pfsense 2.4.4 Route Lifetime not changable w/O static IPv6
-
@pfadmin said in pfsense 2.4.4 Route Lifetime not changable w/O static IPv6:
Thats it. Should be a normal thing, is'nt it?
No not really... Your trying to use a firewall/router distro as a standalone server - For what point.. If you want 2nd dns fire it up on some min linux distro.. You can then run whatever other services you want on this box.. If you wanted to use it as a downstream router - ok. But pfsense not really meant to be some standalone box to run unbound on ;)
This second pfsense has only 1 interface right? I can try and duplicate what your doing.. But if the pfsense box only has 1 interface it would be considered its wan.. Since it would have a gateway.. Pfsense shouldn't be sending RA into its lan with any sort of prefix on it. Can we see your radvd.conf
-
@johnpoz this point is really good, but I wanted to use the same base, gui and so on. Could be, that this never work, but what else should one do with this weather outside :-)
-
See my edit - does this pfsense only have 1 interface? What is your conf file look like.. Why would radvd even be running?
I will try firing up a pfsense Vm on my lan and see if I can duplicate what your doing as just a stand along box.
I would think there only 1 interface and it would be pfsense WAN.. which would have its IPv6 setup as slaac in your first pfsense lan network.
-
@pfadmin said in pfsense 2.4.4 Route Lifetime not changable w/O static IPv6:
@JKnott I don't turned it on. Why you are thinking this? The error message is confusing because I don't want to turn on any dhcpv6, it comes on the way to the RA GUI I want to reach. Is it a language problem and I discribe it in a stupid way? My problem is clear to me and I'm wondering that nobody see it ;-) I'm sorry, will try to describe the whole thing:
The issue is your plans were not clear to us and based on what you've posted since, it appears you're trying to use the wrong tool for the job. Just because pfSense provides a DNS server, doesn't mean it's the best tool for what you want to do. You'd have to turn off DHCP, DHCPv6, SLAAC, etc.. Perhaps you'd have to set up a fully static config and more. Your job is trying to force a square peg into a round hole, because you're using the wrong tool. Sure, you may be able to use a bigger hammer, but it won't be pretty.
-
/var/etc/radvd.conf
Automatically Generated, do not edit
Generated for DHCPv6 Server lan
interface vtnet0 {
AdvSendAdvert on;
MinRtrAdvInterval 5;
MaxRtrAdvInterval 20;
AdvLinkMTU 1500;
AdvDefaultPreference medium;
AdvManagedFlag on;
AdvOtherConfigFlag on;
prefix 2003:xxxx:xxxx:8c00::/64 {
DeprecatePrefix on;
AdvOnLink on;
AdvAutonomous on;
AdvRouterAddr on;
AdvValidLifetime 86400;
AdvPreferredLifetime 14400;
};
route ::/0 {
AdvRoutePreference medium;
RemoveRoute on;
};
RDNSS 2003:xxxx:xxxx:8c00:1406:ddff:fe6f:464 { };
DNSSL example.lan { }; -
@jknott Thank you for your opinion. If I turn on an other interface so pfsense#2 can work as router/firewall, whats the difference? pfsense#1 has no static IPv6, why can I turn on dhcpv6 on LAN side? Why can I reach the RA GUI? Only difference is the way they get an IPv6, in the end there is a Ipv6 on the interface which could propagate. Ok, if I'm the only one with this usecase nobody would code this and I understand this.
I think the whole world gets static IPv6 and live in peace and harmony but in germany only dynamic IPv6 is for the people. In so much threads this is every time the point things not work. I which I could code myself :-)
Thanks again!
-
If you want to use pfsense as standalone box it would only have 1 interface it would call its wan.. You have it with 2 and just have its wan disable.. So it thinks its router - and then then it would need to run RA, etc. To provide to its clients..
When you install pfsense and only bring up 1 interface it gears itself more as standalone box.. But again its not really a great choice of just running unbound..
-
@johnpoz Its not only running unbound. there is pfblocker, radius, maybe a proxy in future. thats the idea.
And RA should running for advertising the DNS Server at pfsense#2. I think, dhcpv6 should also be running for advertising DNS. Or doesnt like the clients RAs from different servers in the network?
-
Here I fired up pfsense with just WAN in my lan network, using slaac.. So its standalone mode so to speak. As you can see NO radvd even there... no dhcpd or dhcpdv6 etc etc...
If you want to use it as standalone - then there should be only 1 interface - and it will be wan... Then no RA will never be sent at all.. Because its not a router ;)
NO!!! RA should not be running on pfsense #2... Hand out your other dns at your ROUTER running RA..
Which is prob going to be hard to do since you have your 2nd dns running slaac to get its IPv6 address :) Not really a great choice for a server that is going to be running services like proxy, unbound, freerad.. Your going to want said server to have a STATIC IP... Or running dhcpv6 so it can get the same IPv6 address all the time via reservation based upon its duid.
-
Hey thanks for your trying. Static is easy said but hard to do with dynamic IPv6. pfsense#1 could assign a semistatic IPv6 adress, knows the prefix from ISP and I tell the Interface Identifier of pfsense#2 wich is static. There are some threads about it, think fritzbox does it easily. Slaac would give also the same Interface Identifier part and the dynamic prefix is also known - semi static. But no one does this in productiv environment so privat user are a little bit lost.
ULA is a problem [https://forum.netgate.com/topic/130319/ipv6-track-interface-unique-local-virtual-ip-no-go/13](Link Adresse) because I see the same problem like UlfMerbold after reboot.
Anyway, I understand that RA is really not build for advertising a DNS Server by himself. And pfsense is confused if I use it not as gateway.
Thank you all to understand a little bit more whats going on.
-
Then get your own IPv6 space - or just use HE which is STATIC... Problems freaking solved with the nonsense that is floating prefixes that change on whim..
Or for that matter.. .Just don't use it... There is ZERO anything saying you have to use IPv6 on your lan..
-
@pfadmin said in pfsense 2.4.4 Route Lifetime not changable w/O static IPv6:
Anyway, I understand that RA is really not build for advertising a DNS Server by himself.
RDNSS is part of RA, which iss one way DNS addresses are distributed. You can also use DHCPv6. When I look at RAs here, I see RDNSS included, complete with DNS server addresses.
