Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Register IPv6 in DNS Resolver with only RA enabled

    IPv6
    3
    18
    1.2k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • BackMupB
      BackMup
      last edited by

      Hello folks,
      ... and friends of IPv6

      As per the subject, I'm searching for a solution to register client IPv6 addresses (GUA and/or ULA) but with only RA enabled. DHCPv6 is disabled and should stay like that.
      It might be a silly question, as ULA and GUA via RA is actually "calculated" on the client side and therefore it can't be back-channeled to pfsense in order to get the GUA/ULA registered in DNS resolver.

      But I was wondering why obviouly some other customer router are able to do that? Maybe they using as kind of mixed mode of DHCPv6 and RA? Or Bind as DNS server to provide DDNS feature?

      Basically my IPv6 setup is working but as there is no name resolution for IPv6 of my hosts, it's actually locally not used (and I would like to change that 😁 )

      Has anyone of you an idea?

      In advance: Sorry if that question has been already discussed in that forum but couldn't squeeze out satisfying answers

      Thanks!

      JKnottJ 1 Reply Last reply Reply Quote 1
      • JKnottJ
        JKnott @BackMup
        last edited by

        @backmup

        I just add them to host overrides. Just make sure you use the consistent address, not the privacy addresses.

        PfSense running on Qotom mini PC
        i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
        UniFi AC-Lite access point

        I haven't lost my mind. It's around here...somewhere...

        BackMupB 1 Reply Last reply Reply Quote 0
        • BackMupB
          BackMup @JKnott
          last edited by

          @jknott
          Thanks for your reply!
          Okay, well that's a possible solution but isn't there anything rather automatic?

          Bob.DigB 1 Reply Last reply Reply Quote 0
          • Bob.DigB
            Bob.Dig LAYER 8 @BackMup
            last edited by

            @backmup For dynamic GUAs you really should use DHCPv6.

            BackMupB JKnottJ 2 Replies Last reply Reply Quote 0
            • BackMupB
              BackMup @Bob.Dig
              last edited by

              @bob-dig

              I was afraid you going to say that ;-)

              But which option?

              1. Manged isn't a good option as Android wouldn't get addresses, right?
              2. Assisted would take the ipv6 from DHCPv6 and additonal config like RDNSS from RA? Would that mean Androids are getting no IPv6 again?
              3. Stateless DHCP would still assign IPv6 via RA and addtional config would come from DHCPv6?

              That's how I understand it. Which melts down to "Assisted" or do I miss here something bigger?

              Thanks for your help!

              Bob.DigB 1 Reply Last reply Reply Quote 0
              • Bob.DigB
                Bob.Dig LAYER 8 @BackMup
                last edited by Bob.Dig

                @backmup You only need a name if you run a server on it, so I wouldn't need one for my phone, no problem there.

                Assisted is good and android gets an IP but no name.

                BackMupB JKnottJ 2 Replies Last reply Reply Quote 1
                • JKnottJ
                  JKnott @Bob.Dig
                  last edited by

                  @bob-dig said in Register IPv6 in DNS Resolver with only RA enabled:

                  For dynamic GUAs you really should use DHCPv6.

                  The problem with that is Android devices won't work with it.

                  PfSense running on Qotom mini PC
                  i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                  UniFi AC-Lite access point

                  I haven't lost my mind. It's around here...somewhere...

                  1 Reply Last reply Reply Quote 0
                  • BackMupB
                    BackMup @Bob.Dig
                    last edited by

                    @bob-dig
                    True, for the clients it's not that important.
                    I will give it a try with Assisted.

                    Bob.DigB 1 Reply Last reply Reply Quote 0
                    • JKnottJ
                      JKnott @Bob.Dig
                      last edited by

                      @bob-dig said in Register IPv6 in DNS Resolver with only RA enabled:

                      Assisted is good and android gets an IP but no name.

                      The other side of this is how often will this be needed? All my devices are listed in host overrides. I just had to do it once.

                      PfSense running on Qotom mini PC
                      i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                      UniFi AC-Lite access point

                      I haven't lost my mind. It's around here...somewhere...

                      Bob.DigB 1 Reply Last reply Reply Quote 1
                      • Bob.DigB
                        Bob.Dig LAYER 8 @BackMup
                        last edited by Bob.Dig

                        @backmup The reason you don't need a name for clients is, every machine has many IPv6 addresses, only one of those has a name, the rest has none anyways, so the name is only good for a server to reach and according firewall rules to allow a connection but not good for blocking a machine via rules.

                        BackMupB 1 Reply Last reply Reply Quote 1
                        • Bob.DigB
                          Bob.Dig LAYER 8 @JKnott
                          last edited by

                          @jknott said in Register IPv6 in DNS Resolver with only RA enabled:

                          @bob-dig said in Register IPv6 in DNS Resolver with only RA enabled:

                          Assisted is good and android gets an IP but no name.

                          The other side of this is how often will this be needed? All my devices are listed in host overrides. I just had to do it once.

                          Your prefix is very undynamic then. 😉

                          BackMupB 1 Reply Last reply Reply Quote 1
                          • BackMupB
                            BackMup @Bob.Dig
                            last edited by

                            @bob-dig
                            Basically you're right but it's just such a clash in my mind. In the IPv4 world you can define all the names of clients and in the IPv6 you can't (at least not with RA only).
                            But well, maybe I need to cut the strings and release the "old" thinking.

                            JKnottJ 1 Reply Last reply Reply Quote 0
                            • BackMupB
                              BackMup @Bob.Dig
                              last edited by

                              @bob-dig
                              For GUA, it wouldn't work but that's also not really the aim. ULA should be fine and ULA doesn't change that much ;-)

                              JKnottJ 1 Reply Last reply Reply Quote 0
                              • JKnottJ
                                JKnott @BackMup
                                last edited by

                                @backmup said in Register IPv6 in DNS Resolver with only RA enabled:

                                But well, maybe I need to cut the strings and release the "old" thinking.

                                Or maybe you can convince Google to stop listening to that idiot who thinks Android shouldn't support DHCPv6. That where the problem lies. He doesn't like it, so Android doesn't support it.

                                PfSense running on Qotom mini PC
                                i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                                UniFi AC-Lite access point

                                I haven't lost my mind. It's around here...somewhere...

                                1 Reply Last reply Reply Quote 0
                                • JKnottJ
                                  JKnott @BackMup
                                  last edited by

                                  @backmup said in Register IPv6 in DNS Resolver with only RA enabled:

                                  and ULA doesn't change that much

                                  My GUA hasn't changed for years and has survived replacing both my cable modem and the computer I run pfSense on. However, ULA is useful, if your ISP doesn't provide a consistent prefix.

                                  PfSense running on Qotom mini PC
                                  i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                                  UniFi AC-Lite access point

                                  I haven't lost my mind. It's around here...somewhere...

                                  Bob.DigB 1 Reply Last reply Reply Quote 0
                                  • Bob.DigB
                                    Bob.Dig LAYER 8 @JKnott
                                    last edited by Bob.Dig

                                    @jknott Yep, for "reasons" I do NAT IPv6 to ULA for my email server and have given up using IPv6 for the rest...

                                    JKnottJ 1 Reply Last reply Reply Quote 0
                                    • JKnottJ
                                      JKnott @Bob.Dig
                                      last edited by

                                      @bob-dig

                                      Why do you use NAT? You can have both GUA and ULA on the same interface.

                                      PfSense running on Qotom mini PC
                                      i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                                      UniFi AC-Lite access point

                                      I haven't lost my mind. It's around here...somewhere...

                                      Bob.DigB 1 Reply Last reply Reply Quote 0
                                      • Bob.DigB
                                        Bob.Dig LAYER 8 @JKnott
                                        last edited by

                                        @jknott Because GUA with a dynamic prefix is problematic, especially for hosts that don't get notified that the prefix has changed. So for now, only pfSense has to know for its WAN interface. That does work better, as long as pfSense is the first router.

                                        1 Reply Last reply Reply Quote 0
                                        • First post
                                          Last post
                                        Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.