Unique Local Addresses?
-
So I am still confused as to what is not working, or then trying to create some alias that has both your Global address that you got via a TRACK interface network? And this is changing on you?? Are you saying you can not create a alias with your IPv6 global address and your ULA..
Once again. I can set up ULA with RA, no problem, but the pfSense LAN interface doesn't get an IPv6 address. When I create an alias on the pfSense LAN port, for the ULA, I cannot even ping it. It simply doesn't respond. Worse, when I reboot the firewall, I lose the GUA address on the WAN port. Up the thread, someone else posted some links that showed problems with alias addresses on pfSense.
So, what I'm trying to do is
a) create the ULA with RA - this works
b) get a working ULA address on the LAN interface. This doesn't work.Can you ping from a device on a ULA only to the firewall? And to the VPN?
I spent all yesterday afternoon, trying to just be able to ping a ULA address on the pfSense LAN interface, without success. This is decribed further up the list.
However, I'll try again and see what happens.
-
I just tried it and the same thing happens. I cannot even ping the firewall ULA and after rebooting it, I lose IPv6 to my network. PfSense is busted!!!
-
One thing I just thought of. It may not be necessary for pfSense to have a ULA to route from the ULA prefix. Routing is still done via the link local address. I'll have to see if I can figure out some way to test this. I may have to dust off my Cisco 2600 router.
-
" just tried it and the same thing happens. I cannot even ping the firewall ULA and after rebooting it, I lose IPv6 to my network. PfSense is busted!!!"
Maybe your pfsense is busted.. But this is not the case with mine.. Add ULA address as VIP.. Works as it should - can ping it to that address (if firewall rules allow it) and routes just fine..
What your saying makes ZERO sense - how would adding a vip cause such an issue?? Be it a ula or another global, etc..
-
I don't know why it's happening, but it happened twice. Also, as mentioned in other posts, there apparently is a problem. And I created the alias by clicking on Firewall > Virtual IPs.
-
And what did you pick for the type of VIP?
-
-
With pfSense 2.4.0, I can now add a ULA alias on my LAN interface, without losing Internet access. It appears there was a problem with the previous version.
-
^^^^
Looks like I spoke too soon. As before, after a reboot, the problem returns. However, one thing I noticed is the default route on my computer changes, from the main LAN to a VLAN interface on my pfSense router. I'm not sure what causes this, as the VLAN has a different prefix from the ULA on the main LAN.Why would the default route change? I checked the router.priority for each RA and the VLAN is set to low and main LAN set to normal.
-
It's currently working, with the ULA alias. I have no idea why it's working now and not before.
I set the mail RA priority to high, but IP -6 route show shows both the main LAN and VLAN to have medium preference:
default via fe80::1:1 dev eth0 proto ra metric 1024 expires 58sec hoplimit 64 pref medium
default via fe80::216:17ff:fea7:f2d3 dev vlan3 proto ra metric 1024 expires 51sec hoplimit 64 pref mediumShouldn't that reflect the router priority setting, which is high for main LAN and low for VLAN3?
My computer is running OpenSUSE Linux.
-
Once it is added in, you can then setup the prefix in the RA config to advertise each prefix defined on the interface. Note that clients on that L2 will get an address for EACH advertised prefix (if listening to RAs). Keep in mind they will also get more than 1 gateway this way.
Just one correction, It will still be only one Gateway no matter how many prefixes are advertised. You would only get a 2nd Gateway if you had a 2nd box broadcasting RAs. 1 box broadcasting many prefixes = 1 Gateway.
And that gateway is a Link Local address, not a ULA or GUA.
-
^^^^
It shows both gateways, but whatever happens, I lose Internet access. I can ping local addresses, including ULA, so routing still appears to be functioning at least that far, but I cannot get out to the Internet. Also, sometimes it works OK after rebooting, Sometimes it doesn't. I have no idea why it's failing. I agree it shouldn't matter which is default route, as both are to a link local address on the same interface. -
Do you have more then 1 router? If not there should not be more then 1 gateway.
If you only have 1 pfSense router, then you need to find what is advertising itself as a router.
Again 1 router advertising more then 1 prefix will still only advertise 1 gateway.
Edit: i just noticed someing in a prev post. Do you have 2 pfsense interfaces plugged into the same layer2/vlan?
-
There is only 1 router, pfSense. The router has to advertise itself on all interfaces, including VLANs. Regardless, it shouldn't matter, because all RAs point to the same router. I have a main LAN and a VLAN on 1 interface. The main LAN has both global and ULA addresses. The curious thing is that when I configure the pfSense alias for the ULA on the main LAN, everything works fine. But if I then reboot pfSense, it usually, but not always fails.
-
I was and am confused becuase you said that hey you have two gateways which sounded like it was on the same client like your client was seen two different Gateway from pfSense if that's the case that makes no sense and it would lead me to believe that two different vlans are mixed together on the same layer 2/brodcast domain. Unless I'm just misunderstanding what you're saying.
-
I get 2 router advertisements, one on the main LAN and 1 on the VLAN. I don't think I ever said I had 2 gateways. The RAs have to be on every interface, including VLANs, so that every device will receive them. However, that doesn't hurt, as it's still the same gateway, no matter which RA is used. Regardless, just adding ULA alias on the main LAN is what causes the problem I really don't understand why it should. A I mentioned, the problem usally happens after a reboot. Prior to the reboot, everything works fine.
-
Aren't you the one who thinks he can use an unmanaged switch to "isolate" VLANs? Is that the case here?
-
I get 2 router advertisements, one on the main LAN and 1 on the VLAN. I don't think I ever said I had 2 gateways.
Same thing really, you shouldn't be getting 2 different RA's. It should be 1 RA from 1 pfSense interface per VLAN.
Aren't you the one who thinks he can use an unmanaged switch to "isolate" VLANs? Is that the case here?
It does indeed sound like there is 2 pfSense interface on 1 VLAN/Broadcast domain.
-
Aren't you the one who thinks he can use an unmanaged switch to "isolate" VLANs? Is that the case here?
I have never said anything like that. I said unmanaged switches can pass VLAN tagged frames.
-
Are you using an unmanaged switch for the untagged and tagged networks in this case?
