How-to disable ipv6 dns server from dhcp (v4) server

hadrich

Hello
I have an issue with the dhcp server configured with 2 adresses ip for the dns server, but in the windows clients a third ipv6 address will be added and it is used as default and not working.
Thanks for the help!

johnpoz

And what is this ipv6 IP its pointing too? Are you running ipv6?

dhcpv4 doesn't hand out IPv6 dns! That would be via dhcpv6, or IPv6 can get its dns from SLAAC.. Via the RA.

hadrich

I don't use Ipv6 and the dns address was fe80::7e35:xxxx:xxxx:151a

johnpoz

fe80 is link local address. If you don't use ipv6, are you on windows - then uncheck for it to be used in your interface configuration.

hadrich

I have some visitor, and I don't want to Config anything in clients.
Note : when I plug any client directly to ISP router the connexion work fine.

johnpoz

Well your prob handing out RA via pfsense.. Or some other device and that is how your clients are getting the IPv6 dns.

JKnott

@hadrich said in How-to disable ipv6 dns server from dhcp (v4) server:

I don't use Ipv6 and the dns address was fe80::7e35:xxxx:xxxx:151a

That's a link local address and if you don't have IPv6 it won't be used for much. You can ignore it. Every IPv6 capable device will have one of those.

johnpoz

That is where is dns is pointing to, while I agree he should switch over to his other IPv4 dns when that doesn't answer. Its still not optimal to have IPv6 that doesn't work configured.

Either fix it so it works, or disable it is best... If he has no working IPv6 he shouldn't be handing link-local out for NS via RA..

hadrich

Thinks for your responses.
How-to disable Ipv6 or how-to Config RA.
I'm sorry, I don't understand very well Ipv6 and I don't use it.

JKnott

@johnpoz said in How-to disable ipv6 dns server from dhcp (v4) server:

That is where is dns is pointing to

How did that happen, unless someone configured it somewhere. An IPv4 DHCP server cannot be configured to do that and there would have to be IPv6 enabled on the network, not just LL addresses, for it to be configured on a router.

If he has no working IPv6 he shouldn't be handing link-local out for NS via RA..

If IPv6 is not enabled on the network, there shouldn't be any RAs to provide a DNS address. If there are RAs, there's an IPv6 enabled router somewhere.

johnpoz

Before we get all nuts... Lets make sure you just didn't set this on the client..

Lets see the output of ipconfig /all

hadrich

The output of ipconfig /all : (for local adapter)

Ethernet adapter Local Area Connection:

   Connection-specific DNS Suffix  . : xxxxx.local
   Description . . . . . . . . . . . : Intel(R) PRO/1000 MT Desktop Adapter
   Physical Address. . . . . . . . . : 08-00-XX-XX-XX-1D
   DHCP Enabled. . . . . . . . . . . : Yes
   Autoconfiguration Enabled . . . . : Yes
   Link-local IPv6 Address . . . . . : fe80::905b:ae6:53db:fc64%11(Preferred)
   IPv4 Address. . . . . . . . . . . : 192.168.183.171(Preferred)
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Lease Obtained. . . . . . . . . . : vendredi 24 janvier 2020 20:04:01
   Lease Expires . . . . . . . . . . : samedi 25 janvier 2020 11:34:08
   Default Gateway . . . . . . . . . : 192.168.183.254
   DHCP Server . . . . . . . . . . . : 192.168.183.254
   DHCPv6 IAID . . . . . . . . . . . : 235405351
   DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-25-BC-61-2B-08-00-XX-XX-XX-1D

   DNS Servers . . . . . . . . . . . : fe80::a76:ffff:feb3:aa72%11
                                       192.168.183.254
   NetBIOS over Tcpip. . . . . . . . : Enabled

johnpoz

And do you have dhvpv6 or RA enabled on pfsense?

hadrich

JKnott

@hadrich

What about the RA tab? IPv6 can use RDNSS to provide the DNS address.

johnpoz

Yeah but RAs would have to be running..

Do you see radvd running in Status / Services

Its not suppose to run if you don't have IPv6 setup on your lan interfaces.. Simple enough to sniff to see if your seeing the RAs - and from where..

JKnott

@johnpoz

Well, it's coming from somewhere. The OP can run Packet Capture or Wireshark, filtering on ICMP6, to see where and find out the MAC address.

johnpoz

^ agreed, which is why I gave an example of doing just that!

The sniff will give us positive proof/info of where its coming from.

hadrich

Screenshot from 2020-01-28 13-22-15.png
The result of : sudo tcpdump ip6

13:16:53.314987 IP6 fe80::ed39:2950:1669:fe0c > ff02::16: HBH ICMP6, multicast listener report v2, 1 group record(s), length 28
13:16:53.314993 IP6 fe80::ed39:2950:1669:fe0c > ff02::16: HBH ICMP6, multicast listener report v2, 1 group record(s), length 28
13:16:53.315092 IP6 fe80::fab1:56ff:feca:a7f > ff02::1:ff00:0: ICMP6, neighbor solicitation, who has ::, length 32
13:16:53.316529 IP6 fe80::ed39:2950:1669:fe0c > ff02::16: HBH ICMP6, multicast listener report v2, 1 group record(s), length 28
13:16:53.316533 IP6 fe80::ed39:2950:1669:fe0c > ff02::16: HBH ICMP6, multicast listener report v2, 1 group record(s), length 28
13:16:53.317795 IP6 fe80::ed39:2950:1669:fe0c.dhcpv6-client > ff02::1:2.dhcpv6-server: dhcp6 inf-req
13:16:53.317799 IP6 fe80::ed39:2950:1669:fe0c.dhcpv6-client > ff02::1:2.dhcpv6-server: dhcp6 inf-req
13:16:53.322526 IP6 fe80::ed39:2950:1669:fe0c > ff02::16: HBH ICMP6, multicast listener report v2, 1 group record(s), length 28
13:16:53.322530 IP6 fe80::ed39:2950:1669:fe0c > ff02::16: HBH ICMP6, multicast listener report v2, 1 group record(s), length 28
13:16:53.323345 IP6 fe80::ed39:2950:1669:fe0c.61385 > ff02::1:3.llmnr: UDP, length 28
13:16:53.323348 IP6 fe80::ed39:2950:1669:fe0c.61385 > ff02::1:3.llmnr: UDP, length 28
13:16:53.326481 IP6 fe80::a76:ffff:feb3:aa72.dhcpv6-server > fe80::ed39:2950:1669:fe0c.dhcpv6-client: dhcp6 reply
13:16:53.428126 IP6 fe80::ed39:2950:1669:fe0c.61385 > ff02::1:3.llmnr: UDP, length 28
13:16:53.428139 IP6 fe80::ed39:2950:1669:fe0c.61385 > ff02::1:3.llmnr: UDP, length 28
13:16:53.521076 IP6 :: > ff02::1:ff69:fe0c: ICMP6, neighbor solicitation, who has fe80::ed39:2950:1669:fe0c, length 24
13:16:53.521078 IP6 :: > ff02::1:ff69:fe0c: ICMP6, neighbor solicitation, who has fe80::ed39:2950:1669:fe0c, length 24
13:16:53.521120 IP6 fe80::ed39:2950:1669:fe0c > ip6-allrouters: ICMP6, router solicitation, length 16
13:16:53.521122 IP6 fe80::ed39:2950:1669:fe0c > ip6-allrouters: ICMP6, router solicitation, length 16
13:16:53.521191 IP6 fe80::ed39:2950:1669:fe0c > ff02::16: HBH ICMP6, multicast listener report v2, 2 group record(s), length 48
13:16:53.521197 IP6 fe80::ed39:2950:1669:fe0c > ff02::16: HBH ICMP6, multicast listener report v2, 2 group record(s), length 48
13:16:53.565274 IP6 fe80::ed39:2950:1669:fe0c > ff02::1:ffb3:aa72: ICMP6, neighbor solicitation, who has fe80::a76:ffff:feb3:aa72, length 32
13:16:53.565278 IP6 fe80::ed39:2950:1669:fe0c > ff02::1:ffb3:aa72: ICMP6, neighbor solicitation, who has fe80::a76:ffff:feb3:aa72, length 32
13:16:53.566265 IP6 fe80::a76:ffff:feb3:aa72 > fe80::ed39:2950:1669:fe0c: ICMP6, neighbor advertisement, tgt is fe80::a76:ffff:feb3:aa72, length 32

johnpoz

Well open that RA up and look at it with wireshark... Your dump not showing enough info.