Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    IPv6 Prefix Delegation broken?

    2.1 Snapshot Feedback and Problems - RETIRED
    4
    29
    13.4k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • A
      athurdent
      last edited by

      Ok, thanks for the help so far.
      I have found the problem. I had set my RADVD to "Assisted". Setting it to "Managed" solved the problems.
      Is it mandatory to use "Managed" when configuring IA-PD?
      Most users do not have the option to configure their DHCPv6 server / RADVD, I think. Normally your Cable/DSL provider will do that for you, maybe you do not have access to the device at all.
      As a workaround, could we safely turn off SLAAC on the Client when using IA-PD or would that break something?

      1 Reply Last reply Reply Quote 0
      • jimpJ
        jimp Rebel Alliance Developer Netgate
        last edited by

        Not sure there, databeestje would know for sure.

        Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

        Need help fast? Netgate Global Support!

        Do not Chat/PM for help!

        1 Reply Last reply Reply Quote 0
        • A
          athurdent
          last edited by

          As it is mandatory on other BSD to set net.inet6.ip6.accept_rtadv=0 when enabling IPv6 forwarding, I tried to do this on my test system. Sadly I can't find a way to have this option set at boot time, which is necessary because at least in my case I have to reboot to get IA-PD working.
          I tried it via the GUI and also in /etc/sysctl.conf but it will always be (re)set to 1 at some point I cannot find. Any hints?

          1 Reply Last reply Reply Quote 0
          • E
            eri--
            last edited by

            That is set since probably you have a DHCP6 type WAN interface configured which requires routing advertisement set!
            Not sure how this case can be handled.

            UPDATE: Does your dhcp wan get router information through DHCP by any case? Or it needs RA as well?

            1 Reply Last reply Reply Quote 0
            • A
              athurdent
              last edited by

              I turned off RA completely and only left on DHCPv6 on my Router, then my client gets an external /128 and ignores the delegated prefix. It uses the external net on the inside again. So the only way to get IA-PD to work on the client side is to use RA set to Managed and turn on DHCPv6. I am out of ideas how one would use IA-PD on pfSense when RA does anything else than Managed. Maybe it is invalid to use anything else and databeestje can shed some light into this.

              1 Reply Last reply Reply Quote 0
              • E
                eri--
                last edited by

                Can you try with later snapshots or gitsync i think i fixed this just now.
                This is the related fix https://github.com/bsdperimeter/pfsense/commit/6ebfa0ccfd7db500a4f85d2d45ebd74699a8805f

                1 Reply Last reply Reply Quote 0
                • A
                  athurdent
                  last edited by

                  Thanks for looking into this!
                  As I'm on NanoBSD, I just copied the interfaces.inc over, no gitsync. I am on the latest snapshot.
                  For the tests I have set RADVD to Assisted on my gateway.
                  Interface configuration on the client looks good after a reboot. No external address on the inside, just an address of the delegated network.
                  RADVD and DHCPv6 are not started automatically after reboot, the configs also don't contain the delegated subnet.
                  If I press save / apply on the external interface, they get generated/configured correctly and start.
                  But that also spawns a second dhcp6c, the old one is not killed.

                  root  19235  0.0  0.5  3328  1288  ??  Ss    2:32PM   0:00.01 /usr/local/sbin/dhcp6c -d -c /var/etc/dhcp6c_lan.conf -p /var/run/dhcp6c_lan.pid vr0
root  82988  0.0  0.5  3328  1288  ??  Ss    2:34PM   0:00.00 /usr/local/sbin/dhcp6c -d -c /var/etc/dhcp6c_lan.conf -p /var/run/dhcp6c_lan.pid vr0

                  Pressing save / apply on the internal interface destroys the radvd.conf and dhcpdv6.conf and nothing works anymore.
                  If I press save / apply on the external interface again, I get third dhcp6c instance.

                  1 Reply Last reply Reply Quote 0
                  • E
                    eri--
                    last edited by

                    I pushed some more fixes.
                    Same you can just recopy interfaces.inc since it contains the changes.

                    1 Reply Last reply Reply Quote 0
                    • A
                      athurdent
                      last edited by

                      Didn't change anything, sorry. Even with latest 6387590fa6dcd90f11154c62ad87c62aec43b1b9
                      The system acts exactly like described before. I double checked that I am using the newest version of interfaces.inc

                      Edit: if it helps, from Syslog right after reboot:
                      php: : Error: cannot open dhcpdv6.conf in services_dhcpdv6_configure().
                      dhcp6c[19183]: update_ia: T1(2250) and/or T2(3600) is locally determined

                      1 Reply Last reply Reply Quote 0
                      • P
                        phil.davis
                        last edited by

                        Are you on a nanobsd system?
                        There isn't any call to conf_mount_rw then conf_mount_ro in services_dhcpdv6_configure(). If this routine is called from something that does not already have the file system mounted RW, then trying to write the dhcpdv6.conf will fail. The easy fix would be to put these rw/ro calls either side of the block of code doing the file_put_contents. But ermal might see a better/more appropriate place to do it - I'll leave it to him as I don't have a test system accessible now to play on.

                        As the Greek philosopher Isosceles used to say, "There are 3 sides to every triangle."
                        If I helped you, then help someone else - buy someone a gift from the INF catalog http://secure.inf.org/gifts/usd/

                        1 Reply Last reply Reply Quote 0
                        • E
                          eri--
                          last edited by

                          Pushed another fix its both services.inc and interfaces.inc
                          Test it out and let me know.

                          1 Reply Last reply Reply Quote 0
                          • A
                            athurdent
                            last edited by

                            Sorry, no changes. Same behaviour as described in http://forum.pfsense.org/index.php/topic,58664.msg314878.html#msg314878

                            1 Reply Last reply Reply Quote 0
                            • E
                              eri--
                              last edited by

                              Can you show me the contents of /tmp/dhcpd.sh?

                              1 Reply Last reply Reply Quote 0
                              • A
                                athurdent
                                last edited by

                                Sure:

                                cat /tmp/dhcpd.sh
mkdir -p /var/dhcpd
mkdir -p /var/dhcpd/dev
mkdir -p /var/dhcpd/etc
mkdir -p /var/dhcpd/usr/local/sbin
mkdir -p /var/dhcpd/var/db
mkdir -p /var/dhcpd/var/run
mkdir -p /var/dhcpd/usr
mkdir -p /var/dhcpd/lib
mkdir -p /var/dhcpd/run
chown -R dhcpd:_dhcp /var/dhcpd/*
cp /lib/libc.so.* /var/dhcpd/lib/
cp /usr/local/sbin/dhcpd /var/dhcpd/usr/local/sbin/
chmod a+rx /var/dhcpd/usr/local/sbin/dhcpd
                                1 Reply Last reply Reply Quote 0
                                • E
                                  eri--
                                  last edited by

                                  Do you have those directories created?
                                  If you run the script from ssh do you get any errors?

                                  1 Reply Last reply Reply Quote 0
                                  • P
                                    phil.davis
                                    last edited by

                                    Hmmm - I thought this would be easy to reproduce on nanobsd. But my system comes up OK. On the console at boot:

                                    Starting DHCP service...done.
Starting DHCPv6 service...done.

                                    And the dhcp conf files are there:

                                    -rw-r--r--  1 root  _dhcp  731 Feb 10 18:55 dhcpd.conf
-rw-r--r--  1 root  _dhcp  482 Feb 10 18:55 dhcpdv6.conf

                                    The system boots cleanly, with the filesystem read-only at the end.
                                    On my system, the dhcpdv6.conf must be written at a time when the filesystem is read-write. I don't actually have any DHCPv6 available from my ISP, so I am not getting an IPv6 stuff handed down from upstream to my WAN. Perhaps the asynchronous receipt of IPv6 settings from upstream will trigger a call to services_dhcpdv6_configure() when the filesystem is read-only?
                                    Interesting to see what is different about the startup sequence for arthurdent.

                                    As the Greek philosopher Isosceles used to say, "There are 3 sides to every triangle."
                                    If I helped you, then help someone else - buy someone a gift from the INF catalog http://secure.inf.org/gifts/usd/

                                    1 Reply Last reply Reply Quote 0
                                    • A
                                      athurdent
                                      last edited by

                                      After a reboot it looks OK. Everything the script does is done and it does not give any errors running is manually. However If found the following in my system log. There seems to be an error at some point while booting up (like I said before, "lan" is the external interface in my test setup, so "interface: lan" is correct here):

                                      Feb 10 14:45:19 pfsense-alix php: : rc.newwanipv6: Informational is starting vr0.
Feb 10 14:45:24 pfsense-alix php: : rc.newwanipv6: on (IP address: 2001:xxx:xxx:dead:20d:b9ff:fe12:7864) (interface: lan) (real interface: vr0).
Feb 10 14:45:25 pfsense-alix php: : The command '/bin/sh /tmp/dhcpd.sh' returned exit code '127', the output was 'chown: not found mount: not found'
Feb 10 14:45:28 pfsense-alix dhcpleases: kqueue error: unkown
Feb 10 14:45:28 pfsense-alix dhcpleases: Could not deliver signal HUP to process because its pidfile does not exist, No such file or directory.

                                      Ermal, would you like me to PM you the whole log?

                                      1 Reply Last reply Reply Quote 0
                                      • E
                                        eri--
                                        last edited by

                                        I pushed another fix but yeah system log would be useful.

                                        1 Reply Last reply Reply Quote 0
                                        • A
                                          athurdent
                                          last edited by

                                          I send the necessary information via PM, hope it arrived.

                                          1 Reply Last reply Reply Quote 0
                                          • First post
                                            Last post
                                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.