Please Help with DHCP6C on native /56
-
Hi Alphaz,
Does your WAN connection happen to be IPoE and not PPPoE?
We've encountered a similar problem. pfsense is waiting on the ISP's BNG to send an RA before it'll trigger the dhcp6client, however the ISP's BNG is waiting on the router to send a DHCPv6 SOLICIT before it authenticates the customer and allows the router on to the network. Hence, a stalemate.I've raised a bug in redmine with basically exactly the above in the ticket:
https://redmine.pfsense.org/issues/5993 -
I went through same issues like alphaz yesterday with my provider. I'm on bonded DSL line and was pulling my hair after configuring and re-configuring same things over and over again. Everything looked correct (with exact same settings like alphaz), and I would still not get IPv6 address assigned to my LAN. Then occurred to me to check if dhcp6c is running, and, of course, it was not. The moment I started it manually I got IPv6 address.
Problem is, after every change, and on every reboot I would have to restart it myself. So, what piece of pfSense is supposed to take care of that?
-
Evaluate this: https://forum.pfsense.org/index.php?topic=101967.msg601280#msg601280
-
@hda:
https://forum.pfsense.org/index.php?topic=101967.msg601280#msg601280
That doesn't fix the problem I described above.
Problem is, after every change, and on every reboot I would have to restart it myself. So, what piece of pfSense is supposed to take care of that?
Try this patch to /etc/inc/interfaces.inc https://drive.google.com/open?id=0B4TgGdFbcHgZQmcyZVJUb3NPU0U
It just calls dhcp6c prior to rtsold. The overall rtsold/dhcp6c logic could do with a bit of a rethink.
-
@det:
Problem is, after every change, and on every reboot I would have to restart it myself. So, what piece of pfSense is supposed to take care of that?
Try this patch to /etc/inc/interfaces.inc https://drive.google.com/open?id=0B4TgGdFbcHgZQmcyZVJUb3NPU0U
It just calls dhcp6c prior to rtsold. The overall rtsold/dhcp6c logic could do with a bit of a rethink.
Is that patch for pfSense v2.2.6? It wants to modify the following code…
function interface_group_add_member($interface, $groupname) { $interface = get_real_interface($interface); if (does_interface_exist($interface)) mwexec("/sbin/ifconfig {$interface} group " . escapeshellarg($groupname), true); }…right before if statement. Is that correct?
-
Is that patch for pfSense v2.2.6? It wants to modify the following code…
Ahh sorry no, I was basing this on the daily snapshots.
The patch needs to be inserted above the mwexec() for rtsold around here: https://github.com/pfsense/pfsense/blob/master/src/etc/inc/interfaces.inc#L4010However it's probably best inserted after the enabling of accept_rtadv a couple of lines down.
-
Before blindly changing that script I looked around that area. Your patch is identical to last two lines of the generated script /var/etc/rtsold_XXX_script.sh. here is the whole block of interest
$rtsoldscript = "#!/bin/sh\n"; $rtsoldscript .= "# This shell script launches dhcp6c and configured gateways for this interface.\n"; $rtsoldscript .= "echo $2 > {$g['tmp_path']}/{$wanif}_routerv6\n"; $rtsoldscript .= "echo $2 > {$g['tmp_path']}/{$wanif}_defaultgwv6\n"; $rtsoldscript .= "/usr/bin/logger -t rtsold \"Recieved RA specifying route \$2 for interface {$interface}({$wanif})\"\n"; $rtsoldscript .= "if [ -f {$g['varrun_path']}/dhcp6c_{$wanif}.pid ]; then\n"; $rtsoldscript .= "\t/bin/pkill -F {$g['varrun_path']}/dhcp6c_{$wanif}.pid\n"; $rtsoldscript .= "\t/bin/sleep 1\n"; $rtsoldscript .= "fi\n"; $rtsoldscript .= "/usr/local/sbin/dhcp6c -d -c {$g['varetc_path']}/dhcp6c_{$interface}.conf -p {$g['varrun_path']}/dhcp6c_{$wanif}.pid {$wanif}\n"; $rtsoldscript .= "/usr/bin/logger -t rtsold \"Starting dhcp6 client for interface {$interface}({$wanif})\"\n"; /* Add wide-dhcp6c shell script here. Because we can not pass a argument to it. */ if (!@file_put_contents("{$g['varetc_path']}/rtsold_{$wanif}_script.sh", $rtsoldscript)) { printf("Error: cannot open rtsold_{$interface}_script.sh in interface_dhcpv6_configure() for writing.\n"); unset($rtsoldscript); return 1; } unset($rtsoldscript); @chmod("{$g['varetc_path']}/rtsold_{$wanif}_script.sh", 0755); /* accept router advertisements for this interface */ set_single_sysctl("net.inet6.ip6.accept_rtadv", "1"); log_error("Accept router advertisements on interface {$wanif} "); mwexec("/sbin/ifconfig {$wanif} inet6 accept_rtadv"); /* fire up rtsold for IPv6 RAs first, this backgrounds immediately. It will call dhcp6c */ if (isvalidpid("{$g['varrun_path']}/rtsold_{$wanif}.pid")) { killbypid("{$g['varrun_path']}/rtsold_{$wanif}.pid"); sleep(2); } mwexec("/usr/sbin/rtsold -1 -p {$g['varrun_path']}/rtsold_{$wanif}.pid -O {$g['varetc_path']}/rtsold_{$wanif}_script.sh {$wanif}");Now, if they are identical, question is why are the not doing what they are supposed to do? Adding them again, as patched, should not make difference. Unless there's problem in generated rtsold script. That made me look in my boot log and I've found these 3 lines
radvd[58467]: Exiting, failed to read config file. radvd[58467]: error parsing or activating the config file: /var/etc/radvd.conf radvd[58467]: syntax error in /var/etc/radvd.conf, line 11: /So, there's an error in that file and it's this
# Automatically Generated, do not edit # Generated for DHCPv6 Server wan interface hn0 { AdvSendAdvert on; MinRtrAdvInterval 5; MaxRtrAdvInterval 20; AdvLinkMTU 1500; AdvDefaultPreference low; AdvManagedFlag on; AdvOtherConfigFlag on; prefix / { DeprecatePrefix on; AdvOnLink on; AdvAutonomous on; AdvRouterAddr on; }; route ::/0 { RemoveRoute on; }; DNSSL home { }; }; # Generated config for dhcp6 delegation from wan on lan interface hn1 { AdvSendAdvert on; MinRtrAdvInterval 3; MaxRtrAdvInterval 10; AdvLinkMTU 1500; AdvOtherConfigFlag on; prefix ::/64 { AdvOnLink on; AdvAutonomous on; AdvRouterAddr on; }; DNSSL home { }; };That prefix / line looks suspicious. It has no prefix and no length. Can anyone tell where are they suppose to come from?
-
How is your hn0 interface configured? That "prefix /" line looks to be impossible to obtain on stock source (granted I'm looking at 2.3 here, but don't think that specific area has changed). The variables that fill there are checked with is_ipaddrv6 earlier in that code block and it skips if that's false.
-
This is my WAN config:
-
Before blindly changing that script I looked around that area. Your patch is identical to last two lines of the generated script /var/etc/rtsold_XXX_script.sh. here is the whole block of interest
That's good, you should definitely have a look at the patch to understand what it's doing.
However, the key point that you're missing is that we've moved the launching of dhcp6c outside of the rtsold function.
rtsold is the "Router Solicitation Daemon" (why it's userland in FreeBSD is beyond me, but seems silly). Anywho, please see my post here for the explanation of why I added this additional call to dhcp6c before rtsold: https://forum.pfsense.org/index.php?topic=102008.msg603091#msg603091Now, if they are identical, question is why are the not doing what they are supposed to do? Adding them again, as patched, should not make difference. Unless there's problem in generated rtsold script. That made me look in my boot log and I've found these 3 lines
radvd[58467]: Exiting, failed to read config file. radvd[58467]: error parsing or activating the config file: /var/etc/radvd.conf radvd[58467]: syntax error in /var/etc/radvd.conf, line 11: /So, there's an error in that file and it's this
# Automatically Generated, do not edit # Generated for DHCPv6 Server wan interface hn0 { AdvSendAdvert on; MinRtrAdvInterval 5; MaxRtrAdvInterval 20; AdvLinkMTU 1500; AdvDefaultPreference low; AdvManagedFlag on; AdvOtherConfigFlag on; prefix / { DeprecatePrefix on; AdvOnLink on; AdvAutonomous on; AdvRouterAddr on; }; route ::/0 { RemoveRoute on; }; DNSSL home { }; }; # Generated config for dhcp6 delegation from wan on lan interface hn1 { AdvSendAdvert on; MinRtrAdvInterval 3; MaxRtrAdvInterval 10; AdvLinkMTU 1500; AdvOtherConfigFlag on; prefix ::/64 { AdvOnLink on; AdvAutonomous on; AdvRouterAddr on; }; DNSSL home { }; };That prefix / line looks suspicious. It has no prefix and no length. Can anyone tell where are they suppose to come from?
Yup, that syntax looks odd. That section usually looks like "prefix ::/64" which will just start advertising RAs with whatever /64 has been assigned to that interface from the PD that that interface is "tracking".
However it's probably only throwing errors because you don't have an IA-PD delegated, and it hasn't had an IP assigned to that interface. So it's more of a symptom than a cause. -
This is my WAN config:
So hn0 is your WAN? What do you have configured under Services>DHCPv6/RA for WAN?
-
Yes, hn0 is my WAN.
As for DHCPv6/RA, this is what web page says
Services: DHCPv6 server
The DHCPv6 Server can only be enabled on interfaces configured with a static IPv6 address. This system has none.
I went and enables static IPv6 for WAN, then came back to DHCPv6 server page and everything was empty. Saved it anyways, re-enabled DHCPv6 for WAN, and error is gone. I checked /var/etc/radvd.conf file again, and that whole first configuration section is gone for interface hn0. Only part for hn0 (LAN) is there. I'm not sure if that's good or bad, as I said, but error is gone from log.
-
@det:
That's good, you should definitely have a look at the patch to understand what it's doing.
However, the key point that you're missing is that we've moved the launching of dhcp6c outside of the rtsold function.
rtsold is the "Router Solicitation Daemon" (why it's userland in FreeBSD is beyond me, but seems silly). Anywho, please see my post here for the explanation of why I added this additional call to dhcp6c before rtsold: https://forum.pfsense.org/index.php?topic=102008.msg603091#msg603091That patch did it. pfSense now picks up IPv6 after reboot and my LAN gets assigned public IPv6 addresses. Thanks.
-
That patch did it. pfSense now picks up IPv6 after reboot and my LAN gets assigned public IPv6 addresses. Thanks.
Excellent, that's good to hear.
It's by no means perfect. rtsold will superfluously restart dhcp6c after you've already got a PD, but that shouldn't be too noticeable. At least it triggers authentication with the ISP and lets you on the network.One thing, can you check your logs for any XID session mismatch/errors? I don't think we'd be introducing any duplicate instances of dhcp6c by doing this, but just want to make sure.
-
This is my WAN config:
Try this: Use Interfaces-WAN with DHCP6 and DHCP6c conf:
Check, Only request an IPv6 prefix, do not request an IPv6 address
DHCPv6 Prefix Delegation size == 56
Check, Send an IPv6 prefix hint to indicate the desired prefix size for delegation& check: Advanced config, it is no more than:
(send options(ia-pd 0) and Prefix delegation = checked only).Then create Static LAN's config's i.s.o. Track Interface…
-
Yes, hn0 is my WAN.
…re-enabled DHCPv6 for WAN...
Only part for hn0 (LAN) is there...
Makes no sense. DHCPv6/RA is about your LAN's.
-
-
@det:
One thing, can you check your logs for any XID session mismatch/errors? I don't think we'd be introducing any duplicate instances of dhcp6c by doing this, but just want to make sure.
Yes, there are four of them in the log after reboot. Here is pertinent part of the log (public IP addresses are mangled), if that helps
dhcp6c[14001]: script "/var/etc/dhcp6c_wan_script.sh" terminated
dhcp6c[14001]: removing an event on hn0, state=REQUEST
dhcp6c[14001]: removing server (ID: 00:03:00:02:c0:d4:12:14:18:11)
dhcp6c[14001]: got an expected reply, sleeping.
dhcp6c[14001]: release an IA: PD-0
dhcp6c[14001]: reset a timer on hn0, state=RELEASE, timeo=0, retrans=991
dhcp6c[14001]: a new XID (acf098) is generated
dhcp6c[14001]: set client ID (len 14)
dhcp6c[14001]: set server ID (len 10)
dhcp6c[14001]: set elapsed time (len 2)
dhcp6c[14001]: set IA_PD prefix
dhcp6c[14001]: set IA_PD
dhcp6c[14001]: send release to ff02::1:2%hn0
dhcp6c[14001]: remove an IA: PD-0
dhcp6c[14001]: remove a site prefix 2001:fff:ffff:ca00::/56
dhcp6c[14001]: remove an address 2001:fff:ffff:ca99:215:5dff:fe63:cc03/64 on hn1
dhcp6c[14001]: reset a timer on hn0, state=INIT, timeo=0, retrans=793
dhcp6c[14001]: removing an event on hn0, state=INIT
dhcp6c[14001]: receive advertise from fe80::ea4:2ff:fe94:7801%hn0 on hn0
dhcp6c[14001]: get DHCP option server ID, len 10
dhcp6c[14001]: DUID: 00:03:00:02:c0:d4:12:14:18:11
dhcp6c[14001]: get DHCP option client ID, len 14
dhcp6c[14001]: DUID: 00:01:00:01:1e:3d:d6:32:01:18:5a:73:dc:02
dhcp6c[14001]: get DHCP option IA_PD, len 41
dhcp6c[14001]: IA_PD: ID=0, T1=86400, T2=144000
dhcp6c[14001]: get DHCP option IA_PD prefix, len 25
dhcp6c[14001]: IA_PD prefix: 2001:fff:ffff:ca00::/56 pltime=172800 vltime=345600
dhcp6c[14001]: get DHCP option DNS, len 32
dhcp6c[14001]: XID mismatch
dhcp6c[14001]: receive advertise from fe80::ea4:2ff:fe94:7801%hn0 on hn0
dhcp6c[14001]: get DHCP option server ID, len 10
dhcp6c[14001]: DUID: 00:03:00:02:c0:d4:12:14:18:11
dhcp6c[14001]: get DHCP option client ID, len 14
dhcp6c[14001]: DUID: 00:01:00:01:1e:3d:d6:32:01:18:5a:73:dc:02
dhcp6c[14001]: get DHCP option IA_PD, len 41
dhcp6c[14001]: IA_PD: ID=0, T1=86400, T2=144000
dhcp6c[14001]: get DHCP option IA_PD prefix, len 25
dhcp6c[14001]: IA_PD prefix: 2001:fff:ffff:ca00::/56 pltime=172800 vltime=345600
dhcp6c[14001]: get DHCP option DNS, len 32
dhcp6c[14001]: XID mismatch
dhcp6c[14001]: receive advertise from fe80::ea4:2ff:fe94:7801%hn0 on hn0
dhcp6c[14001]: get DHCP option server ID, len 10
dhcp6c[14001]: DUID: 00:03:00:02:c0:d4:12:14:18:11
dhcp6c[14001]: get DHCP option client ID, len 14
dhcp6c[14001]: DUID: 00:01:00:01:1e:3d:d6:32:01:18:5a:73:dc:02
dhcp6c[14001]: get DHCP option IA_PD, len 41
dhcp6c[14001]: IA_PD: ID=0, T1=86400, T2=144000
dhcp6c[14001]: get DHCP option IA_PD prefix, len 25
dhcp6c[14001]: IA_PD prefix: 2001:fff:ffff:ca00::/56 pltime=172800 vltime=345600
dhcp6c[14001]: get DHCP option DNS, len 32
dhcp6c[14001]: XID mismatch
dhcp6c[14001]: receive advertise from fe80::ea4:2ff:fe94:7801%hn0 on hn0
dhcp6c[14001]: get DHCP option server ID, len 10
dhcp6c[14001]: DUID: 00:03:00:02:c0:d4:12:14:18:11
dhcp6c[14001]: get DHCP option client ID, len 14
dhcp6c[14001]: DUID: 00:01:00:01:1e:3d:d6:32:01:18:5a:73:dc:02
dhcp6c[14001]: get DHCP option IA_PD, len 41
dhcp6c[14001]: IA_PD: ID=0, T1=86400, T2=144000
dhcp6c[14001]: get DHCP option IA_PD prefix, len 25
dhcp6c[14001]: IA_PD prefix: 2001:fff:ffff:ca00::/56 pltime=172800 vltime=345600
dhcp6c[14001]: get DHCP option DNS, len 32
dhcp6c[14001]: XID mismatch
dhcp6c[14001]: receive reply from fe80::ea4:2ff:fe94:7801%hn0 on hn0
dhcp6c[14001]: get DHCP option server ID, len 10
dhcp6c[14001]: DUID: 00:03:00:02:c0:d4:12:14:18:11
dhcp6c[14001]: get DHCP option client ID, len 14
dhcp6c[14001]: DUID: 00:01:00:01:1e:3d:d6:32:01:18:5a:73:dc:02
dhcp6c[14001]: get DHCP option IA_PD, len 49
dhcp6c[14001]: IA_PD: ID=0, T1=0, T2=0
dhcp6c[14001]: get DHCP option status code, len 33
dhcp6c[14001]: status code: success
dhcp6c[14001]: executes /var/etc/dhcp6c_wan_script.sh
php-fpm[277]: /rc.newwanipv6: rc.newwanipv6: Info: starting on hn0.
php-fpm[277]: /rc.newwanipv6: rc.newwanipv6: on (IP address: fe80::215:5dff:fe63:cc02) (interface: wan) (real interface: hn0).
unbound: [69580:0] info: service stopped (unbound 1.5.4).
unbound: [69580:0] info: server stats for thread 0: 7 queries, 2 answers from cache, 5 recursions, 0 prefetch
unbound: [69580:0] info: server stats for thread 0: requestlist max 17 avg 8 exceeded 0 jostled 0
unbound: [69580:0] info: average recursion processing time 0.771420 sec
unbound: [69580:0] info: histogram of recursion processing times
unbound: [69580:0] info: [25%]=0 median[50%]=0 [75%]=0
unbound: [69580:0] info: lower(secs) upper(secs) recursions
unbound: [69580:0] info: 0.524288 1.000000 2
unbound: [4200:0] notice: init module 0: validator
unbound: [4200:0] notice: init module 1: iterator
dhcpleases: Sending HUP signal to dns daemon(4200)
unbound: [4200:0] info: start of service (unbound 1.5.4).
unbound: [4200:0] info: service stopped (unbound 1.5.4).
unbound: [4200:0] info: server stats for thread 0: 0 queries, 0 answers from cache, 0 recursions, 0 prefetch
unbound: [4200:0] info: server stats for thread 0: requestlist max 0 avg 0 exceeded 0 jostled 0
unbound: [4200:0] notice: Restart of unbound 1.5.4.
unbound: [4200:0] notice: init module 0: validator
unbound: [4200:0] notice: init module 1: iterator
unbound: [4200:0] info: start of service (unbound 1.5.4).
dhcpleases: Sending HUP signal to dns daemon(4200)
unbound: [4200:0] info: service stopped (unbound 1.5.4).
unbound: [4200:0] info: server stats for thread 0: 0 queries, 0 answers from cache, 0 recursions, 0 prefetch
unbound: [4200:0] info: server stats for thread 0: requestlist max 0 avg 0 exceeded 0 jostled 0
unbound: [4200:0] notice: Restart of unbound 1.5.4.
unbound: [4200:0] notice: init module 0: validator
unbound: [4200:0] notice: init module 1: iterator
unbound: [4200:0] info: start of service (unbound 1.5.4).
radvd[35097]: attempting to reread config file
radvd[35097]: no auto-selected prefix on interface hn1, disabling advertisements
radvd[35097]: sendmsg: Can't assign requested address
radvd[35097]: resuming normal operation
php-fpm[277]: /rc.newwanipv6: ROUTING: setting default route to d99-99-9-9.xxxx.xxxxx.xxx
php-fpm[277]: /rc.newwanipv6: ROUTING: setting IPv6 default route to fe80::ea4:2ff:fe94:7801%hn0
apinger: SIGHUP received, reloading configuration.
dhcp6c[14001]: script "/var/etc/dhcp6c_wan_script.sh" terminated
dhcp6c[14001]: removing an event on hn0, state=RELEASE
dhcp6c[14001]: exiting -
If you want to switch to 2.3RC there are a couple of patches available that will fix the issue with the XID's too. I'm keeping the patches reasonably up to date. If you do update and find the patches don't apply then pm me and I'll update them for you, otherwise a full fix for this is slated for 2.3.1
The patches can be found here, always take the last ones in the attached files, there are two you'll need, interfaces.inc and interfaces.php.
-
cool, i'm glad people are having the same issue as me… I kinda forgot about the issue or that I even created this topic a while back.. until I rebooted my router to upgrade it to 2.3, :\ couldn't remember what was wrong, until I found my own thread haha!
But apparently its still a problem in 2.3 , is there a patch now? or whats the status?
Thanks