IPv6 DHCP-PD – radvd dies after interface reset - dhcpv6 does not reaquire addr

priller · Apr 2, 2013, 1:43 AM

I have opened the following bug: https://redmine.pfsense.org/issues/2919

I was running a packet capture when the lease expired. The IPv6 DHCP server is responding properly, but pfSense never binds.

darkcrucible · Apr 9, 2013, 6:05 PM

With the April 8th snapshot, IPv6 connectivity with my Comcast link is restored to the LAN clients. I skimmed through redmine to see what might be affecting this. A few items stood out. Not sure exactly which one.

Getting connectivity back is certainly an improvement. pfsense itself still doesn't use the IPv6 DNS given to it by Comcast and none of the LAN clients seem to use the IPv6 LAN address of pfsense for DNS forwarding like they used to back in February.

I'll report back in a few days after the renewal on whether connectivity remains and if the pfsense starts using IPv6 DNS at that point.

johnpoz · Apr 9, 2013, 6:37 PM

sweet!!!! I will try this build when I get home!

Michael Sh. · Apr 10, 2013, 12:04 PM

On my routers DHCP v6 not working at all after switching on rtsol.

rtsold should be used on IPv6 hosts (non-router nodes) only.

[2.1-BETA1][root@router.lan]/root(105): /usr/sbin/rtsold -1 -p /var/run/rtsold_em0.pid -O /var/etc/rtsold_em0_script.sh em0
rtsold: kernel is configured as a router, not a host

johnpoz · Apr 10, 2013, 1:05 PM

Still not working

2.1-BETA1 (i386)
built on Tue Apr 9 13:23:01 EDT 2013

Get errors that radvd.conf is bad

Apr 10 08:09:51 radvd[74841]: Exiting, failed to read config file.
Apr 10 08:09:51 radvd[74841]: error parsing or activating the config file: /var/etc/radvd.conf
Apr 10 08:09:51 radvd[74841]: syntax error in /var/etc/radvd.conf, line 2:

There is nothing in this file other than

[2.1-BETA1][root@pfsense.local.lan]/var/etc(11): cat /var/etc/radvd.conf

Automatically Generated, do not edit

[2.1-BETA1][root@pfsense.local.lan]/var/etc(12):

What is suppose to update this file? I tried clean install, and I did see my 2001 address on wan and 2006 address on lan, but it ended it :2 – and after reboot gone? No nothing on wan other than local link address, and nothing on lan.

This was working perfect, and then just stopped??

johnpoz · Apr 10, 2013, 3:17 PM

So I gave it some time, and now getting /128 on wan and /64 on lan

WAN (wan) -> em1 -> v4/DHCP4: 24.13.xx.xx/21
v6/DHCP6: 2001:558:xxxx:12c:405d:37e1:34e1:fe29/128
LAN (lan) -> em0 -> v4: 192.168.1.253/24
v6/t6: 2601:d:xxxx:d7:250:56ff:fe00:2/64

So it is working - but here is question. I don't want the lan IP to use the mac, which clearly is where that address is coming from. What would be nicer is if the lan interface grabbed the first IP in the net

2601:d:xxxx:d7::1

so my mac on the lan interface is

em0: flags=8843 <up,broadcast,running,simplex,multicast>metric 0 mtu 1500
options=98 <vlan_mtu,vlan_hwtagging,vlan_hwcsum>ether 00:50:56:00:00:02

Is there some setting that needs to be made so it doesn't do that, and just uses the first IP in the network its assigned?</vlan_mtu,vlan_hwtagging,vlan_hwcsum></up,broadcast,running,simplex,multicast>

darkcrucible · Apr 11, 2013, 10:22 PM

At 48 hours, the renewal time, the IPv6 LAN address disappears, RADVD vanishes from the services page, and resolv.conf picks up the IPv6 DNS from Comast (it only had the 75.75.x addresses prior to the renewal).

priller · Apr 12, 2013, 11:27 AM

@darkcrucible:

At 48 hours, the renewal time, the IPv6 LAN address disappears, RADVD vanishes from the services page, and resolv.conf picks up the IPv6 DNS from Comast (it only had the 75.75.x addresses prior to the renewal).

pfSense will only bind the LAN IPv6 prefix at boot time. Once the lease expires it will never rebind. It just keeps trying to infinity. I'd say this is definitely a Show-Stopper bug.

johnpoz · Apr 12, 2013, 1:17 PM

Yup seems I lost my IPs as well…

So I have updated to

2.1-BETA1 (i386)
built on Fri Apr 12 04:55:08 EDT 2013
FreeBSD 8.3-RELEASE-p7

Still not working, so turned off ipv6 on the wan - then back on. Got my 2001 on my wan, then a bit later new 2601 on my lan - but different subnet. Gawd that sucks - if the /64 handed to me is going to change every time, I will just go back to the tunnel from HE. This never changed.

Also noticed that delete virtual IPs is still not working as well. Since the virtual I put on my lan with ::1 as the address vs the mac containing ipv6 it get would not delete. Using IE gives a warning about deleting, you say yes never deletes - firefox no such warning, but might because I popups blocked. But does not delete. So once got new address on lan, I change my virtual to be in that /64 and now I have ipv6 access again. But its a pain, lets see if goes away in 48 hours.

And I looked in the config - only place that address was listed was


	 <virtualip><vip><mode>ipalias</mode>
			<interface>lan</interface>
			 <descr><type>single</type>
			<subnet_bits>64</subnet_bits>
			<subnet>2601:d:xxxx:d7::1</subnet></descr></vip></virtualip>

priller · Apr 12, 2013, 5:19 PM

@johnpoz:

Still not working, so turned off ipv6 on the wan - then back on. Got my 2001 on my wan, then a bit later new 2601 on my lan - but different subnet. Gawd that sucks - if the /64 handed to me is going to change every time, I will just go back to the tunnel from HE. This never changed.

That's what I've ended up doing. HE is solid.

After studying my packet captures, I see two related issues here.

When it's time to renew, pfs sends a REBIND. The response from the server is a renewal of the same prefix. That's good, unfortunately that is not processed by pfs … that's bad. The result is that the LAN IPv6 address is purged and never returns.
When pfs does an initial SOLICIT. You get a response from two Comcast DHCP servers, each with a different prefix. One is the what you had before (as long as you are within the lease window) the other is a new one. If pfs remembered it's last prefix, it should just rebind on a matching response. However, it does not. The end result is that your LAN prefix can keep changing each time you reset/reboot. Again, that is in the bad category.

shavenne · Apr 26, 2013, 7:59 AM

Any fix available yet? ???
My ISP (Deutsche Telekom) gives me an IPv6 address (dual stack) since I switched to IPTV. It comes via DHCP6, but it's not static (it changes everytime I reboot or go offline+online).
LAN is set to Track Interface.
When I reboot, WAN is getting the IPv6 IP, LAN is also getting another IPv6 IP, but radvd doesn't seem to work. When I go to Services and restart radvd my clients are also getting IPv6 IPs and it works perfect. But after about 10 or 20 minutes radvd kills itself and disappeares in the Services menu and the LAN interface doesn't have it's IPv6 address anymore.

Apr 25 19:18:10 radvd[58188]: version 1.9.1 started
Apr 25 19:18:41 radvd[58287]: attempting to reread config file
Apr 25 19:18:41 radvd[58287]: resuming normal operation
Apr 25 19:29:22 radvd[58287]: sendmsg: Can't assign requested address
Apr 25 19:29:23 radvd[58287]: attempting to reread config file
Apr 25 19:29:23 radvd[58287]: syntax error in /var/etc/radvd.conf, line 44:
Apr 25 19:29:23 radvd[58287]: error parsing or activating the config file: /var/etc/radvd.conf
Apr 25 19:44:31 radvd[30802]: version 1.9.1 started
Apr 25 19:44:31 radvd[30802]: syntax error in /var/etc/radvd.conf, line 2:
Apr 25 19:44:31 radvd[30802]: error parsing or activating the config file: /var/etc/radvd.conf
Apr 25 19:44:31 radvd[30802]: Exiting, failed to read config file.

Any suggestions? :-[
It's unusable for me at the moment.

mokuso · Apr 30, 2013, 4:07 PM

The reason the /64 allocation changes is that the /var/db/dhcp6c_duid file does not persist on reboot. Each reboot this file is recreated and a new DUID is assigned.

It would be nice to have the option to retain this file.

MaxPF · May 23, 2013, 3:54 PM

Any updates on this one?

johnpoz · May 23, 2013, 4:06 PM

I still don't see it working.. Im on

2.1-BETA1 (i386)
built on Tue May 21 20:50:09 EDT 2013
FreeBSD 8.3-RELEASE-p8

And when I updated to it the other day I tried to get it working again.. It look like it took it for a second, I saw an IPv6 in inf status, then next thing it was gone.

Now I know they just added the RC tag - so I might update tonight again, but something is still not right with this.

priller · May 23, 2013, 4:33 PM

Here's the bug for the IPv6 addressing being lost: http://redmine.pfsense.org/issues/2919

I would definitely consider this a Show Stopper bug. The ability to acquire and maintain addressing is a basic function, without that nothing else matters. I was surprised to see the change to RC status, with issues like this remaining.

MaxPF · May 23, 2013, 5:02 PM

@priller:

Here's the bug for the IPv6 addressing being lost: http://redmine.pfsense.org/issues/2919

I would definitely consider this a Show Stopper bug. The ability to acquire and maintain addressing is a basic function, without that nothing else matters. I was surprised to see the change to RC status, with issues like this remaining.

That was exactly what I thought. When I read about the RC status I went back looking for this hoping that I missed the update. Considering that the main feature of 2.1 is IPV6 support, this is pretty major, together with the broken 6RD support.

emue · May 25, 2013, 7:13 AM

Yes, this really is a critical issue. DHCPv6-PD looks to become one of the most common, if not the most common native IPv6 deployment method for home users and small businesses.

Here in Germany for example the largest ISP (Deutsche Telekom) has silently started its IPv6 rollout for end users. Millions of connections will be migrated to dual stack using DHCPv6-PD over PPPoE in the next few years.

I don't think pfsense can really claim to support IPv6 until this is working properly.

BrianPlencner · May 26, 2013, 12:07 AM

I want to echo what others have said about the broken state of IPv6 in the 2.1 beta's of pfSense.

For reference, this is the version that I am currently running: 2.1-BETA1 Built On: Thu May 9 07:05:02 EDT 2013.

When I first installed that version, I was able to fully get IPv6 to work with my ISP, which is Comcast. It worked fine for 4 days, and then just stopped working.

After 4 days, which I believe is the dhcp server's lease period for IPv6, I noticed the following things

"radvd" service is now MIA from the list.
WAN interface no longer shows anything to do with IPv6 (except the IPv6 Link Local and Gateway IPv6)
IPv6 Test sites fail with 0/10
Comcast's IPv6 Speedtest site fails to load

If I shutdown my pfSense box, as well as my modem, and then power both back up, IPv6 will then work for another 4 days, and then stop working again.

I would strongly encourage those who work on pfSense to get this resolved before moving from Beta to RC status on this project. If this is not fixed, I envision a lot of unhappy customers.

If there is anything I can to do help resolve this issue, please let me know. I can post logs, screen shots, or whatever other information may be needed by the developers at pfSense that may be helpful to resolve this.

–Brian

wallabybob · May 26, 2013, 4:43 AM

@BrianPlencner:

If there is anything I can to do help resolve this issue, please let me know. I can post logs, screen shots, or whatever other information may be needed by the developers at pfSense that may be helpful to resolve this.

Please post any reports from the system log (displayed by pfSense shell command```
clog /var/log/system.log


Any reports from radvd (output from pfSense shell command```
clog /var/log/system.log | grep radvd
```) might also be useful.

priller · May 26, 2013, 12:51 PM

There is a wealth of information, logs and other, included in this thread and attached to the bug.

If one of the devs wants to PM me, I can provide the full packet capture that is shown in my post here:
http://forum.pfsense.org/index.php/topic,59996.msg329002.html#msg329002

The bug notes also further details the exact behavior that is show in the packet capture. He it is again:

The WAN DHCP IPv6 address and LAN DHCP-PD lease time from the provider is 4 days. When the lease expires, pfSense goes through the following sequence, but never rebinds the IPv6 addressing. The result is WAN and LAN IPV6 addresses is lost and never recovers.

Initially, a DHCPv6 SOLICIT is sent. The DHCPv6 server replies with the expected addressing to be renewed.
Five seconds later, a DHCPv6 REBIND is sent. There is never a RENEW, it immediately goes to REBIND. Again, the DHCPv6 server replies with the expected addressing to be renewed.
Now pfSense keeps sending DHCPv6 SOLICITs. The DHCPv6 server is responding, but pfSense never binds.

This just continues until pfSense is rebooted.

–-

I was initially wondering if this problem was isolated to Comcast users. However, users on other providers are now reporting the same behavior.

FWIW, On the Comcast forums, m0n0wall users report no problems. Maybe somebody could ask their old buddies how they have implemented DHCP-PD client.