[solved] RA Subnets

JKnott

Here's what I have:

Bob.Dig

@jknott And I got those only where I have Static IPv6 Configuration set (with ULA), but not on that interface, which has track interface for GUA and ULA in RA Subnet. The ULA prefix doesn't show up in pfSense.

Also the interface only got the GUA.

JKnott

@bob-dig

Where are you looking? The web interface doesn't show them, but ifconfig does.

Bob.Dig

@jknott said in RA Subnets:

but ifconfig does.

Ok, trying it right now, but ifconfig is showing the same as the webinterface, so no ULA I set on ra subnet, just the GUA via track interface.

I guess, no one does that, GUA by track interface and ULA by ra subnet? Or are my settings wrong?

I also use the DHCPv6 Server and have a static mapping configured, so I want to use both.

JKnott

@bob-dig

You wouldn't track the interface for ULA, as you manually assign it on the Router Advertisement page. When you track an interface, the prefix is provided by the ISP and they'd have nothing to do with your ULA, though they might have them on the WAN interface.

You have to ensure you actually have a ULA address on the interface. If you have that, then try pinging another ULA on the same subnet. Once you have that, then you can try routing between subnets.

Bob.Dig

@jknott I have none, I have a GUA.

So it is a bug.

JKnott

@bob-dig

Have you specified a ULA prefix (starts with fc or fd), with a /64 subnet size on the Router Advertisements page? If so, the prefix should be included in the RAs. This is why I asked you to do a packet capture, to ensure the RA includes the ULA prefix. If that's there, then any IPv6 capable device on the network should get a ULA address, in addition to GUA. And no, it's not a bug. I have no problem getting ULA addresses on my networks.

Just run Packet Capture for a few minutes, filtering on ICMP6 and post here, so I can read it.

Bob.Dig

@jknott Please, you obviously not reading my posts and not looking at the screenshots provided. Sure, I resist doing something I don't know much about, but I also already gave a good reason for not doing it, because it is already wrong in pfSense, I don't need to capture traffic for that in the first place.

Bob.Dig

2.5.1 didn't fixed it.

JeGr

@bob-dig I only see that you entered it in the RA settings. What about pfSense itself? Where is the ULA for that interface set up? Screens please. Seems more that you are simply doing it wrong :)

Bob.Dig

@jegr Hey Jens, that is why I am asking.
But to be honest, where else to put it? Like I said, interface is on track for the GUA, so...

JeGr

@bob-dig said in [Bug] RA Subnets:

But to be honest, where else to put it? Like I said, interface is on track for the GUA, so...

You are throwing things together that have nothing to do with each other. Yes, putting it in RA seems fine. So you're handing out ULAs to clients. Yay. But without you handing one to pfsense itself, how are you thinking that it should receive packets from those IP6s? Magically? ;)

How about simply giving pfSense an appropriate ULA IP6 via an IP ALIAS as you want it to serve two different prefixes? How else do you think the interface will get an IP6 from that ULA if you don't configure it there yourself? ;)

Also your firewall rules will not work in "normal" ways anymore as "<lan> network" alias won't magically include the second prefix on that interface, only the one configured via Interface setup. So watch your rules, too!

Bob.Dig

@jegr I am trying this right now, never used an IP alias before. lets see if I succeed.

Bob.Dig

@jegr Instantly works, thanks Jens!

JKnott

@jegr said in [Bug] RA Subnets:

How about simply giving pfSense an appropriate ULA IP6 via an IP ALIAS as you want it to serve two different prefixes?

My complaint is the alias doesn't show up anywhere other than with the ifconfig command.

Bob.Dig

@jknott said in [solved] RA Subnets:

My complaint is the alias doesn't show up anywhere other than with the ifconfig command.

That is true, now I can see this myself.

JeGr

@jknott said in [solved] RA Subnets:

My complaint is the alias doesn't show up anywhere other than with the ifconfig command.

Perhaps I'm tired but I can't follow :) Care to elaborate?

Bob.Dig

@jegr said in [solved] RA Subnets:

Also your firewall rules will not work in "normal" ways anymore as "<lan> network" alias won't magically include the second prefix on that interface, only the one configured via Interface setup. So watch your rules, too!

Interestingly it worked anyway. I pinged the "lan" interface from the "voip" interface without a problem.

PS C:\Windows\system32> ping fd28:faaf:f468:1:192:168:1:1

Pinging fd28:faaf:f468:1:192:168:1:1 with 32 bytes of data:
Reply from fd28:faaf:f468:1:192:168:1:1: time<1ms
Reply from fd28:faaf:f468:1:192:168:1:1: time<1ms
Reply from fd28:faaf:f468:1:192:168:1:1: time<1ms
Reply from fd28:faaf:f468:1:192:168:1:1: time<1ms

Ping statistics for fd28:faaf:f468:1:192:168:1:1:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 0ms, Maximum = 0ms, Average = 0ms

"voip" was the interface in question all the time. Will have to try from another interface to "voip".

Bob.Dig

@bob-dig said in [solved] RA Subnets:

Will have to try from another interface to "voip".

Even this is working without any modifications @JeGr

Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),

Bob.Dig

So I think pfSense knows what "lan_voip net" is because of ifconfig:

hn4: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
        description: lan_voip
        options=48071b<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,TSO4,TSO6,LRO,LINKSTATE,TXCSUM_IPV6>
        ether 00:15:5d:82:4e:3c
        inet6 fe80::215:5dff:fe82:4e3c%hn4 prefixlen 64 scopeid 0xa
        inet6 fe80::1:1%hn4 prefixlen 64 scopeid 0xa
        inet6 fd28:faaf:f468:98:192:168:98:1 prefixlen 64
        inet6 2003:da:a711:44f0:215:5dff:fe82:4e3c prefixlen 64
        inet 192.168.98.1 netmask 0xffffff00 broadcast 192.168.98.255
        media: Ethernet autoselect (10Gbase-T <full-duplex>)
        status: active
        nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>