Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    fe80::/16 not included in interface networks?

    Scheduled Pinned Locked Moved IPv6
    31 Posts 5 Posters 3.6k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • O
      OffstageRoller @JKnott
      last edited by

      @jknott

      Perhaps I'm asking the wrong question.

      Why, when I enable IPv6 and Avahi, is pfSense blocking these link local addresses? If they're not routable, why does pfSense see them as being routed and then block them with the default reject rule?

      56285b97-58ba-460e-b44b-c788db9d6161-image.png

      1a12a09f-84e4-4e90-ba93-c25bbe963dc9-image.png

      1 Reply Last reply Reply Quote 0
      • johnpozJ
        johnpoz LAYER 8 Global Moderator @OffstageRoller
        last edited by johnpoz

        @offstageroller said in fe80::/16 not included in interface networks?:

        but that interface name does not include fe80::/16, and therefore I need to create an

        Why would you think your "net" address should include fe80::/16? The interfaces link local would be only a /64..

        look on your interfaces with ifconfig to see your link local addresses..

        example here is my lan interface

        inet6 fe80::208:a2ff:fe0c:e624%igb0 prefixlen 64 scopeid 0x1
        

        if the source of the traffic was using the same prefix then it should be part of your "net" alias..

        An alias for any specific "net" using the space of /16 wouldn't be a specific net, it would be a huge chuck of the whole space FE80::/10, where did you come up with using /16 anyway?

        edit: not sure where you came up with the ff00::/8 prefix for mdns it would only ever use "ff02::fb" not sure why you would allow ff00::/8

        An intelligent man is sometimes forced to be drunk to spend time with his fools
        If you get confused: Listen to the Music Play
        Please don't Chat/PM me for help, unless mod related
        SG-4860 24.11 | Lab VMs 2.8, 24.11

        O 1 Reply Last reply Reply Quote 0
        • O
          OffstageRoller @johnpoz
          last edited by

          @johnpoz

          You're right... I'm communicating this poorly.

          When I say fe80::/16, I really mean the actual /64. I guess in this case my rule should actually be fe80::/64, since that's what my addresses end up being.

          I will also update my rule for the destinations to be ff02::fb.

          I'm still confused though. Here's what I see for the link local addresses on my VL30_KIDS interface:

          	inet6 fe80::208:a2ff:fe0d:153f%lagg0.30 prefixlen 64 scopeid 0xe
          	inet6 fe80::1:1%lagg0.30 prefixlen 64 scopeid 0xe
          

          However, when I see the current states on the interface, it shows these as the sources and destinations:

          fe80::ce5:190d:b990:d6e7[5353] -> ff02::fb[5353]
          fe80::1c5f:ab8a:c0d:d49[5353] -> ff02::fb[5353]
          

          Those don't match the address of the link local address on my interface, so I'm confused on where those are coming from then?

          JKnottJ 1 Reply Last reply Reply Quote 0
          • JKnottJ
            JKnott @OffstageRoller
            last edited by

            @offstageroller

            As I mentioned, every IPv6 capable device has a link local address, so that narrows it down to any device on your LAN. The ff02 means multicast to the local link only.

            PfSense running on Qotom mini PC
            i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
            UniFi AC-Lite access point

            I haven't lost my mind. It's around here...somewhere...

            O 1 Reply Last reply Reply Quote 0
            • O
              OffstageRoller @JKnott
              last edited by

              @jknott

              iOS doesn't show their link local addresses in the settings. But it's safe to assume those two link local addresses are my two kid's iPads then.

              iOS does show the IPv6 gateway is a link local address, and I assume that's expected as well.

              So having my iOS devices use their link local addresses to communicate with ff02::fb over port 5353 is expected for mDNS correct?

              pfSense blocks that be default. pfSense blocks everything by default, but when I create a rule to allow that interface to communicate over port 5353, I expect that would work for IPv6.

              The default interface network names do not include the link local addresses on them, but that's why I created this post... shouldn't they? Aren't link local addresses on that interface part of that network?

              JKnottJ 1 Reply Last reply Reply Quote 0
              • JKnottJ
                JKnott @OffstageRoller
                last edited by

                @offstageroller said in fe80::/16 not included in interface networks?:

                So having my iOS devices use their link local addresses to communicate with ff02::fb over port 5353 is expected for mDNS correct?

                Yes. mDNS uses multicast and is intended for the local LAN only. If you examine a packet capture, you will likely find the hop limit is 255, which is another way to ensure it doesn't leave the local link. If you're getting errors a rule to allow those packets should be OK, as it's allowing something that will never happen.

                PfSense running on Qotom mini PC
                i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                UniFi AC-Lite access point

                I haven't lost my mind. It's around here...somewhere...

                1 Reply Last reply Reply Quote 0
                • bmeeksB
                  bmeeks
                  last edited by

                  I think there is some confusion with responses in this thread maybe due to incomplete reading of the original post.

                  The OP is using avahi to distribute multicast traffic across several local VLANs. The avahi daemon runs on pfSense itself in this setup. So link local packets must hit the firewall on one VLAN and then get allowed in so avahi can "see" them to copy them over to other VLANs (or "route them" if you will).

                  What @JKnott is saying about link local IPs not normally being routed elsewhere is technically true, but in this particular setup with avahi that the OP is using, he does in fact need to "route" that traffic to other subnets. So he needs the "*NET" built-in alias to include the IPv6 link local addresses as part of the alias so the default IPv6 rules don't drop the multicast traffic and thus hide it from the avahi daemon. At least that's what he needs in his case with avahi, but normally this is not needed since link-local traffic is, by definition, restricted to just the local subnet.

                  So I can see the point of not including that address space in the default definition, but perhaps the avahi package needs to be modifed such that it adds its own firewall rule to cover this situation, so the user doesn't have to.

                  johnpozJ JKnottJ 2 Replies Last reply Reply Quote 1
                  • johnpozJ
                    johnpoz LAYER 8 Global Moderator @bmeeks
                    last edited by

                    @bmeeks said in fe80::/16 not included in interface networks?:

                    he does in fact need to "route" that traffic to other subnets.

                    Not sure route is the correct term in this context to be honest ;) Repeated prob better term.

                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                    If you get confused: Listen to the Music Play
                    Please don't Chat/PM me for help, unless mod related
                    SG-4860 24.11 | Lab VMs 2.8, 24.11

                    1 Reply Last reply Reply Quote 0
                    • JKnottJ
                      JKnott @bmeeks
                      last edited by

                      @bmeeks said in fe80::/16 not included in interface networks?:

                      What @JKnott is saying about link local IPs not normally being routed elsewhere is technically true, but in this particular setup with avahi that the OP is using, he does in fact need to "route" that traffic to other subnets.

                      No, he does not need to route. He needs to have multicast enabled on all relevant interfaces. Link local packets are by definition on one local LAN only.

                      BTW, I just checked Wireshark, which I left running overnight. The MDNS packets show a hop limit of 1, which would prevent passing through a router. When it tries to route the hop limit would be decremented to 0, which would cause it to be discarded.

                      PfSense running on Qotom mini PC
                      i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                      UniFi AC-Lite access point

                      I haven't lost my mind. It's around here...somewhere...

                      1 Reply Last reply Reply Quote 0
                      • bmeeksB
                        bmeeks
                        last edited by

                        Guys, I put the term "route" in quotes for a reason. I fully understand you don't actually route link-local traffic. I think you are getting too excited trying to be technically correct, and forgetting the root issue in this case.

                        Yes, "repeat" is a more apt description. The point remains that link-local traffic on one local subnet needs to get repeated over into another local subnet to solve the problem. The evidence of that is that the devices work when he creates the rule to allow link-local traffic into the interface. The avahi daemon running on pfSense does that "repeating" across subnets for you. The real issue here is not "routing" in the pure sense of the term. The issue is that the default definition of the *NET built-in alias does not include some IPv6 multicast related addresses needed for the avahi package. He says the IPv4 version of that alias does include those addresses (but I have not checked to verify that).

                        johnpozJ 1 Reply Last reply Reply Quote 1
                        • johnpozJ
                          johnpoz LAYER 8 Global Moderator @bmeeks
                          last edited by johnpoz

                          @bmeeks said in fe80::/16 not included in interface networks?:

                          He says the IPv4 version of that alias does include those addresses (but I have not checked to verify that).

                          I don't think that is true to be honest.. The destination of mdns for IPv4 would be 224.0.0.251, that is not going to be included in the "net" alias for any interface. But if he has an any that would be ok.. The source of that traffic from a IPv4 client would be its IPv4 address.. So source would included in typical interface net alias listing the "net" as source..

                          The destination being multicast would be allowed in the default any rule on lan, which is prob duplicated on other interfaces creating..

                          To be honest does he really even need IPv6 mdns resolution.. IPv4 would normally work in your typical users setup without having to do any special rules.. Because the default rules would allow for the source net, and the dest via any..

                          Where you run into problems with source net for link-local, is client A is going to be in a different prefix anyway from client B - even if they are in the same L2..

                          Here is client of mine

                          inet6 fe80::3bc8:c970:a732:ac17  prefixlen 64  scopeid 0x20<link>
                          

                          That is connected to pfsense interface but it has

                          inet6 fe80::208:a2ff:fe0c:e621%igb3 prefixlen 64 scopeid 0x4
                          

                          Now if the client sent the mdns query from its GUA address - you don't have this problem.. But this whole discovery protocol is only meant for L2 anyway.. So other than a firewall/router you wouldn't normally run into the problems say client finding the printer..

                          I would think a "note" on the package on what rules you "might" want to add or edit if using avahi would be a way better idea then auto creation of rules..

                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                          If you get confused: Listen to the Music Play
                          Please don't Chat/PM me for help, unless mod related
                          SG-4860 24.11 | Lab VMs 2.8, 24.11

                          bmeeksB 1 Reply Last reply Reply Quote 1
                          • bmeeksB
                            bmeeks @johnpoz
                            last edited by bmeeks

                            @johnpoz said in fe80::/16 not included in interface networks?:

                            I would think a "note" on the package on what rules you "might" want to add or edit if using avahi would be a way better idea then auto creation of rules..

                            Yeah, my thought as well. Either include the subnet via a checkbox on the Advanced Setup page (like exists for enabling or blocking Bogons and such), or put it as a visible note in the package configuration for avahi. Maybe a checkbox selectable option in the package that would auto-create the rule for you and then remove it when the package is uninstalled.

                            I just think the thread got a bit derailed by the "routing" arguments and lost track of the original problem.

                            P.S. -- just saw this morning that my cable ISP (which was recently purchased by Vyve Broadband) moved my account to damn CGNAT overnight. Argh! I had avoided that for several years. So now I have that to bitch about and can forget "routing" of link-local stuff ... 😀.

                            johnpozJ 1 Reply Last reply Reply Quote 0
                            • johnpozJ
                              johnpoz LAYER 8 Global Moderator @bmeeks
                              last edited by

                              @bmeeks said in fe80::/16 not included in interface networks?:

                              my account to damn CGNAT overnight

                              Did they send out any notification that was "going" to happen??

                              An intelligent man is sometimes forced to be drunk to spend time with his fools
                              If you get confused: Listen to the Music Play
                              Please don't Chat/PM me for help, unless mod related
                              SG-4860 24.11 | Lab VMs 2.8, 24.11

                              bmeeksB 1 Reply Last reply Reply Quote 0
                              • bmeeksB
                                bmeeks @johnpoz
                                last edited by

                                @johnpoz said in fe80::/16 not included in interface networks?:

                                @bmeeks said in fe80::/16 not included in interface networks?:

                                my account to damn CGNAT overnight

                                Did they send out any notification that was "going" to happen??

                                Nope. Was surfing late last night around midnight and noticed external connectivity was lost. Happens once in a blue moon when they do maintenance, and I was about to retire for the night anyway. Got up this morning and saw new WAN IP notice emails in my Inbox from pfSense. Am now in a 24.49.195.0 subnet, while previously I was in a 38.x.x.x (if I am remembering that right). My firewall WAN IP is now a 100.64.x.x address.

                                johnpozJ JKnottJ 2 Replies Last reply Reply Quote 0
                                • johnpozJ
                                  johnpoz LAYER 8 Global Moderator @bmeeks
                                  last edited by johnpoz

                                  @bmeeks said in fe80::/16 not included in interface networks?:

                                  Am now in a 24.49.195.0 subnet

                                  huh? So which is it you your 24.49.x.x or 100.x ?

                                  So you got email from pfsense saying you switched to 24.49, and then later it switched to 100.x?

                                  Oh - 24 is what your public is, they are natting you -- DUH!!! ;) heheeeh

                                  Sucks dude - guess someone be shopping for new isp today... That's what I would be doing..

                                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                                  If you get confused: Listen to the Music Play
                                  Please don't Chat/PM me for help, unless mod related
                                  SG-4860 24.11 | Lab VMs 2.8, 24.11

                                  bmeeksB 2 Replies Last reply Reply Quote 0
                                  • bmeeksB
                                    bmeeks @johnpoz
                                    last edited by

                                    @johnpoz said in fe80::/16 not included in interface networks?:

                                    @bmeeks said in fe80::/16 not included in interface networks?:

                                    Am now in a 24.49.195.0 subnet

                                    huh? So which is it you your 24.49.x.x or 100.x ?

                                    So you got email from pfsense saying you switched to 24.49, and then later it switched to 100.x?

                                    I got the email from the Dynamic DNS agent. The 100.64 address is on my WAN interface now on the firewall. So I assume the 24.49 is the real public IP in front of the CGNAT. Not sure what magic they pulled for that. I have my own domain (themeeks.net). I assume that is now resolving externally to the 24.49 IP, since that's what the Dynamic DNS agent reports.

                                    WAN.png

                                    johnpozJ 1 Reply Last reply Reply Quote 0
                                    • johnpozJ
                                      johnpoz LAYER 8 Global Moderator @bmeeks
                                      last edited by

                                      Well maybe you find a better/cheaper ISP.. Bastards!

                                      Little heads up would of been nice - give users time to leave, or maybe pay for public, etc.. Douche Baggy move to just do it without notice that is for sure.

                                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                                      If you get confused: Listen to the Music Play
                                      Please don't Chat/PM me for help, unless mod related
                                      SG-4860 24.11 | Lab VMs 2.8, 24.11

                                      1 Reply Last reply Reply Quote 0
                                      • bmeeksB
                                        bmeeks @johnpoz
                                        last edited by bmeeks

                                        @johnpoz said in fe80::/16 not included in interface networks?:

                                        Oh - 24 is what your public is, they are natting you -- DUH!!! ;) heheeeh

                                        Sucks dude - guess someone be shopping for new isp today... That's what I would be doing..

                                        Yeah on the NAT.

                                        Likely "no" on shopping for a new ISP for now. My only other choice is a local wireless ISP operator.

                                        But it's a small town, so I will drop by the office and see if the tech will accomodate me. I knew the former tech (he grew up two houses down from me and was friends with my kids), and he moved me off CGNAT when I originally ordered the service. But he has moved on to something else at a bank.

                                        1 Reply Last reply Reply Quote 0
                                        • JKnottJ
                                          JKnott @bmeeks
                                          last edited by

                                          @bmeeks said in fe80::/16 not included in interface networks?:

                                          My firewall WAN IP is now a 100.64.x.x address

                                          Yep, that's definitely CGNAT.

                                          Do they also provide IPv6? Some ISPs provide IPv4 over IPv6.

                                          PfSense running on Qotom mini PC
                                          i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                                          UniFi AC-Lite access point

                                          I haven't lost my mind. It's around here...somewhere...

                                          bmeeksB 1 Reply Last reply Reply Quote 0
                                          • bmeeksB
                                            bmeeks @JKnott
                                            last edited by

                                            @jknott said in fe80::/16 not included in interface networks?:

                                            @bmeeks said in fe80::/16 not included in interface networks?:

                                            My firewall WAN IP is now a 100.64.x.x address

                                            Yep, that's definitely CGNAT.

                                            Do they also provide IPv6? Some ISPs provide IPv4 over IPv6.

                                            Nope, no IPv6 here yet. I have a Hurricane Electric setup, but I've had that tunnel out of service for the last year and a half. I have not gone to the trouble of working around the Netflix IPv6 issues caused by HE tunnels, so I just disabled the tunnel for a while during visits by my grandkids. Their iOS devices were trying to use IPv6 when I had it set up on my LAN and on the WAN via the HE tunnel. Took the expedient way out of that and just turned off IPv6. Really don't need it for now.

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.