Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    IPv6 working but I have to disable gateway monitoring

    Scheduled Pinned Locked Moved IPv6
    36 Posts 6 Posters 4.8k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • JKnottJ
      JKnott @lohphat
      last edited by

      @lohphat said in IPv6 working but I have to disable gateway monitoring:

      @kiokoman Thanks. I was doing that manually, but I would have hoped that the DHCP6 would provide a proper upstream gateway IPv6 address for the pfsense client to then use.

      What gateway address are you getting? It's entirely normal for link local addresses to be used for the gateway.

      PfSense running on Qotom mini PC
      i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
      UniFi AC-Lite access point

      I haven't lost my mind. It's around here...somewhere...

      lohphatL 1 Reply Last reply Reply Quote 0
      • lohphatL
        lohphat @JKnott
        last edited by lohphat

        @JKnott I am getting a link local address for the IPv6 gateway. Why can't the DHCP6 client then use that for monitoring? If I manually add it, it doesn't work.

        SG-3100 24.11-RELEASE (arm) | Avahi (2.2_6) | ntopng (5.6.0_1) | openvpn-client-export (1.9.5) | pfBlockerNG-devel (3.2.1_20) | System_Patches (2.2.20_1)

        JKnottJ 1 Reply Last reply Reply Quote 0
        • JKnottJ
          JKnott @lohphat
          last edited by

          @lohphat said in IPv6 working but I have to disable gateway monitoring:

          @JKnott I am getting a ling local address for the IPv6 gateway. Why can't the DHCP6 client then use that for monitoring? If I manually add it, it doesn't work.

          One thing about link local addresses is that you often have to specify the interface used to reach that address. For example, if you were to ping that address, you'd have to specify that interface. There are 2 reasons for this. One, there is no relationship between the address and the route to get to it, as with routeable addresses. The other is having duplicate link local addresses on different links is also valid. They only have to be unique on the link.

          PfSense running on Qotom mini PC
          i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
          UniFi AC-Lite access point

          I haven't lost my mind. It's around here...somewhere...

          lohphatL 1 Reply Last reply Reply Quote 0
          • lohphatL
            lohphat @JKnott
            last edited by lohphat

            @JKnott OK, I'll try that but the original question still stands: why can't the DHCP6 code figure all this out by itself as it can for the DHCP4 WAN interface?

            I tried forcing the interface and it still doesn't work with the link local address.

            SG-3100 24.11-RELEASE (arm) | Avahi (2.2_6) | ntopng (5.6.0_1) | openvpn-client-export (1.9.5) | pfBlockerNG-devel (3.2.1_20) | System_Patches (2.2.20_1)

            JKnottJ DerelictD 2 Replies Last reply Reply Quote 0
            • JKnottJ
              JKnott @lohphat
              last edited by JKnott

              @lohphat said in IPv6 working but I have to disable gateway monitoring:

              @JKnott OK, I'll try that but the original question still stands: why can't the DHCP6 code figure all this out by itself as it can for the DHCP4 WAN interface?

              With IPv4, the address implies the interface. So, if you have a network 192.168.0.0 /24, then there will be an interface within that range. There is no such relationship between the link local address and interface. Some things can determine the interface, in response to received packets, such as with RAs. But if you are specifying a link local address, then you must specify the interface. As I mentioned, you could have the same LL address on multiple links. How is it to determine which interface you're referring to?

              Here's an example. My gateway address is the standard pfSense fe80::1:1. I'll ping with and without specifying the interface:

              With:
              ping fe80::1:1 -I eth0
              PING fe80::1:1(fe80::1:1) from fe80::76d4:35ff:fe5b:f5fa%eth0 eth0: 56 data bytes
              64 bytes from fe80::1:1%eth0: icmp_seq=1 ttl=64 time=0.250 ms
              64 bytes from fe80::1:1%eth0: icmp_seq=2 ttl=64 time=0.260 ms
              64 bytes from fe80::1:1%eth0: icmp_seq=3 ttl=64 time=0.252 ms

              Without:
              ping fe80::1:1
              connect: Invalid argument

              This is the same problem as you're getting when trying to use the link local address for monitoring.

              PfSense running on Qotom mini PC
              i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
              UniFi AC-Lite access point

              I haven't lost my mind. It's around here...somewhere...

              lohphatL 1 Reply Last reply Reply Quote 0
              • lohphatL
                lohphat @JKnott
                last edited by lohphat

                @JKnott Hoever I've tried forcing the interface and it still doesn't work.

                SG-3100 24.11-RELEASE (arm) | Avahi (2.2_6) | ntopng (5.6.0_1) | openvpn-client-export (1.9.5) | pfBlockerNG-devel (3.2.1_20) | System_Patches (2.2.20_1)

                JKnottJ 1 Reply Last reply Reply Quote 0
                • JKnottJ
                  JKnott @lohphat
                  last edited by

                  @lohphat

                  Then you'll have to use some other address.

                  PfSense running on Qotom mini PC
                  i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                  UniFi AC-Lite access point

                  I haven't lost my mind. It's around here...somewhere...

                  lohphatL 1 Reply Last reply Reply Quote 0
                  • lohphatL
                    lohphat @JKnott
                    last edited by lohphat

                    @JKnott I'm wondering what the monitoring process is. It may be that the IPv6 gateway doesn't respond to ICMP pings.

                    So I've reverted to using the Google DNS address as the monitoring address altough I hate using someone's services as a monitoring point as it's unsolicited traffic. Using the local CPE gateway is still the obvious best solution.

                    sigh

                    SG-3100 24.11-RELEASE (arm) | Avahi (2.2_6) | ntopng (5.6.0_1) | openvpn-client-export (1.9.5) | pfBlockerNG-devel (3.2.1_20) | System_Patches (2.2.20_1)

                    JKnottJ 1 Reply Last reply Reply Quote 0
                    • JKnottJ
                      JKnott @lohphat
                      last edited by

                      @lohphat said in IPv6 working but I have to disable gateway monitoring:

                      It may be that the IPv6 gateway doesn't respond to ICMP pings.

                      The way to verify that is with Packet Capture. If you see them going out, but no response then that's the issue. You might also try with a known address, such as Google's DNS servers. You can use 2001:4860:4860::8888 and 2001:4860:4860::8844. You can also try pinging from the command line, remembering to specify the interface.

                      PfSense running on Qotom mini PC
                      i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                      UniFi AC-Lite access point

                      I haven't lost my mind. It's around here...somewhere...

                      lohphatL 1 Reply Last reply Reply Quote 0
                      • lohphatL
                        lohphat @JKnott
                        last edited by

                        @JKnott Yeah, I tried to ping the gateway local link and 100% packet loss but pinging the Google DNS IPv6 addresses worked. Must be a Spectrum or a Motorola/Arris cabelmodem config.

                        SG-3100 24.11-RELEASE (arm) | Avahi (2.2_6) | ntopng (5.6.0_1) | openvpn-client-export (1.9.5) | pfBlockerNG-devel (3.2.1_20) | System_Patches (2.2.20_1)

                        JKnottJ 1 Reply Last reply Reply Quote 0
                        • JKnottJ
                          JKnott @lohphat
                          last edited by

                          @lohphat

                          Where did you ping from? If pinging a link local address, you have to do it from a computer on the same link. This means you have to ping from pfSense, not a computer behind it.

                          PfSense running on Qotom mini PC
                          i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                          UniFi AC-Lite access point

                          I haven't lost my mind. It's around here...somewhere...

                          lohphatL 1 Reply Last reply Reply Quote 0
                          • lohphatL
                            lohphat @JKnott
                            last edited by

                            @JKnott Correct. I pinged from the diagnostic menu in the pfSense UI and specified the interface as well. No joy.

                            SG-3100 24.11-RELEASE (arm) | Avahi (2.2_6) | ntopng (5.6.0_1) | openvpn-client-export (1.9.5) | pfBlockerNG-devel (3.2.1_20) | System_Patches (2.2.20_1)

                            N JKnottJ 2 Replies Last reply Reply Quote 0
                            • N
                              Napsterbater @lohphat
                              last edited by

                              @lohphat
                              Why not do a trace route and find and use the first hop that responds as the target for the monitor?

                              lohphatL JKnottJ 2 Replies Last reply Reply Quote 0
                              • lohphatL
                                lohphat @Napsterbater
                                last edited by

                                @Napsterbater Because in a redundant path BGP environment, there may be multiple paths from the local POP and whichever I select may be a dynamic route which may sometimes be down for maintenance. This presumes Spectrum has a brain cell, but I digress...

                                SG-3100 24.11-RELEASE (arm) | Avahi (2.2_6) | ntopng (5.6.0_1) | openvpn-client-export (1.9.5) | pfBlockerNG-devel (3.2.1_20) | System_Patches (2.2.20_1)

                                N 1 Reply Last reply Reply Quote 0
                                • N
                                  Napsterbater @lohphat
                                  last edited by

                                  @lohphat
                                  Though the first thing to show in a trace may just be the CMTSs GUA, thus just as good as the Link Local.

                                  Just because the LL doesn't respond doesn't mean the GUA wont. Though depends on the configuration of course

                                  1 Reply Last reply Reply Quote 0
                                  • JKnottJ
                                    JKnott @lohphat
                                    last edited by JKnott

                                    @lohphat

                                    Correct. I pinged from the diagnostic menu in the pfSense UI and specified the interface as well. No joy.

                                    I wonder why they would do that. Given it can't be pinged from beyond the local links, the usual security reasons for doing so don't apply.

                                    PfSense running on Qotom mini PC
                                    i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                                    UniFi AC-Lite access point

                                    I haven't lost my mind. It's around here...somewhere...

                                    lohphatL 1 Reply Last reply Reply Quote 0
                                    • JKnottJ
                                      JKnott @Napsterbater
                                      last edited by

                                      @Napsterbater said in IPv6 working but I have to disable gateway monitoring:

                                      @lohphat
                                      Why not do a trace route and find and use the first hop that responds as the target for the monitor?

                                      If the next hop is also a link local address, he won't be able to ping it or any other LL address beyond the local link.

                                      PfSense running on Qotom mini PC
                                      i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                                      UniFi AC-Lite access point

                                      I haven't lost my mind. It's around here...somewhere...

                                      JKnottJ N 2 Replies Last reply Reply Quote 0
                                      • lohphatL
                                        lohphat @JKnott
                                        last edited by lohphat

                                        @JKnott My guess is that it's dependent on the OEM firmware IPv6 for the cablemodem, in my case a Motorola/Arris unit. It may not be the ISP's choice.

                                        I tried both UDP and ICMP pings and the next local IPv6 hop seems to be a reasonable ...::1 address so I will try using that for awhile instead of the Google DNS IPv6 address for gateway monitoring. I'll keep an eye on it.

                                        However this case might be interesting for the DHCP6 code owners to look oup for unrespondive link local WAN gateways and perhaps compensate by doing an ICMP traceroute and using the first hop's address.

                                        SG-3100 24.11-RELEASE (arm) | Avahi (2.2_6) | ntopng (5.6.0_1) | openvpn-client-export (1.9.5) | pfBlockerNG-devel (3.2.1_20) | System_Patches (2.2.20_1)

                                        JKnottJ 1 Reply Last reply Reply Quote 0
                                        • JKnottJ
                                          JKnott @JKnott
                                          last edited by

                                          @JKnott said in IPv6 working but I have to disable gateway monitoring:

                                          If the next hop is also a link local address, he won't be able to ping it or any other LL address beyond the local link.

                                          I just did some testing. My gateway link local address also does not respond to a ping. However, traceroute shows an address with a /128 prefix. Both that address and the link local have the same MAC address, so that is the address to use for monitoring. This demonstrates what I have often mentioned, while link local addresses are often used for routing, the interface will usually have a /128 prefix for a routeable address that can be used for testing, etc.

                                          PfSense running on Qotom mini PC
                                          i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                                          UniFi AC-Lite access point

                                          I haven't lost my mind. It's around here...somewhere...

                                          lohphatL 1 Reply Last reply Reply Quote 0
                                          • lohphatL
                                            lohphat @JKnott
                                            last edited by lohphat

                                            @JKnott Correct. My assigned /128 was 2604:2000:xxxx:... and the 2604:2000:xxxx::1 address was the first hop of the traceroute -- so that's what I now have as my monitoring address.

                                            Perhaps this can be considered a common IPv6 gateway config case and the DHCP6 code can be updated to automatically determine the upsteam gateway on its own without manual intervention for ease of configuration.

                                            The problem I see with the current manual intervention is that if Spectrum issues me a different /128 on the next cablemodem reboot and then the manual gateway monitor address may not be appropriate.

                                            SG-3100 24.11-RELEASE (arm) | Avahi (2.2_6) | ntopng (5.6.0_1) | openvpn-client-export (1.9.5) | pfBlockerNG-devel (3.2.1_20) | System_Patches (2.2.20_1)

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.