Aliases Not Resolving to IPv6



  • I'm having trouble with a firewall rule for irc. I cannot connect to servers via IPv6 with this rule. Here it is pictured below:

    The IRCNetworks Alias has a list of irc server names such as chat.freenode.net and irc.p2p-network.net etc. The firewall seems to be blocking the connections. If I replace the domain name with the actual IPv6 address it works fine. It would appear that the server name is not resolving properly to it's IPv6 address.

    I've uesd the packet capture and it seems to be hitting the internal LAN interface but not exiting through the IPv6 Gateway.

    Here it is in the firewall logs:

    The resulting message is:

    The rule that triggered this action is:

    @3 scrub in on gif0 all fragment reassemble
    @3 block drop in log inet6 all label "Default deny rule IPv6"



  • Did you reset firewall states after adding the rule? See Diagnostics -> States, click on Reset states tab and read the explanation.

    Does the source address shown in the firewall log match the Lan net address set in the rule?



  • Yes I reset the state table and yes the source address matches the LAN net address.


  • Rebel Alliance Developer Netgate

    What does your IRCNetworks alias look like?

    I'm not sure if the underlying tool that resolves hostnames (filterdns) is 100% ready for IPv6, since it could be a bit tricky on the backend. IIRC pf doesn't support mixing IPv4 and IPv6 entries in the same table, so there will probably need to be even more logic to make sure things aren't getting mixed up, and to make sure that an IPv4 table isn't made for an IPv6 rule and vice versa.

    You're getting into areas that probably won't be completely ironed out until well after 2.0 releases and we can focus more on 2.1 and IPv6 in general.


  • LAYER 8 Global Moderator

    Yeah I would think there would have to be something that says if set for ipv6 rule that aliases only do AAAA or something like.. I know when I query say chat.freenode.net I only get ipv4 unless I do a specific AAAA query.  Do the irc servers have specific fqdn that only resolve ipv6, something like ipv6.google.com for example?

    here you go
    http://freenode.net/irc_servers.shtml

    looks like you can do ipv6.chat.freenode.net, maybe that would help with your aliases?



  • aliases can have mixed ipv4 and ipv6 entries, it understands that atleast. Filterdns probably doesn't yet.

    So hostnames will always be resolved with their v4 address currently iirc. But if the alias contains a ipv6 address it's fine.

    What then applies is the inet/inet6 toggle on the filter rules page to decide what it applies to.



  • @jimp:

    I'm not sure if the underlying tool that resolves hostnames (filterdns) is 100% ready for IPv6

    @databeestje:

    aliases can have mixed ipv4 and ipv6 entries, it understands that atleast. Filterdns probably doesn't yet.
    So hostnames will always be resolved with their v4 address currently iirc. But if the alias contains a ipv6 address it's fine.

    This is what I suspected as replacing the IRCNetworks alias with any (*) in the firewall rule or replacing the hostname with it's ipv6 address will work. However, it will not work properly with the p2p-network irc network as doing an nslookup on any of their hostnames returns all 5 of their ipv6 addresses and they don't return in the same order every time. This means I would have to enter all 5 of their addresses in the alias or have a 1 in 5 chance of connecting to the correct IP address on the first try. The other way would be to enter the same addresses into the alias and into mIRC instead of a hostname.

    @johnpoz:

    I know when I query say chat.freenode.net I only get ipv4 unless I do a specific AAAA query.

    Our settings must be different because when I do a plain nslookup on chat.freenode.net or irc.p2p-network.net I get this:

    C:\Users\Matt>nslookup irc.p2p-network.net
    Server:  pf.int.*****.info
    Address:  192.168.1.1
    
    Non-authoritative answer:
    Name:    irc.p2p-network.net
    Addresses:  2001:470:1f11:cda::6667
              2001:470:d:1c2:1:1:0:6667
              2001:470:1c:188::6667
              2001:1af8:4100:a008:1::6667
              2607:f128:40:f00:fe31::5
              67.220.66.113
              216.86.158.123
              72.20.40.52
              67.43.228.226
    
    C:\Users\Matt>nslookup chat.freenode.net
    Server:  pf.int.*****.info
    Address:  192.168.1.1
    
    Non-authoritative answer:
    Name:    chat.freenode.net
    Addresses:  2001:1418:13:1::25
              2a01:270:0:666f::1
              2001:6b0:e:2018::172
              78.40.125.4
              82.96.64.4
              86.65.39.15
              89.16.176.16
              93.152.160.101
              128.237.157.136
              130.239.18.172
              140.211.167.98
              140.211.167.99
              174.143.119.91
              213.92.8.4
              213.179.58.83
              213.232.93.3
              216.155.130.130
              38.229.70.20
    
    

    mIRC always takes the IPv6 address over the IPv4 address when connecting to a server.


  • LAYER 8 Global Moderator

    you did your queries from a windows box..

    But the pfsense box would be the one that would query chat.freenode.net to find the ip for the alias.

    here I did a nslookup from the pfsense shell

    nslookup

    chat.freenode.net
    Server:         127.0.0.1
    Address:        127.0.0.1#53

    Non-authoritative answer:
    Name:   chat.freenode.net
    Address: 213.232.93.3
    Name:   chat.freenode.net
    Address: 128.237.157.136
    Name:   chat.freenode.net
    Address: 82.96.64.4
    Name:   chat.freenode.net
    Address: 130.239.18.172
    Name:   chat.freenode.net
    Address: 140.211.167.98
    Name:   chat.freenode.net
    Address: 86.65.39.15
    Name:   chat.freenode.net
    Address: 216.155.130.130
    Name:   chat.freenode.net
    Address: 89.16.176.16
    Name:   chat.freenode.net
    Address: 140.211.167.99
    Name:   chat.freenode.net
    Address: 174.143.119.91
    Name:   chat.freenode.net
    Address: 78.40.125.4
    Name:   chat.freenode.net
    Address: 213.92.8.4
    Name:   chat.freenode.net
    Address: 38.229.70.20
    Name:   chat.freenode.net
    Address: 213.179.58.83
    Name:   chat.freenode.net
    Address: 93.152.160.101

    And then a dig from same shell

    ; <<>> DiG 9.6.2-P2 <<>> chat.freenode.net
    ;; global options: +cmd
    ;; Got answer:
    ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 27359
    ;; flags: qr rd ra; QUERY: 1, ANSWER: 15, AUTHORITY: 4, ADDITIONAL: 1

    ;; QUESTION SECTION:
    ;chat.freenode.net.             IN      A

    ;; ANSWER SECTION:
    chat.freenode.net.      60      IN      A       213.232.93.3
    chat.freenode.net.      60      IN      A       216.155.130.130
    chat.freenode.net.      60      IN      A       38.229.70.20
    chat.freenode.net.      60      IN      A       78.40.125.4
    chat.freenode.net.      60      IN      A       82.96.64.4
    chat.freenode.net.      60      IN      A       86.65.39.15
    chat.freenode.net.      60      IN      A       89.16.176.16
    chat.freenode.net.      60      IN      A       93.152.160.101
    chat.freenode.net.      60      IN      A       128.237.157.136
    chat.freenode.net.      60      IN      A       130.239.18.172
    chat.freenode.net.      60      IN      A       140.211.167.98
    chat.freenode.net.      60      IN      A       140.211.167.99
    chat.freenode.net.      60      IN      A       174.143.119.91
    chat.freenode.net.      60      IN      A       213.92.8.4
    chat.freenode.net.      60      IN      A       213.179.58.83

    ;; AUTHORITY SECTION:
    freenode.net.           86400   IN      NS      auth1.ns.sargasso.net.
    freenode.net.           86400   IN      NS      ns0.tunk.net.
    freenode.net.           86400   IN      NS      ns.bofh.it.
    freenode.net.           86400   IN      NS      ns4086.freenode.net.

    ;; ADDITIONAL SECTION:
    ns4086.freenode.net.    86400   IN      A       140.211.167.99

    ;; Query time: 181 msec
    ;; SERVER: 127.0.0.1#53(127.0.0.1)
    ;; WHEN: Fri Aug 12 13:57:27 2011
    ;; MSG SIZE  rcvd: 391

    But sure if I do it from a windows box, he likes the IPv6 stuff

    Default Server:  pfsense.ipv6.xxxx.net
    Address:  2001:470:xxxx:b85::1

    chat.freenode.net
    Server:  pfsense.ipv6.xxxx.net
    Address:  2001:470:xxxx:b85::1

    Non-authoritative answer:
    Name:    chat.freenode.net
    Addresses:  2001:1418:13:1::25
             2001:6b0:e:2018::172
             2a01:270:0:666f::1
             128.237.157.136
             130.239.18.172
             140.211.167.98
             140.211.167.99
             174.143.119.91
             213.92.8.4
             213.179.58.83
             213.232.93.3
             216.155.130.130
             38.229.70.20
             78.40.125.4
             82.96.64.4
             86.65.39.15
             89.16.176.16
             93.152.160.101



  • Works for me.

    [2.1-DEVELOPMENT][root@thingy.org]/root/pfsense-ipv6(80): host chat.freenode.net
    chat.freenode.net has address 213.92.8.4
    chat.freenode.net has address 213.232.93.3
    chat.freenode.net has address 193.219.128.49
    chat.freenode.net has address 213.179.58.83
    chat.freenode.net has address 86.65.39.15
    chat.freenode.net has address 140.211.167.98
    chat.freenode.net has address 128.237.157.136
    chat.freenode.net has address 140.211.167.99
    chat.freenode.net has address 130.239.18.172
    chat.freenode.net has address 89.16.176.16
    chat.freenode.net has address 78.40.125.4
    chat.freenode.net has address 93.152.160.101
    chat.freenode.net has address 216.155.130.130
    chat.freenode.net has address 174.143.119.91
    chat.freenode.net has address 38.229.70.20
    chat.freenode.net has IPv6 address 2001:1418:13:1::25
    chat.freenode.net has IPv6 address 2001:6b0:e:2018::172
    chat.freenode.net has IPv6 address 2a01:270:0:666f::1


  • LAYER 8 Global Moderator

    I see that, is that the method that firewall uses to resolve aliases?



  • Well, normall filterdns does that, but some other parts of the system might use host instead.

    Filterdns definitely used for the aliases and firewall rules though.
    But resolving from the firewall is not the issues that others are seeing, with dig or otherwise.


Log in to reply