Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    PFSense Not Working with DHCPV6 or Stateless on tracking interface

    Scheduled Pinned Locked Moved IPv6
    48 Posts 10 Posters 15.0k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • M
      moscato359
      last edited by

      @marjohn56:

      Why would the wan interface address change?

      Comcast claims I have a static ipv6, but I've seen the network ID change.
      Why they change me occassionally, I don't know.
      It's really annoying.

      I don't want to risk a situation where the network ID changes, and then the ipv6 network goes down when I'm not there.

      If I have a tracking interface, with working unmanaged RA, it'll be self healing.

      With tracking interface:
      If the network address changes, then the router advertisement changes, which then the local host ipv6 address changes.

      It's a safety net.

      1 Reply Last reply Reply Quote 0
      • ?
        Guest
        last edited by

        I've never known an ISP to change a static without advising the client first, it would cause absolute havoc.

        It sounds like you have a 'Sticky' static address, which can be made even more sticky by fixing the DUID and IAID, as the IAID does is fixed with pfSense ( at present ) that will not change. I suggest you set your DUID to fix it at its current value. You can also turn on 'Do not send release' which will prevent dhcp6c from sending a release signal, some ISP's will give you a new address/prefix if they get a release signal. However as Comcast say you are on a static  this should not happen either.

        I have a sticky dhcp6 address, through experimentation it's been found that if both the above are carried out, fixing the DUID and never sending a release signal then the prefix never changes, the only side note would be if pfsense went offline for several days, in which case I 'might' get a new prefix.

        1 Reply Last reply Reply Quote 0
        • S
          severach
          last edited by

          @moscato359:

          Comcast claims I have a static ipv6, but I've seen the network ID change.

          Google searches still show that Comcast does not support static ipv6 addressing. My ipv6 address changes every time they put in a new modem. My ipv4 address is unchanged across all the supplied modems.

          Don't expect a static any time soon. The 'static' problem is supposed to be taken care of by DNS when the router and DNS providers get it all working. "Services, DHCPv6 Server & RA, LAN, DHCPv6 Server, Dynamic DNS Display" is the new static in it's early stages.

          I don't want to risk a situation where the network ID changes, and then the ipv6 network goes down when I'm not there.

          If I have a tracking interface, with working unmanaged RA, it'll be self healing.

          No it won't. Try repowering the modem with a switch in between the router and the cable box so the router can't sense link down. The address won't change but connectivity will be lost.

          NATv6 FTW until this problem is fixed.

          1 Reply Last reply Reply Quote 0
          • JKnottJ
            JKnott
            last edited by

            You can also turn on 'Do not send release' which will prevent dhcp6c from sending a release signal, some ISP's will give you a new address/prefix if they get a release signal.

            Where is that setting?  I sometimes get a new prefix and in testing I could see pfSense send a DHCPv6 release after I disconnected and reconnected the WAN Ethernet cable.  My DUID has not changed since last May.  I'm on Rogers.

            PfSense running on Qotom mini PC
            i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
            UniFi AC-Lite access point

            I haven't lost my mind. It's around here...somewhere...

            1 Reply Last reply Reply Quote 0
            • ?
              Guest
              last edited by

              @JKnott:

              You can also turn on 'Do not send release' which will prevent dhcp6c from sending a release signal, some ISP's will give you a new address/prefix if they get a release signal.

              Where is that setting?  I sometimes get a new prefix and in testing I could see pfSense send a DHCPv6 release after I disconnected and reconnected the WAN Ethernet cable.  My DUID has not changed since last May.  I'm on Rogers.

              Interfaces/WAN/DHCP6 Client Configuration - Do not allow PD/Address release.

              DUID hold is in System/Advanced/Networking.

              1 Reply Last reply Reply Quote 0
              • JKnottJ
                JKnott
                last edited by

                I don't see that, even under Advanced Configuration.  I'm running pfSense 2.3.2_1.

                PfSense running on Qotom mini PC
                i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                UniFi AC-Lite access point

                I haven't lost my mind. It's around here...somewhere...

                1 Reply Last reply Reply Quote 0
                • H
                  hda
                  last edited by

                  DHCP6 Client Configuration, 2.4B ;)

                  "Do not allow PD/Address release"
                  "dhcp6c will send a release to the ISP on exit, some ISPs then release the allocated address or prefix. This option prevents that signal ever being sent"

                  1 Reply Last reply Reply Quote 0
                  • ?
                    Guest
                    last edited by

                    @hda:

                    DHCP6 Client Configuration, 2.4B ;)

                    "Do not allow PD/Address release"
                    "dhcp6c will send a release to the ISP on exit, some ISPs then release the allocated address or prefix. This option prevents that signal ever being sent"

                    Did I fail to mention that… Beg pardon  8)

                    1 Reply Last reply Reply Quote 0
                    • JKnottJ
                      JKnott
                      last edited by

                      DHCP6 Client Configuration, 2.4B

                      There's a version 2.4B???

                      I'm supposedly at the latest and I don't see that setting anywhere.

                      PfSense running on Qotom mini PC
                      i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                      UniFi AC-Lite access point

                      I haven't lost my mind. It's around here...somewhere...

                      1 Reply Last reply Reply Quote 0
                      • JKnottJ
                        JKnott
                        last edited by

                        DUID hold is in System/Advanced/Networking.

                        I don't see that one either.  My version of pfSense must have come from a parallel universe or something, as it doesn't appear to have either of those settings.

                        PfSense running on Qotom mini PC
                        i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                        UniFi AC-Lite access point

                        I haven't lost my mind. It's around here...somewhere...

                        1 Reply Last reply Reply Quote 0
                        • MikeV7896M
                          MikeV7896
                          last edited by

                          It's a setting in the pfSense 2.4 beta.

                          The S in IOT stands for Security

                          1 Reply Last reply Reply Quote 0
                          • JKnottJ
                            JKnott
                            last edited by

                            I'll have to watch for that new version.  Any idea when it will be available?

                            PfSense running on Qotom mini PC
                            i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                            UniFi AC-Lite access point

                            I haven't lost my mind. It's around here...somewhere...

                            1 Reply Last reply Reply Quote 0
                            • ?
                              Guest
                              last edited by

                              @JKnott:

                              I'll have to watch for that new version.  Any idea when it will be available?

                              For several months now… Its in beta but its very stable. Either install from clean, my preference, or you can select 2.4 as you should find it in update/update settings.

                              1 Reply Last reply Reply Quote 0
                              • JKnottJ
                                JKnott
                                last edited by

                                You can also turn on 'Do not send release' which will prevent dhcp6c from sending a release signal, some ISP's will give you a new address/prefix if they get a release signal.

                                I've found that in v2.3.3 and have set it.  Hopefully it works, so my prefix won't change simply because I unplugged my Ethernet cable.

                                Incidentally, why did pfSense send a DHCPv6 release when the computers was merely disconnected from the modem & reconnected?  I could see that happening when I monitored the connection with Wireshark.  A release is something that should be specifically requested and not occur for something as trivial as a disconnect/reconnect.

                                PfSense running on Qotom mini PC
                                i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                                UniFi AC-Lite access point

                                I haven't lost my mind. It's around here...somewhere...

                                1 Reply Last reply Reply Quote 0
                                • ?
                                  Guest
                                  last edited by

                                  @JKnott:

                                  You can also turn on 'Do not send release' which will prevent dhcp6c from sending a release signal, some ISP's will give you a new address/prefix if they get a release signal.

                                  I've found that in v2.3.3 and have set it.  Hopefully it works, so my prefix won't change simply because I unplugged my Ethernet cable.

                                  Incidentally, why did pfSense send a DHCPv6 release when the computers was merely disconnected from the modem & reconnected?  I could see that happening when I monitored the connection with Wireshark.  A release is something that should be specifically requested and not occur for something as trivial as a disconnect/reconnect.

                                  Because dhcp6c exits and on exit it sends a release, hence the addition of the no-release flag and an updated dhcp6c client.

                                  1 Reply Last reply Reply Quote 0
                                  • JKnottJ
                                    JKnott
                                    last edited by

                                    The question is why it sends the release by default.  With IPv4 DHCP, a device normally requests the same address on re-connection and gets it if available.  You have to specifically request a release.  Why shouldn't it be the same with IPv6?

                                    PfSense running on Qotom mini PC
                                    i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                                    UniFi AC-Lite access point

                                    I haven't lost my mind. It's around here...somewhere...

                                    1 Reply Last reply Reply Quote 0
                                    • ?
                                      Guest
                                      last edited by

                                      @JKnott:

                                      The question is why it sends the release by default.  With IPv4 DHCP, a device normally requests the same address on re-connection and gets it if available.  You have to specifically request a release.  Why shouldn't it be the same with IPv6?

                                      Because it's a totally different client and bears little resemblance to its v4 counterpart.

                                      1 Reply Last reply Reply Quote 0
                                      • JKnottJ
                                        JKnott
                                        last edited by

                                        DHCPv6 has something called "DUID" the purpose of which is to identify the client so it get the same prefix.  Having the default release means that no longer works.  With IPv4, a changed address could affect a single device, but on IPv6 at least a /64, but often more, affecting potentially gazillions of addresses.  When the prefix changed, I had to go and update all the DNS entries for devices on my network, even if I did nothing more than connect in a managed switch, so that I could monitor the traffic with Wireshark.  I don't think the release should be happening, unless specifically requested, as happens with IPv4.

                                        PfSense running on Qotom mini PC
                                        i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                                        UniFi AC-Lite access point

                                        I haven't lost my mind. It's around here...somewhere...

                                        1 Reply Last reply Reply Quote 0
                                        • ?
                                          Guest
                                          last edited by

                                          That's why it's been modified along with the DUID stored in the config.

                                          1 Reply Last reply Reply Quote 0
                                          • JKnottJ
                                            JKnott
                                            last edited by

                                            I've found that in v2.3.3 and have set it.  Hopefully it works, so my prefix won't change simply because I unplugged my Ethernet cable.

                                            It appears to work.  I have disconnected/reconnected the WAN cable several times since yesterday.  My prefix stays the same and I'm not seeing any DHCPv6 release.

                                            PfSense running on Qotom mini PC
                                            i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                                            UniFi AC-Lite access point

                                            I haven't lost my mind. It's around here...somewhere...

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.