From nobody Wed Apr 22 08:20:09 2026 X-Original-To: questions@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4g0sbd4DNFz6bkMH for ; Wed, 22 Apr 2026 08:20:13 +0000 (UTC) (envelope-from philip@freebsd.org) Received: from smtp.freebsd.org (smtp.freebsd.org [96.47.72.83]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "smtp.freebsd.org", Issuer "R12" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4g0sbd004Wz3dZD; Wed, 22 Apr 2026 08:20:12 +0000 (UTC) (envelope-from philip@freebsd.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1776846013; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=rV3/sDp89488V98JyYuWtWIoyssmpTGwQnWFwXBR1yo=; b=QfS6rHrTjfyi3EYeatxAnUhVhEr9zQ+uBztq2NtK/WEzrQpq7agfyIVxDLYjpcaM/qQvNN +Mg0CbhkMgJz0tuyc0de/H/lOk2g+XfC6+o3lJGPXf3FFnNGRC2ihAp6dpCOB1TZF34B+m WSd/VXBo2O4mlP1FltJYOgbpSnHlW+gAdHLabNCPUPMupPm8briiEqLdpcl20Bog3IZ2PP iBgcxxqhdjcZze/Sxk5iTAUc3U6EXEkfndDpXCr5W6wvvxzw/oMNTgYgnMw/xH7iseEpUC 3SM4SIEYAxm4ms7YmhSBsOGltfV7WKkLFqW5NfMP7uwkCGxgGaXlgDrsMsUDFg== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1776846013; a=rsa-sha256; cv=none; b=EdWl/Ponixe4pP9PanhBHxSjPI6NSR2f14LKTjpdlCHYSYtLUQXbAi9Ke1biFndMonULWS JGvdtOG6swnhmLzB5LqlP3skmokydVS5cbkv7daHjTIIMd7idGGXtaWEobVwbJlp3g0F6M To8pQEtBaZNUzRq+WlMTYRs7cfGPOxjddDzqrA+csy+wwxVsUtLiFErRlvUJhn1i0inYZg BvVN1lhzZrcK3+PBEpLgoMqAH3jGEk3EdxP3vHIXre1hml3uzeMQXS3gxTK+33AdE28d1T hTwtkffVliEN07nNmoJNVbkAdxvA62J86gEfSHraXnswoLEfo4SHdyAAlv4H6g== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1776846013; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=rV3/sDp89488V98JyYuWtWIoyssmpTGwQnWFwXBR1yo=; b=empjBoAjzwPK1TIdQEK1mJd3hGDRFkc5kILuRx3gSoTn2wCH+Dg2AFKVhoNd/hVq5zDlqi mfwA2j3SwFeEg5aKPRNOezcLVb/mgF5TFA+PiI3RAnq9hlOQa64z+GT2OmsEhrkxxSCJrB c+iycZyY5mOA0ehQHtsoD6HBr/EmmSvqDDt+Ip8mzZZYZjDnZsr7uAKKVKCv9vFM9q57DI bgH10E1jtx7U9/J9pghHY0v5+uHXAcg2NtZCKtUu0T3woL1wq4FeO3hq8lmRdk5OjsMHDZ kKkbZ1nUbZDBBVFatSD2dQIraAaP21TS7QzGjMty/GYwAAZ+kpRD7DUXsz8JpQ== Received: from fauth-a2-smtp.messagingengine.com (fauth-a2-smtp.messagingengine.com [103.168.172.201]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) (Authenticated sender: philip/mail) by smtp.freebsd.org (Postfix) with ESMTPSA id 4g0sbc6CG6z1SYp; Wed, 22 Apr 2026 08:20:12 +0000 (UTC) (envelope-from philip@freebsd.org) Received: from phl-compute-02.internal (phl-compute-02.internal [10.202.2.42]) by mailfauth.phl.internal (Postfix) with ESMTP id 52397F40068; Wed, 22 Apr 2026 04:20:12 -0400 (EDT) Received: from phl-frontend-03 ([10.202.2.162]) by phl-compute-02.internal (MEProxy); Wed, 22 Apr 2026 04:20:12 -0400 X-ME-Sender: X-ME-Received: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgeefhedrtddtgdeifeejjecutefuodetggdotefrod ftvfcurfhrohhfihhlvgemucfhrghsthforghilhdpuffrtefokffrpgfnqfghnecuuegr ihhlohhuthemuceftddtnecusecvtfgvtghiphhivghnthhsucdlqddutddtmdenucfjug hrpefhvfevufffoffkjghfgggtgfesthekmhdtredtjeenucfhrhhomheprfhhihhlihhp ucfrrggvphhsuceophhhihhlihhpsehfrhgvvggsshgurdhorhhgqeenucggtffrrghtth gvrhhnpeegfeetuedugffhjefgueektddvteejtdelkeejhfdujefgkeehvdetleegkeei ffenucffohhmrghinhepfhhrvggvsghsugdrohhrghdpqhhurgguledrnhgvthdpihhprd ifthhfpdhorhhgrdhnrghmvgenucevlhhushhtvghrufhiiigvpedtnecurfgrrhgrmhep mhgrihhlfhhrohhmpehphhhilhhiphdomhgvshhmthhprghuthhhphgvrhhsohhnrghlih hthidqudduieeivdeivdegkedqvdefhedukedttdekqdhphhhilhhipheppehfrhgvvggs shgurdhorhhgsehtrhhouhgslhgvrdhishdpnhgspghrtghpthhtohepvddpmhhouggvpe hsmhhtphhouhhtpdhrtghpthhtohepohguhhhirghmsghosehgmhgrihhlrdgtohhmpdhr tghpthhtohepqhhuvghsthhiohhnshesfhhrvggvsghsugdrohhrgh X-ME-Proxy: Feedback-ID: ia691475d:Fastmail Received: by mail.messagingengine.com (Postfix) with ESMTPA; Wed, 22 Apr 2026 04:20:11 -0400 (EDT) From: Philip Paeps To: Washington Odhiambo Cc: questions Subject: Re: Updating Ports on 15.0-RELEASE-p5 Date: Wed, 22 Apr 2026 16:20:09 +0800 X-Mailer: MailMate (2.0r6290) Message-ID: <542ED13F-A214-414C-8BD9-12A286DE8FEF@freebsd.org> In-Reply-To: References: <1D832CDB-EE1E-44E3-A60F-20B99501F0BF@freebsd.org> <77AF51FE-C831-4BF1-BB1B-1BA708CAF7B5@freebsd.org> List-Id: User questions List-Archive: https://lists.freebsd.org/archives/freebsd-questions List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: freebsd-questions@freebsd.org Sender: owner-freebsd-questions@FreeBSD.org MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 8bit On 2026-04-22 15:44:05 (+0800), Washington Odhiambo wrote: > On Wed, Apr 22, 2026 at 10:17 AM Philip Paeps > wrote: >> On 2026-04-22 14:45:25 (+0800), Washington Odhiambo wrote: >>> On Wed, Apr 22, 2026 at 8:58 AM Philip Paeps >>> wrote: >>>> I just noticed this message from a couple of weeks ago. The >>>> problem >>>> might have been transient but ... >>>> >>>> On 2026-04-04 19:50:48 (+0800), Washington Odhiambo wrote: >>>>> What's going on here? >>>> >>>> It looks like you're getting timeouts because you're talking to a >>>> pkg.FreeBSD.org mirror very far from where you are. >>>> >>>>> pkg: Failed to fetch >>>>> https://pkg.FreeBSD.org/FreeBSD:15:amd64/latest/meta.conf: Timeout >>>>> was reached >>>>> >>>>> [...] >>>> >>>> It's very odd to see you being sent all the way to New Jersey. Our >>>> GeoDNS should be sending you to Fastly infrastructure in Cape Town >>>> or >>>> our mirror in Johannesburg. Both are still a long way away but >>>> 70ms >>>> is a lot better than 250ms! >>>> >>>> Could you tell me your source IP address please? I can optimise >>>> the >>>> routing. >>> >>> [...] >>> 4 * * 41.215.131.9 (41.215.131.9) 3.135 ms >> >> This hop is in Nairobi and our GeoDNS would send you to somewhere >> nearby. Are you perhaps using a DNS server far away, or one that >> strips >> ECS information? E.g. 9.9.9.9 will do this - 9.9.9.11 will work much >> better. >> >> See https://quad9.net/service/service-addresses-and-features/#ecssec >> >> Or is your origin network (masked by the NAT hops) in another >> netblock >> that isn't geolocated to Kenya? >> >> What does this tell you? >> >> % curl http://ip.wtf >> >>> 18 pkg0.nyi.freebsd.org (96.47.72.71) 251.058 ms 251.621 ms >>> 246.661 ms >>> root@gw:/home/wash # >>> root@gw:/home/wash # pkg update >>> Updating FreeBSD-ports repository catalogue... >>> pkg: Failed to fetch >>> https://pkg.FreeBSD.org/FreeBSD:15:amd64/latest/meta.conf: Timeout >>> was >>> reached >>> pkg: Failed to fetch >> >> pkg should be robust with high latency but there are a lot of hops on >> the path. And who knows what those first couple of hops are doing. >> :) >> >> For what it's worth, from WaveX in Nairobi I get sent to Fastly in >> Cape >> Town. > > root@gw:/home/wash # nslookup >> pkg.freebsd.org > Server: 127.0.0.1 > Address: 127.0.0.1#53 > > Non-authoritative answer: > pkg.freebsd.org canonical name = pkgmir.geo.freebsd.org. > Name: pkgmir.geo.freebsd.org > Address: 96.47.72.71 > Name: pkgmir.geo.freebsd.org > Address: 2610:1c1:1:606c::50:1 >> > root@gw:/home/wash # lsof -i -P -n | grep :53 > unbound 46811 unbound 3u IPv4 0xfffff800063af540 0 UDP > 127.0.0.1:53->*:* > unbound 46811 unbound 4u IPv4 0xfffff80006dff540 0 TCP > 127.0.0.1:53->*:* (LISTEN) > root@gw:/home/wash # cat /var/unbound/forward.conf > forward-zone: > name: . > forward-tls-upstream: yes > forward-first: no > forward-addr: 1.0.0.1@53 #cloudflare > This is your problem. Cloudflare does not send the EDNS Client Subnet (ECS) to our authoritative servers so we have no way of determining where your query comes from. In the absence of a geographic origin, we point you at our site of last resort: New Jersey. One option is to configure a stub-zone for geo.FreeBSD.org, e.g.: stub-zone: name: geo.FreeBSD.org stub-host: gns1.FreeBSD.org stub-host: gns2.FreeBSD.org stub-first: yes The "stub-first: yes" will ensure you can still resolve geo.FreeBSD.org if we ever decide to rename our servers something else and save you some debugging. (Note that we don't plan to rename these servers but, if ever the operational need arises, we might.) Note that this will send us queries without TLS (we don't do DNS-over-TLS) but your ISP already sees your traffic to FreeBSD.org - sending us a couple of DNS queries won't give them much more information. You could also work around this with another forward-zone block for geo.FreeBSD.org that points to a DNS server that sends us client information, e.g.: forward-zone: name: . forward-tls-upstream: yes forward-first: yes forward-addr: 9.9.9.11@53 #quad9 with ECS The "forward-first: yes" will make Unbound fall back to regular resolving from the root, which is a good idea for robustness. If you feel strongly about TLS, you might want to turn this off. In that case, it'll break if you can't reach 9.9.9.11. Before you embark on this adventure though, please do a quick test with e.g. nameserver 9.9.9.11 (or your ISP's DNS servers) in /etc/resolv.conf (i.e. bypass your local-unbound for testing). If that also sends you to New Jersey, I might be talking out of my hat and we can try something else. :) (I don't think I'm talking out of my hat though.) > PS: I am using Jamii Telecommunications in Nairobi. I checked all of the prefixes being announced by JTL/AS36866 and they're all being sent to Fastly (probably Cape Town) with a fallback to Europe (Sweden). Isn't DNS fun?! ;) Philip