Odd ipfw behavior with UDP query on the same host
- Go to: [ bottom of page ] [ top of archives ] [ this month ]
Date: Sun, 04 Jun 2023 00:14:24 UTC
Hey ipfw folks — Im skipping questions@ and asking this directly here, FreeBSD 12.4 (amd64) Assume a partial firewall ruleset like this: 00300 0 0 allow ip from any to any via lo0 00400 0 0 allow ip from any to any via lo1 00500 0 0 deny ip from any to 127.0.0.0/8 in 00600 0 0 deny ip from any to ::/64 in 01600 1 174 allow ip from any to me 53 in // DNS queries 01700 1 293 allow ip from me 53 to any out // DNS responses 03000 0 0 reset log ip from any to any 65535 0 0 allow ip from any to any For some reason, with the above, I’m able to query a DNS server living on my own (public) ipv6 interface, i,e: dig @2001:b00b:6b:2::53 version.bind CH TXT: ;communications error to 2001:b00b:6b:2::53#53: timed out This is not a bind config problem. Bind answers from outside and everywhere else but itself. == If I change rule 1600 to simply be "allow ip from any to me 53” it works. If I do ipfw disable firewall it works. Localhost always works. Using the ipv4 address works. == It’s only when using an ipv6 interface ip on the same box that this breaks. TCP also works, this only seems to be a UDP issue. My best guess is something about the “inbound/outbound” determination logic is weird in ipv6. My log rule shows: Jun 3 23:44:35 box kernel: ipfw: 3000 Deny UDP [2001:b00b:6b:2::53]:53 [2001:b00b:6b:2::53]:26588 in via em0 Jun 3 23:44:40 box kernel: ipfw: 3000 Deny UDP [2001:b00b:6b:2::53]:53 [2001:b00b:6b:2::53]:32389 in via em0 ipv4 doesn’t show this problem. Subnet masks and the like are correct. Any ideas? -Dan