ULA routing stops when trackinterface is down

NightlyShark · Mar 18, 2024, 6:34 PM

@gwabber said in ULA routing stops when trackinterface is down:

@gwabber Allright, two questions before I continue:

should I set the interface of my fake gateway to WAN?

If the current problem is that te gateway goes offline, is it also possible to tick the option "don't take action" in the default IPv6 gateway? Or is that too simple?

No. You create one gateway per LAN
Read the reddit post

the other · Mar 18, 2024, 6:50 PM

hey there,
sorry for disturbing this very interesting post... :)

I just tried (too lazy to run all those chairs) and deactivated IPv6 in my Internetrouter (Fritzbox).
Behind that router sits my pfsense.
So with deactivated IPv6 my WAN (DHCPv6) went to "pending"...not reaching anything via v6 outside my LAN.

But: I could still ping and via browser reach my devices under their fd:whatever ULAs...
So I am a little confused now. Reading all this, I began to think I remembered wrongly in my first post. But now, with that try, I am a little lost.
I have no static routes or whatsoever discussed in this thread...I might do the labour, run those steps and pull the plug from pfsense's WAN and give it another try.
Or am I missing something obvious (no DHCPv6 in pfsense's LAN, using SLAAC via RA unmanaged...)?

NightlyShark · Mar 18, 2024, 6:58 PM

@gwabber

@gwabber said in ULA routing stops when trackinterface is down:

@gwabber Allright, two questions before I continue:

should I set the interface of my fake gateway to WAN?

If the current problem is that te gateway goes offline, is it also possible to tick the option "don't take action" in the default IPv6 gateway? Or is that too simple?

@the-other said in ULA routing stops when trackinterface is down:

hey there,
sorry for disturbing this very interesting post... :)

I just tried (too lazy to run all those chairs) and deactivated IPv6 in my Internetrouter (Fritzbox).
Behind that router sits my pfsense.
So with deactivated IPv6 my WAN (DHCPv6) went to "pending"...not reaching anything via v6 outside my LAN.

But: I could still ping and via browser reach my devices under their fd:whatever ULAs...
So I am a little confused now. Reading all this, I began to think I remembered wrongly in my first post. But now, with that try, I am a little lost.
I have no static routes or whatsoever discussed in this thread...I might do the labour, run those steps and pull the plug from pfsense's WAN and give it another try.
Or am I missing something obvious (no DHCPv6 in pfsense's LAN, using SLAAC via RA unmanaged...)?

I think the answer to all those problems in the end, is to do away with the ISP prefixes all together by doing ULA NpT

gwabber · Mar 18, 2024, 7:01 PM

@the-other okay.. that is something else.... how did you deactivate the wan? Did you disable the gateway or the wan ipv6 alltogether?

gwabber · Mar 18, 2024, 7:03 PM

@NightlyShark That is what I would like to do... but there are two caveats :

My ISP delivers a dynamic prefix
Windows prefers IPv4 above ULA's. It's fixable, but very annoying to setup every computer.

NightlyShark · Mar 18, 2024, 7:03 PM

@gwabber So, it was the addresses themselves that weren't reachable for sure? Or a DNS name? Just checking...

gwabber · Mar 18, 2024, 7:06 PM

@NightlyShark the addresses themselves unfortunately... thanks for your help so far!

Other weird thing; I just disabled the default WAN ipv6 gateway just for shits and giggles. Now the ULA's were still reachable....

NightlyShark · Mar 18, 2024, 7:13 PM

@gwabber It's one of those "did you turn it on and off" things, then...

gwabber · Mar 18, 2024, 7:25 PM

@NightlyShark I really don't know anymore . Only difference with pulling the plug on my modem was that the GUA's stayed active, only mu IPv6 internet was down. When I pulled the plug on my modem, the GUA's dissapeared. My girlfriend is using Netflix right nog, so I can't pull the plug on my modem. Tomorrow I will try that!

The show continues...

the other · Mar 18, 2024, 7:39 PM

hey..pantpant...there...jk ;)

Just went in the cellar, pulled the plug (LAN cable between fritzbox (internetrouter) and pfsense's WAN.
Then run back upstairs. Rebootet pfsense. Rebooted pc.
Waited.
Tried ip a on pc > shows no GUA (of course) but its ULA (static mapping in pfsense).
Logged into pfsense (IPv4), tried ifonfig > no GUA, but all ULAs still there. ok
Then went to Status > Interfaces: same, no GUA (I get dynmaic prefixes from my ISP here as well, a nice /56) but ULAs as set under RA settings. ok.

then tried to ping my v6 devices (some of them, same and different vlans). reached all of them with their ULA.ok.

then tried to reach them with firefox, entering my https://ULAs. Reached all of them.ok.

So: after pulling the switch, rebooting, confirming that no GUAs are given out to anything in pfsense and pfsense itself...routing ULAs still works as if I never even pulled that LAN cable (and DID NOT RUN THOSE STAIRS, dammit). ;)

Then went downstairs again, just put LAN cable between fritzbox and pfsense back in, crawled upstairs again...tadaa: no reboot, still getting my GUA now for all interfaces with active v6 and all devices get their GUA as well (as another ip a showed).

I tried all that with their ULA, not DNS name...

At least I got my pe today.

Bob.Dig · Mar 18, 2024, 7:38 PM

Maybe the problem is related to that patch? Now who has that patch and who doesn't.

the other · Mar 18, 2024, 7:48 PM

@Bob-Dig hey there,
indeed, after the 2.72 "bug" that broke ULA routing I downloaded the patch (assuming that's the one you meant) and applied it.
It worked and I just looked: must have reverted it sometime ago, it is not "active" in my system/patches view...
But if I remember correctly: wasn't the problem to that patch, that even with v6 online and working one could not route ULAs only? Aliases and VIPs were somehow not working (which did prior to 2.7.2). But it's Monday and late and I might recall that incorrectly. :)

Bob.Dig · Mar 18, 2024, 7:52 PM

@the-other Hi, the problem with that patch is that you can not get IPv6 working on another interface after it is applied. Now has @gwabber this patch too? If yes, it is not related to that patch.

the other · Mar 18, 2024, 7:59 PM

@Bob-Dig yes, I recall that there was a problem with the patch now...I read that and tried as well with no positive result...couldn't apply v6 to another interface as well (one that was pure v4 before). Maybe that's why I reverted it.
And funfact: the user @gwabber started that post back then as well (about the 2.7.2 ULA problem)...just read that one. :)

Here: 2.7.2 broke ULA routing thread

the other · Mar 18, 2024, 8:02 PM

@gwabber yes, when I pulled the plug (before rebooting) GUAs stayed active (shown with ifconfig and Status/Interfaces) as well...same when I just deactivted v6 on my Fritzbox...but also: in all scenarios ULA routing worked.
So: do you have said patch applied on your system?

gwabber · Mar 18, 2024, 8:08 PM

@the-other thanks for trying the options! I have the said patch active on my system.

Weird that when you pull the plug, your GUA's stay active. Mine disappear completely. What could be diffrent in the default config...

Tomorrow is my day off, I'm gonna try the different scenario's!

gwabber · Mar 18, 2024, 9:46 PM

@gwabber allright. Girlfriend went to bed. I went behind my pc.

I set, for testpurposes, the gateway on "Disable Gateway Monitoring Action". I pulled the plug. My GUA's were gone again.

I visited one of my servers with the ULA. I could reach it... same for my pi and stuff. One weird thing. My pings to those servers became slower and timed out once in a while.... What that's about... I don't know.

So it works, like most of it, but not what it's supposed to be I think...

EDIT
never mind... it was a fluke. It broke down again. I don't get it anymore

EDIT2:
With the fake gateways it works! I still have the feeling that it should be easier then creating a fake gateway per LAN, but it works for now :)