Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    IPv6 and DNS Lead to Some Slow Websites

    IPv6
    4
    20
    2.5k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • B
      bfeitell
      last edited by

      Try testing your IPv6 connectivity and DNS lookup with the MTU set to default on the WAN. Do you still have the same problems?

      1 Reply Last reply Reply Quote 0
      • W
        wre136
        last edited by

        No Go. I just switched back to DNS Resolver and still some websites are slow. As soon as I switch back to DNS Forwarder, they work fine.

        1 Reply Last reply Reply Quote 0
        • B
          bfeitell
          last edited by

          What are your settings in DNS Resolver?

          1 Reply Last reply Reply Quote 0
          • W
            wre136
            last edited by

            Any easy way to get that other than a screen shot?

            1 Reply Last reply Reply Quote 0
            • PippinP
              Pippin
              last edited by

              ICMP blocked somewhere?
              Maybe Prefer IPv4 over IPv6 helps?

              I gloomily came to the ironic conclusion that if you take a highly intelligent person and give them the best possible, elite education, then you will most likely wind up with an academic who is completely impervious to reality.
              Halton Arp

              W 1 Reply Last reply Reply Quote 0
              • B
                bfeitell
                last edited by bfeitell

                You should leave the WAN MTU at the default. Being able to send a max ping of 1472 shows that 1500 is your actual MTU on the connection. The missing 8 bytes are the ICMP header for the ping packets. Please report what you have set for "IP Do-Not-Fragment compatibility", in system/advanced/firewall&nat?

                W 1 Reply Last reply Reply Quote 0
                • W
                  wre136 @Pippin
                  last edited by

                  @pippin Under system i did specify for it to use IPv4 over IPv6 but sadly didn't change anything

                  1 Reply Last reply Reply Quote 0
                  • B
                    bfeitell
                    last edited by

                    A screenshot of the first settings page would be perfect.

                    1 Reply Last reply Reply Quote 0
                    • W
                      wre136 @bfeitell
                      last edited by

                      @bfeitell I have the IP Don-Not-Fragment compatibility flag not set. Should I enable that feature?

                      1 Reply Last reply Reply Quote 0
                      • B
                        bfeitell
                        last edited by bfeitell

                        I would try it, and see if it has an effect on the function of DNS Resolver. I think that playing with your MTU on the WAN might be the cause, but I'd still like to see your settings for DNS Resolver. If you are using dns over tls with the Quad9 resolvers, that might explain things. I have found the Quad9 resolvers to be very slow in comparison to the cloudflare resolvers.

                        1 Reply Last reply Reply Quote 0
                        • W
                          wre136
                          last edited by

                          Below are the basic settings I have for DNS Resolver:

                          0_1538518269334_DNS Resolver Settings.png

                          1 Reply Last reply Reply Quote 0
                          • B
                            bfeitell
                            last edited by

                            Check the log file for DNSBL in pfblocker. Depending upon what lists you are using, you might be blocking access to certain name servers you need for DNS Resolver to work correctly. If you temporarily disable pfb_dnsbl, you will need to reload on the update page to clear any blocks. Then test the DNS Resolver again.

                            1 Reply Last reply Reply Quote 0
                            • W
                              wre136
                              last edited by

                              Pfblockerng isn't much of the issue. I factory reset my router and did a minimal setup using DNS Resolver and no pfblockerng. Still had the same issue. After seeing no change, I restored my original config bringing pfblockerng back

                              1 Reply Last reply Reply Quote 0
                              • sigiS
                                sigi @wre136
                                last edited by

                                @wre136 I bet on https://redmine.pfsense.org/issues/8934 have own DNS on FreeBSD and get many problems with IPv6 DNS and Fragments. Disabling scrubbing helps. But then IPv4 DNS has same problems :-(

                                Oct  9 17:25:41 host1 kernel: ipfw: 65300 Deny TCP [2001:500:e::1] [2axx:xxxx:xxxx:xxxx::53] in via bge0 (frag 1217fb81:188@9856)
Oct  9 17:25:57 host1 kernel: ipfw: 65300 Deny TCP [2001:500:f::1] [2axx:xxxx:xxxx:xxxx::53] in via bge0 (frag 4d6091d8:188@9856)
Oct  9 17:26:45 host1 kernel: ipfw: 65300 Deny TCP [2001:500:e::1] [2axx:xxxx:xxxx:xxxx::53] in via bge0 (frag 350be3db:188@9856)
Oct  9 17:31:29 host1 kernel: ipfw: 65300 Deny UDP [2001:500:40::1] [2axx:xxxx:xxxx:xxxx::53] in via bge0 (frag b576286c:361@9856)
Oct  9 17:51:24 host1 kernel: ipfw: 65300 Deny UDP [2001:470:1a::1] [2axx:xxxx:xxxx:xxxx::53] in via bge0 (frag 8533c2a5:642@9856)
Oct  9 17:51:26 host1 kernel: ipfw: 65300 Deny UDP [2001:5a0:10::1] [2axx:xxxx:xxxx:xxxx::53] in via bge0 (frag e06893c2:650@9856)
Oct  9 17:53:07 host1 kernel: ipfw: 65300 Deny UDP [2001:67c:18c4:2000::11:53] [2axx:xxxx:xxxx:xxxx::53] in via bge0 (frag 55df3089:362@9856)
Oct  9 18:11:05 host1 kernel: ipfw: 65300 Deny UDP [2001:500:48::1] [2axx:xxxx:xxxx:xxxx::53] in via bge0 (frag 8424932b:361@9856)
Oct  9 18:11:25 host1 kernel: ipfw: 65300 Deny UDP [2001:500:b::1] [2axx:xxxx:xxxx:xxxx::53] in via bge0 (frag 9da68734:361@9856)
Oct  9 18:14:41 host1 kernel: ipfw: 65300 Deny UDP [2001:500:c::1] [2axx:xxxx:xxxx:xxxx::53] in via bge0 (frag 69a41126:361@9856)
Oct  9 18:18:05 host1 kernel: ipfw: 65300 Deny UDP [2001:500:40::1] [2axx:xxxx:xxxx:xxxx::53] in via bge0 (frag a639e4fd:361@9856)
                                1 Reply Last reply Reply Quote 0
                                • First post
                                  Last post
                                Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.