On Wed, Jan 28, 2015 at 9:13 AM, Lev Serebryakov <l...@freebsd.org> wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA512
>
>
> I could not resolve names with DNSSEC (for example, in freebsd.org
> domain) on two of my installations, one with FreeBSD 11 and other with
> FreeBSD 9.3.
>
> Symptoms are the same: answer is sent as fragmented IP/UDP packet and
> second part of answer is never arrived. For example, this doesn't work
> for me ("timeout" and only first part of fragmented packet on wire
> according to tcpdump):
>
> % dig +dnssec www.freebsd.org @72.52.71.1
>
> ; <<>> DiG 9.9.5 <<>> +dnssec www.freebsd.org @72.52.71.1
> ;; global options: +cmd
> ;; connection timed out; no servers could be reached
> %
>
> Problem is, latest bind (9.9 from ports) send such requests over UDP,
> not TCP.
>
> Is it Ok? Is it misconfiguration of my networks (I have such problem
> in tow different installations) or something?
>
> - --
> // Lev Serebryakov
>
Does the system have a firewall? If so, is it configured to allow
fragments?
For ipfw you need something like "allow ip from any to me frag". If you
want to restrict this to DNS, restrict it to dst-port 53.
--
Kevin Oberman, Network Engineer, Retired
E-mail: rkober...@gmail.com
_______________________________________________
freebsd-net@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-net
To unsubscribe, send any mail to "freebsd-net-unsubscr...@freebsd.org"
