Aliases Not Resolving to IPv6
-
Did you reset firewall states after adding the rule? See Diagnostics -> States, click on Reset states tab and read the explanation.
Does the source address shown in the firewall log match the Lan net address set in the rule?
-
Yes I reset the state table and yes the source address matches the LAN net address.
-
What does your IRCNetworks alias look like?
I'm not sure if the underlying tool that resolves hostnames (filterdns) is 100% ready for IPv6, since it could be a bit tricky on the backend. IIRC pf doesn't support mixing IPv4 and IPv6 entries in the same table, so there will probably need to be even more logic to make sure things aren't getting mixed up, and to make sure that an IPv4 table isn't made for an IPv6 rule and vice versa.
You're getting into areas that probably won't be completely ironed out until well after 2.0 releases and we can focus more on 2.1 and IPv6 in general.
-
Yeah I would think there would have to be something that says if set for ipv6 rule that aliases only do AAAA or something like.. I know when I query say chat.freenode.net I only get ipv4 unless I do a specific AAAA query. Do the irc servers have specific fqdn that only resolve ipv6, something like ipv6.google.com for example?
here you go
http://freenode.net/irc_servers.shtmllooks like you can do ipv6.chat.freenode.net, maybe that would help with your aliases?
-
aliases can have mixed ipv4 and ipv6 entries, it understands that atleast. Filterdns probably doesn't yet.
So hostnames will always be resolved with their v4 address currently iirc. But if the alias contains a ipv6 address it's fine.
What then applies is the inet/inet6 toggle on the filter rules page to decide what it applies to.
-
I'm not sure if the underlying tool that resolves hostnames (filterdns) is 100% ready for IPv6
aliases can have mixed ipv4 and ipv6 entries, it understands that atleast. Filterdns probably doesn't yet.
So hostnames will always be resolved with their v4 address currently iirc. But if the alias contains a ipv6 address it's fine.This is what I suspected as replacing the IRCNetworks alias with any (*) in the firewall rule or replacing the hostname with it's ipv6 address will work. However, it will not work properly with the p2p-network irc network as doing an nslookup on any of their hostnames returns all 5 of their ipv6 addresses and they don't return in the same order every time. This means I would have to enter all 5 of their addresses in the alias or have a 1 in 5 chance of connecting to the correct IP address on the first try. The other way would be to enter the same addresses into the alias and into mIRC instead of a hostname.
I know when I query say chat.freenode.net I only get ipv4 unless I do a specific AAAA query.
Our settings must be different because when I do a plain nslookup on chat.freenode.net or irc.p2p-network.net I get this:
C:\Users\Matt>nslookup irc.p2p-network.net Server: pf.int.*****.info Address: 192.168.1.1 Non-authoritative answer: Name: irc.p2p-network.net Addresses: 2001:470:1f11:cda::6667 2001:470:d:1c2:1:1:0:6667 2001:470:1c:188::6667 2001:1af8:4100:a008:1::6667 2607:f128:40:f00:fe31::5 67.220.66.113 216.86.158.123 72.20.40.52 67.43.228.226 C:\Users\Matt>nslookup chat.freenode.net Server: pf.int.*****.info Address: 192.168.1.1 Non-authoritative answer: Name: chat.freenode.net Addresses: 2001:1418:13:1::25 2a01:270:0:666f::1 2001:6b0:e:2018::172 78.40.125.4 82.96.64.4 86.65.39.15 89.16.176.16 93.152.160.101 128.237.157.136 130.239.18.172 140.211.167.98 140.211.167.99 174.143.119.91 213.92.8.4 213.179.58.83 213.232.93.3 216.155.130.130 38.229.70.20mIRC always takes the IPv6 address over the IPv4 address when connecting to a server.
-
you did your queries from a windows box..
But the pfsense box would be the one that would query chat.freenode.net to find the ip for the alias.
here I did a nslookup from the pfsense shell
nslookup
chat.freenode.net
Server: 127.0.0.1
Address: 127.0.0.1#53Non-authoritative answer:
Name: chat.freenode.net
Address: 213.232.93.3
Name: chat.freenode.net
Address: 128.237.157.136
Name: chat.freenode.net
Address: 82.96.64.4
Name: chat.freenode.net
Address: 130.239.18.172
Name: chat.freenode.net
Address: 140.211.167.98
Name: chat.freenode.net
Address: 86.65.39.15
Name: chat.freenode.net
Address: 216.155.130.130
Name: chat.freenode.net
Address: 89.16.176.16
Name: chat.freenode.net
Address: 140.211.167.99
Name: chat.freenode.net
Address: 174.143.119.91
Name: chat.freenode.net
Address: 78.40.125.4
Name: chat.freenode.net
Address: 213.92.8.4
Name: chat.freenode.net
Address: 38.229.70.20
Name: chat.freenode.net
Address: 213.179.58.83
Name: chat.freenode.net
Address: 93.152.160.101And then a dig from same shell
; <<>> DiG 9.6.2-P2 <<>> chat.freenode.net
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 27359
;; flags: qr rd ra; QUERY: 1, ANSWER: 15, AUTHORITY: 4, ADDITIONAL: 1;; QUESTION SECTION:
;chat.freenode.net. IN A;; ANSWER SECTION:
chat.freenode.net. 60 IN A 213.232.93.3
chat.freenode.net. 60 IN A 216.155.130.130
chat.freenode.net. 60 IN A 38.229.70.20
chat.freenode.net. 60 IN A 78.40.125.4
chat.freenode.net. 60 IN A 82.96.64.4
chat.freenode.net. 60 IN A 86.65.39.15
chat.freenode.net. 60 IN A 89.16.176.16
chat.freenode.net. 60 IN A 93.152.160.101
chat.freenode.net. 60 IN A 128.237.157.136
chat.freenode.net. 60 IN A 130.239.18.172
chat.freenode.net. 60 IN A 140.211.167.98
chat.freenode.net. 60 IN A 140.211.167.99
chat.freenode.net. 60 IN A 174.143.119.91
chat.freenode.net. 60 IN A 213.92.8.4
chat.freenode.net. 60 IN A 213.179.58.83;; AUTHORITY SECTION:
freenode.net. 86400 IN NS auth1.ns.sargasso.net.
freenode.net. 86400 IN NS ns0.tunk.net.
freenode.net. 86400 IN NS ns.bofh.it.
freenode.net. 86400 IN NS ns4086.freenode.net.;; ADDITIONAL SECTION:
ns4086.freenode.net. 86400 IN A 140.211.167.99;; Query time: 181 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Fri Aug 12 13:57:27 2011
;; MSG SIZE rcvd: 391But sure if I do it from a windows box, he likes the IPv6 stuff
Default Server: pfsense.ipv6.xxxx.net
Address: 2001:470:xxxx:b85::1chat.freenode.net
Server: pfsense.ipv6.xxxx.net
Address: 2001:470:xxxx:b85::1Non-authoritative answer:
Name: chat.freenode.net
Addresses: 2001:1418:13:1::25
2001:6b0:e:2018::172
2a01:270:0:666f::1
128.237.157.136
130.239.18.172
140.211.167.98
140.211.167.99
174.143.119.91
213.92.8.4
213.179.58.83
213.232.93.3
216.155.130.130
38.229.70.20
78.40.125.4
82.96.64.4
86.65.39.15
89.16.176.16
93.152.160.101 -
Works for me.
[2.1-DEVELOPMENT][root@thingy.org]/root/pfsense-ipv6(80): host chat.freenode.net
chat.freenode.net has address 213.92.8.4
chat.freenode.net has address 213.232.93.3
chat.freenode.net has address 193.219.128.49
chat.freenode.net has address 213.179.58.83
chat.freenode.net has address 86.65.39.15
chat.freenode.net has address 140.211.167.98
chat.freenode.net has address 128.237.157.136
chat.freenode.net has address 140.211.167.99
chat.freenode.net has address 130.239.18.172
chat.freenode.net has address 89.16.176.16
chat.freenode.net has address 78.40.125.4
chat.freenode.net has address 93.152.160.101
chat.freenode.net has address 216.155.130.130
chat.freenode.net has address 174.143.119.91
chat.freenode.net has address 38.229.70.20
chat.freenode.net has IPv6 address 2001:1418:13:1::25
chat.freenode.net has IPv6 address 2001:6b0:e:2018::172
chat.freenode.net has IPv6 address 2a01:270:0:666f::1 -
I see that, is that the method that firewall uses to resolve aliases?
-
Well, normall filterdns does that, but some other parts of the system might use host instead.
Filterdns definitely used for the aliases and firewall rules though.
But resolving from the firewall is not the issues that others are seeing, with dig or otherwise.
