odd ipv6 routing issue
-
I can successfully ping -6 other devices on my lan. Not sure what to look for in a packet capture file can not ping -6 wan test-ipv6.com shows 10/10 on the working computers but on these 2 it shows 0/10. it does show my dns is good though. thanks.
-
@techpro2004 so why would you think its a pfsense issue, if other devices on this network work via IPv6?
If it was a pfsense issue, no devices would work.
Why/How could pfsense single out 2 devices - and say sorry no internet for you via IPv6, but the machine next to you - sure he can have internet via IPv6..
So your clients get a valid IP in the prefix on this interface?
Your saying it worked, and then you rebooted the machine and it doesn't work - so it didn't get an IPv6 in this prefix after reboot? Would be the most likely explanation for the problem.
These 2 machines that are not working are running sunvalley 2 version of windows 11, the other machines running windows 10? They are not running the 22H2 version of windows 11?
-
most of the machines are running sunvally 2, working and non working. the others run linux. the machines in question show an ipv6 address in ipconfig but in pfsense/status/dhcpv6 leases, it does not show up. thanks.
-
@techpro2004 and is this IPv6 it show in the prefix that is on this interface? Or is it just a link local address?
-
@techpro2004 said in odd ipv6 routing issue:
Not sure what to look for in a packet capture
Filter on the MAC address and ICMP6 to see the packet going out and if there's a response from either the target or pfsense.
-
it is an actual ipv6 address not link local.
I have attached a screen shot from wireshark. not sure what to look for:
this machine has a dual port nic. the other is single.
-
Since you're using Wireshark you don't have to worry about the MAC address. I only mentioned that in case you were using Packet Capture in pfsense.
Here's part of what you'd see. I pinged Google and the requests and replies are shown. If there were some problem, you might see an ICMP message from pfsense or beyond.
-
without mac filtering on pfsense i get this
wan
12:40:59.871538 IP6 2600:4040:9afe:9c00:3eec:efff:fe3c:e916 > 2600:4040:9af0:400:d602:ce46:7c60:2ea0: ICMP6, destination unreachable, unreachable address 2600:4040:9afe:9c00:549f:26ff:fedc:a99, length 93
12:41:12.357996 IP6 fe80::3eec:efff:fe3c:e917 > fe80::3e61:4ff:fe04:2cb4: ICMP6, neighbor solicitation, who has fe80::3e61:4ff:fe04:2cb4, length 32
12:41:12.363982 IP6 2600:4040:9af0::1 > fe80::3eec:efff:fe3c:e917: ICMP6, neighbor advertisement, tgt is fe80::3e61:4ff:fe04:2cb4, length 24
12:41:13.734544 IP6 2600:4040:9afe:9c00:3eec:efff:fe3c:e916 > 2600:4040:9af0:400:ad:c23c:1afe:f92: ICMP6, destination unreachable, unreachable address 2600:4040:9afe:9c00:549f:26ff:fedc:a99, length 102lan
12:43:51.743616 IP6 2600:4040:9afe:9c00:3eec:efff:fe3c:e916 > 2600:4040:9afe:9c00:513f:e541:8dd8:32ee: ICMP6, neighbor solicitation, who has 2600:4040:9afe:9c00:513f:e541:8dd8:32ee, length 32
12:43:51.743856 IP6 2600:4040:9afe:9c00:513f:e541:8dd8:32ee > 2600:4040:9afe:9c00:3eec:efff:fe3c:e916: ICMP6, neighbor advertisement, tgt is 2600:4040:9afe:9c00:513f:e541:8dd8:32ee, length 32
12:43:55.865398 IP6 2600:4040:9afe:9c00:7954:fcee:8a9f:bb6c > ff02::1:ff3c:e916: ICMP6, neighbor solicitation, who has fe80::3eec:efff:fe3c:e916, length 32
12:43:56.193142 IP6 fe80::a0f1:7778:958f:e558 > ff02::1:ff3c:e916: ICMP6, neighbor solicitation, who has fe80::3eec:efff:fe3c:e916, length 32
12:43:56.655690 IP6 2600:4040:9afe:9c00::1587 > 2600:4040:9afe:9c00:3eec:efff:fe3c:e916: ICMP6, neighbor solicitation, who has 2600:4040:9afe:9c00:3eec:efff:fe3c:e916, length 32
12:43:56.655704 IP6 2600:4040:9afe:9c00:3eec:efff:fe3c:e916 > 2600:4040:9afe:9c00::1587: ICMP6, neighbor advertisement, tgt is 2600:4040:9afe:9c00:3eec:efff:fe3c:e916, length 24
12:43:56.704211 IP6 2600:4040:9afe:9c00:7954:fcee:8a9f:bb6c > ff02::1:ff3c:e916: ICMP6, neighbor solicitation, who has fe80::3eec:efff:fe3c:e916, length 32
12:43:57.201453 IP6 fe80::a0f1:7778:958f:e558 > ff02::1:ff3c:e916: ICMP6, neighbor solicitation, who has fe80::3eec:efff:fe3c:e916, length 32
12:43:57.697283 IP6 2600:4040:9afe:9c00:7954:fcee:8a9f:bb6c > ff02::1:ff3c:e916: ICMP6, neighbor solicitation, who has fe80::3eec:efff:fe3c:e916, length 32
12:43:58.192367 IP6 fe80::a0f1:7778:958f:e558 > ff02::1:ff3c:e916: ICMP6, neighbor solicitation, who has fe80::3eec:efff:fe3c:e916, length 32
12:43:59.714466 IP6 2600:4040:9afe:9c00:7954:fcee:8a9f:bb6c > ff02::1:ff3c:e916: ICMP6, neighbor solicitation, who has fe80::3eec:efff:fe3c:e916, length 32
12:44:00.690822 IP6 2600:4040:9afe:9c00:7954:fcee:8a9f:bb6c > ff02::1:ff3c:e916: ICMP6, neighbor solicitation, who has fe80::3eec:efff:fe3c:e916, length 32
12:44:01.192689 IP6 2600:4040:9afe:9c00:3eec:efff:fe3c:e916 > 2600:4040:9afe:9c00::1587: ICMP6, neighbor solicitation, who has 2600:4040:9afe:9c00::1587, length 32
12:44:01.192933 IP6 2600:4040:9afe:9c00::1587 > 2600:4040:9afe:9c00:3eec:efff:fe3c:e916: ICMP6, neighbor advertisement, tgt is 2600:4040:9afe:9c00::1587, length 32
12:44:01.703178 IP6 2600:4040:9afe:9c00:7954:fcee:8a9f:bb6c > ff02::1:ff3c:e916: ICMP6, neighbor solicitation, who has fe80::3eec:efff:fe3c:e916, length 32
12:44:03.708535 IP6 2600:4040:9afe:9c00:7954:fcee:8a9f:bb6c > ff02::1:ff3c:e916: ICMP6, neighbor solicitation, who has fe80::3eec:efff:fe3c:e916, length 32
12:44:04.697691 IP6 2600:4040:9afe:9c00:7954:fcee:8a9f:bb6c > ff02::1:ff3c:e916: ICMP6, neighbor solicitation, who has fe80::3eec:efff:fe3c:e916, length 32
12:44:05.703067 IP6 2600:4040:9afe:9c00:7954:fcee:8a9f:bb6c > ff02::1:ff3c:e916: ICMP6, neighbor solicitation, who has fe80::3eec:efff:fe3c:e916, length 32
12:44:06.692817 IP6 fe80::7954:fcee:8a9f:bb6c > ff02::1:ff3c:e916: ICMP6, neighbor solicitation, who has fe80::3eec:efff:fe3c:e916, length 32
12:44:07.699262 IP6 2600:4040:9afe:9c00:7954:fcee:8a9f:bb6c > ff02::1:ff3c:e916: ICMP6, neighbor solicitation, who has fe80::3eec:efff:fe3c:e916, length 32
12:44:07.766260 IP6 fe80::3eec:efff:fe3c:e916 > ff02::1:ffdc:a99: ICMP6, neighbor solicitation, who has 2600:4040:9afe:9c00:549f:26ff:fedc:a99, length 32
12:44:08.705047 IP6 2600:4040:9afe:9c00:7954:fcee:8a9f:bb6c > ff02::1:ff3c:e916: ICMP6, neighbor solicitation, who has fe80::3eec:efff:fe3c:e916, length 32
12:44:08.765518 IP6 fe80::3eec:efff:fe3c:e916 > ff02::1:ffdc:a99: ICMP6, neighbor solicitation, who has 2600:4040:9afe:9c00:549f:26ff:fedc:a99, length 32
12:44:09.327734 IP6 2600:4040:9afe:9c00:a0f1:7778:958f:e558 > ff02::1:ff3c:e916: ICMP6, neighbor solicitation, who has fe80::3eec:efff:fe3c:e916, length 32
12:44:09.698999 IP6 2600:4040:9afe:9c00:7954:fcee:8a9f:bb6c > ff02::1:ff3c:e916: ICMP6, neighbor solicitation, who has fe80::3eec:efff:fe3c:e916, length 32
12:44:09.769572 IP6 fe80::3eec:efff:fe3c:e916 > ff02::1:ffdc:a99: ICMP6, neighbor solicitation, who has 2600:4040:9afe:9c00:549f:26ff:fedc:a99, length 32
12:44:10.193935 IP6 2600:4040:9afe:9c00:a0f1:7778:958f:e558 > ff02::1:ff3c:e916: ICMP6, neighbor solicitation, who has fe80::3eec:efff:fe3c:e916, length 32
12:44:10.704596 IP6 2600:4040:9afe:9c00:7954:fcee:8a9f:bb6c > ff02::1:ff3c:e916: ICMP6, neighbor solicitation, who has fe80::3eec:efff:fe3c:e916, length 32
12:44:11.198181 IP6 2600:4040:9afe:9c00:a0f1:7778:958f:e558 > ff02::1:ff3c:e916: ICMP6, neighbor solicitation, who has fe80::3eec:efff:fe3c:e916, length 32
12:44:11.694641 IP6 2600:4040:9afe:9c00:7954:fcee:8a9f:bb6c > ff02::1:ff3c:e916: ICMP6, neighbor solicitation, who has fe80::3eec:efff:fe3c:e916, length 32
12:44:12.205018 IP6 2600:4040:9afe:9c00:a0f1:7778:958f:e558 > ff02::1:ff3c:e916: ICMP6, neighbor solicitation, who has fe80::3eec:efff:fe3c:e916, length 32
12:44:12.696961 IP6 2600:4040:9afe:9c00:7954:fcee:8a9f:bb6c > ff02::1:ff3c:e916: ICMP6, neighbor solicitation, who has fe80::3eec:efff:fe3c:e916, length 32
12:44:13.190706 IP6 2600:4040:9afe:9c00:a0f1:7778:958f:e558 > ff02::1:ff3c:e916: ICMP6, neighbor solicitation, who has fe80::3eec:efff:fe3c:e916, length 32 -
tracert results
bad
good
same network.
-
@techpro2004 said in odd ipv6 routing issue:
without mac filtering on pfsense i get this
I guess you missed my point on using Wireshark vs Packet Capture. With Packet Capture, you'll see all traffic, not just the computer you're testing with. So, you'd use the MAC address to filter it out from the noise. You don't have to do that if you're using Wireshark on the computer you're pinging from. Which method are you using to capture those packets? Either way, if you run the capture when you start pinging, you should see the pings going out and any response, as I did in my example. I could be wrong, but I don't see any pings in your example. When I did my test, there were other things besides ping, but I took only the portion of the capture that showed the pings and replies. If you're using Wireshark, you can also use display filters to show only what you want, even though other stuff was captured.
-
the first example was in wireshark and i was using the filters i ran ping -6 ipv6.google.com in both cases while the capture was running. not sure why it did not show up.
-
The usual method is to start the capture, run ping for several cycles and then stop the capture. If you're capturing ICMP6, as you appear to be doing, then you should see some pings in the capture.
-
@techpro2004 said in odd ipv6 routing issue:
not sure why it did not show up.
Because from the trace you show that it can not talk to the gateway, has no mac address for what it thinks it gateway is. So it can not send a ping without anyplace to send it.
-
so how do I fix it.
-
and why did pfsense supply that info to some of my systems but not the others.
-
Just rechecked my config. only lan has an ipv6 address not opt* however lan and opt* are bridged. Does this matter?
-
@techpro2004 said in odd ipv6 routing issue:
and why did pfsense supply that info to some of my systems but not the others.
What is different about these systems? Are they connected different, wifi or wired? Do you have any sort of bridge setup..
What exactly is the pfsense IP address for this network? What is the IP address of the system no working.. I see devices asking for this fe80::3eec:efff:fe3c:e916
12:44:10.193935 IP6 2600:4040:9afe:9c00:a0f1:7778:958f:e558 > ff02::1:ff3c:e916: ICMP6, neighbor solicitation, who has fe80::3eec:efff:fe3c:e916, length 32 12:44:10.704596 IP6 2600:4040:9afe:9c00:7954:fcee:8a9f:bb6c > ff02::1:ff3c:e916: ICMP6, neighbor solicitation, who has fe80::3eec:efff:fe3c:e916, length 32 12:44:11.198181 IP6 2600:4040:9afe:9c00:a0f1:7778:958f:e558 > ff02::1:ff3c:e916: ICMP6, neighbor solicitation, who has fe80::3eec:efff:fe3c:e916, length 32Which I assume is pfsense, since the address would seem to be the link local of what is being sent to in your trace that works..
fe3c:e916
however lan and opt* are bridged. Does this matter?
Why would you have anything bridged?
-
it is bridged as my entire house is wired for ethernet so I have cables going to each room and I did not want to use a switch so I built a 12port router out of an old server and 3x i350-t4 nics and installed pfsense on it.
-
not working system: 2600:4040:9afe:9c00:a0f1:7778:958f:e558 and 2600:4040:9afe:9c00:7954:fcee:8a9f:bb6c
pfsense lan: 2600:4040:9afe:9c00:3eec:efff:fe3c:e916
all systems are wired with gs108 and gs108ev3 and gs116 switches.
-
@techpro2004 said in odd ipv6 routing issue:
I did not want to use a switch
Well that was a bad solution to a non issue. bridging is not switching, while it can somewhat act like a switch - its not a switch..
If you want switch ports, get a switch.. Bridging has its own complexity and issues, and again its not a switch.. And users almost always have issues with its setup.. especially when on a firewall.
My suggestion would be to get a switch.. You can get a 16 port switch for very reasonable price, even smart switches that do vlans with 16 ports are reasonable.
How much did you pay for the i350-t4 nics interfaces? Can pretty much promise you could of gotten an actual switch with more ports for less than what those cost.
