odd ipv6 routing issue
-
Since you're using Wireshark you don't have to worry about the MAC address. I only mentioned that in case you were using Packet Capture in pfsense.
Here's part of what you'd see. I pinged Google and the requests and replies are shown. If there were some problem, you might see an ICMP message from pfsense or beyond.
-
without mac filtering on pfsense i get this
wan
12:40:59.871538 IP6 2600:4040:9afe:9c00:3eec:efff:fe3c:e916 > 2600:4040:9af0:400:d602:ce46:7c60:2ea0: ICMP6, destination unreachable, unreachable address 2600:4040:9afe:9c00:549f:26ff:fedc:a99, length 93
12:41:12.357996 IP6 fe80::3eec:efff:fe3c:e917 > fe80::3e61:4ff:fe04:2cb4: ICMP6, neighbor solicitation, who has fe80::3e61:4ff:fe04:2cb4, length 32
12:41:12.363982 IP6 2600:4040:9af0::1 > fe80::3eec:efff:fe3c:e917: ICMP6, neighbor advertisement, tgt is fe80::3e61:4ff:fe04:2cb4, length 24
12:41:13.734544 IP6 2600:4040:9afe:9c00:3eec:efff:fe3c:e916 > 2600:4040:9af0:400:ad:c23c:1afe:f92: ICMP6, destination unreachable, unreachable address 2600:4040:9afe:9c00:549f:26ff:fedc:a99, length 102lan
12:43:51.743616 IP6 2600:4040:9afe:9c00:3eec:efff:fe3c:e916 > 2600:4040:9afe:9c00:513f:e541:8dd8:32ee: ICMP6, neighbor solicitation, who has 2600:4040:9afe:9c00:513f:e541:8dd8:32ee, length 32
12:43:51.743856 IP6 2600:4040:9afe:9c00:513f:e541:8dd8:32ee > 2600:4040:9afe:9c00:3eec:efff:fe3c:e916: ICMP6, neighbor advertisement, tgt is 2600:4040:9afe:9c00:513f:e541:8dd8:32ee, length 32
12:43:55.865398 IP6 2600:4040:9afe:9c00:7954:fcee:8a9f:bb6c > ff02::1:ff3c:e916: ICMP6, neighbor solicitation, who has fe80::3eec:efff:fe3c:e916, length 32
12:43:56.193142 IP6 fe80::a0f1:7778:958f:e558 > ff02::1:ff3c:e916: ICMP6, neighbor solicitation, who has fe80::3eec:efff:fe3c:e916, length 32
12:43:56.655690 IP6 2600:4040:9afe:9c00::1587 > 2600:4040:9afe:9c00:3eec:efff:fe3c:e916: ICMP6, neighbor solicitation, who has 2600:4040:9afe:9c00:3eec:efff:fe3c:e916, length 32
12:43:56.655704 IP6 2600:4040:9afe:9c00:3eec:efff:fe3c:e916 > 2600:4040:9afe:9c00::1587: ICMP6, neighbor advertisement, tgt is 2600:4040:9afe:9c00:3eec:efff:fe3c:e916, length 24
12:43:56.704211 IP6 2600:4040:9afe:9c00:7954:fcee:8a9f:bb6c > ff02::1:ff3c:e916: ICMP6, neighbor solicitation, who has fe80::3eec:efff:fe3c:e916, length 32
12:43:57.201453 IP6 fe80::a0f1:7778:958f:e558 > ff02::1:ff3c:e916: ICMP6, neighbor solicitation, who has fe80::3eec:efff:fe3c:e916, length 32
12:43:57.697283 IP6 2600:4040:9afe:9c00:7954:fcee:8a9f:bb6c > ff02::1:ff3c:e916: ICMP6, neighbor solicitation, who has fe80::3eec:efff:fe3c:e916, length 32
12:43:58.192367 IP6 fe80::a0f1:7778:958f:e558 > ff02::1:ff3c:e916: ICMP6, neighbor solicitation, who has fe80::3eec:efff:fe3c:e916, length 32
12:43:59.714466 IP6 2600:4040:9afe:9c00:7954:fcee:8a9f:bb6c > ff02::1:ff3c:e916: ICMP6, neighbor solicitation, who has fe80::3eec:efff:fe3c:e916, length 32
12:44:00.690822 IP6 2600:4040:9afe:9c00:7954:fcee:8a9f:bb6c > ff02::1:ff3c:e916: ICMP6, neighbor solicitation, who has fe80::3eec:efff:fe3c:e916, length 32
12:44:01.192689 IP6 2600:4040:9afe:9c00:3eec:efff:fe3c:e916 > 2600:4040:9afe:9c00::1587: ICMP6, neighbor solicitation, who has 2600:4040:9afe:9c00::1587, length 32
12:44:01.192933 IP6 2600:4040:9afe:9c00::1587 > 2600:4040:9afe:9c00:3eec:efff:fe3c:e916: ICMP6, neighbor advertisement, tgt is 2600:4040:9afe:9c00::1587, length 32
12:44:01.703178 IP6 2600:4040:9afe:9c00:7954:fcee:8a9f:bb6c > ff02::1:ff3c:e916: ICMP6, neighbor solicitation, who has fe80::3eec:efff:fe3c:e916, length 32
12:44:03.708535 IP6 2600:4040:9afe:9c00:7954:fcee:8a9f:bb6c > ff02::1:ff3c:e916: ICMP6, neighbor solicitation, who has fe80::3eec:efff:fe3c:e916, length 32
12:44:04.697691 IP6 2600:4040:9afe:9c00:7954:fcee:8a9f:bb6c > ff02::1:ff3c:e916: ICMP6, neighbor solicitation, who has fe80::3eec:efff:fe3c:e916, length 32
12:44:05.703067 IP6 2600:4040:9afe:9c00:7954:fcee:8a9f:bb6c > ff02::1:ff3c:e916: ICMP6, neighbor solicitation, who has fe80::3eec:efff:fe3c:e916, length 32
12:44:06.692817 IP6 fe80::7954:fcee:8a9f:bb6c > ff02::1:ff3c:e916: ICMP6, neighbor solicitation, who has fe80::3eec:efff:fe3c:e916, length 32
12:44:07.699262 IP6 2600:4040:9afe:9c00:7954:fcee:8a9f:bb6c > ff02::1:ff3c:e916: ICMP6, neighbor solicitation, who has fe80::3eec:efff:fe3c:e916, length 32
12:44:07.766260 IP6 fe80::3eec:efff:fe3c:e916 > ff02::1:ffdc:a99: ICMP6, neighbor solicitation, who has 2600:4040:9afe:9c00:549f:26ff:fedc:a99, length 32
12:44:08.705047 IP6 2600:4040:9afe:9c00:7954:fcee:8a9f:bb6c > ff02::1:ff3c:e916: ICMP6, neighbor solicitation, who has fe80::3eec:efff:fe3c:e916, length 32
12:44:08.765518 IP6 fe80::3eec:efff:fe3c:e916 > ff02::1:ffdc:a99: ICMP6, neighbor solicitation, who has 2600:4040:9afe:9c00:549f:26ff:fedc:a99, length 32
12:44:09.327734 IP6 2600:4040:9afe:9c00:a0f1:7778:958f:e558 > ff02::1:ff3c:e916: ICMP6, neighbor solicitation, who has fe80::3eec:efff:fe3c:e916, length 32
12:44:09.698999 IP6 2600:4040:9afe:9c00:7954:fcee:8a9f:bb6c > ff02::1:ff3c:e916: ICMP6, neighbor solicitation, who has fe80::3eec:efff:fe3c:e916, length 32
12:44:09.769572 IP6 fe80::3eec:efff:fe3c:e916 > ff02::1:ffdc:a99: ICMP6, neighbor solicitation, who has 2600:4040:9afe:9c00:549f:26ff:fedc:a99, length 32
12:44:10.193935 IP6 2600:4040:9afe:9c00:a0f1:7778:958f:e558 > ff02::1:ff3c:e916: ICMP6, neighbor solicitation, who has fe80::3eec:efff:fe3c:e916, length 32
12:44:10.704596 IP6 2600:4040:9afe:9c00:7954:fcee:8a9f:bb6c > ff02::1:ff3c:e916: ICMP6, neighbor solicitation, who has fe80::3eec:efff:fe3c:e916, length 32
12:44:11.198181 IP6 2600:4040:9afe:9c00:a0f1:7778:958f:e558 > ff02::1:ff3c:e916: ICMP6, neighbor solicitation, who has fe80::3eec:efff:fe3c:e916, length 32
12:44:11.694641 IP6 2600:4040:9afe:9c00:7954:fcee:8a9f:bb6c > ff02::1:ff3c:e916: ICMP6, neighbor solicitation, who has fe80::3eec:efff:fe3c:e916, length 32
12:44:12.205018 IP6 2600:4040:9afe:9c00:a0f1:7778:958f:e558 > ff02::1:ff3c:e916: ICMP6, neighbor solicitation, who has fe80::3eec:efff:fe3c:e916, length 32
12:44:12.696961 IP6 2600:4040:9afe:9c00:7954:fcee:8a9f:bb6c > ff02::1:ff3c:e916: ICMP6, neighbor solicitation, who has fe80::3eec:efff:fe3c:e916, length 32
12:44:13.190706 IP6 2600:4040:9afe:9c00:a0f1:7778:958f:e558 > ff02::1:ff3c:e916: ICMP6, neighbor solicitation, who has fe80::3eec:efff:fe3c:e916, length 32 -
tracert results
bad
good
same network.
-
@techpro2004 said in odd ipv6 routing issue:
without mac filtering on pfsense i get this
I guess you missed my point on using Wireshark vs Packet Capture. With Packet Capture, you'll see all traffic, not just the computer you're testing with. So, you'd use the MAC address to filter it out from the noise. You don't have to do that if you're using Wireshark on the computer you're pinging from. Which method are you using to capture those packets? Either way, if you run the capture when you start pinging, you should see the pings going out and any response, as I did in my example. I could be wrong, but I don't see any pings in your example. When I did my test, there were other things besides ping, but I took only the portion of the capture that showed the pings and replies. If you're using Wireshark, you can also use display filters to show only what you want, even though other stuff was captured.
-
the first example was in wireshark and i was using the filters i ran ping -6 ipv6.google.com in both cases while the capture was running. not sure why it did not show up.
-
The usual method is to start the capture, run ping for several cycles and then stop the capture. If you're capturing ICMP6, as you appear to be doing, then you should see some pings in the capture.
-
@techpro2004 said in odd ipv6 routing issue:
not sure why it did not show up.
Because from the trace you show that it can not talk to the gateway, has no mac address for what it thinks it gateway is. So it can not send a ping without anyplace to send it.
-
so how do I fix it.
-
and why did pfsense supply that info to some of my systems but not the others.
-
Just rechecked my config. only lan has an ipv6 address not opt* however lan and opt* are bridged. Does this matter?
-
@techpro2004 said in odd ipv6 routing issue:
and why did pfsense supply that info to some of my systems but not the others.
What is different about these systems? Are they connected different, wifi or wired? Do you have any sort of bridge setup..
What exactly is the pfsense IP address for this network? What is the IP address of the system no working.. I see devices asking for this fe80::3eec:efff:fe3c:e916
12:44:10.193935 IP6 2600:4040:9afe:9c00:a0f1:7778:958f:e558 > ff02::1:ff3c:e916: ICMP6, neighbor solicitation, who has fe80::3eec:efff:fe3c:e916, length 32 12:44:10.704596 IP6 2600:4040:9afe:9c00:7954:fcee:8a9f:bb6c > ff02::1:ff3c:e916: ICMP6, neighbor solicitation, who has fe80::3eec:efff:fe3c:e916, length 32 12:44:11.198181 IP6 2600:4040:9afe:9c00:a0f1:7778:958f:e558 > ff02::1:ff3c:e916: ICMP6, neighbor solicitation, who has fe80::3eec:efff:fe3c:e916, length 32Which I assume is pfsense, since the address would seem to be the link local of what is being sent to in your trace that works..
fe3c:e916
however lan and opt* are bridged. Does this matter?
Why would you have anything bridged?
-
it is bridged as my entire house is wired for ethernet so I have cables going to each room and I did not want to use a switch so I built a 12port router out of an old server and 3x i350-t4 nics and installed pfsense on it.
-
not working system: 2600:4040:9afe:9c00:a0f1:7778:958f:e558 and 2600:4040:9afe:9c00:7954:fcee:8a9f:bb6c
pfsense lan: 2600:4040:9afe:9c00:3eec:efff:fe3c:e916
all systems are wired with gs108 and gs108ev3 and gs116 switches.
-
@techpro2004 said in odd ipv6 routing issue:
I did not want to use a switch
Well that was a bad solution to a non issue. bridging is not switching, while it can somewhat act like a switch - its not a switch..
If you want switch ports, get a switch.. Bridging has its own complexity and issues, and again its not a switch.. And users almost always have issues with its setup.. especially when on a firewall.
My suggestion would be to get a switch.. You can get a 16 port switch for very reasonable price, even smart switches that do vlans with 16 ports are reasonable.
How much did you pay for the i350-t4 nics interfaces? Can pretty much promise you could of gotten an actual switch with more ports for less than what those cost.
-
I will know that for next time I wire a house. in the mean time, pfsense has been working fine for 5 years like this, it is just ipv6 that is giving me trouble and I am not investing in a switch/router/firewall over this so how do we make this work.
-
@techpro2004 said in odd ipv6 routing issue:
this so how do we make this work.
your machine need to be able to find the mac of their gateway.. Why that works on some machines and not others could have something to do with the bridge?
And you say it works just fine with IPv4.. Wouldn't be a firewall issue, because you can still arp and NDP even with firewall..
Did you mention these machines are multihomed? Have more than 1 interface?
What is the IP address of pfsense, both GUA, and the link-local. What does your client show for its gateway route print, what does it show in its neighbors table?
netsh int ipv6 show neighbors
-
I may have fixed it, not sure if it will survive a reboot.
I edited my bridge, clicked on advanced and put a check mark next to "enable ipv6 auto linklocal". and rebooted pfsense
thanks for all of your help.
will post back if it acts up again.
-
so I had ipv6 working but then I rebooted my win 11 machine and I am back where I was.
-
the system I currently am testing on has 2 nics
-
ipv6 address: 2600:4040:9afe:9c00:3eec:efff:fe3c:e916
lan kink local: e80::1:1%igb2
wan link local: fe80::3eec:efff:fe3c:e917%igb3
this may be interesting:
wan gateway: fe80::3e61:4ff:fe04:2cb4%igb3
