[nsd-users] nsd: Could not tcp connect to a:a:a:a::1:1: Operation timed out

[Michael Grimm]

Hi --

I do run both my primary and secondary nameservers in FreeBSD jails as outlined below:

(jail1/a:a:a:a::1:1)                         <----->                          (jail2/b:b:b:b::1:1)
(jail1/10.10.10.1) <--NAT--> (host 1.2.3.4)  <-----> (host 5.6.7.8) <--NAT--> (jail2/10.10.10.1)


jail1 (master): nsd.conf (relevant part)

        ip-address:     10.10.10.1
        ip-address:     a:a:a:a::1:1
	[...]
        notify:                 b:b:b:b::1:1       secret-key
        provide-xfr:            b:b:b:b::1:1       secret-key
        outgoing-interface:     a:a:a:a::1:1
	[...]

jail2 (slave): nsd.conf (relevant part)

        ip-address:     10.10.10.1
        ip-address:     b:b:b:b::1:1
	[...]
        allow-notify:           a:a:a:a::1:1       secret-key
        request-xfr:            AXFR a:a:a:a::1:1  secret-key
        outgoing-interface:     b:b:b:b::1:1
	[...]

Both servers are running well, serving all requests as expected, and the master is delivering all zones with afxr at startup perfectly well. But, I get the following error messages (for IPv6 address, only!) in the *slave*'s syslog:
| nsd: Could not tcp connect to a:a:a:a::1:1: Operation timed out

tcpdump at the *master* tells me (shortend to the relevant part):
| pass in on em0: (flowlabel 0x360ed, hlim 63, next-header TCP (6) payload length: 40) b:b:b:b::1:1.15298 > a:a:a:a::1:1.53: Flags [S], cksum 0xfedd (incorrect -> 0x7df6), seq 1459122906, win 65535, options [mss 1440,nop,wscale 6,sackOK,TS val 333780857 ecr 0], length 0

So, what's going wrong here:
- Is it my setup regarding nsd?
- Is it a screwed IPv6 routing?
- Or something else?

Any help is highly appreciated.

Thanks and with kind regards,
Michael