It seems as if radvd is not working properly. Either there is no routing info, or unbound marches to a different drummer. I think the next step is to find out what the ISP actually sends and evaluate that with Wireshark. It could be problem a problem with the subnets and prefix sizes.

@ftln46 said in What is my ISP using for IPV6?:

What I was having a hard time figuring out is why does my WAN interface get no global IPV6 address ?

From a technical standpoint, it's not needed. A global IPv6 address on the WAN interface wouldn't be used for anything beyond testing (ping, etc.) or management. On IPv6, routing is normally done with the link local addresses. As for your ISP, you'll have to ask them if they provided an IPv6 address for the WAN interface.
.

@mircolino I wish I could give a better answer but I did what I previously described and my problem hasn't come back since. I think there was some sort of setting persisting that shouldn't have and what I did was clear it out...

@roally Are you certain your ISP delegates a /48?

Doesn't say much?
ND entry? how do I delete?
0_1542848042859_Screen Shot 2018-11-22 at 1.53.07 PM.png

@bepo I know that it is not a payment service @bepo, thanks for remembering it. I also know that there are comments that allow progress and others that do not. Thank you for your comment.

Is anyone running Hyper-v w/ v6 dhcp working from ISP on this latest pfsense??

Overall, IPv6 works the same as IPv4, but there are some differences. One great benefit is getting rid of NAT. If you want a consistent address, you just have to turn off privacy addresses. The way you do that depends on your operating system.

I may have solved this on my own. My floating rules were set to all interfaces in the list, but it seem that selecting no interface in the list makes it apply to every interface. I'm still testing this, but I don't see the (let out anything from firewall host itself) anymore.

So today I did a new install of pfsense 2.4.4 and played back my config. There is an ULA in virtuel IP's at LAN1 and so as discribed LAN1 gets an IPv6 from WAN via Tracking and it is shown as second in ifconfig. But RADVD is'nt working correct anymore on this Interface. It not advertises the prefix. So this is a BUG, right?

pfadmin

@pmisch said in Clients don't receive IPv6 address on LAN with track interface:

Do you have any other filtering mechanisms in place like intrusion prevention or have you activated "block bogon" on your LAN interface?
I suspect the outgoing packets do not leave the firewall even though the packet filter itself isn't blocking. Must be something else.
There's also a possibility of an interim device like a switch that might block packets. Quite unlikely but not impossible.

Triggered by your comment on an interim device like a switch blocking packets I checked my switches, since I had been messing with multicast and broadcast filtering and settings on those switches (2 Netgear ProSAFE Plus Switches). My provider has an IPTV service (using multicast for TV channels) and it's a bit unstable, which is why I've been tinkering with those settings.

After turning off some filtering (I think turning off 'Block Unknown Multicast Address' did the trick) the router advertisements arrived at the clients and they receive an IPv6 address! So that was the problem.

Thank you very much for your comments and help!

I'm seeing the exact same behavior on my VM running 2.4.4-RELEASE (amd64). What gives?

Nov 2 08:45:52 pfsense dhcp6c[60377]: failed to open /usr/local/etc/dhcp6cctlkey: No such file or directory Nov 2 08:45:52 pfsense dhcp6c[60377]: failed initialize control message authentication Nov 2 08:45:52 pfsense dhcp6c[60377]: skip opening control port Nov 2 08:45:52 pfsense dhcp6c[60377]: /var/etc/dhcp6c_wan.conf:3 IA_PD (0) is not defined Nov 2 08:45:52 pfsense dhcp6c[60377]: failed to parse configuration file

after upgrading pfSense to 2.4.4 IPv6 assignment is back working again, without doing anything. maybe there was a bug I missed? Thanks anyway everyone for helping

My prefix is "dynamic"... yes, in theory as long as the DUID doesn't change, my prefix doesn't change either (I successfully held the same /60 prefix from my ISP for over a year, before changing the DUID for troubleshooting purposes). Same with the IPv4 address and my MAC address.

But that doesn't mean that my ISP couldn't at some point initiate some changes to their network that would cause my prefix to change, just as my IPv4 address has changed in the past when they've done major network maintenance, though obviously the MAC wouldn't have changed.

So I am still of the notion that this is something needed. A dynamic prefix, no matter how stable it might be, is still dynamic and could potentially change at any time for a variety of reasons.

@gertjan

Ah,,,, I thought you choose IPSec

Seems that OpenVPN can't handle dynamic prefix delegation , which will be support at 2.5 in the future.My network environment will be a big problem...

@pmisch
Thanks for your support. We sorted this issue out now.
Our uplink provider removed a fe80:: link local filter on their interface and out of a sudden, everything works smooth.

Yes you were right, before they did the change, we did see constant (about every 2s) neighbor solicitation asking who ::2 is.
This helped to narrow down the problem.

Issue solved.

"The default configuration is to assign the /48 to the switch port which it sounds like that is not what you need for your setup."

It's not what anyone needs for any setup.

I'm going to add the data point that with Comcast, I've had amazing stability with my IPv6 prefix. Thanks to pfSense keeping the DUID in the config file, I was even able to change my pfSense box hardware and keep the same IPv6 prefix (though the IPv4 address changed, since that's MAC-based).

I had the same IPv6 prefix for over a year until I changed the DUID during 2.4.4 testing since I was running into other issues with IPv6 on 2.4.4 at that time.

@pfadmin said in pfsense 2.4.4 Route Lifetime not changable w/O static IPv6:

Anyway, I understand that RA is really not build for advertising a DNS Server by himself.

RDNSS is part of RA, which iss one way DNS addresses are distributed. You can also use DHCPv6. When I look at RAs here, I see RDNSS included, complete with DNS server addresses.