IPv6 ULA Router Advertisement not working on GUESTS interface with VLAN
-
Hi all,
we run pfSense (version 2.4.3-RELEASE-p1) on a Netgate XG-7100. On one switch port we have the uplink to our ISP, on another switch port the downlink to our main switch for the internal LAN and on another switch port we have connected (via PoE injector) a Ubiquiti Unifi access point broadcasting an employee and a guest wifi (the latter using a separate VLAN).
As our ISP is IPv4 only, we did not have IPv6 configured at all. Now we want to use IPv6 internally using ULAs. We configured two randomly generated static IPv6 fdxx/48 addresses in the LAN and the GUESTS interface. Then we configured the respective Router Advertisements (mode unmanaged) using a /64 subnet of the /48 prefix of the interfaces (for LAN and GUESTS respectively).
While it works for the LAN network (even Wifi!) and clients do get IPv6 ULAs assigned (even DNS server is handed out), it does not work on the GUESTS network. Both interfaces have their respective IPv6 address assigned (verified via web and console).
When looking at the generated /var/etc/radvd.conf of the running radvd process, the two entries for LAN and GUESTS look identical (except of course for the different IPv6 address prefixes). While the one for LAN works, the one for GUESTS does not.
Firewall rules for GUESTS only have restriction for LAN access, but otherwise, everything is allowed.
I'm puzzled as how to debug further whether the problem is on the firewall rules (which however work for IPv4), the VLAN configuration (which however works for IPv4), the Unifi Controller configuration (which however works for IPv4) ... any hint on what to check and what to debug are very much appreciated.
Greetings,
Stefan -
@stb said in IPv6 ULA Router Advertisement not working on GUESTS interface with VLAN:
we run pfSense (version 2.4.3-RELEASE-p1) on a Netgate XG-7100.
First and foremost act responsible and update to the latest and currently supported version, 2.4.4p2 atm.
-
After reports like
https://www.youtube.com/watch?v=t6chVx386C0
https://forum.netgate.com/topic/135895/package-update-triggers-only-half-2-4-4-update
https://forum.netgate.com/topic/137200/update-2-4-3p1-to-2-4-4-fails
https://forum.netgate.com/topic/136226/ipv6-no-longer-working-after-updating-to-2-4-4I'm a bit hesitant to upgrade. It's not a VM, it's a real XG-7100 and if I mess that up, we are in a mess. ;-)
-
Then keep a factory image ready. Currently you are running a vulnerable system as a firewall, stupid idea.
https://docs.netgate.com/pfsense/en/latest/releases/2-4-4-new-features-and-changes.html#security
https://docs.netgate.com/pfsense/en/latest/releases/2-4-4-p1-new-features-and-changes.html#security-errata
https://www.netgate.com/blog/update-pfsense-packages-to-protect-against-vulnerabilities.htmlSo don't be an idiot, be a responsible admin.
-
@stb said in IPv6 ULA Router Advertisement not working on GUESTS interface with VLAN:
I'm a bit hesitant to upgrade. It's not a VM, it's a real XG-7100 and if I mess that up, we are in a mess. ;-)
So your just going to say on that version forever? The farther you are behind the more likely something could go wrong on update, etc. And even more security problems will start to add up.
While in a production setup yeah it can be tough to get a change window, and you prob don't want to click update the minute the update releases, etc.
As stated, take a backup of your config, have install media ready, etc. Do whatever change control you need to do in your company, and provide your change window long enough to recover from any possible mishap, have the proper tools available, etc.
But 999/1000 if you pay attention and follow the instructions it will go smooth as silk.. Being the responsible admin keeps their stuff up to date and plans for the worse case scenario so even when that happens still looks like smooth as silk to the users.
If even the possibility of an issue could be a problem, then get yourself a spare and have it standing by, etc.
-
Ok, advice noted, will get a fallback pfSense box first where I can install a working backup prior to experimenting with the real one. Can you reinstall a XG-7100 backup on a SG-x100 box? Or is this calling for trouble due to the different switch/lagg/interface setup of the XG-7100?
Nevertheless, any advice on my original question?
-
@stb said in IPv6 ULA Router Advertisement not working on GUESTS interface with VLAN:
I can install a working backup prior to experimenting with the real one.
That is always a good option for mission critical sort of hardware - why we all have spares on site or 4 hour SLAs on hardware replacement, etc.
There is zero reason to debug anything or look deeper if your not on current to be honest..
What exactly is not working in the ULA? Do you run say a captive portal on your guest? Are you doing any sort of multicast filtering on the guest network and not the lan wifi?
Out of curiosity what exactly are you hoping to accomplish with ula IPv6 space on your network that can not just be done via IPv4? Seems like for someone not wanting any issues, by not updating your firewall to current code your looking to introduce problems with adding IPv6... Curious what the driving point of that would be..
-
@johnpoz Even though our ISP does not support IPv6, we now need IPv6 internally in order to test our own software against IPv6. Therefore the requirement for the IPv6 ULAs on the internal LAN. On the GUESTS network, strictly speaking, we do not require them at all, I just configured both interfaces exactly the same way and while ULAs work on one, thy don't on the other. Hence my astonishment and motivation to dig and find out what's wrong, because I feel uncomfortable if something that should work, does not work - similar to not being on the latest patchlevel. ;-)
Can an XG-7100 backup be reinstalled on a SG-x100 box? Then I'd got for a SG-x100 box instead of a XG-7100 as fallback device.
To answer your questions (sorry, overlooked them): No captive portal on guest, no multicast filtering either. What is not working? The Router Advertisement is not reaching the clients, so they do not get ULAs handed out.
-
but the RA are leaving pfsense, you sniffed and see them?
As to backing up to some other SG-X100 device, that is a great question.. I would assume so with some caveats on interface naming, etc.
-
Yes, running
tcpdump -vvvv -ttt -i br0 icmp6 and 'ip6[40] = 134'or
tcpdump -vvvv -ttt -i br0.200 icmp6 and 'ip6[40] = 134'respectively directly on the Unifi access point clearly shows that on the internal wifi and the GUESTS wifi (VLAN 200), the RA packets arrive with the respective prefixes set.
I'm really wondering whether the VLAN somehow interferes ...
-
Update to 2.4.4-RELEASE-p2 did not change anything regarding this behaviour ...
-
Well if you see the RAs on your AP... Then it has zero to do with pfsense.. the unifi ap can do multicast filtering... So your problem is most likely there.
What firmware you running on your unifi AP... I show current beta at 4.0.30, which I am running... I don't currently have ipv6 enabled on my wifi but easy enough to turn on and validate.. Could do a ula easy enough..
Let me grab my phone and check...
-
Works here:-
-
yeah was going to say works here too, I just fired up a prefix from my /48 on HE on my guest vlan wifi..And works just fine!
I could change that to a ula prefix, but don't see how it would matter.. If your saying you see the RA on your AP pfsense is sending them, etc..
-
Ok, thanks ... so over to the Unifi forums then ...
-
@stb said in IPv6 ULA Router Advertisement not working on GUESTS interface with VLAN:
s our ISP is IPv4 only, we did not have IPv6 configured at all. Now we want to use IPv6 internally using ULAs. We configured two randomly generated static IPv6 fdxx/48 addresses in the LAN and the GUESTS interface. Then we configured the respective Router Advertisements (mode unmanaged) using a /64 subnet of the /48 prefix of the interfaces (for LAN and GUESTS respectively).
While it works for the LAN network (even Wifi!) and clients do get IPv6 ULAs assigned (even DNS server is handed out), it does not work on the GUESTS network. Both interfaces have their respective IPv6 address assigned (verified via web and console).
When looking at the generated /var/etc/radvd.conf of the running radvd process, the two entries for LAN and GUESTS look identical (except of course for the different IPv6 address prefixes). While the one for LAN works, the one for GUESTS does not.
Firewall rules for GUESTS only have restriction for LAN access, but otherwise, everything is allowed.
I'm puzzled as how to debug further whether the problem is on the firewall rules (which however work for IPv4), the VLAN configuration (which however works for IPv4), the Unifi Controller configuration (which however works for IPv4) ... any hint on what to check and what to debug are very much appreciated.
Greetings,Are you using the Ubiquity Guest Policy settings ?
Andy
1 x Netgate SG-4860 - 3 x Linksys LGS308P - 1 x Aruba InstantOn AP22
-
So just fired up ula...
Set my one vlan to eab5 prefix, then another interface on pfsense to the eab6 prefix, and bing bang zoom pinging the other prefix from my phone on the eab5
-
@NogBadTheBad said in IPv6 ULA Router Advertisement not working on GUESTS interface with VLAN:
Are you using the Ubiquity Guest Policy settings ?
Most likely, and with the slowness of UBNT when it comes to supporting IPv6 I wouldn't be surprised if that blocks RAs completely.
-
@Grimson said in IPv6 ULA Router Advertisement not working on GUESTS interface with VLAN:
@NogBadTheBad said in IPv6 ULA Router Advertisement not working on GUESTS interface with VLAN:
Are you using the Ubiquity Guest Policy settings ?
Most likely, and with the slowness of UBNT when it comes to supporting IPv6 I wouldn't be surprised if that blocks RAs completely.
IPv6 doesn't work if you tick the Guest Policy setting, so he'll need to create a preshared key or enable captive portal on the Guest interface in pfSense.
-
I don't see a way to add ipv6 networks even in the guest control section.. But I asked when this thread first started if using guest.. Should of been more clear vs asking if using captive portal... But why would you have guest policy on if not using portal, etc.
But that for sure could be his problem.
