Re: ip6tables breaks dnssec?

[Leo Baltus <Leo.Baltus@omroep.nl>]

Op 27/04/2011 om 13:22:57 +0200, schreef Jan Engelhardt:
> On Wednesday 2011-04-27 12:43, Ulrich Weber wrote:
> 
> >Each fragmented IPv6 packets will traverse netfilter separately,
> >in contrast to IPv4, where its only one refragmented packet.
> 
> Not really. All fragments enter nf_hook_slow, be it IPv4 or IPv6.
> It's just that nf_defrag - which is a netfilter module - collects and 
> suppresses fragments before spitting out the unfragmented one.
> 
> >"ip6tables -A INPUT -j ACCEPT -p udp --dport 53" will only match the
> >first fragment, where the UDP header can be found. To match the
> >additional fragments, you have to insert these rules:
> >
> >ip6tables -I INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
> >ip6tables -I OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
> 
> That will load nf_conntrack_ipv6, and because conntrack depends on 
> nf_defrag_ipv6, will load that too. Once it is loaded, packets should 
> be defragmented independetly of whether you actually use -m conntrack 
> (or the obsolete -m state) or not.

my /proc/config.gs says:
CONFIG_NF_CONNTRACK_IPV6=y
so it is already loaded

But is does not defrag.

Also I am a bit worried about using conntrack because of the high
volume dns queries tend to be which would generate a very large
connectiontracking table and/or system load.

-- 
Leo Baltus, internetbeheerder                         /\
NPO ICT Internet Services                            /NPO/\
Sumatralaan 45, 1217 GP Hilversum, Filmcentrum, west \  /\/
beheer@omroep.nl, 035-6773555                         \/