Topics

Hi folks,

after the update to 25.1.4_1 (I think from 25.1.2) BIND is not starting anymore.

In system.log I only see:

Code Select Expand

<13>1 2025-03-28T19:08:58+01:00 SERVERNAME root 33135 - [meta sequenceId="1"] /usr/local/etc/rc.d/named: ERROR: named-checkconf for /usr/local/etc/namedb/named.conf failed

If I try to start binaries manually via shell, I get:

Code Select Expand

ld-elf.so.1: Shared object "libisc-9.20.7.so" not found, required by "named-checkconf"
ld-elf.so.1: Shared object "libisc-9.20.6.so" not found, required by "named"
ld-elf.so.1: Shared object "libdns-9.20.7.so" not found, required by "named-journalprint"

So there might something be mixed up in the package with the binaries and their libraries...
It would be great if this could be fixed as I prefer BIND vs. Unbound.

TIA & best regards,
Stefan

Hi everyone,

I have a strange issue:

I finally found a configuration that allows for pre-fragmentation of packets sent through routed IPsec Site-2-Site VPN. All my packet captures show that IP packets are correctly fragmented *before* being encapsulated (which is important in my network setup). On the target site, packets seem to get reassembled and then sent out via LAN interface - but they have in incorrect ipv4-Checksum and get dropped by final recipient.

To be precise: The checksum value for the reassembled packet is taken from the first fragment, corrected by +0x100 for TTL. [see packet #3 in LAN_filtered.pcap (csum 0xf23e) vs. p#5 in VTI_filtered.pcap (csum 0xf13e)]

What is even more strange:
On the first reassembeld packet, everything works. Starting with the second, it fails. after approx 15-20 secs -> works again (maybe some internal reset). Non fragmented packets are not affected.

I attached a packet capture with the relevant packets. It contains two pings needing fragmentation (first works, second does not), and two pings without fragmentation (both work).

I guess this is not a directly OPNsense related bug, but may reside in the FreeBSD/HardenedBSD ipsec stack. If so, shall I file a bug report somewhere else?

Best regards,
   Stefan

PS: Checksum offloading is deactivated in all involved OPNsense instances.
PPS: pre-fragmentation is gained by simply setting a smaller MTU on VTI interface. I can provide more info on network setup on request if this is not directly forwarded to OS issues.