Problems with IPFW causing failed DNS and FTP sessions

[Don O'Neil]

My DNS config is pretty generic. I did try putting in the options to stop
recursive lookups, but all that did was cause even more failures (permission
denied lookups, etc...), so I removed that.

Here's my basic config;

options {
        directory       "/etc/namedb";
        pid-file        "/var/run/named/pid";
        dump-file       "/var/dump/named_dump.db";
        statistics-file "/var/stats/named.stats";

};

zone "." {
        type hint;
        file "named.root";
};

I'm not sure the problem is specific to named, but something more systemic
with IPFW.... like I said, FTP sessions are timing out as well, and when I
turn off IPFW that fixes that problem too.

Is there any way to monitor what IPFW is dropping, by some sort of counters
rather than logging everything, and see what's going on internally to IPFW?

Thanks!

-----Original Message-----
From: Michael Sierchio [mailto:kudzu at tenebras.com] 
Sent: Monday, April 01, 2013 7:23 AM
To: Don O'Neil
Cc: freebsd-questions at freebsd.org
Subject: Re: Problems with IPFW causing failed DNS and FTP sessions

Okay, what's your DNS setup?  Are you running a recursive cache that
contacts the root servers directly?  Using your ISP's servers?  Etc.

As a mitigation step, I tried pointing my caches to 8.8.8.8 and
8.8.4.4. - but it turns out that Google is intentionally blocking
(returning NX responses to) many netblocks right now because they
contain hosts known to be part of the botnet in the DDOS DNS
amplification attack.

I'm mirroring the root zone everywhere I have a cache, and it's helping.