Unique Local Addresses?
-
Regardless of rules etc., it shouldn't be difficult/impossible to set up an alias, along with RA for the ULA prefix. Also, setting up an alias shouldn't kill the GUA on the LAN interface. As I mentioned, RA works fine for ULA, but an address is not assigned to the LAN interface and creating an alias kills the router for IPv6. A business user may have reasons for routing ULA between sites via VPN. PfSense won't allow that, as far as I can see.
-
"A business user may have reasons for routing ULA between sites via VPN. PfSense won't allow that, as far as I can see."
Why is that.. I just created a gateway to my ULA box the 5133::100 address, I then created a route saying hey if you want to go to 5134::/64 talk to the gateway… I then did a sniff and pinged from pfsense to a 5134::100 address and it sent the traffic from its vip 5133::1 address to 5134:100 to the mac of my 5133:100 box.. So sure looks like that is routing to me.
If it was via a vpn connection, then would have its own vpn interface, etc. any could for sure create routes that go down that tunnel to get to a ULA range.
So I am still confused as to what is not working, or then trying to create some alias that has both your Global address that you got via a TRACK interface network? And this is changing on you?? Are you saying you can not create a alias with your IPv6 global address and your ULA..
Sorry not seeing what your issue is.
-
So I am still confused as to what is not working
Have a look at https://redmine.pfsense.org/issues/5999, that is just the tip of the iceberg.
But more specifically having a virtual IP set on an interface that is also tracking the WAN. Similarly if an interface is a DHCP client and also needs a VIP we get into the same situation.Basically, as has been discussed before, IPv6 is fundamentally different than IPv4 in some of the basic principles, starting with the fact that an interface can and does have more than one IP address, this is defined in the RFCs. It can have a mixture of any number of ULAs, GUAs and a link-local addresses. Consequently, the software needs to be aware of this and make intelligent choices, or allow the user to dictate, based on this fact.
Many of the functionalities in pfSense, and quite possibly the underlying FreeBSD OS, are just "enhanced" versions of their IPv4 counterpart and haven't necessarily taken this requirement to heart. As the redmine ticket indicates, there is much work to be done to bring the code base up-to full to par so that expected IPv6 behavior works.I'm thinking that a work-around in JKnott's case might be to assign the ULA range to a separate interface and plug it into the same L2 as the LAN interface.
-
So I am still confused as to what is not working, or then trying to create some alias that has both your Global address that you got via a TRACK interface network? And this is changing on you?? Are you saying you can not create a alias with your IPv6 global address and your ULA..
Once again. I can set up ULA with RA, no problem, but the pfSense LAN interface doesn't get an IPv6 address. When I create an alias on the pfSense LAN port, for the ULA, I cannot even ping it. It simply doesn't respond. Worse, when I reboot the firewall, I lose the GUA address on the WAN port. Up the thread, someone else posted some links that showed problems with alias addresses on pfSense.
So, what I'm trying to do is
a) create the ULA with RA - this works
b) get a working ULA address on the LAN interface. This doesn't work.Can you ping from a device on a ULA only to the firewall? And to the VPN?
I spent all yesterday afternoon, trying to just be able to ping a ULA address on the pfSense LAN interface, without success. This is decribed further up the list.
However, I'll try again and see what happens.
-
I just tried it and the same thing happens. I cannot even ping the firewall ULA and after rebooting it, I lose IPv6 to my network. PfSense is busted!!!
-
One thing I just thought of. It may not be necessary for pfSense to have a ULA to route from the ULA prefix. Routing is still done via the link local address. I'll have to see if I can figure out some way to test this. I may have to dust off my Cisco 2600 router.
-
" just tried it and the same thing happens. I cannot even ping the firewall ULA and after rebooting it, I lose IPv6 to my network. PfSense is busted!!!"
Maybe your pfsense is busted.. But this is not the case with mine.. Add ULA address as VIP.. Works as it should - can ping it to that address (if firewall rules allow it) and routes just fine..
What your saying makes ZERO sense - how would adding a vip cause such an issue?? Be it a ula or another global, etc..
-
I don't know why it's happening, but it happened twice. Also, as mentioned in other posts, there apparently is a problem. And I created the alias by clicking on Firewall > Virtual IPs.
-
And what did you pick for the type of VIP?
-
-
With pfSense 2.4.0, I can now add a ULA alias on my LAN interface, without losing Internet access. It appears there was a problem with the previous version.
-
^^^^
Looks like I spoke too soon. As before, after a reboot, the problem returns. However, one thing I noticed is the default route on my computer changes, from the main LAN to a VLAN interface on my pfSense router. I'm not sure what causes this, as the VLAN has a different prefix from the ULA on the main LAN.Why would the default route change? I checked the router.priority for each RA and the VLAN is set to low and main LAN set to normal.
-
It's currently working, with the ULA alias. I have no idea why it's working now and not before.
I set the mail RA priority to high, but IP -6 route show shows both the main LAN and VLAN to have medium preference:
default via fe80::1:1 dev eth0 proto ra metric 1024 expires 58sec hoplimit 64 pref medium
default via fe80::216:17ff:fea7:f2d3 dev vlan3 proto ra metric 1024 expires 51sec hoplimit 64 pref mediumShouldn't that reflect the router priority setting, which is high for main LAN and low for VLAN3?
My computer is running OpenSUSE Linux.
-
Once it is added in, you can then setup the prefix in the RA config to advertise each prefix defined on the interface. Note that clients on that L2 will get an address for EACH advertised prefix (if listening to RAs). Keep in mind they will also get more than 1 gateway this way.
Just one correction, It will still be only one Gateway no matter how many prefixes are advertised. You would only get a 2nd Gateway if you had a 2nd box broadcasting RAs. 1 box broadcasting many prefixes = 1 Gateway.
And that gateway is a Link Local address, not a ULA or GUA.
-
^^^^
It shows both gateways, but whatever happens, I lose Internet access. I can ping local addresses, including ULA, so routing still appears to be functioning at least that far, but I cannot get out to the Internet. Also, sometimes it works OK after rebooting, Sometimes it doesn't. I have no idea why it's failing. I agree it shouldn't matter which is default route, as both are to a link local address on the same interface. -
Do you have more then 1 router? If not there should not be more then 1 gateway.
If you only have 1 pfSense router, then you need to find what is advertising itself as a router.
Again 1 router advertising more then 1 prefix will still only advertise 1 gateway.
Edit: i just noticed someing in a prev post. Do you have 2 pfsense interfaces plugged into the same layer2/vlan?
-
There is only 1 router, pfSense. The router has to advertise itself on all interfaces, including VLANs. Regardless, it shouldn't matter, because all RAs point to the same router. I have a main LAN and a VLAN on 1 interface. The main LAN has both global and ULA addresses. The curious thing is that when I configure the pfSense alias for the ULA on the main LAN, everything works fine. But if I then reboot pfSense, it usually, but not always fails.
-
I was and am confused becuase you said that hey you have two gateways which sounded like it was on the same client like your client was seen two different Gateway from pfSense if that's the case that makes no sense and it would lead me to believe that two different vlans are mixed together on the same layer 2/brodcast domain. Unless I'm just misunderstanding what you're saying.
-
I get 2 router advertisements, one on the main LAN and 1 on the VLAN. I don't think I ever said I had 2 gateways. The RAs have to be on every interface, including VLANs, so that every device will receive them. However, that doesn't hurt, as it's still the same gateway, no matter which RA is used. Regardless, just adding ULA alias on the main LAN is what causes the problem I really don't understand why it should. A I mentioned, the problem usally happens after a reboot. Prior to the reboot, everything works fine.
-
Aren't you the one who thinks he can use an unmanaged switch to "isolate" VLANs? Is that the case here?
