Asymmetric routing with IPv6
-
Hi everyone,
since I added IPv6 to my configuration I continue to find in the logs some ipv4 and ipv6 connections of the lan interface blocked by the default rule, they are ipv6 TCP connections with flag PA FPA FA RA.
I noticed some problems when Android devices need to update applications, observing blocked ipv6 connections when trying to connect to some google ip.
In fact the play store starts to download the application update but almost at the end it stops and after an unspecified time it starts again completing the download.
I followed the guide to add a gif for hurricane electrics but I used it for my isp fastweb.
On the interface of the gif I only have the rule that allows the ipv6 tunnel, while on the lan interface I have an ipv4 rule for each known device, an ipv6 rule for two devices and a generic one that allows all ipv6 traffic.
The main problem as already mentioned is the update of applications on Android devices while browsing has no problems.
If you need more details, don't hesitate to ask me.
Thanks for your help. -
https://docs.netgate.com/pfsense/en/latest/firewall/troubleshooting-blocked-log-entries-for-legitimate-connection-packets.html
-
I have already tried to solve them using the methods suggested but without success.
-
If it were me I would packet capture the phone, update applications, and see what it's doing.
-
^ exactly - how do you know its not starting the conversation via cell data connection and then switching it to wifi..
All pfsense is saying with those blocks is hey there is not freaking state for that.. Lots of reasons that could happen..
Could be something as odd as switching wifi networks - do you run more than 1? Do you have more than 1 AP? Do you have a AP doing nat, and another not, etc. etc.
Asymmetrical can be a reason for seeing those blocked packets sure, but could be something like pfsense wan bounced and you have it set to reset all states?
