Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    pfSense does not reply to NS sent by ISP router, ISP does not respond to DHCPv6 request as a result

    Scheduled Pinned Locked Moved IPv6
    48 Posts 4 Posters 7.7k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • C
      cnrd
      last edited by cnrd

      @JKnott

      Thanks

      Here is a pcap of all IPv6 traffic while pfsense is booting all the way through complete bootup.

      It was captured using port mirroring on my switch.

      As a trivia my ISP has told me they are using Juniper hardware on their end.

      JKnottJ 1 Reply Last reply Reply Quote 0
      • JKnottJ
        JKnott @cnrd
        last edited by

        @cnrd

        Is it possible to capture only DHCPv6 and ICMP6. I can certainly do that with Wireshark. For example, I could create a rule port 546 or icmp6, which would capture those two, but nothing else. Otherwise I have to sort through a lot of noise.

        PfSense running on Qotom mini PC
        i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
        UniFi AC-Lite access point

        I haven't lost my mind. It's around here...somewhere...

        C 1 Reply Last reply Reply Quote 0
        • C
          cnrd @JKnott
          last edited by cnrd

          @JKnott If you open the pcap, you can see that it's all that's in the file ;-) It has 20 entries, all either ICMPv6 or DHCPv6.

          EDIT: The ISP is Gigabit.dk

          JKnottJ 1 Reply Last reply Reply Quote 0
          • JKnottJ
            JKnott @cnrd
            last edited by

            @cnrd

            Sorry, I was looking at the wrong file. Is fe80::ae16:2dff:fe94:bbd3 your firewall or the ISP? I see requests for that address coming from the unknown address source.

            PfSense running on Qotom mini PC
            i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
            UniFi AC-Lite access point

            I haven't lost my mind. It's around here...somewhere...

            C 1 Reply Last reply Reply Quote 0
            • C
              cnrd @JKnott
              last edited by

              @JKnott said in pfSense does not reply to NS sent by ISP router, ISP does not respond to DHCPv6 request as a result:

              fe80::ae16:2dff:fe94:bbd3

              That is my firewall. (ac:16:2d:94:bb:d3)

              Not really sure why pfSense is sending NS for it self.

              Those first 4 packages with unknown source seems to be origin from the firewall's NIC (src MAC matches).

              JKnottJ 1 Reply Last reply Reply Quote 0
              • JKnottJ
                JKnott @cnrd
                last edited by

                @cnrd

                Then that 1st line would be duplicate address detection (DAD) and when there's no response it assumes the address is free. Later you see the multicast listener reports initially have the unknown source and then 1 with your address. Then there are DHCPv6 solicits, but no response. There should be advertisements from the DHCPv6 server, they're not there.

                PfSense running on Qotom mini PC
                i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                UniFi AC-Lite access point

                I haven't lost my mind. It's around here...somewhere...

                C 2 Replies Last reply Reply Quote 1
                • C
                  cnrd @JKnott
                  last edited by cnrd

                  This post is deleted!
                  1 Reply Last reply Reply Quote 1
                  • C
                    cnrd @JKnott
                    last edited by

                    @JKnott said in pfSense does not reply to NS sent by ISP router, ISP does not respond to DHCPv6 request as a result:

                    @cnrd

                    Then there are DHCPv6 solicits, but no response. There should be advertisements from the DHCPv6 server, they're not there.

                    @JKnott I know it's been some time, but I got my ISP to fix their problem with sending out RA, so now it makes sense to try to fix this.

                    The problem here is that the DHCPv6 server have no idea about where to send the response, as pfSense is not responding to the NS: "Neighbor Solicitation for fe80::ae16:2dff:fe94:bbd3 from fe:33:42:10:c8:6b", so it has no idea about where fe80::ae16:2dff:fe94:bbd3 is.

                    The response should have been: "Neighbor Advertisement fe80::ae16:2dff:fe94:bbd3 (sol, ovr) is at ac:16:2d:94:bb:d3"

                    If pfSense had send that response, then the DHCPv6 server would have replied with a lease.

                    I'm pretty sure that the DHCPv6 server is not required to multicast the reply, so for unicast it needs to know the mac of the local-link IP requesting a lease.

                    JKnottJ 1 Reply Last reply Reply Quote 0
                    • JKnottJ
                      JKnott @cnrd
                      last edited by

                      @cnrd said in pfSense does not reply to NS sent by ISP router, ISP does not respond to DHCPv6 request as a result:

                      The problem here is that the DHCPv6 server have no idea about where to send the response, as pfSense is not responding to the NS: "Neighbor Solicitation for fe80::ae16:2dff:fe94:bbd3 from fe:33:42:10:c8:6b", so it has no idea about where fe80::ae16:2dff:fe94:bbd3 is.

                      Is that NS being sent to the correct address? Also, is it possible to do a packet capture? You can use Packet Capture in pfSense and download the capture file to post here.

                      PfSense running on Qotom mini PC
                      i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                      UniFi AC-Lite access point

                      I haven't lost my mind. It's around here...somewhere...

                      C 1 Reply Last reply Reply Quote 0
                      • C
                        cnrd @JKnott
                        last edited by cnrd

                        @JKnott said in pfSense does not reply to NS sent by ISP router, ISP does not respond to DHCPv6 request as a result:

                        Is that NS being sent to the correct address?

                        Yes it's being sent to ff02::1:ff94:bbd3, pfSense' local-link address is fe80::ae16:2dff:fe94:bbd3

                        Also, is it possible to do a packet capture? You can use Packet Capture in pfSense and download the capture file to post here.

                        Here is a cap from pfSense, that is captured while reloading the WAN interface, to force it to send a DHCP request.

                        packetcapture.cap

                        It is captured by pfSense with Interface set to WAN and Address Family set to IPv6

                        As before:
                        WAN: ac:16:2d:94:bb:d3
                        ISP DHCP servers: fe:33:42:10:c8:6b, e6:5d:37:84:53:17

                        Also I'm not seeing any NS being blocked in the firewall log.

                        JKnottJ 1 Reply Last reply Reply Quote 0
                        • JKnottJ
                          JKnott @cnrd
                          last edited by

                          @cnrd said in pfSense does not reply to NS sent by ISP router, ISP does not respond to DHCPv6 request as a result:

                          Yes it's being sent to ff02::1:ff94:bbd3, pfSense' local-link address is fe80::ae16:2dff:fe94:bbd3

                          That ff02 address is a solicited node multicast, which is the other end trying to determine your MAC address. However, I don't know why it's doing that, as it should be able to find that in the solicit XID. Regardless, your system should be responding.

                          PfSense running on Qotom mini PC
                          i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                          UniFi AC-Lite access point

                          I haven't lost my mind. It's around here...somewhere...

                          C 1 Reply Last reply Reply Quote 0
                          • C
                            cnrd @JKnott
                            last edited by cnrd

                            @JKnott Yeah, I'm not sure why they need that, but I don't think it's out of spec.

                            Regardless, your system should be responding.

                            Yeah this it the whole problem, it seems like the NS arrives at pfSense WAN interface, and running pfctl -vvsr indicates that it is even allowed through the firewall?

                            @11(1000000107) pass quick inet6 proto ipv6-icmp all icmp6-type neighbrsol keep state
                              [ Evaluations: 3509019   Packets: 554001    Bytes: 53687917    States: 0     ]
                              [ Inserted: pid 72478 State Creations: 683   ]
                            

                            Do you have any idea about what I could try to figure this out?

                            Also thanks for the help you have already provided :-)

                            EDIT: Could it be related to the fact that the NS sent by the ISP DHCP server is sent from 2a00:7660::249, which is not a private address, therefor pfSense refuses to reply?

                            28	9.708786	2a00:7660::249	ff02::1:ff94:bbd3	ICMPv6	86	Neighbor Solicitation for fe80::ae16:2dff:fe94:bbd3 from fe:33:42:10:c8:6b
                            

                            As you can see here the source is 2a00:7660::249 and the dest is ff02::1:ff94:bbd3 at this point in time pfSense only knows the address fe80::ae16:2dff:fe94:bbd3 which is not in the same space as 2a00:7660::249

                            JKnottJ 1 Reply Last reply Reply Quote 0
                            • JKnottJ
                              JKnott @cnrd
                              last edited by

                              @cnrd said in pfSense does not reply to NS sent by ISP router, ISP does not respond to DHCPv6 request as a result:

                              EDIT: Could it be related to the fact that the NS sent by the ISP DHCP server is sent from 2a00:7660::249, which is not a private address, therefor pfSense refuses to reply?

                              I wouldn't think so. While you can enable Unique Local Addresses (ULA) they're not needed. Normally, you have public addresses, at least 18.4 billion, billion of 'em.
                              ULA == the IPv6 equivalent of RFC 1918 addresses.

                              PfSense running on Qotom mini PC
                              i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                              UniFi AC-Lite access point

                              I haven't lost my mind. It's around here...somewhere...

                              1 Reply Last reply Reply Quote 0
                              • C
                                cnrd
                                last edited by

                                @JKnott I'm simply lost at what to try, to get this to work at this point. I know what the root cause is, namely that there is no reply from pfSense for the NS, I know that the package arrives at the pfSense firewall, I know that it is passed through the firewall, but something behind the firewall simply isn't sending out a reply.

                                I even tried running with pfctl -d to verify that it was not the firewall that caused the problem.

                                JKnottJ 1 Reply Last reply Reply Quote 0
                                • JKnottJ
                                  JKnott @cnrd
                                  last edited by

                                  @cnrd

                                  Perhaps you can try an experiment. Connect another computer to the WAN port and try pinging the link local address and see what happens. Do a packet capture of it.

                                  PfSense running on Qotom mini PC
                                  i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                                  UniFi AC-Lite access point

                                  I haven't lost my mind. It's around here...somewhere...

                                  C 1 Reply Last reply Reply Quote 0
                                  • C
                                    cnrd @JKnott
                                    last edited by

                                    @JKnott I just connected my desktop directly to pfSense WAN port, pinging the WAN local-link address worked just fine, and the package-capture showed an NS sent from my desktop and an NA reply from pfSense.

                                    Both machines here used local-link addresses, so I still suspect that the problem lies somewhere with the public address used by my ISP's dhcp servers.

                                    Here is the capture (I only saved the relevant parts): NS-NA.pcapng

                                    C 1 Reply Last reply Reply Quote 0
                                    • C
                                      cnrd @cnrd
                                      last edited by

                                      I also just tested it out on a totally clean install of both pfSense 2.4.5-RELEASE-p1 and a clean install of the latest 2.5-SNAPSHOT, no difference, pfSense is simply not replying.

                                      1 Reply Last reply Reply Quote 0
                                      • JKnottJ
                                        JKnott
                                        last edited by

                                        Ping obviously works.

                                        I just did a packet capture with Wireshark and a managed switch, configured as a data tap.

                                        Here's what I see
                                        neighbour solicitation for duplicate address detection
                                        router solicitation
                                        router advertisement
                                        solicit XID
                                        advertise XID
                                        request XID
                                        reply XID

                                        I have attached the packet capture. How does yours compare? I've been using pfsense for almost 4 years and haven't seen it fail. It just works. In fact IPv6 was the reason I moved to pfsense, as the Linux firewall I was running didn't support DHCPv6-PD.

                                        pfsense startup IPv6.pcapng

                                        PfSense running on Qotom mini PC
                                        i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                                        UniFi AC-Lite access point

                                        I haven't lost my mind. It's around here...somewhere...

                                        C 1 Reply Last reply Reply Quote 0
                                        • C
                                          cnrd @JKnott
                                          last edited by cnrd

                                          @JKnott Everything here is captured in the same way, Wireshark with a port mirror.

                                          Here is the order:

                                          duplicate address detection
                                          solicit XID (x5)
                                          neighbor solicit from 2a00:7660::248 and 2a00:7660::249

                                          This pattern repeats, as pfSense is waiting for a reply to the solicit XID and ISP routers are waiting for a reply to the neighbor solicits before sending a reply to the XID.

                                          pfsense startup.pcapng

                                          Interestingly I also tried setting up a pure FreeBSD 12.2 machine, just to see if that would reply to the NS, but no dice, so it seems that the problem lies somewhere below pfSense.

                                          Here is a capture of that NS-no-response.pcapng

                                          As you can see, same pattern, the ISP routers refuses to do anything before they get a reply to the NS they are sending out, while FreeBSD refuses to reply.

                                          I know that everything will work, if I can just get pfSense/FreeBSD to reply to that NS, as I have experimented with Linux, which replies to the NS after which everything runs smoothly:

                                          10	5.677136	2a00:7660::248	ff02::1:ffc9:11ee	ICMPv6	86	Neighbor Solicitation for fe80::541e:337d:38c9:11ee from e6:5d:37:84:53:17
                                          11	5.677141	fe80::541e:337d:38c9:11ee	2a00:7660::248	ICMPv6	86	Neighbor Advertisement fe80::541e:337d:38c9:11ee (sol, ovr) is at ac:16:2d:94:bb:d3
                                          12	5.677527	2a00:7660::249	ff02::1:ffc9:11ee	ICMPv6	86	Neighbor Solicitation for fe80::541e:337d:38c9:11ee from fe:33:42:10:c8:6b
                                          13	5.677724	fe80::541e:337d:38c9:11ee	2a00:7660::249	ICMPv6	86	Neighbor Advertisement fe80::541e:337d:38c9:11ee (sol, ovr) is at ac:16:2d:94:bb:d3
                                          14	5.678332	fe80::e65d:37ff:fe84:5317	fe80::541e:337d:38c9:11ee	ICMPv6	78	Router Advertisement from e6:5d:37:84:53:17
                                          15	5.678687	fe80::fe33:42ff:fe10:c86b	fe80::541e:337d:38c9:11ee	ICMPv6	78	Router Advertisement from fe:33:42:10:c8:6b
                                          
                                          JKnottJ 1 Reply Last reply Reply Quote 0
                                          • JKnottJ
                                            JKnott @cnrd
                                            last edited by

                                            @cnrd said in pfSense does not reply to NS sent by ISP router, ISP does not respond to DHCPv6 request as a result:

                                            This pattern repeats, as pfSense is waiting for a reply to the solicit XID and ISP routers are waiting for a reply to the neighbor solicits before sending a reply to the XID.
                                            pfsense startup.pcapng
                                            Interestingly I also tried setting up a pure FreeBSD 12.2 machine, just to see if that would reply to the NS, but no dice, so it seems that the problem lies somewhere below pfSense.

                                            It looks to me like the problem is with the ISP, given the lack of responses. I assume your modem is in bridge mode, not gateway.

                                            PfSense running on Qotom mini PC
                                            i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                                            UniFi AC-Lite access point

                                            I haven't lost my mind. It's around here...somewhere...

                                            C 1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.