8

I am running Bind 9.10.2 version on CentOS 6.6 machine. While running the dig command, i am getting "net.c:577: sendmsg() failed: Operation not permitted" notification.

dig utility is giving me an answer but on the top, it shows this notification.

$dig nkn.in +short   
**net.c:577: sendmsg() failed: Operation not permitted**  
164.100.129.98

System Information :-  
cat /etc/*-release   
CentOS release 6.6 (Final)   
LSB_VERSION=base-4.0-amd64:base-4.0-noarch:core-4.0-amd64:core-4.0-noarch:graphics-4.0-amd64:graphics-4.0-noarch:printing-4.0-amd64:printing-4.0-noarch    
CentOS release 6.6 (Final)   
CentOS release 6.6 (Final)

Can some one please help me out why i am getting this notification?

IPv6 firewall rules sets:-

*filter  
:INPUT DROP [0:0]  
:FORWARD DROP [0:0]  
:OUTPUT DROP [0:0]  
:LOGGING - [0:0]  
-A INPUT -i lo -j ACCEPT  
-A INPUT -p icmpv6 -j ACCEPT   
-A INPUT -p udp --dport 5353 -d ff02::fb -j ACCEPT  
-A INPUT -p udp -m udp --dport 631 -j ACCEPT  
-A INPUT -p tcp -m tcp --dport 631 -j ACCEPT  
-A INPUT -p udp -m udp --dport 53 -j ACCEPT  
-A INPUT -p tcp -m tcp --dport 53 -j ACCEPT  
-A OUTPUT -p icmpv6 --icmpv6-type echo-reply -j ACCEPT  
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT  
-A INPUT -m udp -p udp --sport 1812 -j ACCEPT  
-A INPUT -m udp -p udp --sport 1813 -j ACCEPT 
-A INPUT -s fe80::/64 -j ACCEPT  
-A INPUT -s ff02::/64 -j ACCEPT  
-A INPUT -j LOG --log-prefix "IP6Tables:INPUT " --log-level 7  
-A OUTPUT -p udp -m udp --dport 53 -j ACCEPT  
-A OUTPUT -p tcp -m tcp --dport 53 -j ACCEPT  
-A OUTPUT -p icmpv6 -j ACCEPT  
-A OUTPUT -p icmpv6 --icmpv6-type echo-request -j ACCEPT  
-A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT  
-A OUTPUT -d 2001:db8::/32 -j ACCEPT  
-A OUTPUT -d fe80::/64 -j ACCEPT  
-A OUTPUT -d ff02::/64 -j ACCEPT  
-A OUTPUT -j LOG --log-prefix "IP6Tables:OUTPUT " --log-level 7  
-A LOGGING -m limit --limit 2/min -j LOG --log-prefix "IP6Tables-Dropped: "  
-A LOGGING -j DROP  
COMMIT  
3
  • Probably a network/routing issue. Are you able to contact all the nameservers in your /etc/resolv.conf? – Jenny D May 29 '15 at 13:57
  • @JennyD... Its a dns server.. And having entry like 'nameserver 127.0.0.1' and i am able to resolve the domains. – Gaurav Kansal Jun 1 '15 at 13:35
  • 1
    @kayess... My firewall rule set is updated in question section. Pl help me out what wrong in that. – Gaurav Kansal Jun 2 '15 at 16:17
8

In my arch linux it helped adding an ip6tables firewall rule to allow sending local udp packets from localhost to localhost:

ip6tables -I OUTPUT 1 -p udp -s 0000:0000:0000:0000:0000:0000:0000:0001 \ 
-d 0000:0000:0000:0000:0000:0000:0000:0001 -j ACCEPT
2
  • 2
    Any idea why IP6tables was generating an alert without the above rule ? – Gaurav Kansal Oct 21 '16 at 7:49
  • 1
    @GauravKansal, when you retrieve an IP address with a function such as getaddrinfo(), you get a list of possibilities and when IPv6 is turned on, that's included in the response and they make it first now. That means tools like dig and host will first try with the IPv6 address, next it will try with IPv4. – Alexis Wilke Feb 2 '17 at 1:13
1

Have you tried to reach that destination with any other protocol? Like ICMP?

This error might indicate that you have no rights to do that action, or either blocked by a firewall rule.

14
  • You can try running the same command as root. If that fails, you can try to temporarily disable the iptables firewall, if any and try again. – basos May 29 '15 at 13:18
  • 1
    @basos Disabling the firewally is not a good troubleshooting practice. The right thing would be to look at the firewall logs to see whether anything does get caught in it. – Jenny D May 29 '15 at 13:45
  • I believe this answer is onto something. I have seen that error message being produced when a process try to send a UDP packet, which is being blocked by an iptables rule in the OUTPUT chain. – kasperd May 29 '15 at 14:06
  • 1
    @basos.... Ya i had tried from root also.. But same issue.... After disabling ipv6 firewall, i am not getting dis notification. – Gaurav Kansal Jun 1 '15 at 13:39
  • 1
    @kansal, can you explain what do you mean by "dis notification" ? – basos Jun 2 '15 at 11:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.