pfSense gets addresses, clients don't!?



  • I've been having IPv6 issues for a while but never really got around to nailing them down. I feel like I'm 99% of the way there and I'm slightly out of my comfort zone and I may have something set wrong. If someone could sanity-check what I'm doing it would be great, thanks!

    Clients are FreeBSD 11.2, Windows 10, and iOS 12.2 with pfSense build
    2.5.0.a.20190513.0647. The BSD box reports an IPv6 of ::1/128 which is obviously wrong. pfSense interfaces are showing the correct info:-

    Interfaces.png

    The IPv6 addresses here are in the correct ranges as per my ISP who give me a /64 ND prefix and a delegated /48. When I previously looked at it, there was a suggestion my ISP was sending out the /128 but that doesn't seem to be the case.

    The routing system log is showing this:-
    System Routing Log.png

    But the WAN config shows a /64 for the ND prefix...
    WAN-config.png

    And the DHCPv6 Options also appear to be picking up /64
    DHCPv6 Options.png

    There's nothing much in the LAN configuration...
    LAN-Config.png

    ...and the Router Advertisements look like this.
    Advertisements.png

    Thanks in advance!


  • LAYER 8 Global Moderator

    moved to 2.5 section..

    Can tell you right now that /48 on you lan is wrong..

    When you track you should get the first /64 out of what was delegated to you.. Not a /48..



  • That's interesting, because I'm not telling it what to use (so far as I can see) and the /48 it is in is the one my ISP assigned me. So where the heck is it getting that from!?

    If I was to try and do a packet capture to try to see what's being sent, are what settings would you recommend?



  • @johnpoz - if I was to decide to use my delegated /48 instead, do I set the WAN IP as fixed and then “track” it on the LAN or set fixed IPs in the delegated range for both?

    I really feel like I should know this kind of thing as I covered IP6 and a lot of low level networking stuff at uni but it was 20 years ago!


  • LAYER 8 Global Moderator

    you would never put a /48 on an interface - would be /64

    thisiswrong.png



  • Looks like you're on Zen. I have this working with IPv6 on 2.4.4.

    In your WAN>DHCP6 Client Configuration:

    • uncheck 'Only request an IPv6 prefix, do not request an IPv6 address'.
    • Change DHCPv6 Prefix Delegation size to 48

    There are some great posts by David_W which you might find useful:
    https://forums.thinkbroadband.com/zen/t/4542153-ipv6-problems.html



  • @bigsy - thanks I am with Zen, I changed those options and the only thing that has changed is that the LAN interface is now showing as a /64 subnet but I can't work out what change caused that to happen, when I roll the config back to before any changes it doesn't revert to the /48.

    The /64 I get on the LAN adapter is still out of the /48 range I'm given by the ISP. I've fired up a packet capture to see what was going on and I can see the client I'm testing from making DHCPv6 Solicit requests - but pfSense is not responding to them.

    Unless someone has any better ideas I'm going to set my WAN IPv6 to None, give LAN a static address and start work from there... I figure if pfSense isn't responding to solicit requests in that situation then I've done pretty much all I can.



  • @motific Can you try things in pfsense 2.4.4? IPv6 with Zen is definitely fine with me on 2.4.4p3. I have not tried it with 2.5.0 so perhaps something has broken there?

    Do you have one of the original beta-tester IPv6 Zen setups or the framed IPv6 route which I think they now give out? I now have the latter. I have the two virtual IP entries (/128 IP Alias and /48 Other) referred to in the linked discussion and have set static addresses on my internal interfaces.



  • @bigsy - I have now taken Zen completely out of the equation and disabled IP6 on the WAN and statically assigned the LAN.

    As of now the problem is purely pfSense not handing out addresses. I’ll post more info later.



  • @motific said in pfSense gets addresses, clients don't!?:

    And the DHCPv6 Options also appear to be picking up /64

    d8cf0dd1-7475-448d-9d8f-ba5bb4b7367e-image.png

    That range doesn't looks 'ok' to me.

    I'm not using Track-IPv6 myself, but I assigned the first /64 chunk out of the /48 to my LAN, the DHCP6 pool will be correct then ....
    (next /64 chunk of the /48 on second LAN, etc.)


  • Galactic Empire

    @johnpoz said in pfSense gets addresses, clients don't!?:

    moved to 2.5 section..
    Can tell you right now that /48 on you lan is wrong..
    When you track you should get the first /64 out of what was delegated to you.. Not a /48..

    IPv6 works fine with Zen, mine is configured as follows:-

    Screenshot 2019-05-30 at 15.55.19.png

    The VLANS are configured statically, split your /48.

    They are your addresses and will only ever be allocated to you, there's no need to track.

    Screenshot 2019-05-30 at 15.55.40.png

    Screenshot 2019-05-30 at 15.55.50.png


  • Galactic Empire

    Screenshot 2019-05-30 at 16.12.06.png



  • @NogBadTheBad - I basically have changed it to how you have it now but with the WAN IPV6 set to none.

    I have done a packet capture from pfSense and can see DHCPv6 Solicit requests going unanswered.


  • Galactic Empire

    @motific said in pfSense gets addresses, clients don't!?:

    e been having IPv6 issues for a while but never really got around to nailing them down. I feel like I'm 99% of the way there and I'm slightly out of my comfort zone and I may have something set wrong. If someone could sanity-check what I'm doing it would be great, thanks!
    Clients are FreeBSD 11.2, Windows 10, and iOS 12.2 with pfSense build
    2.5.0.a.20190513.0647. The BSD box reports an IPv6 of ::1/128 which is obviously wrong. pfSense interfaces are showing the correct info:-

    Maybe its an issue with the development release, I don't know as I run 2.4.4-RELEASE-p3 rather than a development release.

    BTW all my clients report a /128, it's correct DHCPv6 servers give out addresses but don't tell the client anything about the subnet as thats handled by the RAs


  • LAYER 8 Global Moderator

    If your wanting to use dhcpv6 vs just ra, you need to use the managed with onlink I do believe. Not 100% on that since don't ever run dhcpv6.. Don't see a point to it in my setup.

    You really should post up your dhvp6 settings and your RA settings.

    with out the onlink flag your prob only going to get /128's but that is going to be troublesome.. Is been some time where did anything with that.

    My current play with ipv6, I just set static on boxes I want to use ipv6 on..

    But as I think about it more your going down the dhcpv6 path you prob want assisted mode with onlink and auto..



  • @johnpoz - I’ve changed the config a lot since I posted originally so I’ll post a fresh set of screenshots when I’m back in a couple of hours. I don’t really mind if what IPv6 assignment I use if it works because nothing is working. Though if there is an issue with DHCPv6 in 2.5.0 then it probably needs hunting down.

    I traced some of the original issues in the thread you quoted back to pfBlocker (I’m on BBCan177’s private beta list) there was something pointing to the virtual IP when it shouldn’t have been so for now I have that disabled until I sort this out.



  • @NogBadTheBad - my clients only show a link-local address.


  • LAYER 8 Global Moderator

    I could fire up a 2.5 snap... But I just fired up dhvp6 on 2.4.4p3 and working fine... My client pulled global IPv6 out of the ranged I called for, etc.

    dhvp6lease.png

    And using onlink, so I get valid route for the local /64
    64route.png

    And clearly can talk outbound IPv6

    $ ping ipv6.google.com
    
    Pinging ipv6.l.google.com [2607:f8b0:4009:800::200e] with 32 bytes of data:
    Reply from 2607:f8b0:4009:800::200e: time=44ms
    Reply from 2607:f8b0:4009:800::200e: time=32ms
    Reply from 2607:f8b0:4009:800::200e: time=43ms
    Reply from 2607:f8b0:4009:800::200e: time=32ms
    
    Ping statistics for 2607:f8b0:4009:800::200e:
        Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
    Approximate round trip times in milli-seconds:
        Minimum = 32ms, Maximum = 44ms, Average = 37ms
    

  • LAYER 8

    i think we have a "Layer 8" problem here, idk about zen but i have 2 different tunnel with Hurricane electric (HE) with pfsense 2.5.0 in 2 different home, i have WAN configured as none and in the lan interface i assigned a static ip from the first /64 chunk out of the /48 from HE after that i enabled dhcpv6 with mode Assisted -ra flags (idk if it's right but it work for me)
    So if i assign something like 2001:xxx:xx:xxx:: 1 to the lan interface, the available range for dhcpv6 should be
    2001:xxx:xxx:xxx:: 2 to 2001:xxx:xx:xxx:ffff:ffff:ffff:ffff just to be safe. i have no problem at all with dhcpv6 and my pc have working ipv6 address and dns from pfsense 2.5.0
    ipv6.jpg



  • @kiokoman “idk if it’s right” is probably not a phrase you want to be using when suggesting a Layer 8 issue :)


  • LAYER 8

    @motific yeah that was only my intention to say something funny not to offend or else :) "idk if it's right" because i don't remember why i selected that options when i have configured my interface, you have to pardon me because english is not my first language and sometimes i don't use/don't know the right word

    now that i think about it, it's because i have android devices that only use SLAAC for IPv6 addresses, as you can see on the photo i have ath0 and athp0 in that machine.



  • @kiokoman - I took it in the spirit it was intended! It was funny and I'm totally not ruling out a Layer-8 issue!

    Android devices aren't a concern for me, I don't allow them on this network. :)



  • I have basically copied @NogBadTheBad 's config, I have IPv6 to WAN directly from pfSense. LAN clients get nothing. You can see from the packet capture that pfSense is receiving Solicit requests, but does not answer and (so far as I can tell) it should.

    WAN is on DHCP, pfSense can ping IPv6 addresses on the internet.
    LAN is static

    WAN.png

    LAN.png

    DHCPv6-Options.png

    RA-Options.png

    These are the results from that config...

    DHCPv6-Leases.png

    Packet-Capture.png


  • Galactic Empire

    Hmmm very odd, I'm a bit stuck as mine works fine and to be honest when I set it up I didn't know alot about IPv6, it just sort of worked.

    Screenshot 2019-06-03 at 13.44.46.png


  • LAYER 8

    maybe a stupid question but did you check the firewall to see if ICMPv6 is blocked?



  • @motific I’m pretty sure your WAN is still not correct. Zen hand out a /48 and this should be reflected in the WAN>DHCP6 Client Configuration>DHCP6 Prefix Delegation size.

    5EC523C9-D7B4-4DD4-9467-6C0D228A1DD2.jpeg

    Can you post the information that Zen sent you whenever you had IPv6 enabled (minus IP addresses)?


  • Galactic Empire

    It will be something like mine:-

    Thank you for your email. Your subscriber account (zenxxxx@zen) has now been enabled for IPv6. The new attributes will take effect next time the session is restarted. Your IPv6 address details are;

    ND Prefix: 2a02:xxxx:xxxx:xx::/64
    PD Prefix: 2a02:yyyy:yyyy::/48

    The two prefixes are described below, along with some further information on the Zen IPv6 service:

    /64 Neighbour Discovery (ND) Prefix. This is used to automatically address the WAN interface of your Router, or if you are directly connected without a router, the WAN interface of that device.

    /48 Delegation Prefix. This is usually provided over DHCPv6, and requires that your router acts as a requesting router for the purpose of IPv6 delegation RFC3633 - (https://tools.ietf.org/html/rfc3633). Subnets of this prefix are used by the CPE to address devices on the LAN. If prefix delegation is not supported on the router, a suggested interface ID and static route is available, which should allow routing to take place.



  • @bigsy - WAN is fine, it's in the ranges provided by Zen and it works just fine as I can ping IPv6 hosts from pfSense without an issue...

    What I can't do is get any IPs to clients.

    But if you're interested...

    Good Afternoon,

    Your subscriber account zenxxxxxx@zen, has been enabled for IPv6. The new attributes will take effect next time the session is restarted.

    Your IPv6 Address details are;
    ND Prefix 2a02:8011:XXXX:X::/64
    Delegated Prefix 2a02:8010:XXXX::/48
    Regards,



  • @kiokoman - At this point anything is worth checking but as the packet capture was from my pfSense box I'd expect outbound blocked content not to show up (unless there's some 'gotcha' I don't know about).

    I've just done a capture from a client, that is seeing ICMPv6 messages btw.


  • LAYER 8 Global Moderator

    Wow pretty impressive email, and they delegate a /48 nice!!

    You understand none of that actually means anything if your wanting to hand out dhcpv6 on your lan and that is not working.. Forget about the the delegation or any of that until figure out why when you set a static on your lan, and enable dhcpv6 your not sending back anything..



  • @johnpoz - I get that entirely. I was just about to point that out.

    Interestingly, stateless addresses aren't working either... feel free to correct me if I'm wrong here - as I understand it if the RA messages are getting out then in that mode the clients should be giving themselves addresses via Stateless/SLAAC, right?

    I'm going back to the packet captures and go through them in more detail. I'll let you know what I find.


  • LAYER 8 Global Moderator

    So here is the thing if there was something wrong with 2.5 and clients being to get ipv6 behind it... The boards would be just on fire with posts about it...

    We need to figure out what is unique to your setup that is the problem... Doesn't matter if you get a delegation from your isp or what is on our wan... If you setup an ipv6 on your lan, then that is what your clients should get be it auto, dhcpv6, whatever.. Your wan is out of the picture..



  • @johnpoz - That's a good point, there would be noise about it if it were purely a 2.5 issue. My IPv6 on LAN is set completely manually, so WAN is now completely irrelevant as you say.

    It looks like the problem runs deeper than I originally thought, looking back at the packet capture I'm seeing as well as not responding to DHCPv6 Solicit requests there is no ICMPv6 NDP traffic leaving on the LAN interface at all, it's all inbound.

    radvd appears to be running etc.

    I think at this point I'm going to wipe this box, reconfigure and see what happens rather than spend any more time trying to figure out what has happened to it. I'll get back to you all either way on how that goes.


  • LAYER 8

    this is what i found, specific configuration for Zen uk and ipv6, i hope it can be useful for you.

    WAN
    IPv6 using DHCP, select DHCP6 in the IPv6 connection
    DHCPv6 Prefix Delegation size /48
    Use IPv4 connectivity as parent interface

    LAN
    Select Interfaces ‣ [LAN] and set the IPv6 Configuration Type to ‘Track Interface’
    set the Track IPv6 Interface to WAN,
    set the IPv6 Prefix ID to 0.

    Reboot the system

    DHCPv6 LAN server should be set automatically with subnet mask /64
    range from *:0000:0001 to *:ffff:ffff:ffff


  • Banned



  • @kiokoman - read what johnpoz wrote above.



  • @Grimson - very funny. 😆


  • LAYER 8

    @motific it was only so that, if you wipe your machine and start over, you have a summary of the step needed



  • @kiokoman - thanks, looks like apart from doing the DHCP request via IP4 it was all preset and ready to go out of the box. :)

    Having wiped the machine the problem seems to be sorted.


Log in to reply