# DNS packets getting eaten between tcpdump and nslookup



## cjyar (May 21, 2012)

I'm trying to build a router/firewall out of this nice little Atom box: it's a Fit-PC 2i, with 2 re0 network interfaces. When talking to the external network, DNS responses are never received by nslookup, even though I can see them with tcpdump.

I attach tcpdump to the external network (*tcpdump -vv -l -n -i re0 ip host blah*) and run nslookup on another tty. Tcpdump shows my DNS query going out, and a response coming back. But nslookup never claims to have received it. Two more query/response pairs show up before nslookup times out.

I can perform the same experiment on the internal network, asking my local DNS server about a host on my private network, and everything works as expected. I can even swap the ethernet cables and ifconfig settings between my two ports, and the problem follows my external network rather than staying with a specific NIC port.

I've removed ipfw and ipdivert from my loader.conf, disabled natd, and done everything else I can think of to eliminate variables. The rebooted box is now just a simple gateway with 2 NICs, but it's showing the same behavior. The only difference I can see between these two interfaces is that one carries the default route, and the other doesn't.


```
May 20 18:59:45 gw kernel: re0: <RealTek 8168/8111 B/C/CP/D/DP/E PCIe Gigabit Ethernet> port
 0x2000-0x20ff mem 0xd0100000-0xd0100fff,0xd0500000-0xd050ffff irq 16 at device 0.0 on pci2
May 20 18:59:45 gw kernel: re1: <RealTek 8168/8111 B/C/CP/D/DP/E PCIe Gigabit Ethernet> port
 0x3000-0x30ff mem 0xd0200000-0xd0200fff,0xd0600000-0xd060ffff irq 17 at device 0.0 on pci3
```

Any ideas on what could be causing the problem?

Chris


----------



## cjyar (May 22, 2012)

Figured it out, with a strong hint from http://forums.freebsd.org/showthread.php?t=1524. It turns out the next-hop wasn't paying attention to any ARP info, so it didn't realize the MAC address had changed for my IP address.


----------

