Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Old IPv6 addresses may continue to be used after DHCP or RA changes #12947 - not fixed?

    CE 2.8.0 Development Snapshots
    2
    20
    504
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • M
      marcosm Netgate
      last edited by marcosm

      The DHCP6 client script has been changed to call rc.newwanipv6 on RENEW which deals with the issue I was able to reproduce:
      https://redmine.pfsense.org/projects/pfsense/repository/2/revisions/646389402feb2dd94171d7c81d4be67feef4f8d8

      If it's still an issue for you however, there may be something else going on. Can you show the output of ifconfig before and after the issue happens as well as both the full system and DHCP logs covering the period when the issue happens?

      U 1 Reply Last reply Reply Quote 0
      • U
        UweV @marcosm
        last edited by

        @marcosm

        I modified the IPv6 addresses slightly (xx.xx) - not to publish my full IPs here.

        Before:
        Upstream router:
        IPv6-Prefix: 2003:xx:xx43:7f00::/56

        [2.8.0-BETA][admin@pfSense-ipv6.home.arpa]/root: ifconfig
        vtnet0: flags=1008843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST,LOWER_UP> metric 0 mtu 1500
        description: WAN
        options=800b8<VLAN_MTU,VLAN_HWTAGGING,JUMBO_MTU,VLAN_HWCSUM,LINKSTATE>
        ether 02:11:32:2d:5b:36
        inet 192.168.7.253 netmask 0xffffff00 broadcast 192.168.7.255
        inet6 fe80::11:32ff:fe2d:5b36%vtnet0 prefixlen 64 scopeid 0x1
        inet6 fdc7:326a:c353:0:11:32ff:fe2d:5b36 prefixlen 64 autoconf pltime 3600 vltime 7200
        inet6 2003:xx:xx43:7f00:11:32ff:fe2d:5b36 prefixlen 64 autoconf pltime 1424 vltime 7200
        media: Ethernet autoselect (10Gbase-T <full-duplex>)
        status: active
        nd6 options=23<PERFORMNUD,ACCEPT_RTADV,AUTO_LINKLOCAL>
        vtnet1: flags=1008843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST,LOWER_UP> metric 0 mtu 1500
        description: VLAN20
        options=800b8<VLAN_MTU,VLAN_HWTAGGING,JUMBO_MTU,VLAN_HWCSUM,LINKSTATE>
        ether 02:11:32:22:a9:2f
        inet 192.168.20.253 netmask 0xffffff00 broadcast 192.168.20.255
        inet6 fe80::11:32ff:fe22:a92f%vtnet1 prefixlen 64 scopeid 0x2
        inet6 fe80::1:1%vtnet1 prefixlen 64 scopeid 0x2
        inet6 2003:xx:xx43:7ff8:11:32ff:fe22:a92f prefixlen 64
        media: Ethernet autoselect (10Gbase-T <full-duplex>)
        status: active
        nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>
        vtnet2: flags=1008843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST,LOWER_UP> metric 0 mtu 1500
        description: VLAN30
        options=800b8<VLAN_MTU,VLAN_HWTAGGING,JUMBO_MTU,VLAN_HWCSUM,LINKSTATE>
        ether 02:11:32:23:ab:b3
        inet 192.168.30.253 netmask 0xffffff00 broadcast 192.168.30.255
        inet6 fe80::11:32ff:fe23:abb3%vtnet2 prefixlen 64 scopeid 0x3
        inet6 fe80::1:1%vtnet2 prefixlen 64 scopeid 0x3
        inet6 2003:xx:xx43:7ff9:11:32ff:fe23:abb3 prefixlen 64
        media: Ethernet autoselect (10Gbase-T <full-duplex>)
        status: active
        nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>

        After:(I initiated a IPv6 prefix change, all client IPv6 communication stops)
        Upstream router:
        New IPv6-Prefix: 2003:xx:xx02:2200::/56

        [2.8.0-BETA][admin@pfSense-ipv6.home.arpa]/root: ifconfig
        vtnet0: flags=1008843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST,LOWER_UP> metric 0 mtu 1500
        description: WAN
        options=800b8<VLAN_MTU,VLAN_HWTAGGING,JUMBO_MTU,VLAN_HWCSUM,LINKSTATE>
        ether 02:11:32:2d:5b:36
        inet 192.168.7.253 netmask 0xffffff00 broadcast 192.168.7.255
        inet6 fe80::11:32ff:fe2d:5b36%vtnet0 prefixlen 64 scopeid 0x1
        inet6 fdc7:326a:c353:0:11:32ff:fe2d:5b36 prefixlen 64 autoconf pltime 3600 vltime 7200
        inet6 2003:xx:xx43:7f00:11:32ff:fe2d:5b36 prefixlen 64 deprecated autoconf pltime 0 vltime 7132
        inet6 2003:xx:xx02:2200:11:32ff:fe2d:5b36 prefixlen 64 autoconf pltime 1731 vltime 7200
        media: Ethernet autoselect (10Gbase-T <full-duplex>)
        status: active
        nd6 options=23<PERFORMNUD,ACCEPT_RTADV,AUTO_LINKLOCAL>
        vtnet1: flags=1008843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST,LOWER_UP> metric 0 mtu 1500
        description: VLAN20
        options=800b8<VLAN_MTU,VLAN_HWTAGGING,JUMBO_MTU,VLAN_HWCSUM,LINKSTATE>
        ether 02:11:32:22:a9:2f
        inet 192.168.20.253 netmask 0xffffff00 broadcast 192.168.20.255
        inet6 fe80::11:32ff:fe22:a92f%vtnet1 prefixlen 64 scopeid 0x2
        inet6 fe80::1:1%vtnet1 prefixlen 64 scopeid 0x2
        inet6 2003:xx:xx43:7ff8:11:32ff:fe22:a92f prefixlen 64
        media: Ethernet autoselect (10Gbase-T <full-duplex>)
        status: active
        nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>
        vtnet2: flags=1008843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST,LOWER_UP> metric 0 mtu 1500
        description: VLAN30
        options=800b8<VLAN_MTU,VLAN_HWTAGGING,JUMBO_MTU,VLAN_HWCSUM,LINKSTATE>
        ether 02:11:32:23:ab:b3
        inet 192.168.30.253 netmask 0xffffff00 broadcast 192.168.30.255
        inet6 fe80::11:32ff:fe23:abb3%vtnet2 prefixlen 64 scopeid 0x3
        inet6 fe80::1:1%vtnet2 prefixlen 64 scopeid 0x3
        inet6 2003:xx:xx43:7ff9:11:32ff:fe23:abb3 prefixlen 64
        media: Ethernet autoselect (10Gbase-T <full-duplex>)
        status: active
        nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>

        U 1 Reply Last reply Reply Quote 0
        • U
          UweV @UweV
          last edited by

          system - general:

          Apr 7 16:54:59 check_reload_status 472 Reloading filter
          Apr 7 16:54:58 php-fpm 397 /rc.newwanipv6: Gateway, NONE AVAILABLE
          Apr 7 16:54:58 php-fpm 397 /rc.newwanipv6: Gateway, NONE AVAILABLE
          Apr 7 16:54:19 php-fpm 397 /rc.newwanipv6: rc.newwanipv6: on (IP address: 2003:xx:xx02:2200:11:32ff:fe2d:5b36) (interface: wan) (real interface: vtnet0).
          Apr 7 16:54:19 php-fpm 397 /rc.newwanipv6: rc.newwanipv6: Info: starting on vtnet0 due to RENEW.

          U 1 Reply Last reply Reply Quote 0
          • U
            UweV @UweV
            last edited by

            I cannot post the DHCP logs because the forum software flags it as SPAM

            U 1 Reply Last reply Reply Quote 0
            • U
              UweV @UweV
              last edited by

              in there another option for sending you logs?

              1 Reply Last reply Reply Quote 0
              • M
                marcosm Netgate
                last edited by

                You can upload everything here:
                https://nc.netgate.com/nextcloud/s/9RnP5LzP7eYBX7C

                U 1 Reply Last reply Reply Quote 0
                • U
                  UweV @marcosm
                  last edited by

                  I uploaded the first document - I will upload a second soon.
                  I'm documenting the full cycle until most issues are cleared up automatically. This takes multiple hours (IPv6 client are offline).

                  U 1 Reply Last reply Reply Quote 0
                  • U
                    UweV @UweV
                    last edited by UweV

                    2nd document uploaded.

                    fyi - a pfSense reboot fixes everything after an IPv6 prefix change.

                    U 1 Reply Last reply Reply Quote 0
                    • U
                      UweV @UweV
                      last edited by

                      Thank you for the patch.
                      It looks like it is not solving the issue.
                      3rd document uploaded.

                      1 Reply Last reply Reply Quote 0
                      • M
                        marcosm Netgate
                        last edited by marcosm

                        Further testing here shows that when the lease is renewed the downstream interfaces were updated by dhcp6c with the new prefix (vmx4 is the LAN, vmx1 is the WAN):

                        Apr 8 10:02:13 	dhcp6c 	37136 	Sending Renew
Apr 8 10:02:13 	dhcp6c 	37136 	dhcp6c Received INFO
Apr 8 10:02:13 	dhcp6c 	37136 	add an address 2001:db8:a:a::aab0/128 on vmx1
Apr 8 10:02:13 	dhcp6c 	37136 	Sending Renew
Apr 8 10:02:13 	dhcp6c 	37136 	dhcp6c Received INFO
Apr 8 10:02:13 	dhcp6c 	37136 	add an address 2001:db8:c:0:250:56ff:feb2:a5f1/64 on vmx4
Apr 8 10:02:13 	dhcp6c 	37136 	remove an address 2001:db8:b:18:250:56ff:feb2:a5f1/64 on vmx4

                        As I understand, in order for the client to update its interfaces with the new prefix outside of the scheduled times it would need to receive an unsolicited reconfigure message (RFC6644). From the logs provided so far, I'm not seeing this happening. This seems to align with the reported behavior on redmine stating that "This situation resolves only after 1.5 to 2 hours."

                        FWIW "reconfigure" messages are not supported by Kea according to their documentation, and it seems to be the case for ISC dhcpd as well.

                        U 1 Reply Last reply Reply Quote 0
                        • U
                          UweV @marcosm
                          last edited by

                          @marcosm DHCPv6 is not enabled on the pfSense. RA is used with router mode "unmanaged".
                          -> Stateless Address Auto-Configuration (SLAAC)

                          d5d6b376-5a88-4310-baaa-2c2217aaa825-image.png

                          I assume the tracked LAN interfaces of the pfSense need to get first new delegated IPv6 prefix and a new IPv6 IP assigned.
                          That is not happening.

                          97458b20-f033-42d4-a15c-46e39081a5ad-image.png

                          vtnet0 = WAN Interface
                          vtnet1 = VLAN20 = LAN Interface

                          vtnet0: flags=1008843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST,LOWER_UP> metric 0 mtu 1500
                          description: WAN
                          options=800b8<VLAN_MTU,VLAN_HWTAGGING,JUMBO_MTU,VLAN_HWCSUM,LINKSTATE>
                          ether 02:11:32:2d:5b:36
                          inet 192.168.7.253 netmask 0xffffff00 broadcast 192.168.7.255
                          ...
                          inet6 2003:xx:xx1c:6a00:11:32ff:fe2d:5b36 prefixlen 64 autoconf pltime 1183 vltime 7200
                          media: Ethernet autoselect (10Gbase-T <full-duplex>)
                          status: active
                          nd6 options=23<PERFORMNUD,ACCEPT_RTADV,AUTO_LINKLOCAL>
                          vtnet1: flags=1008843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST,LOWER_UP> metric 0 mtu 1500
                          description: VLAN20
                          options=800b8<VLAN_MTU,VLAN_HWTAGGING,JUMBO_MTU,VLAN_HWCSUM,LINKSTATE>
                          ether 02:11:32:22:a9:2f
                          inet 192.168.20.253 netmask 0xffffff00 broadcast 192.168.20.255
                          inet6 2003:xx:xx01:cf8:11:32ff:fe22:a92f prefixlen 64
                          media: Ethernet autoselect (10Gbase-T <full-duplex>)
                          status: active
                          nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>

                          U 1 Reply Last reply Reply Quote 0
                          • U
                            UweV @UweV
                            last edited by

                            To be able to do testing with you I switched to RA router mode "managed" and enabled DHCPv6 service (ISC DHCP for now) on the LAN interfaces.

                            I do not think that the communication DHCPv6 service to the clients on the LAN subnets is the initial/first/main issue.

                            The pfSense interfaces do not get an IPv6 address with the new prefix and the new prefix is also not listed in the DHCPv6 service config screen.

                            To resolve both issues manually as a workaround I'm going to the WAN interface and save and apply.
                            Afterthat everything is correct:

                            • Interfaces got a valid IPv6
                            • new prefix is listed on DHCPv6 service config screen
                            • clients get a new IPv6 IP with correct prefix assigned
                            • client have Internet connectivity.

                            This is listed in the system logs while doing the "WAN interface and save and apply."

                            68c80eb0-60f7-47fe-8250-a57e891e4056-Pasted Graphic 4.png

                            I assume not all tasks are required on a upstream router IPv6 prefix change.
                            But some needs to be initiated automatically to allow client IPv6 communication again.

                            Thanks for your support.

                            

                            U 1 Reply Last reply Reply Quote 0
                            • U
                              UweV @UweV
                              last edited by

                              Pfsense-IPv6-280beta_v4 uploaded.

                              157e7805-95a0-4063-b23e-bdb276be3bd5-image.png

                              The DHCPv6 / RA sends the new prefix and assigns a new IP address to the WAN interface on pfSense.

                              2.8.0-BETA][admin@pfSense-ipv6.home.arpa]/root: ifconfig vtnet0 | grep 2003
                              inet6 2003:xx:xx1e:c800:11:32ff:fe28:7ee6 prefixlen 64 deprecated autoconf pltime 0 vltime 7087
                              inet6 2003:xx:xx32:7c00:11:32ff:fe28:7ee6 prefixlen 64 autoconf pltime 1687 vltime 7200

                              The old IP gets deprecated and the new IP is listed.
                              I added the radvdump to the document.
                              To me this part of the process looks good.

                              I assume based on the IPv6 IP change on the WAN interface the pfSense software needs to take action (run a script etc.)

                              1. assign new IPv6 IPs to all LAN interfaces
                              2. assign the new prefix to all DHCPv6 services on all LAN Interfaces

                              Please let me know if you need more information or remote access to my pfSense test VM.
                              Thank you.

                              1 Reply Last reply Reply Quote 0
                              • M
                                marcosm Netgate
                                last edited by

                                SLAAC can only help with the WAN prefix and not the delegated prefixes for LAN. In order for pfSense to know that the PD has changed outside of the normal times, DHCPv6 with RFC664 would be needed. If you still think something is being done incorrectly, run a packet capture on pfSense's WAN interface and reproduce the issue. Is there something there that tells pfSense that the PD has changed in order for pfSense to update its LANs?

                                U 1 Reply Last reply Reply Quote 0
                                • U
                                  UweV @marcosm
                                  last edited by

                                  So you assume that the upstream internet router does not tell pfSense that the prefix delegation has changed - correct?

                                  I started a packet capture on WAN - uploaded.
                                  The upstream router got this prefix assigned:
                                  IPv6 prefix: 2003:e2:xx39:3700::/56

                                  fyi - I do not know how to filter the capture correctly for this purpose.
                                  on the same subnet an IPv4 carp cluster is running, too.

                                  U M 2 Replies Last reply Reply Quote 0
                                  • U
                                    UweV @UweV
                                    last edited by

                                    upstream router settings:
                                    b38bb4e8-ea4e-49fd-992c-e49e0eba736e-image.png

                                    1 Reply Last reply Reply Quote 0
                                    • M
                                      marcosm Netgate @UweV
                                      last edited by

                                      @UweV

                                      So you assume that the upstream internet router does not tell pfSense that the prefix delegation has changed - correct?

                                      Yes. The PCAP shows the server sending Router Advertisement's for the new prefix as expected which allows pfSense to update its route table and WAN, but it will not affect the delegated prefixes tracked by the LAN interfaces.

                                      U 1 Reply Last reply Reply Quote 0
                                      • U
                                        UweV @marcosm
                                        last edited by

                                        @marcosm

                                        I will try to troubleshoot with the internet router vendor.

                                        Do you know how to filter for these specific packages? (PD)
                                        a004aa9e-4e9e-4a8f-97c3-7c68a56d9ca7-image.png

                                        Would it be possible to run a script every minute to check for WAN interface IPv6 prefix change (IP only) and if there is a change then request by another script a new delegated prefix from the internet router?
                                        FYI: someone worked on a workaround two years ago. I think it's no longer working now:
                                        https://github.com/geschke/ccw-ipv6

                                        If many internet router are not handling the delegated prefix change correctly, would it be possible to implement a workaround in pfSense?
                                        Like:

                                        • add a question / checkbox in the WAN Interface (or LAN config screens) configuration screen:
                                          x request a new delegated prefix if an IPv6 IP prefix change is detected
                                        • then update the tracked interfaces and the DHCPv6 and RA services on LAN networks

                                        Thanks for your feedback.

                                        U 1 Reply Last reply Reply Quote 0
                                        • U
                                          UweV @UweV
                                          last edited by UweV

                                          packetcapture-vtnet0-20250411155701.pcap -> contains a prefix delegation change initiated by a WAN interface save&apply. You should see the request from the pfSense and the answer from the upstream internet router in this capture file.

                                          IPv6 prefix assigned to upstream internet router by internet provider: 2003:e2:8703:e000::/56
                                          Delegated to pfSense: 2003:e2:8703:e0f8::/61

                                          1 Reply Last reply Reply Quote 0
                                          • First post
                                            Last post
                                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.