On Tue, 29 May 2012 08:22:54 +0200 Per Jessen wrote:

James Knott wrote:

...

Carlos E. R. wrote:

...

I have a local dns server (bind 9), and I wonder if there is some setting so that it doesn't do any IPv6 query to outside. Would that be AAAA records? Perhaps is it possible to block such queries in the firewall?

I don't know about bind, but I doubt you could filter it at the firewall, as you'd then have to filter all DNS requests.

Not necessarily - iptables has content inspection, so it might be possible to identify individual AAAA queries. The question is if dropping such queries wouldn't just mean longer processing time?

At the risk of pointing out the obvious and unintentionally insulting someone, in this case I'd recommend the 'BIND 9 Administrator Reference Manual' from Internet Systems Consortium, available at this page on their site under 'Reference and FAQ'. There is also a 'new KnowledgeBase' available linked from this page: http://www.isc.org/software/bind/documentation I'm not sure I exactly understand your requirement, Carlos, but if it can be done, the BIND 9 ARM is the penultimate named.conf 'cook book' :-) hth & regards, Carl -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

Carlos E. R. wrote:

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1

On 2012-05-29 15:43, Carl Hartung wrote:

...

At the risk of pointing out the obvious and unintentionally insulting someone, in this case I'd recommend the 'BIND 9 Administrator Reference Manual' from Internet Systems Consortium, available at this page on their site under 'Reference and FAQ'. There is also a 'new KnowledgeBase' available linked from this page:

http://www.isc.org/software/bind/documentation

I'm not sure I exactly understand your requirement, Carlos, but if it can be done, the BIND 9 ARM is the penultimate named.conf 'cook book' :-)

But the point of posting here is that perhaps somebody already knows how to do it, and not force me to study that documentation in depth and become a bind expert. What I did was search for the word ipv6 in the documentation included with named, which includes the FAQ. I also searched for ipv6 in the link you posted, and nothing comes to light close to my requirement.

What I want is simply that when something searches for an address, the answer should not include an IPv6 address, no matter what.

Yes, that is understood - I haven't got the bind9 admin manual memorized word for word, but I don't recall ever seeing anything that would allow one to suppress a reply or ignore a query based on the type/contents. Personally I doubt if anyone happens to know how to do it - it is a highly unusual request. -- Per Jessen, Zürich (24.9°C) -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

Carl Hartung wrote:

On Tue, 29 May 2012 16:59:22 +0200 "Carlos E. R." wrote:

<snipped>

...

What I want is simply that when something searches for an address, the answer should not include an IPv6 address, no matter what.

Got it now, thanks! :-)

Edit named.conf, change "any" to "none" for item 'listen-on-v6 port 53':

options { listen-on port 53 { any; }; - - - - - 8< - - - - - listen-on-v6 port 53 { none; - - - - - 8< - - - - - };

restart bind

That doesn't do it, unfortunately. That only controls if bind should receive queries from IPv6 networks, not whether it should not return AAAA records. -- Per Jessen, Zürich (25.5°C) -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

Carl Hartung wrote:

On Tue, 29 May 2012 17:52:15 +0200 Per Jessen wrote:

...

Carl Hartung wrote:

...

On Tue, 29 May 2012 16:59:22 +0200 "Carlos E. R." wrote:

<snipped>

...

What I want is simply that when something searches for an address, the answer should not include an IPv6 address, no matter what.

Got it now, thanks! :-)

Edit named.conf, change "any" to "none" for item 'listen-on-v6 port 53':

options { listen-on port 53 { any; }; - - - - - 8< - - - - - listen-on-v6 port 53 { none; - - - - - 8< - - - - - };

restart bind

That doesn't do it, unfortunately. That only controls if bind should receive queries from IPv6 networks, not whether it should not return AAAA records.

Pardon my denseness and I'm certainly not an expert, but doesn't restricting the server to operating in 'IPv4 only' mode cause it to only return IPv4 addresses? How can it return IPv6 responses via port 53 in the IPv4 address space (without tunneling)?

We're not talking about responses going over IPv6, but about responses with AAAA DNS records (which happen to be IPv6 addresses). The actual communication might happen over IPv4, -5 or -6 or even carrier pigeon (RFC1149). :-) -- Per Jessen, Zürich (23.6°C) -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

Carl Hartung wrote:

On Tue, 29 May 2012 19:33:59 +0200 Per Jessen wrote:

[snip]

...

We're not talking about responses going over IPv6, but about responses with AAAA DNS records (which happen to be IPv6 addresses). The actual communication might happen over IPv4, -5 or -6 or even carrier pigeon (RFC1149). :-)

I get this part, Per. I really do - at least I /thought/ I did. This explains why, when I run a query via cli from my IPv4 network, I get back a listing containing both addresses (if the IPv6 address exists.)

Exactly.

But that's a diagnostic procedure, right?

Nope.

It isn't an exact replacement for the 'live' transaction that occurs between, say, a browser on an IPv4 network and a DNS server configured for, and residing on, an IPv6 network, right? IOW, in everyday operation, if a request arrives at an IPv6 enabled server on IPv4 port 53, the fact that it arrives at the IPv4 address results in the IPv4 address, alone, being returned - the rational being it is presumed that the client is unable to use the IPv6 address.

Am I way out past left field here today? :-)

Yeah ... how a DNS query arrives will at most determine how the response will be sent back. Whether a DNS query arrives via IPv4 or IPv6 does not in any way determine what the response contains. -- Per Jessen, Zürich (19.6°C) -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 2012-05-29 21:49, Carl Hartung wrote:

On Tue, 29 May 2012 21:33:13 +0200 Per Jessen <> wrote:

Thanks for all the responses, first thing .-)

...

Yeah ... how a DNS query arrives will at most determine how the response will be sent back. Whether a DNS query arrives via IPv4 or IPv6 does not in any way determine what the response contains.

So the server sends back two records instead of one, and the client just discards the one it can't use. That's not very efficient (stupid server!) Thanks for the clarification ;-)

The problem is this: cer@Telcontar:~> host download.opensuse.org download.opensuse.org has address 195.135.221.134 download.opensuse.org has IPv6 address 2001:67c:2178:8::13 cer@Telcontar:~> Now look at this message from the kernel when booting and setting up the network: <0.7> 2012-05-26 14:27:40 Telcontar kernel - - - [ 266.098003] eth0: no IPv6 routers present Nevertheless, if the IPv6 address fails, programs attempt to send IPv6 over internet, even though there is no IPv6 router, only same segment transport. One method of avoiding these connectivity problems would be to somehow not getting the IPv6 address in DNS queries, somehow. - -- Cheers / Saludos, Carlos E. R. (from 11.4 x86_64 "Celadon" at Telcontar) -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.16 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iEYEARECAAYFAk/FMaYACgkQIvFNjefEBxqMvwCghP88uNRuSriNrweFIUYWYCms P/EAoIPZMv5WOJBld39CNsIlnoYM2Y00 =UQS0 -----END PGP SIGNATURE----- -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

Carlos E. R. wrote:

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1

On 2012-05-29 22:29, Carlos E. R. wrote:

...

The problem is this:

...

...

Now look at this message from the kernel when booting and setting up the network:

<0.7> 2012-05-26 14:27:40 Telcontar kernel - - - [ 266.098003] eth0: no IPv6 routers present

Why, if the kernel knows it is impossible to route IPv6 addresses, why does it still send them? That message should be enough to disable internet IPv6.

I guess it's not the kernel, but an application that tries. Also, lack of a default route could be just a temporary issue. -- Per Jessen, Zürich (22.3°C) -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

Carlos E. R. wrote:

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1

On 2012-05-30 12:47, Per Jessen wrote:

...

Carlos E. R. wrote:

...

I guess it's not the kernel, but an application that tries. Also, lack of a default route could be just a temporary issue.

Well, the kernel should say "no" immediately, till it knows that there is a route.

You could try openeing a bugreport/enhancement request - my personal feeling is that it is working as designed. After all, networking doesn't shut down just because there is no external route. -- Per Jessen, Zürich (23.6°C) -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

Per Jessen wrote:

Carlos E. R. wrote:

...

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1

On 2012-05-30 12:47, Per Jessen wrote:

...

Carlos E. R. wrote: I guess it's not the kernel, but an application that tries. Also, lack of a default route could be just a temporary issue. Well, the kernel should say "no" immediately, till it knows that there is a route. You could try openeing a bugreport/enhancement request - my personal feeling is that it is working as designed. After all, networking doesn't shut down just because there is no external route.

Quite so. Every IPv6 capable device has a link local address that can be used for communication within the local LAN. For example, when you use a router, you use it's link local address. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

Carlos E. R. wrote:

...

Quite so. Every IPv6 capable device has a link local address that can

...

be used for communication within the local LAN. For example, when you use a router, you use it's link local address. I understand that local addresses are accessible. But how about internet addresses, should they be considered accessible without an IPv6 capable router?

I don't know the details, but the IP stack should be able to recogize what's reachable and what's not. I don't seem to have a problem with the apps I use. As I mentioned in an earlier note, my firewall resolv.conf contains 2 IPv6 DNS server addresses and 1 IPv4. The main reason I have the IPv4 one is that the 6in4 tunnel software needs to use a DNS to start up and find the tunnel broker. If I had only IPv6 DNS servers available, it would never work. So, the tunnel software manages to get past those 2 IPv6 addresses and reach the IPv4 DNS. Other apps, such as browsers and email likewise have no problem working regardless of whether or not IPv6 is available. Perhaps the problem is within that app that you're having problems with. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 2012-05-30 14:32, James Knott wrote:

Carlos E. R. wrote:

...

...

Now look at this message from the kernel when booting and setting up

...

the network:

...

<0.7> 2012-05-26 14:27:40 Telcontar kernel - - - [ 266.098003] eth0: no IPv6 routers present Why, if the kernel knows it is impossible to route IPv6 addresses, why does it still send them? That message should be enough to disable internet IPv6.

-

It is entirely possible to use IPv6 without routing IPv6 addresses. Link local addresses (the ones that start with FE80) can be used on the local network. They're also used for forwarding through a router. For example, here's my IPv6 default route: default via fe80::202:a5ff:fe7b:d908. Also, the Windows "Home Group" uses only IPv6, regardless of whether there's IPv6 routing.

For local addresses, I understand. But internet addresses are not accessible, no? - -- Cheers / Saludos, Carlos E. R. (from 11.4 x86_64 "Celadon" at Telcontar) -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.16 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iEYEARECAAYFAk/GFGgACgkQIvFNjefEBxoNXACfV9yKVbmCosIR6wechUlp4yKs 3d4An3ovlYZq7/jD02eYfIyEUuiTuKnA =0d0R -----END PGP SIGNATURE----- -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

Carl Hartung wrote:

So the server sends back two records instead of one, and the client just discards the one it can't use. That's not very efficient (stupid server!)

How is the server to know whether the requester can use IPv6 addresses? As I mentioned in another note, DNS requests on my local network can be either IPv4 or IPv6, but all computers can access IPv6 sites. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

Carl Hartung wrote:

On Tue, 29 May 2012 16:54:36 -0400 James Knott wrote:

...

...

So the server sends back two records instead of one, and the client just discards the one it can't use. That's not very efficient (stupid server!) How is the server to know whether the requester can use IPv6 addresses? An IPv6 capable requester will use the DNS server's IPv6 address. Any requester directing it's inquiries to the server's IPv4 address could be

Carl Hartung wrote: presumed incapable of using IPv6.

...

As I mentioned in another note, DNS requests on my local network can be either IPv4 or IPv6, but all computers can access IPv6 sites. Doesn't this just mean that your network has built-in backwards compatibility so it can support legacy 'IPv4 only' systems? Certainly it doesn't mean that your IPv6 systems are pestering the DNS server on it's IPv4 address? :-)

As I mentioned earlier, the only thing that determines whether IPv4 or IPv6 is used is static configuration or DHCP. With static configuration, I specify the IPv6 address. However, since the DHCP server is not capable of handing out IPv6 addresses, any device using DHCP uses the IPv4 address. There are also many DNS servers on the web that hand out IPv6 info over IPv4. I can use them, if I choose, and still get IPv6 info. In fact, I was doing that before I found a suitable IPv6 address DNS server. So, not only cannot a DNS server assume that an IPv4 request means the requester cannot use IPv6, it must not. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

Carl Hartung wrote:

On Tue, 29 May 2012 21:33:13 +0200 Per Jessen wrote:

...

how a DNS query arrives will at most determine how the response will be sent back. Whether a DNS query arrives via IPv4 or IPv6 does not in any way determine what the response contains.

So the server sends back two records instead of one, and the client just discards the one it can't use. That's not very efficient (stupid server!) Thanks for the clarification ;-)

Computers are stupid, they only do what they're told :-) The server just answers the query - if the client asked for both kinds of addresses (which an IPv6-aware application would), that's what the server will respond with (if available). -- Per Jessen, Zürich (16.8°C) -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

James Knott wrote:

Per Jessen wrote:

...

Yeah ... how a DNS query arrives will at most determine how the response will be sent back. Whether a DNS query arrives via IPv4 or IPv6 does not in any way determine what the response contains.

Quite so. I run dnsmasq on my firewall. The resolv.conf file for that computer lists 2 different IPv6 DNS servers and one IPv4. Computers on my network with static configuration use the IPv6 address to access dnsmasq and those that use DHCP, use IPv4. Either way, all computers get the exact same info, whether IPv6 or IPv4 addresses.

I guess Carlos is really in a bind with this one. ;-)

Haha, good one! If Carlos is determined to go this way, I think his only option might be to use iptables content inspection and fiddle with the incoming query packet - there should be flags indicating the desired address types: ipv4, ipv6 or both. -- Per Jessen, Zürich (16.8°C) -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

Carlos E. R. wrote:

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1

On 2012-05-30 08:37, Per Jessen wrote:

...

James Knott wrote:

...

...

I guess Carlos is really in a bind with this one. ;-)

Haha, good one!

Yah, right :-?

...

If Carlos is determined to go this way, I think his only option might be to use iptables content inspection and fiddle with the incoming query packet - there should be flags indicating the desired address types: ipv4, ipv6 or both.

Well, it is something I don't know how to do :-}

Right now I don't know either, but it's a matter of looking at a DNS query packet and then writing some iptables rules that will a) identify such packets and b) modify the right bits. -- Per Jessen, Zürich (22.2°C) -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org