Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Old IPv6 addresses may continue to be used after DHCP or RA changes #12947 - not fixed?

    Scheduled Pinned Locked Moved CE 2.8.0 Development Snapshots
    20 Posts 2 Posters 578 Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • M
      marcosm Netgate
      last edited by marcosm

      Further testing here shows that when the lease is renewed the downstream interfaces were updated by dhcp6c with the new prefix (vmx4 is the LAN, vmx1 is the WAN):

      Apr 8 10:02:13 	dhcp6c 	37136 	Sending Renew
Apr 8 10:02:13 	dhcp6c 	37136 	dhcp6c Received INFO
Apr 8 10:02:13 	dhcp6c 	37136 	add an address 2001:db8:a:a::aab0/128 on vmx1
Apr 8 10:02:13 	dhcp6c 	37136 	Sending Renew
Apr 8 10:02:13 	dhcp6c 	37136 	dhcp6c Received INFO
Apr 8 10:02:13 	dhcp6c 	37136 	add an address 2001:db8:c:0:250:56ff:feb2:a5f1/64 on vmx4
Apr 8 10:02:13 	dhcp6c 	37136 	remove an address 2001:db8:b:18:250:56ff:feb2:a5f1/64 on vmx4

      As I understand, in order for the client to update its interfaces with the new prefix outside of the scheduled times it would need to receive an unsolicited reconfigure message (RFC6644). From the logs provided so far, I'm not seeing this happening. This seems to align with the reported behavior on redmine stating that "This situation resolves only after 1.5 to 2 hours."

      FWIW "reconfigure" messages are not supported by Kea according to their documentation, and it seems to be the case for ISC dhcpd as well.

      U 1 Reply Last reply Reply Quote 0
      • U
        UweV @marcosm
        last edited by

        @marcosm DHCPv6 is not enabled on the pfSense. RA is used with router mode "unmanaged".
        -> Stateless Address Auto-Configuration (SLAAC)

        d5d6b376-5a88-4310-baaa-2c2217aaa825-image.png

        I assume the tracked LAN interfaces of the pfSense need to get first new delegated IPv6 prefix and a new IPv6 IP assigned.
        That is not happening.

        97458b20-f033-42d4-a15c-46e39081a5ad-image.png

        vtnet0 = WAN Interface
        vtnet1 = VLAN20 = LAN Interface

        vtnet0: flags=1008843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST,LOWER_UP> metric 0 mtu 1500
        description: WAN
        options=800b8<VLAN_MTU,VLAN_HWTAGGING,JUMBO_MTU,VLAN_HWCSUM,LINKSTATE>
        ether 02:11:32:2d:5b:36
        inet 192.168.7.253 netmask 0xffffff00 broadcast 192.168.7.255
        ...
        inet6 2003:xx:xx1c:6a00:11:32ff:fe2d:5b36 prefixlen 64 autoconf pltime 1183 vltime 7200
        media: Ethernet autoselect (10Gbase-T <full-duplex>)
        status: active
        nd6 options=23<PERFORMNUD,ACCEPT_RTADV,AUTO_LINKLOCAL>
        vtnet1: flags=1008843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST,LOWER_UP> metric 0 mtu 1500
        description: VLAN20
        options=800b8<VLAN_MTU,VLAN_HWTAGGING,JUMBO_MTU,VLAN_HWCSUM,LINKSTATE>
        ether 02:11:32:22:a9:2f
        inet 192.168.20.253 netmask 0xffffff00 broadcast 192.168.20.255
        inet6 2003:xx:xx01:cf8:11:32ff:fe22:a92f prefixlen 64
        media: Ethernet autoselect (10Gbase-T <full-duplex>)
        status: active
        nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>

        U 1 Reply Last reply Reply Quote 0
        • U
          UweV @UweV
          last edited by

          To be able to do testing with you I switched to RA router mode "managed" and enabled DHCPv6 service (ISC DHCP for now) on the LAN interfaces.

          I do not think that the communication DHCPv6 service to the clients on the LAN subnets is the initial/first/main issue.

          The pfSense interfaces do not get an IPv6 address with the new prefix and the new prefix is also not listed in the DHCPv6 service config screen.

          To resolve both issues manually as a workaround I'm going to the WAN interface and save and apply.
          Afterthat everything is correct:

          • Interfaces got a valid IPv6
          • new prefix is listed on DHCPv6 service config screen
          • clients get a new IPv6 IP with correct prefix assigned
          • client have Internet connectivity.

          This is listed in the system logs while doing the "WAN interface and save and apply."

          68c80eb0-60f7-47fe-8250-a57e891e4056-Pasted Graphic 4.png

          I assume not all tasks are required on a upstream router IPv6 prefix change.
          But some needs to be initiated automatically to allow client IPv6 communication again.

          Thanks for your support.

          

          U 1 Reply Last reply Reply Quote 0
          • U
            UweV @UweV
            last edited by

            Pfsense-IPv6-280beta_v4 uploaded.

            157e7805-95a0-4063-b23e-bdb276be3bd5-image.png

            The DHCPv6 / RA sends the new prefix and assigns a new IP address to the WAN interface on pfSense.

            2.8.0-BETA][admin@pfSense-ipv6.home.arpa]/root: ifconfig vtnet0 | grep 2003
            inet6 2003:xx:xx1e:c800:11:32ff:fe28:7ee6 prefixlen 64 deprecated autoconf pltime 0 vltime 7087
            inet6 2003:xx:xx32:7c00:11:32ff:fe28:7ee6 prefixlen 64 autoconf pltime 1687 vltime 7200

            The old IP gets deprecated and the new IP is listed.
            I added the radvdump to the document.
            To me this part of the process looks good.

            I assume based on the IPv6 IP change on the WAN interface the pfSense software needs to take action (run a script etc.)

            1. assign new IPv6 IPs to all LAN interfaces
            2. assign the new prefix to all DHCPv6 services on all LAN Interfaces

            Please let me know if you need more information or remote access to my pfSense test VM.
            Thank you.

            1 Reply Last reply Reply Quote 0
            • M
              marcosm Netgate
              last edited by

              SLAAC can only help with the WAN prefix and not the delegated prefixes for LAN. In order for pfSense to know that the PD has changed outside of the normal times, DHCPv6 with RFC664 would be needed. If you still think something is being done incorrectly, run a packet capture on pfSense's WAN interface and reproduce the issue. Is there something there that tells pfSense that the PD has changed in order for pfSense to update its LANs?

              U 1 Reply Last reply Reply Quote 0
              • U
                UweV @marcosm
                last edited by

                So you assume that the upstream internet router does not tell pfSense that the prefix delegation has changed - correct?

                I started a packet capture on WAN - uploaded.
                The upstream router got this prefix assigned:
                IPv6 prefix: 2003:e2:xx39:3700::/56

                fyi - I do not know how to filter the capture correctly for this purpose.
                on the same subnet an IPv4 carp cluster is running, too.

                U M 2 Replies Last reply Reply Quote 0
                • U
                  UweV @UweV
                  last edited by

                  upstream router settings:
                  b38bb4e8-ea4e-49fd-992c-e49e0eba736e-image.png

                  1 Reply Last reply Reply Quote 0
                  • M
                    marcosm Netgate @UweV
                    last edited by

                    @UweV

                    So you assume that the upstream internet router does not tell pfSense that the prefix delegation has changed - correct?

                    Yes. The PCAP shows the server sending Router Advertisement's for the new prefix as expected which allows pfSense to update its route table and WAN, but it will not affect the delegated prefixes tracked by the LAN interfaces.

                    U 1 Reply Last reply Reply Quote 0
                    • U
                      UweV @marcosm
                      last edited by

                      @marcosm

                      I will try to troubleshoot with the internet router vendor.

                      Do you know how to filter for these specific packages? (PD)
                      a004aa9e-4e9e-4a8f-97c3-7c68a56d9ca7-image.png

                      Would it be possible to run a script every minute to check for WAN interface IPv6 prefix change (IP only) and if there is a change then request by another script a new delegated prefix from the internet router?
                      FYI: someone worked on a workaround two years ago. I think it's no longer working now:
                      https://github.com/geschke/ccw-ipv6

                      If many internet router are not handling the delegated prefix change correctly, would it be possible to implement a workaround in pfSense?
                      Like:

                      • add a question / checkbox in the WAN Interface (or LAN config screens) configuration screen:
                        x request a new delegated prefix if an IPv6 IP prefix change is detected
                      • then update the tracked interfaces and the DHCPv6 and RA services on LAN networks

                      Thanks for your feedback.

                      U 1 Reply Last reply Reply Quote 0
                      • U
                        UweV @UweV
                        last edited by UweV

                        packetcapture-vtnet0-20250411155701.pcap -> contains a prefix delegation change initiated by a WAN interface save&apply. You should see the request from the pfSense and the answer from the upstream internet router in this capture file.

                        IPv6 prefix assigned to upstream internet router by internet provider: 2003:e2:8703:e000::/56
                        Delegated to pfSense: 2003:e2:8703:e0f8::/61

                        1 Reply Last reply Reply Quote 0
                        • First post
                          Last post
                        Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.