How-to disable ipv6 dns server from dhcp (v4) server



  • Hello
    I have an issue with the dhcp server configured with 2 adresses ip for the dns server, but in the windows clients a third ipv6 address will be added and it is used as default and not working.
    Thanks for the help!


  • LAYER 8 Global Moderator

    And what is this ipv6 IP its pointing too? Are you running ipv6?

    dhcpv4 doesn't hand out IPv6 dns! That would be via dhcpv6, or IPv6 can get its dns from SLAAC.. Via the RA.



  • I don't use Ipv6 and the dns address was fe80::7e35:xxxx:xxxx:151a


  • LAYER 8 Global Moderator

    fe80 is link local address. If you don't use ipv6, are you on windows - then uncheck for it to be used in your interface configuration.



  • I have some visitor, and I don't want to Config anything in clients.
    Note : when I plug any client directly to ISP router the connexion work fine.


  • LAYER 8 Global Moderator

    Well your prob handing out RA via pfsense.. Or some other device and that is how your clients are getting the IPv6 dns.



  • @hadrich said in How-to disable ipv6 dns server from dhcp (v4) server:

    I don't use Ipv6 and the dns address was fe80::7e35:xxxx:xxxx:151a

    That's a link local address and if you don't have IPv6 it won't be used for much. You can ignore it. Every IPv6 capable device will have one of those.


  • LAYER 8 Global Moderator

    That is where is dns is pointing to, while I agree he should switch over to his other IPv4 dns when that doesn't answer. Its still not optimal to have IPv6 that doesn't work configured.

    Either fix it so it works, or disable it is best... If he has no working IPv6 he shouldn't be handing link-local out for NS via RA..



  • Thinks for your responses.
    How-to disable Ipv6 or how-to Config RA.
    I'm sorry, I don't understand very well Ipv6 and I don't use it.



  • @johnpoz said in How-to disable ipv6 dns server from dhcp (v4) server:

    That is where is dns is pointing to

    How did that happen, unless someone configured it somewhere. An IPv4 DHCP server cannot be configured to do that and there would have to be IPv6 enabled on the network, not just LL addresses, for it to be configured on a router.

    If he has no working IPv6 he shouldn't be handing link-local out for NS via RA..

    If IPv6 is not enabled on the network, there shouldn't be any RAs to provide a DNS address. If there are RAs, there's an IPv6 enabled router somewhere.


  • LAYER 8 Global Moderator

    Before we get all nuts... Lets make sure you just didn't set this on the client..

    Lets see the output of ipconfig /all



  • The output of ipconfig /all : (for local adapter)

    Ethernet adapter Local Area Connection:
    
       Connection-specific DNS Suffix  . : xxxxx.local
       Description . . . . . . . . . . . : Intel(R) PRO/1000 MT Desktop Adapter
       Physical Address. . . . . . . . . : 08-00-XX-XX-XX-1D
       DHCP Enabled. . . . . . . . . . . : Yes
       Autoconfiguration Enabled . . . . : Yes
       Link-local IPv6 Address . . . . . : fe80::905b:ae6:53db:fc64%11(Preferred)
       IPv4 Address. . . . . . . . . . . : 192.168.183.171(Preferred)
       Subnet Mask . . . . . . . . . . . : 255.255.255.0
       Lease Obtained. . . . . . . . . . : vendredi 24 janvier 2020 20:04:01
       Lease Expires . . . . . . . . . . : samedi 25 janvier 2020 11:34:08
       Default Gateway . . . . . . . . . : 192.168.183.254
       DHCP Server . . . . . . . . . . . : 192.168.183.254
       DHCPv6 IAID . . . . . . . . . . . : 235405351
       DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-25-BC-61-2B-08-00-XX-XX-XX-1D
    
       DNS Servers . . . . . . . . . . . : fe80::a76:ffff:feb3:aa72%11
                                           192.168.183.254
       NetBIOS over Tcpip. . . . . . . . : Enabled
    

  • LAYER 8 Global Moderator

    And do you have dhvpv6 or RA enabled on pfsense?

    RA.jpg



  • Screenshot from 2020-01-25 12-47-08.png



  • @hadrich

    What about the RA tab? IPv6 can use RDNSS to provide the DNS address.


  • LAYER 8 Global Moderator

    Yeah but RAs would have to be running..

    Do you see radvd running in Status / Services

    Its not suppose to run if you don't have IPv6 setup on your lan interfaces.. Simple enough to sniff to see if your seeing the RAs - and from where..

    sniffRA.jpg



  • @johnpoz

    Well, it's coming from somewhere. The OP can run Packet Capture or Wireshark, filtering on ICMP6, to see where and find out the MAC address.


  • LAYER 8 Global Moderator

    ^ agreed, which is why I gave an example of doing just that!

    The sniff will give us positive proof/info of where its coming from.



  • Screenshot from 2020-01-28 13-22-15.png
    The result of : sudo tcpdump ip6

    13:16:53.314987 IP6 fe80::ed39:2950:1669:fe0c > ff02::16: HBH ICMP6, multicast listener report v2, 1 group record(s), length 28
    13:16:53.314993 IP6 fe80::ed39:2950:1669:fe0c > ff02::16: HBH ICMP6, multicast listener report v2, 1 group record(s), length 28
    13:16:53.315092 IP6 fe80::fab1:56ff:feca:a7f > ff02::1:ff00:0: ICMP6, neighbor solicitation, who has ::, length 32
    13:16:53.316529 IP6 fe80::ed39:2950:1669:fe0c > ff02::16: HBH ICMP6, multicast listener report v2, 1 group record(s), length 28
    13:16:53.316533 IP6 fe80::ed39:2950:1669:fe0c > ff02::16: HBH ICMP6, multicast listener report v2, 1 group record(s), length 28
    13:16:53.317795 IP6 fe80::ed39:2950:1669:fe0c.dhcpv6-client > ff02::1:2.dhcpv6-server: dhcp6 inf-req
    13:16:53.317799 IP6 fe80::ed39:2950:1669:fe0c.dhcpv6-client > ff02::1:2.dhcpv6-server: dhcp6 inf-req
    13:16:53.322526 IP6 fe80::ed39:2950:1669:fe0c > ff02::16: HBH ICMP6, multicast listener report v2, 1 group record(s), length 28
    13:16:53.322530 IP6 fe80::ed39:2950:1669:fe0c > ff02::16: HBH ICMP6, multicast listener report v2, 1 group record(s), length 28
    13:16:53.323345 IP6 fe80::ed39:2950:1669:fe0c.61385 > ff02::1:3.llmnr: UDP, length 28
    13:16:53.323348 IP6 fe80::ed39:2950:1669:fe0c.61385 > ff02::1:3.llmnr: UDP, length 28
    13:16:53.326481 IP6 fe80::a76:ffff:feb3:aa72.dhcpv6-server > fe80::ed39:2950:1669:fe0c.dhcpv6-client: dhcp6 reply
    13:16:53.428126 IP6 fe80::ed39:2950:1669:fe0c.61385 > ff02::1:3.llmnr: UDP, length 28
    13:16:53.428139 IP6 fe80::ed39:2950:1669:fe0c.61385 > ff02::1:3.llmnr: UDP, length 28
    13:16:53.521076 IP6 :: > ff02::1:ff69:fe0c: ICMP6, neighbor solicitation, who has fe80::ed39:2950:1669:fe0c, length 24
    13:16:53.521078 IP6 :: > ff02::1:ff69:fe0c: ICMP6, neighbor solicitation, who has fe80::ed39:2950:1669:fe0c, length 24
    13:16:53.521120 IP6 fe80::ed39:2950:1669:fe0c > ip6-allrouters: ICMP6, router solicitation, length 16
    13:16:53.521122 IP6 fe80::ed39:2950:1669:fe0c > ip6-allrouters: ICMP6, router solicitation, length 16
    13:16:53.521191 IP6 fe80::ed39:2950:1669:fe0c > ff02::16: HBH ICMP6, multicast listener report v2, 2 group record(s), length 48
    13:16:53.521197 IP6 fe80::ed39:2950:1669:fe0c > ff02::16: HBH ICMP6, multicast listener report v2, 2 group record(s), length 48
    13:16:53.565274 IP6 fe80::ed39:2950:1669:fe0c > ff02::1:ffb3:aa72: ICMP6, neighbor solicitation, who has fe80::a76:ffff:feb3:aa72, length 32
    13:16:53.565278 IP6 fe80::ed39:2950:1669:fe0c > ff02::1:ffb3:aa72: ICMP6, neighbor solicitation, who has fe80::a76:ffff:feb3:aa72, length 32
    13:16:53.566265 IP6 fe80::a76:ffff:feb3:aa72 > fe80::ed39:2950:1669:fe0c: ICMP6, neighbor advertisement, tgt is fe80::a76:ffff:feb3:aa72, length 32
    
    

  • LAYER 8 Global Moderator

    Well open that RA up and look at it with wireshark... Your dump not showing enough info.



  • Sorry for the long time to response because i was very busy and i take a time to understand wireshark and a little ipv6 😋. The problem come from another router that i disabled his dhcp service to use it as AP (wireless). Then i disabled its ipv6 to resolve the problem.


Log in to reply