# bind-9.4.3-P5 not answering queries over tcp6 from remote

## netzwerghh

Hi!

I'm operating two DNS servers. Both connected via IPv4 and IPv6 UDP and TCP. One of them (ns2.netzwerge.de 85.182.254.77 2001:6f8:931:1::2) works fine. It's still running bind-9.4.3_p3. But the other one (ns1.netzwerge.de 85.183.242.2 2001:6f8:1139:1::2) doesn't answer IPv6 queries over TCP only over UDP. This one is running bind-9.4.3-P5. Doing a local dig ns netzwerge.de -6 +tcp @ns1.netzwerge.de works fine. But if I try this form another machine (even from a machine at the same switch in the same IPv6-subnet) I get a timeout. Queries over UDP6 and over v4 are working fine.

I've checked, if it is a firewall issue. But even without any firewall running I get a timeout. I can see via netstat that a TCP6 session is established. But I still get a timeout.

Anyone having the same issue? Or can someone check this please?

Thanks

Dennis Koerner

----------

## richard.scott

Whats in your named.conf?

----------

## netzwerghh

Hi Richard,

the one of the not working ns1 is (I've removed comments and the definition of the acl. The included zones.conf has just zone-declarations in it.):

```

options {

        directory "/var/bind";

        listen-on-v6 { any; };

        pid-file "/var/run/named/named.pid";

        allow-transfer { secns; };

        notify yes;

        allow-recursion { 127.0.0.1; };

        querylog no;

        zone-statistics yes;

        statistics-file "named.stat";

};

zone "." IN {

        type hint;

        file "named.ca";

};

zone "localhost" IN {

        type master;

        file "pri/localhost.zone";

        allow-update { none; };

        notify no;

};

zone "127.in-addr.arpa" IN {

        type master;

        file "pri/127.zone";

        allow-update { none; };

        notify no;

};

zone "168.192.in-addr.arpa" IN {

        type master;

        file "pri/rev-192.168.zone";

        allow-update { none; };

        notify yes;

};

zone "27/0.242.183.85.in-addr.arpa" IN {

        type master;

        file "pri/rev-85.183.242.0-27.zone";

        allow-update { none; };

        notify yes;

};

zone "9.3.1.1.8.f.6.0.1.0.0.2.ip6.arpa" {

        type master;

        file "pri/rev-2001.6f8.1139.zone";

        allow-update { none; };

        notify yes;

};

zone "1.3.9.0.8.f.6.0.1.0.0.2.ip6.arpa" {

        type master;

        file "pri/rev-2001.6f8.931.zone";

        allow-update { none; };

        notify yes;

};

include "/etc/bind/zones.conf";

```

And the one of the working ns2 is:

```

options {

        directory "/var/bind";

        listen-on-v6 { any; };

        pid-file "/var/run/named/named.pid";

        allow-transfer { secns; };

        notify no;

        allow-recursion {

                192.168.102.0/24;

                192.168.100.0/24;

                85.182.254.77/30;

                2001:6f8:931:1::/64;

                127.0.0.1;

        };

        querylog no;

        zone-statistics yes;

        statistics-file "named.stat";

};

zone "." IN {

        type hint;

        file "named.ca";

};

zone "localhost" IN {

        type master;

        file "pri/localhost.zone";

        allow-update { none; };

        notify no;

};

zone "127.in-addr.arpa" IN {

        type master;

        file "pri/127.zone";

        allow-update { none; };

        notify no;

};

zone "168.192.in-addr.arpa" IN {

        type slave;

        file "sec/rev-192.168.zone";

        masters {

                85.183.242.2;

        };

};

zone "9.3.1.1.8.f.6.0.1.0.0.2.ip6.arpa" {

        type slave;

        file "sec/rev-2001.6f8.1139.zone";

        masters {

                85.183.242.2;

        };

};

zone "1.3.9.0.8.f.6.0.1.0.0.2.ip6.arpa" {

        type slave;

        file "sec/rev-2001.6f8.931.zone";

        masters {

                85.183.242.2;

        };

};

include "/etc/bind/zones.conf";

```

----------

## richard.scott

what's the output from:

```
netstat -nat
```

Does the required ports show up?

----------

## netzwerghh

Yes they show up:

 *Quote:*   

> 
> 
> ns1 ~ # netstat -naopt | grep named
> 
> tcp        0      0 192.168.10.103:53       0.0.0.0:*               LISTEN      21779/named          off (0.00/0/0)
> ...

 

And when doing a dig ns netzwerge.de -6 +tcp @ns1.netzwerge.de from ns2.netzwerge.de it says:

 *Quote:*   

> 
> 
> ns1 ~ # netstat -naopt | grep named
> 
> tcp        0      0 192.168.10.103:53       0.0.0.0:*               LISTEN      21779/named          off (0.00/0/0)
> ...

 

But the result ist:

 *Quote:*   

> 
> 
> ns2 ~ # dig ns netzwerge.de -6 +tcp @ns1.netzwerge.de
> 
> ; <<>> DiG 9.4.3-P3 <<>> ns netzwerge.de -6 +tcp @ns1.netzwerge.de
> ...

 

----------

## richard.scott

What if you copy all your config files over from the good server to the broken one?

----------

## netzwerghh

I don't think, this would be a good idea. Unfortunately both servers are production servers. The IPv6 connectivity is not that essential as they are only for testing purposes. So I wouldn't like to break my server by copying config-files from one to another without any sense   :Confused: 

I forgot to mention that I have another DNS server (caching only and internal) running bind-9.4.3_p5 which has the same problems. So I believe this is not a problem with my configuration but with bind-9.4.3_p5. Before upgrading to bind-9.4.3_p5 it worked with bind-9.4.3_p3 like a charme.

Do you or anyone else have a running bind-9.4.3_p5 with IPv6 connectivity working over tcp6?

By the way: Where are 9.7 and even 9.6 in portage? I saw a masked version of 9.6. But nothing for 9.7.

----------

## netzwerghh

OK. I figured out, that this is no bind-Problem. It seems to be some kind of configuration in my network or some kind of problem with my packages. But I still have no idea, what's the cause.

ICMPv6, UDPv6 are working fine. But all communications between my hosts over TCPv6 (DNS, SSH, HTTP) are not working. Netstat says that the TCP6 connection ist established but there seems to be no data exchanged. Very strange. This is also no kernel-configuration-issue, as I use exactly the same configuration for my gentoo-router building the gate to the SIXXS-net. This host works fine and can communicate with the whole v6-internet. But it also is unable to speak to my internal hosts over TCPv6.

By the way: the routing seems to work. I can ping6 form my internal v6-enabled hosts to outside hosts.

Very strange.....

----------

