Odd ipfw behavior with UDP query on the same host

From: Dan Mahoney (Ports) <freebsd_at_gushi.org>
Date: Sun, 04 Jun 2023 00:14:24 UTC
Hey ipfw folks — Im skipping questions@ and asking this directly here,

FreeBSD 12.4 (amd64)

Assume a partial firewall ruleset like this:

00300  0   0 allow ip from any to any via lo0
00400  0   0 allow ip from any to any via lo1
00500  0   0 deny ip from any to 127.0.0.0/8 in
00600  0   0 deny ip from any to ::/64 in
01600  1 174 allow ip from any to me 53 in // DNS queries
01700  1 293 allow ip from me 53 to any out // DNS responses
03000  0   0 reset log ip from any to any
65535  0   0 allow ip from any to any

For some reason, with the above, I’m able to query a DNS server living on my own (public) ipv6 interface, i,e:

dig @2001:b00b:6b:2::53 version.bind CH TXT:
;communications error to 2001:b00b:6b:2::53#53: timed out

This is not a bind config problem.  Bind answers from outside and everywhere else but itself.

==

If I change rule 1600 to simply be "allow ip from any to me 53” it works.  

If I do ipfw disable firewall it works.  

Localhost always works.

Using the ipv4 address works.

==

 It’s only when using an ipv6 interface ip on the same box that this breaks.  TCP also works, this only seems to be a UDP issue.

My best guess is something about the “inbound/outbound” determination logic is weird in ipv6.

My log rule shows: 
Jun  3 23:44:35 box kernel: ipfw: 3000 Deny UDP [2001:b00b:6b:2::53]:53 [2001:b00b:6b:2::53]:26588 in via em0
Jun  3 23:44:40 box kernel: ipfw: 3000 Deny UDP [2001:b00b:6b:2::53]:53 [2001:b00b:6b:2::53]:32389 in via em0

ipv4 doesn’t show this problem.  Subnet masks and the like are correct.

Any ideas?

-Dan