • BIOS
        Vendor: Dell Inc.
        Version: A23
        Release Date: Sun Feb 11 2018

      • Version
        2.4.4-RELEASE (amd64)
        built on Thu Sep 20 09:03:12 EDT 2018
        FreeBSD 11.2-RELEASE-p3
        Version information updated at Tue Oct 2 10:02:18 CDT 2018

      • CPU Type
        Intel(R) Core(TM) i5-2400 CPU @ 3.10GHz
        Current: 3100 MHz, Max: 3101 MHz
        4 CPUs: 1 package(s) x 4 core(s)
        AES-NI CPU Crypto: Yes (active)

      • Hardware crypto
        AES-CBC,AES-XTS,AES-GCM,AES-ICM

      • Kernel PTI
        Enabled

      • Uptime
        01 Hour 19 Minutes 42 Seconds

      • Current date/time
        Tue Oct 2 11:21:16 CDT 2018

      • DNS server(s)
        127.0.0.1
        68.105.28.11
        68.105.29.11
        68.105.28.12
        2001:578:3f::30
        2001:578:3f:1::30
        1.0.0.1
        1.1.1.1
        2606:4700:4700::1001
        2606:4700:4700::1111
        8.8.8.8
        8.8.4.4
        2001:4860:4860::8888
        2001:4860:4860::8844

      • Installed Packages:
        LADVD 1.2.2
        mailreport 3.3
        mtr-nox11 0.85.6_1
        nmap 1.4.4_1
        open-vpn-export 1.4.17_2
        RRD_Summary 2.0
        Service_Watchdog 1.8.6
        Status_Traffic_Totals 1.2.4
        sudo 0.3_1

      1 Reply Last reply Reply Quote 0
      • W
        wre136
        last edited by

        Update:

        I enabled IPv6 on my host and assigned it a static IPv6 DNS Address of 2606:4700:4700::1001 (1.1.1.1 DNS) and it worked.

        So as of right now, the websites that are slow work just fine if I set my IPv4 and IPv6 DNS server entries to something other than my local pfsense router.

        Still do not know why that should matter or what the fix for DNS Resolver should be.

        1 Reply Last reply Reply Quote 0
        • B
          bfeitell
          last edited by

          Out of curiosity, what do you see for the MTU of your WAN interface under status/interfaces?

          1 Reply Last reply Reply Quote 0
          • W
            wre136
            last edited by

            Temporarily, I have resolved the issue by changing from DNS Resolver to to DNS Forwarder. However, I rather have the local DNS server myself that using external DNS servers. So I'm still looking into this.

            Below are the stats for my WAN connection. NOTE: Even though the MTU says 9000, the largest ping I can get from Windows to the Default Gateway of my WAN is 1472. I can ping with jumbo frames to the LAN interface and any object within my LAN

            WAN Interface (wan, igb0)

            • Status
              up

            • DHCP
              up Relinquish Lease

            • MAC Address
              00:1b:21:3c:42:40 - Intel Corporate

            • IPv4 Address
              <omitted>

            • Subnet mask IPv4
              255.255.240.0

            • Gateway IPv4
              174.67.0.1

            • IPv6 Link Local
              fe80::21b:21ff:fe3c:4240%igb0

            • IPv6 Address
              <omitted>

            • Subnet mask IPv6
              128

            • Gateway IPv6
              fe80::238:dfff:fe9a:5019

            • DNS servers
              127.0.0.1
              1.0.0.1
              2606:4700:4700::1001
              1.1.1.1
              2606:4700:4700::1111

            • MTU
              9000

            • Media
              1000baseT <full-duplex>

            • In/out packets
              1638176/805107 (1.89 GiB/94.49 MiB)

            • In/out packets (pass)
              1638176/805107 (1.89 GiB/94.49 MiB)

            • In/out packets (block)
              6670/0 (782 KiB/0 B)

            • In/out errors
              0/0

            • Collisions
              0

            sigiS 1 Reply Last reply Reply Quote 0
            • B
              bfeitell
              last edited by

              Try refreshing the connection without manually setting anything for the WAN MTU, and and please report what the MTU gets set to as reported in status/interfaces.

              1 Reply Last reply Reply Quote 0
              • W
                wre136
                last edited by

                It reports my MTU as 1500

                1 Reply Last reply Reply Quote 0
                • B
                  bfeitell
                  last edited by

                  Try testing your IPv6 connectivity and DNS lookup with the MTU set to default on the WAN. Do you still have the same problems?

                  1 Reply Last reply Reply Quote 0
                  • W
                    wre136
                    last edited by

                    No Go. I just switched back to DNS Resolver and still some websites are slow. As soon as I switch back to DNS Forwarder, they work fine.

                    1 Reply Last reply Reply Quote 0
                    • B
                      bfeitell
                      last edited by

                      What are your settings in DNS Resolver?

                      1 Reply Last reply Reply Quote 0
                      • W
                        wre136
                        last edited by

                        Any easy way to get that other than a screen shot?

                        1 Reply Last reply Reply Quote 0
                        • PippinP
                          Pippin
                          last edited by

                          ICMP blocked somewhere?
                          Maybe Prefer IPv4 over IPv6 helps?

                          I gloomily came to the ironic conclusion that if you take a highly intelligent person and give them the best possible, elite education, then you will most likely wind up with an academic who is completely impervious to reality.
                          Halton Arp

                          W 1 Reply Last reply Reply Quote 0
                          • B
                            bfeitell
                            last edited by bfeitell

                            You should leave the WAN MTU at the default. Being able to send a max ping of 1472 shows that 1500 is your actual MTU on the connection. The missing 8 bytes are the ICMP header for the ping packets. Please report what you have set for "IP Do-Not-Fragment compatibility", in system/advanced/firewall&nat?

                            W 1 Reply Last reply Reply Quote 0
                            • W
                              wre136 @Pippin
                              last edited by

                              @pippin Under system i did specify for it to use IPv4 over IPv6 but sadly didn't change anything

                              1 Reply Last reply Reply Quote 0
                              • B
                                bfeitell
                                last edited by

                                A screenshot of the first settings page would be perfect.

                                1 Reply Last reply Reply Quote 0
                                • W
                                  wre136 @bfeitell
                                  last edited by

                                  @bfeitell I have the IP Don-Not-Fragment compatibility flag not set. Should I enable that feature?

                                  1 Reply Last reply Reply Quote 0
                                  • B
                                    bfeitell
                                    last edited by bfeitell

                                    I would try it, and see if it has an effect on the function of DNS Resolver. I think that playing with your MTU on the WAN might be the cause, but I'd still like to see your settings for DNS Resolver. If you are using dns over tls with the Quad9 resolvers, that might explain things. I have found the Quad9 resolvers to be very slow in comparison to the cloudflare resolvers.

                                    1 Reply Last reply Reply Quote 0
                                    • W
                                      wre136
                                      last edited by

                                      Below are the basic settings I have for DNS Resolver:

                                      0_1538518269334_DNS Resolver Settings.png

                                      1 Reply Last reply Reply Quote 0
                                      • B
                                        bfeitell
                                        last edited by

                                        Check the log file for DNSBL in pfblocker. Depending upon what lists you are using, you might be blocking access to certain name servers you need for DNS Resolver to work correctly. If you temporarily disable pfb_dnsbl, you will need to reload on the update page to clear any blocks. Then test the DNS Resolver again.

                                        1 Reply Last reply Reply Quote 0
                                        • W
                                          wre136
                                          last edited by

                                          Pfblockerng isn't much of the issue. I factory reset my router and did a minimal setup using DNS Resolver and no pfblockerng. Still had the same issue. After seeing no change, I restored my original config bringing pfblockerng back

                                          1 Reply Last reply Reply Quote 0
                                          • sigiS
                                            sigi @wre136
                                            last edited by

                                            @wre136 I bet on https://redmine.pfsense.org/issues/8934 have own DNS on FreeBSD and get many problems with IPv6 DNS and Fragments. Disabling scrubbing helps. But then IPv4 DNS has same problems :-(

                                            Oct  9 17:25:41 host1 kernel: ipfw: 65300 Deny TCP [2001:500:e::1] [2axx:xxxx:xxxx:xxxx::53] in via bge0 (frag 1217fb81:188@9856)
Oct  9 17:25:57 host1 kernel: ipfw: 65300 Deny TCP [2001:500:f::1] [2axx:xxxx:xxxx:xxxx::53] in via bge0 (frag 4d6091d8:188@9856)
Oct  9 17:26:45 host1 kernel: ipfw: 65300 Deny TCP [2001:500:e::1] [2axx:xxxx:xxxx:xxxx::53] in via bge0 (frag 350be3db:188@9856)
Oct  9 17:31:29 host1 kernel: ipfw: 65300 Deny UDP [2001:500:40::1] [2axx:xxxx:xxxx:xxxx::53] in via bge0 (frag b576286c:361@9856)
Oct  9 17:51:24 host1 kernel: ipfw: 65300 Deny UDP [2001:470:1a::1] [2axx:xxxx:xxxx:xxxx::53] in via bge0 (frag 8533c2a5:642@9856)
Oct  9 17:51:26 host1 kernel: ipfw: 65300 Deny UDP [2001:5a0:10::1] [2axx:xxxx:xxxx:xxxx::53] in via bge0 (frag e06893c2:650@9856)
Oct  9 17:53:07 host1 kernel: ipfw: 65300 Deny UDP [2001:67c:18c4:2000::11:53] [2axx:xxxx:xxxx:xxxx::53] in via bge0 (frag 55df3089:362@9856)
Oct  9 18:11:05 host1 kernel: ipfw: 65300 Deny UDP [2001:500:48::1] [2axx:xxxx:xxxx:xxxx::53] in via bge0 (frag 8424932b:361@9856)
Oct  9 18:11:25 host1 kernel: ipfw: 65300 Deny UDP [2001:500:b::1] [2axx:xxxx:xxxx:xxxx::53] in via bge0 (frag 9da68734:361@9856)
Oct  9 18:14:41 host1 kernel: ipfw: 65300 Deny UDP [2001:500:c::1] [2axx:xxxx:xxxx:xxxx::53] in via bge0 (frag 69a41126:361@9856)
Oct  9 18:18:05 host1 kernel: ipfw: 65300 Deny UDP [2001:500:40::1] [2axx:xxxx:xxxx:xxxx::53] in via bge0 (frag a639e4fd:361@9856)
                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.