Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    IPv6 Prefix Delegation broken?

    Scheduled Pinned Locked Moved 2.1 Snapshot Feedback and Problems - RETIRED
    29 Posts 4 Posters 14.2k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • A
      athurdent
      last edited by

      OK, what I found out so far:
      I switched to delegating /62 nets for my tests. Using /62 now on "DHCPv6 Prefix Delegation size".
      External net: 2001:xxxx:xxxx:dead::/64
      Delegated Net in this case: 2001:xxxx:xxxx:2000::/62

      IPv6 Prefix ID: ", or leave blank." does not work, I have to enter something there, went for "0".

      I also have to reboot, that is mandatory. Just pressing apply does not help.

      After a reboot the dashboard shows a correct IP from the delegated net on the internal interface.
      However, ifconfig on the internal net shows the following:

      vr2: flags=8843 <up,broadcast,running,simplex,multicast>metric 0 mtu 1500
        options=8280b <rxcsum,txcsum,vlan_mtu,wol_ucast,wol_magic,linkstate>inet6 fe80::1:1%vr2 prefixlen 64 scopeid 0x3
        inet6 2001:xxxx:xxxx:dead::1 prefixlen 64
        inet6 2001:xxxx:xxxx:2000:20d:b9ff:fe12:7866 prefixlen 64</rxcsum,txcsum,vlan_mtu,wol_ucast,wol_magic,linkstate></up,broadcast,running,simplex,multicast>

      the alias 2001:xxxx:xxxx:dead::1 is wrong, thats my external net.

      Also the auto configured DHCP server uses the wrong (external) net:

      cat /var/dhcpd/etc/dhcpdv6.conf

option domain-name "local-lan";
option ldap-server code 95 = text;
option domain-search-list code 119 = text;

default-lease-time 7200;
max-lease-time 86400;
log-facility local7;
ddns-update-style none;
one-lease-per-client true;
deny duplicates;
ping-check true;
authoritative;
subnet6 2001:xxxx:xxxx:dead::/64 {
        range6 2001:xxxx:xxxx:dead::1000 2001:4dd0:fb52:dead::2000;
      1 Reply Last reply Reply Quote 0
      • jimpJ
        jimp Rebel Alliance Developer Netgate
        last edited by

        I switched mine to /64 on the server and client side and I get the expected IP, no alias like that, and a proper DHCPv6 server config also.

        Not sure where the problem might be there… I only get the wrong addresses if the prefix size on the server doesn't match the client.

        I did notice that rebooting was necessary after changing the size on the client though, not sure what's up there.

        Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

        Need help fast? Netgate Global Support!

        Do not Chat/PM for help!

        1 Reply Last reply Reply Quote 0
        • A
          athurdent
          last edited by

          Ok, thanks for the help so far.
          I have found the problem. I had set my RADVD to "Assisted". Setting it to "Managed" solved the problems.
          Is it mandatory to use "Managed" when configuring IA-PD?
          Most users do not have the option to configure their DHCPv6 server / RADVD, I think. Normally your Cable/DSL provider will do that for you, maybe you do not have access to the device at all.
          As a workaround, could we safely turn off SLAAC on the Client when using IA-PD or would that break something?

          1 Reply Last reply Reply Quote 0
          • jimpJ
            jimp Rebel Alliance Developer Netgate
            last edited by

            Not sure there, databeestje would know for sure.

            Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

            Need help fast? Netgate Global Support!

            Do not Chat/PM for help!

            1 Reply Last reply Reply Quote 0
            • A
              athurdent
              last edited by

              As it is mandatory on other BSD to set net.inet6.ip6.accept_rtadv=0 when enabling IPv6 forwarding, I tried to do this on my test system. Sadly I can't find a way to have this option set at boot time, which is necessary because at least in my case I have to reboot to get IA-PD working.
              I tried it via the GUI and also in /etc/sysctl.conf but it will always be (re)set to 1 at some point I cannot find. Any hints?

              1 Reply Last reply Reply Quote 0
              • E
                eri--
                last edited by

                That is set since probably you have a DHCP6 type WAN interface configured which requires routing advertisement set!
                Not sure how this case can be handled.

                UPDATE: Does your dhcp wan get router information through DHCP by any case? Or it needs RA as well?

                1 Reply Last reply Reply Quote 0
                • A
                  athurdent
                  last edited by

                  I turned off RA completely and only left on DHCPv6 on my Router, then my client gets an external /128 and ignores the delegated prefix. It uses the external net on the inside again. So the only way to get IA-PD to work on the client side is to use RA set to Managed and turn on DHCPv6. I am out of ideas how one would use IA-PD on pfSense when RA does anything else than Managed. Maybe it is invalid to use anything else and databeestje can shed some light into this.

                  1 Reply Last reply Reply Quote 0
                  • E
                    eri--
                    last edited by

                    Can you try with later snapshots or gitsync i think i fixed this just now.
                    This is the related fix https://github.com/bsdperimeter/pfsense/commit/6ebfa0ccfd7db500a4f85d2d45ebd74699a8805f

                    1 Reply Last reply Reply Quote 0
                    • A
                      athurdent
                      last edited by

                      Thanks for looking into this!
                      As I'm on NanoBSD, I just copied the interfaces.inc over, no gitsync. I am on the latest snapshot.
                      For the tests I have set RADVD to Assisted on my gateway.
                      Interface configuration on the client looks good after a reboot. No external address on the inside, just an address of the delegated network.
                      RADVD and DHCPv6 are not started automatically after reboot, the configs also don't contain the delegated subnet.
                      If I press save / apply on the external interface, they get generated/configured correctly and start.
                      But that also spawns a second dhcp6c, the old one is not killed.

                      root  19235  0.0  0.5  3328  1288  ??  Ss    2:32PM   0:00.01 /usr/local/sbin/dhcp6c -d -c /var/etc/dhcp6c_lan.conf -p /var/run/dhcp6c_lan.pid vr0
root  82988  0.0  0.5  3328  1288  ??  Ss    2:34PM   0:00.00 /usr/local/sbin/dhcp6c -d -c /var/etc/dhcp6c_lan.conf -p /var/run/dhcp6c_lan.pid vr0

                      Pressing save / apply on the internal interface destroys the radvd.conf and dhcpdv6.conf and nothing works anymore.
                      If I press save / apply on the external interface again, I get third dhcp6c instance.

                      1 Reply Last reply Reply Quote 0
                      • E
                        eri--
                        last edited by

                        I pushed some more fixes.
                        Same you can just recopy interfaces.inc since it contains the changes.

                        1 Reply Last reply Reply Quote 0
                        • A
                          athurdent
                          last edited by

                          Didn't change anything, sorry. Even with latest 6387590fa6dcd90f11154c62ad87c62aec43b1b9
                          The system acts exactly like described before. I double checked that I am using the newest version of interfaces.inc

                          Edit: if it helps, from Syslog right after reboot:
                          php: : Error: cannot open dhcpdv6.conf in services_dhcpdv6_configure().
                          dhcp6c[19183]: update_ia: T1(2250) and/or T2(3600) is locally determined

                          1 Reply Last reply Reply Quote 0
                          • P
                            phil.davis
                            last edited by

                            Are you on a nanobsd system?
                            There isn't any call to conf_mount_rw then conf_mount_ro in services_dhcpdv6_configure(). If this routine is called from something that does not already have the file system mounted RW, then trying to write the dhcpdv6.conf will fail. The easy fix would be to put these rw/ro calls either side of the block of code doing the file_put_contents. But ermal might see a better/more appropriate place to do it - I'll leave it to him as I don't have a test system accessible now to play on.

                            As the Greek philosopher Isosceles used to say, "There are 3 sides to every triangle."
                            If I helped you, then help someone else - buy someone a gift from the INF catalog http://secure.inf.org/gifts/usd/

                            1 Reply Last reply Reply Quote 0
                            • E
                              eri--
                              last edited by

                              Pushed another fix its both services.inc and interfaces.inc
                              Test it out and let me know.

                              1 Reply Last reply Reply Quote 0
                              • A
                                athurdent
                                last edited by

                                Sorry, no changes. Same behaviour as described in http://forum.pfsense.org/index.php/topic,58664.msg314878.html#msg314878

                                1 Reply Last reply Reply Quote 0
                                • E
                                  eri--
                                  last edited by

                                  Can you show me the contents of /tmp/dhcpd.sh?

                                  1 Reply Last reply Reply Quote 0
                                  • A
                                    athurdent
                                    last edited by

                                    Sure:

                                    cat /tmp/dhcpd.sh
mkdir -p /var/dhcpd
mkdir -p /var/dhcpd/dev
mkdir -p /var/dhcpd/etc
mkdir -p /var/dhcpd/usr/local/sbin
mkdir -p /var/dhcpd/var/db
mkdir -p /var/dhcpd/var/run
mkdir -p /var/dhcpd/usr
mkdir -p /var/dhcpd/lib
mkdir -p /var/dhcpd/run
chown -R dhcpd:_dhcp /var/dhcpd/*
cp /lib/libc.so.* /var/dhcpd/lib/
cp /usr/local/sbin/dhcpd /var/dhcpd/usr/local/sbin/
chmod a+rx /var/dhcpd/usr/local/sbin/dhcpd
                                    1 Reply Last reply Reply Quote 0
                                    • E
                                      eri--
                                      last edited by

                                      Do you have those directories created?
                                      If you run the script from ssh do you get any errors?

                                      1 Reply Last reply Reply Quote 0
                                      • P
                                        phil.davis
                                        last edited by

                                        Hmmm - I thought this would be easy to reproduce on nanobsd. But my system comes up OK. On the console at boot:

                                        Starting DHCP service...done.
Starting DHCPv6 service...done.

                                        And the dhcp conf files are there:

                                        -rw-r--r--  1 root  _dhcp  731 Feb 10 18:55 dhcpd.conf
-rw-r--r--  1 root  _dhcp  482 Feb 10 18:55 dhcpdv6.conf

                                        The system boots cleanly, with the filesystem read-only at the end.
                                        On my system, the dhcpdv6.conf must be written at a time when the filesystem is read-write. I don't actually have any DHCPv6 available from my ISP, so I am not getting an IPv6 stuff handed down from upstream to my WAN. Perhaps the asynchronous receipt of IPv6 settings from upstream will trigger a call to services_dhcpdv6_configure() when the filesystem is read-only?
                                        Interesting to see what is different about the startup sequence for arthurdent.

                                        As the Greek philosopher Isosceles used to say, "There are 3 sides to every triangle."
                                        If I helped you, then help someone else - buy someone a gift from the INF catalog http://secure.inf.org/gifts/usd/

                                        1 Reply Last reply Reply Quote 0
                                        • A
                                          athurdent
                                          last edited by

                                          After a reboot it looks OK. Everything the script does is done and it does not give any errors running is manually. However If found the following in my system log. There seems to be an error at some point while booting up (like I said before, "lan" is the external interface in my test setup, so "interface: lan" is correct here):

                                          Feb 10 14:45:19 pfsense-alix php: : rc.newwanipv6: Informational is starting vr0.
Feb 10 14:45:24 pfsense-alix php: : rc.newwanipv6: on (IP address: 2001:xxx:xxx:dead:20d:b9ff:fe12:7864) (interface: lan) (real interface: vr0).
Feb 10 14:45:25 pfsense-alix php: : The command '/bin/sh /tmp/dhcpd.sh' returned exit code '127', the output was 'chown: not found mount: not found'
Feb 10 14:45:28 pfsense-alix dhcpleases: kqueue error: unkown
Feb 10 14:45:28 pfsense-alix dhcpleases: Could not deliver signal HUP to process because its pidfile does not exist, No such file or directory.

                                          Ermal, would you like me to PM you the whole log?

                                          1 Reply Last reply Reply Quote 0
                                          • E
                                            eri--
                                            last edited by

                                            I pushed another fix but yeah system log would be useful.

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.