PFSense Not Working with DHCPV6 or Stateless on tracking interface
-
This is what happens to my pfSense in this scenario with a nightly change of the WAN address: The LAN interface gets a global IPv6 address once directly after setting it to track the WAN interface but never again when the WAN interfaces's address changes. Looks like the tracking doesn't work. And then the router advertisements obviously cannot work either.
Why would the wan interface address change?
dhcp6c should be sending renew signals. What is your dhcp log showing with respect to dhcp6c?
This is what mine looks like, OK my dhcp6c is modified to give more info and the interface.inc is different but the process of renew is pretty much the same except it says renew. In fact with the newer dhcp6c and interface.inc the call to rc.newwanipv6 does not get called on renew and my system runs solidly as do many others.
Can you give some more information rather than just saying it does not work. Do you need to set 'Do not wait for a RA' or not, what is the refresh time of your ISP? If you run dhcp6c in debug mode it will give you all the information you need to decide if the problem is there or not.
If the lease is not being renewed then you have a problem, but the first thing to do is to find out what the renew time should be and look at the logs around that time and see what's happening.
-
@marjohn56:
Why would the wan interface address change?
Comcast claims I have a static ipv6, but I've seen the network ID change.
Why they change me occassionally, I don't know.
It's really annoying.I don't want to risk a situation where the network ID changes, and then the ipv6 network goes down when I'm not there.
If I have a tracking interface, with working unmanaged RA, it'll be self healing.
With tracking interface:
If the network address changes, then the router advertisement changes, which then the local host ipv6 address changes.It's a safety net.
-
I've never known an ISP to change a static without advising the client first, it would cause absolute havoc.
It sounds like you have a 'Sticky' static address, which can be made even more sticky by fixing the DUID and IAID, as the IAID does is fixed with pfSense ( at present ) that will not change. I suggest you set your DUID to fix it at its current value. You can also turn on 'Do not send release' which will prevent dhcp6c from sending a release signal, some ISP's will give you a new address/prefix if they get a release signal. However as Comcast say you are on a static this should not happen either.
I have a sticky dhcp6 address, through experimentation it's been found that if both the above are carried out, fixing the DUID and never sending a release signal then the prefix never changes, the only side note would be if pfsense went offline for several days, in which case I 'might' get a new prefix.
-
Comcast claims I have a static ipv6, but I've seen the network ID change.
Google searches still show that Comcast does not support static ipv6 addressing. My ipv6 address changes every time they put in a new modem. My ipv4 address is unchanged across all the supplied modems.
Don't expect a static any time soon. The 'static' problem is supposed to be taken care of by DNS when the router and DNS providers get it all working. "Services, DHCPv6 Server & RA, LAN, DHCPv6 Server, Dynamic DNS Display" is the new static in it's early stages.
I don't want to risk a situation where the network ID changes, and then the ipv6 network goes down when I'm not there.
If I have a tracking interface, with working unmanaged RA, it'll be self healing.
No it won't. Try repowering the modem with a switch in between the router and the cable box so the router can't sense link down. The address won't change but connectivity will be lost.
NATv6 FTW until this problem is fixed.
-
You can also turn on 'Do not send release' which will prevent dhcp6c from sending a release signal, some ISP's will give you a new address/prefix if they get a release signal.
Where is that setting? I sometimes get a new prefix and in testing I could see pfSense send a DHCPv6 release after I disconnected and reconnected the WAN Ethernet cable. My DUID has not changed since last May. I'm on Rogers.
-
You can also turn on 'Do not send release' which will prevent dhcp6c from sending a release signal, some ISP's will give you a new address/prefix if they get a release signal.
Where is that setting? I sometimes get a new prefix and in testing I could see pfSense send a DHCPv6 release after I disconnected and reconnected the WAN Ethernet cable. My DUID has not changed since last May. I'm on Rogers.
Interfaces/WAN/DHCP6 Client Configuration - Do not allow PD/Address release.
DUID hold is in System/Advanced/Networking.
-
I don't see that, even under Advanced Configuration. I'm running pfSense 2.3.2_1.
-
DHCP6 Client Configuration, 2.4B ;)
"Do not allow PD/Address release"
"dhcp6c will send a release to the ISP on exit, some ISPs then release the allocated address or prefix. This option prevents that signal ever being sent" -
@hda:
DHCP6 Client Configuration, 2.4B ;)
"Do not allow PD/Address release"
"dhcp6c will send a release to the ISP on exit, some ISPs then release the allocated address or prefix. This option prevents that signal ever being sent"Did I fail to mention that… Beg pardon 8)
-
DHCP6 Client Configuration, 2.4B
There's a version 2.4B???
I'm supposedly at the latest and I don't see that setting anywhere.
-
DUID hold is in System/Advanced/Networking.
I don't see that one either. My version of pfSense must have come from a parallel universe or something, as it doesn't appear to have either of those settings.
-
It's a setting in the pfSense 2.4 beta.
-
I'll have to watch for that new version. Any idea when it will be available?
-
I'll have to watch for that new version. Any idea when it will be available?
For several months now… Its in beta but its very stable. Either install from clean, my preference, or you can select 2.4 as you should find it in update/update settings.
-
You can also turn on 'Do not send release' which will prevent dhcp6c from sending a release signal, some ISP's will give you a new address/prefix if they get a release signal.
I've found that in v2.3.3 and have set it. Hopefully it works, so my prefix won't change simply because I unplugged my Ethernet cable.
Incidentally, why did pfSense send a DHCPv6 release when the computers was merely disconnected from the modem & reconnected? I could see that happening when I monitored the connection with Wireshark. A release is something that should be specifically requested and not occur for something as trivial as a disconnect/reconnect.
-
You can also turn on 'Do not send release' which will prevent dhcp6c from sending a release signal, some ISP's will give you a new address/prefix if they get a release signal.
I've found that in v2.3.3 and have set it. Hopefully it works, so my prefix won't change simply because I unplugged my Ethernet cable.
Incidentally, why did pfSense send a DHCPv6 release when the computers was merely disconnected from the modem & reconnected? I could see that happening when I monitored the connection with Wireshark. A release is something that should be specifically requested and not occur for something as trivial as a disconnect/reconnect.
Because dhcp6c exits and on exit it sends a release, hence the addition of the no-release flag and an updated dhcp6c client.
-
The question is why it sends the release by default. With IPv4 DHCP, a device normally requests the same address on re-connection and gets it if available. You have to specifically request a release. Why shouldn't it be the same with IPv6?
-
The question is why it sends the release by default. With IPv4 DHCP, a device normally requests the same address on re-connection and gets it if available. You have to specifically request a release. Why shouldn't it be the same with IPv6?
Because it's a totally different client and bears little resemblance to its v4 counterpart.
-
DHCPv6 has something called "DUID" the purpose of which is to identify the client so it get the same prefix. Having the default release means that no longer works. With IPv4, a changed address could affect a single device, but on IPv6 at least a /64, but often more, affecting potentially gazillions of addresses. When the prefix changed, I had to go and update all the DNS entries for devices on my network, even if I did nothing more than connect in a managed switch, so that I could monitor the traffic with Wireshark. I don't think the release should be happening, unless specifically requested, as happens with IPv4.
-
That's why it's been modified along with the DUID stored in the config.
