pfSense as subrouter, track interface and routing problems

Spaylia

Hi,

I'm in the process of setting up IPv6 at home and I managed to get set it up on my first router (R1). However, I can't manage to use pfSense (2.7.1) as a subrouter (in order to create 2 separate networks).

R1's RA is configured as stateless, so all clients get address autoconfiguration and other settings via DHCPv6. I think that's what I need to delegate a prefix. My ISP gives a /56 prefix so I delegate /60, from ::10:0:0:0:0 to ::f0:0:0:0:0 (in the doc it says to only enter the range itself), and I can see the pfSense in the delegated prefixes (it got 0:0:0:f0::/60). pfSense's WAN is autoconfigured (because I only request a /60 prefix) and sets an address in the same range as R1's LAN and I can ping internet (such as quad9's address), only from pfSense's WAN address.

Problem 1: I set pfSense LAN interface to "track interface" with a prefix ID of 1 but instead of getting 2001:xxxx:xxxx:xxf1:zzzz:zzzz:zzzz:zzzz, I get ::f1:zzzz:zzzz:zzzz:zzzz/64 (so the delegated f prefix is there, as well as prefix ID 1).

Problem 2: I can't ping from my LAN address to internet, as if pfSense doesn't route anything. pfSense default gateway is provided by R1 DHCP6 and works, it's the right address and I can ping from pfSense WAN.

Problem 3: Clients in R1's LAN (pfSense's WAN) are being advertised with pfSense's WAN interface as default route. How is that possible? I don't (and can't) have RA running on the WAN interface. This is a big problem because it causes those clients to lose connectivity.

Problem 3a: I guess it's related, pfSense RA logs are spammed with:

Nov 16 23:59:26 pfsense radvd[70894]: our AdvManagedFlag on vtnet0 (pfSense WAN adapter) doesn't agree with fe80::yyyy:yyyy:yyyy:yyyy (R1 LAN link local)
Nov 16 23:49:06 pfsense radvd[70894]: RDNSS address 2001:xxxx:xxxx:xxxx:yyyy:yyyy:yyyy:yyyy (R1 LAN address) received on vtnet0 (pfSense WAN adapter) from fe80::yyyy:yyyy:yyyy:yyyy (R1 LAN link local) is not advertised by us

Also, side question: I only have IPv6 "allow to any" rules in pfSense LAN firewall, do I need something else? Such as allowing ICMPv6 on WAN or something?

I've been tearing my hair out over this for a week and I can't understand why. Would anyone have any idea, please?

JKnott

@Spaylia said in pfSense as subrouter, track interface and routing problems:

I'm in the process of setting up IPv6 at home and I managed to get set it up on my first router (R1). However, I can't manage to use pfSense (2.7.1) as a subrouter (in order to create 2 separate networks).

Does the first router provide DHCPv6-PD? If not, you'll have to manually configure pfSense. I have the opposite situation where I have to manually configure a Cisco router as my 2nd.

Spaylia

@JKnott said in pfSense as subrouter, track interface and routing problems:

Does the first router provide DHCPv6-PD?

Yes, I configured the prefix size to /60 and delegated from ::10:0:0:0:0 to ::f0:0:0:0:0. I even get the prefix f0 on pfSense.

JKnott

@Spaylia

What happens if you use SLAAC instead of DHCP6 on the LAN?

Spaylia

@JKnott Then I can't enable RA on the LAN interface.

JKnott

@Spaylia

Sure you can. That's what I have here. You should be using SLAAC, unless you have some need for DHCP6. Also, Android devices won't work with it, thanks to some genius at Google.

Here's the configuration for my ISP.

You then configure the Router Advertisements page.

Spaylia

@JKnott In the linked post, you say you're using "track interface", not SLAAC for LAN.

When I want to change to SLAAC, here's the message I get:

JKnott

@Spaylia

Do you still have DHCPv6 enabled? Try with it off.

Spaylia

@JKnott No DHCPv6 as always been disable on LAN, I only use RA.

JKnott

@Spaylia

What happens if you connect pfSense directly to your ISP, instead of your other router? Also, sometimes it's easier to start from scratch than trying to find the problem.

JKnott

@Spaylia said in pfSense as subrouter, track interface and routing problems:

When I want to change to SLAAC, here's the message I get:

Did you configure a static address on your LAN? You don't have to with SLAAC.

Spaylia

@JKnott said in pfSense as subrouter, track interface and routing problems:

Did you configure a static address on your LAN? You don't have to with SLAAC.

I can do that, but it still doesn't route from LAN to WAN :(

Spaylia

@JKnott I managed to make it work temporarily, I could ping internet from the LAN interface, but my clients still couldn't. Oddly enough there was no addresses on the LAN interface.

When I rebooted, LAN address came back and ping wasn't working anymore. I tried both "track interface" and static IP.

JKnott

@Spaylia

Maybe you should start over from scratch. You might have made so many changes starting over may be easier. Start with the config I provided for my ISP.

Spaylia

@JKnott do I need to add a route or gateway in the first router?

With IPv4, the router keeps a table of the translated address and port and sends the response back where it comes from, to be translated by the second router.

I'm not sure about IPv6. Does the router know where it comes from if it comes from another subnet (behind router 2)?

JKnott

@Spaylia

With IPv6, the default route is set automagically. With SLAAC, it's provided by the router advertisements. You can see this, if you capture with Packet Capture, filtering on icmp6.

Spaylia

@JKnott I'm not asking about the default route, but a downstream route for Router 1, to send the responses to Router 2

When a client requests something, it goes:
Client -> router 2 -> router 1 -> internet

When the server answers
internet -> router 1 -> router 2 -> client

Do I need a route from router 1 to router 2 so the answer can be router back?

JKnott

@Spaylia

It will know the route to the next router, but not the network behind it. So, you'll have to configure the route for that network.

Spaylia

@JKnott Alright, I got it to work, it was a problem with the configuration of R1, after looking at the routes in R1, I noticed it wasn't delegating the prefix properly.

Although devices (mostly debian hosts) under R1 are still advertised with R2 (pfsense) WAN as a default route. Would you know if there's a way to see who advertised a route on debian?

JKnott

@Spaylia

Do a Packet Capture, filtering on icmp6. You will, after a few minutes, have some router advertisements, which provide the route. Examine the source MAC address to see where it's coming from.