Disabling IPv6 on LAN leaves client with IPv6 DNS entry
-
I have a Windows 8 client on the LAN side of my pfSense box. I have IPv6 enabled and working. When I disable IPv6 on the LAN interface within pfSense, I am left with the IPv6 DNS entry on my Windows client. It will not go away. It is the former IPv6 lan address of the pfSense box which was provided to the client by DHCP. Shouldn't pfsense clear this when IPv6 is taken down?
Does anyone know how to manually remove this from Windows? It is incredibly persistent.
-
=> https://social.technet.microsoft.com/Forums/
-
"IPv6 lan address of the pfSense box which was provided to the client by DHCP"
You sure its not finding it via NDP? Pretty sure windows has stateless auto on out of the box.. You can turn it off via netsh
netsh interface ipv6 set interface "Local Area Connection" routerdiscovery=disabled
IPv6 is a completely different beast ;) Even though you disable the dhcpv6 server, did you turn of RA in pfsense?
-
Yes, the rest of the IP6 configuration is stateless, but not the IPv6 DNS setting. If I run netsh interface ipv6 show dnsservers, I see the entry for a "DNS server configured through DHCP". I assume this is done via DHCPv6 in stateless mode from pfSense.
I am curious, aside from the peculiarities of Windows, how is it supposed to work when the IP6 DNS server either changes or goes away if it was configured by DHCPv6 from pfsense in the first place? Also note I never explicitly configured a DHCPv6 server on pfSense. I am only tracking the WAN interface and letting pfSense do the rest.
-
did you release your lease.. How long is the lease? Can you post an ipconfig /all showing this?
-
Attached is the ipconfig /all output. The lease shown doesn't affect the IPv6 DNS server entry - it is for my IP4 configuration. I can /release, /renew with no effect on the IPv6 DNS entry and use /release6 /renew6 with the message that my adapter is not configured for DHCP (v6 that is).
I also tried disabling/re-enabling IPv6, rebooting, etc and cannot get rid of the DNS entry.
-
and what does you ipv6 config look like in your settings..
when you click into it clearly its still enabled if you show a ipv6 link local address. Thought you said you disabled it?
See how when I uncheck it there is no linklocal address or any ipv6 at all.
-
It is all set to obtain automatically - both dns and address for IP6. I can disable IP6 on Windows altogether and see the link local go away along with the DNS entry but the goal is not to disable it on every client, I want to disable it on the firewall and expect the automatic settings on the clients to adjust accordingly. If I re-enable IP6 on Windows, the DNS entry is still there even though I expect the pfSense is not sending it anymore.
So I kept trying more aggressive things within Windows to get rid of it and somewhere along these steps I was able to see it disappear. I ran "netsh winsock reset catalog" and "netsh int ip reset", rebooted, tried "ipconfig /release6". No good. Did all that again with another reboot and at the end it was gone.
Is this more a problem with Windows in how aggressive it is in keeping the setting around or in how pfSense sets it in the first place?
-
So let me guess you still have all the teredo and 6to4 and isatap stuff on all your clients as well.
If you want a simple solution, just push out group policy to disable ipv6 completely..
If your going to run ipv6, then time an planning needs to be put into place to correctly do it. If your not going to run ipv6 on your network than you should take the steps needed to correctly turn it off on the clients.
I don't really understand the logic here.. And again did you turn off RA?
-
My concern is what expectation I should have around how automatic the automatic IP6 configuration should be for all components involved in the network. My WAN is all DHCP and the internal networks track the WAN interface. If I turn off the IP6 tracking on the internal networks, should I reasonably expect the clients to continue on with a good network configuration? My assumption is I should but it sounds like that is faulty. And, to a large extent it does work - the RA message stop and my clients stop using the valid IP6 prefix and routing. It's just the DNS server that stays around which doesn't exactly break anything but it just causes delays in DNS resolution and seems like it should have gone away like everything else.
I haven't touched any of the RA configuration. The RA settings are not exposed because I'm not running static IP6 or a DHCPv6 server. Any RA messages are happening as a result of my internal network set to track WAN for IP6. I expect if I turn that off, the RA messages stop.
-
As noted above. Either disable it altogether on the clients, or stop pretending that IPv6 does not exist.
-
Again if your not going to be using it then why do you have your wan even getting an IP and why would you be tracking on the lan?
Either turn it off at the router and the clients, or take the time to set it up correctly would be my advice.
-
I understand. It's only a concern moving between networks that have IPv6 and those that do not. My motivation behind all of this is when I introduced a new backup WAN that is IPv4 only. Instead of disabling IPv6 altogether, I thought I could easily toggle it on and off so I could force all clients to IPv4 automatically when only my IPv4 WAN is available. I think the best approach is to forget about it until I can support it everywhere.
