Navigation

    Netgate Discussion Forum
    • Register
    • Login
    • Search
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search

    How-to disable ipv6 dns server from dhcp (v4) server

    DHCP and DNS
    3
    21
    3574
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • H
      hadrich last edited by

      Hello
      I have an issue with the dhcp server configured with 2 adresses ip for the dns server, but in the windows clients a third ipv6 address will be added and it is used as default and not working.
      Thanks for the help!

      1 Reply Last reply Reply Quote 0
      • johnpoz
        johnpoz LAYER 8 Global Moderator last edited by johnpoz

        And what is this ipv6 IP its pointing too? Are you running ipv6?

        dhcpv4 doesn't hand out IPv6 dns! That would be via dhcpv6, or IPv6 can get its dns from SLAAC.. Via the RA.

        An intelligent man is sometimes forced to be drunk to spend time with his fools
        If you get confused: Listen to the Music Play
        Please don't Chat/PM me for help, unless mod related
        2440 2.4.5p1 | 2x 3100 2.4.4p3 | 2x 3100 22.01 | 4860 22.01

        1 Reply Last reply Reply Quote 0
        • H
          hadrich last edited by

          I don't use Ipv6 and the dns address was fe80::7e35:xxxx:xxxx:151a

          JKnott 1 Reply Last reply Reply Quote 0
          • johnpoz
            johnpoz LAYER 8 Global Moderator last edited by

            fe80 is link local address. If you don't use ipv6, are you on windows - then uncheck for it to be used in your interface configuration.

            An intelligent man is sometimes forced to be drunk to spend time with his fools
            If you get confused: Listen to the Music Play
            Please don't Chat/PM me for help, unless mod related
            2440 2.4.5p1 | 2x 3100 2.4.4p3 | 2x 3100 22.01 | 4860 22.01

            1 Reply Last reply Reply Quote 0
            • H
              hadrich last edited by

              I have some visitor, and I don't want to Config anything in clients.
              Note : when I plug any client directly to ISP router the connexion work fine.

              1 Reply Last reply Reply Quote 0
              • johnpoz
                johnpoz LAYER 8 Global Moderator last edited by

                Well your prob handing out RA via pfsense.. Or some other device and that is how your clients are getting the IPv6 dns.

                An intelligent man is sometimes forced to be drunk to spend time with his fools
                If you get confused: Listen to the Music Play
                Please don't Chat/PM me for help, unless mod related
                2440 2.4.5p1 | 2x 3100 2.4.4p3 | 2x 3100 22.01 | 4860 22.01

                1 Reply Last reply Reply Quote 0
                • JKnott
                  JKnott @hadrich last edited by

                  @hadrich said in How-to disable ipv6 dns server from dhcp (v4) server:

                  I don't use Ipv6 and the dns address was fe80::7e35:xxxx:xxxx:151a

                  That's a link local address and if you don't have IPv6 it won't be used for much. You can ignore it. Every IPv6 capable device will have one of those.

                  PfSense running on Qotom mini PC
                  i5 CPU, 4 GB memory, 64 GB SSD & 4 Intel Gb Ethernet ports.
                  UniFi AC-Lite access point

                  I haven't lost my mind. It's around here...somewhere...

                  1 Reply Last reply Reply Quote 0
                  • johnpoz
                    johnpoz LAYER 8 Global Moderator last edited by

                    That is where is dns is pointing to, while I agree he should switch over to his other IPv4 dns when that doesn't answer. Its still not optimal to have IPv6 that doesn't work configured.

                    Either fix it so it works, or disable it is best... If he has no working IPv6 he shouldn't be handing link-local out for NS via RA..

                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                    If you get confused: Listen to the Music Play
                    Please don't Chat/PM me for help, unless mod related
                    2440 2.4.5p1 | 2x 3100 2.4.4p3 | 2x 3100 22.01 | 4860 22.01

                    JKnott 1 Reply Last reply Reply Quote 0
                    • H
                      hadrich last edited by

                      Thinks for your responses.
                      How-to disable Ipv6 or how-to Config RA.
                      I'm sorry, I don't understand very well Ipv6 and I don't use it.

                      1 Reply Last reply Reply Quote 0
                      • JKnott
                        JKnott @johnpoz last edited by

                        @johnpoz said in How-to disable ipv6 dns server from dhcp (v4) server:

                        That is where is dns is pointing to

                        How did that happen, unless someone configured it somewhere. An IPv4 DHCP server cannot be configured to do that and there would have to be IPv6 enabled on the network, not just LL addresses, for it to be configured on a router.

                        If he has no working IPv6 he shouldn't be handing link-local out for NS via RA..

                        If IPv6 is not enabled on the network, there shouldn't be any RAs to provide a DNS address. If there are RAs, there's an IPv6 enabled router somewhere.

                        PfSense running on Qotom mini PC
                        i5 CPU, 4 GB memory, 64 GB SSD & 4 Intel Gb Ethernet ports.
                        UniFi AC-Lite access point

                        I haven't lost my mind. It's around here...somewhere...

                        1 Reply Last reply Reply Quote 0
                        • johnpoz
                          johnpoz LAYER 8 Global Moderator last edited by

                          Before we get all nuts... Lets make sure you just didn't set this on the client..

                          Lets see the output of ipconfig /all

                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                          If you get confused: Listen to the Music Play
                          Please don't Chat/PM me for help, unless mod related
                          2440 2.4.5p1 | 2x 3100 2.4.4p3 | 2x 3100 22.01 | 4860 22.01

                          1 Reply Last reply Reply Quote 0
                          • H
                            hadrich last edited by hadrich

                            The output of ipconfig /all : (for local adapter)

                            Ethernet adapter Local Area Connection:
                            
                               Connection-specific DNS Suffix  . : xxxxx.local
                               Description . . . . . . . . . . . : Intel(R) PRO/1000 MT Desktop Adapter
                               Physical Address. . . . . . . . . : 08-00-XX-XX-XX-1D
                               DHCP Enabled. . . . . . . . . . . : Yes
                               Autoconfiguration Enabled . . . . : Yes
                               Link-local IPv6 Address . . . . . : fe80::905b:ae6:53db:fc64%11(Preferred)
                               IPv4 Address. . . . . . . . . . . : 192.168.183.171(Preferred)
                               Subnet Mask . . . . . . . . . . . : 255.255.255.0
                               Lease Obtained. . . . . . . . . . : vendredi 24 janvier 2020 20:04:01
                               Lease Expires . . . . . . . . . . : samedi 25 janvier 2020 11:34:08
                               Default Gateway . . . . . . . . . : 192.168.183.254
                               DHCP Server . . . . . . . . . . . : 192.168.183.254
                               DHCPv6 IAID . . . . . . . . . . . : 235405351
                               DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-25-BC-61-2B-08-00-XX-XX-XX-1D
                            
                               DNS Servers . . . . . . . . . . . : fe80::a76:ffff:feb3:aa72%11
                                                                   192.168.183.254
                               NetBIOS over Tcpip. . . . . . . . : Enabled
                            
                            1 Reply Last reply Reply Quote 0
                            • johnpoz
                              johnpoz LAYER 8 Global Moderator last edited by

                              And do you have dhvpv6 or RA enabled on pfsense?

                              RA.jpg

                              An intelligent man is sometimes forced to be drunk to spend time with his fools
                              If you get confused: Listen to the Music Play
                              Please don't Chat/PM me for help, unless mod related
                              2440 2.4.5p1 | 2x 3100 2.4.4p3 | 2x 3100 22.01 | 4860 22.01

                              1 Reply Last reply Reply Quote 0
                              • H
                                hadrich last edited by

                                Screenshot from 2020-01-25 12-47-08.png

                                JKnott 1 Reply Last reply Reply Quote 0
                                • JKnott
                                  JKnott @hadrich last edited by

                                  @hadrich

                                  What about the RA tab? IPv6 can use RDNSS to provide the DNS address.

                                  PfSense running on Qotom mini PC
                                  i5 CPU, 4 GB memory, 64 GB SSD & 4 Intel Gb Ethernet ports.
                                  UniFi AC-Lite access point

                                  I haven't lost my mind. It's around here...somewhere...

                                  1 Reply Last reply Reply Quote 0
                                  • johnpoz
                                    johnpoz LAYER 8 Global Moderator last edited by

                                    Yeah but RAs would have to be running..

                                    Do you see radvd running in Status / Services

                                    Its not suppose to run if you don't have IPv6 setup on your lan interfaces.. Simple enough to sniff to see if your seeing the RAs - and from where..

                                    sniffRA.jpg

                                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                                    If you get confused: Listen to the Music Play
                                    Please don't Chat/PM me for help, unless mod related
                                    2440 2.4.5p1 | 2x 3100 2.4.4p3 | 2x 3100 22.01 | 4860 22.01

                                    JKnott 1 Reply Last reply Reply Quote 0
                                    • JKnott
                                      JKnott @johnpoz last edited by

                                      @johnpoz

                                      Well, it's coming from somewhere. The OP can run Packet Capture or Wireshark, filtering on ICMP6, to see where and find out the MAC address.

                                      PfSense running on Qotom mini PC
                                      i5 CPU, 4 GB memory, 64 GB SSD & 4 Intel Gb Ethernet ports.
                                      UniFi AC-Lite access point

                                      I haven't lost my mind. It's around here...somewhere...

                                      1 Reply Last reply Reply Quote 0
                                      • johnpoz
                                        johnpoz LAYER 8 Global Moderator last edited by johnpoz

                                        ^ agreed, which is why I gave an example of doing just that!

                                        The sniff will give us positive proof/info of where its coming from.

                                        An intelligent man is sometimes forced to be drunk to spend time with his fools
                                        If you get confused: Listen to the Music Play
                                        Please don't Chat/PM me for help, unless mod related
                                        2440 2.4.5p1 | 2x 3100 2.4.4p3 | 2x 3100 22.01 | 4860 22.01

                                        1 Reply Last reply Reply Quote 0
                                        • H
                                          hadrich last edited by

                                          Screenshot from 2020-01-28 13-22-15.png
                                          The result of : sudo tcpdump ip6

                                          13:16:53.314987 IP6 fe80::ed39:2950:1669:fe0c > ff02::16: HBH ICMP6, multicast listener report v2, 1 group record(s), length 28
                                          13:16:53.314993 IP6 fe80::ed39:2950:1669:fe0c > ff02::16: HBH ICMP6, multicast listener report v2, 1 group record(s), length 28
                                          13:16:53.315092 IP6 fe80::fab1:56ff:feca:a7f > ff02::1:ff00:0: ICMP6, neighbor solicitation, who has ::, length 32
                                          13:16:53.316529 IP6 fe80::ed39:2950:1669:fe0c > ff02::16: HBH ICMP6, multicast listener report v2, 1 group record(s), length 28
                                          13:16:53.316533 IP6 fe80::ed39:2950:1669:fe0c > ff02::16: HBH ICMP6, multicast listener report v2, 1 group record(s), length 28
                                          13:16:53.317795 IP6 fe80::ed39:2950:1669:fe0c.dhcpv6-client > ff02::1:2.dhcpv6-server: dhcp6 inf-req
                                          13:16:53.317799 IP6 fe80::ed39:2950:1669:fe0c.dhcpv6-client > ff02::1:2.dhcpv6-server: dhcp6 inf-req
                                          13:16:53.322526 IP6 fe80::ed39:2950:1669:fe0c > ff02::16: HBH ICMP6, multicast listener report v2, 1 group record(s), length 28
                                          13:16:53.322530 IP6 fe80::ed39:2950:1669:fe0c > ff02::16: HBH ICMP6, multicast listener report v2, 1 group record(s), length 28
                                          13:16:53.323345 IP6 fe80::ed39:2950:1669:fe0c.61385 > ff02::1:3.llmnr: UDP, length 28
                                          13:16:53.323348 IP6 fe80::ed39:2950:1669:fe0c.61385 > ff02::1:3.llmnr: UDP, length 28
                                          13:16:53.326481 IP6 fe80::a76:ffff:feb3:aa72.dhcpv6-server > fe80::ed39:2950:1669:fe0c.dhcpv6-client: dhcp6 reply
                                          13:16:53.428126 IP6 fe80::ed39:2950:1669:fe0c.61385 > ff02::1:3.llmnr: UDP, length 28
                                          13:16:53.428139 IP6 fe80::ed39:2950:1669:fe0c.61385 > ff02::1:3.llmnr: UDP, length 28
                                          13:16:53.521076 IP6 :: > ff02::1:ff69:fe0c: ICMP6, neighbor solicitation, who has fe80::ed39:2950:1669:fe0c, length 24
                                          13:16:53.521078 IP6 :: > ff02::1:ff69:fe0c: ICMP6, neighbor solicitation, who has fe80::ed39:2950:1669:fe0c, length 24
                                          13:16:53.521120 IP6 fe80::ed39:2950:1669:fe0c > ip6-allrouters: ICMP6, router solicitation, length 16
                                          13:16:53.521122 IP6 fe80::ed39:2950:1669:fe0c > ip6-allrouters: ICMP6, router solicitation, length 16
                                          13:16:53.521191 IP6 fe80::ed39:2950:1669:fe0c > ff02::16: HBH ICMP6, multicast listener report v2, 2 group record(s), length 48
                                          13:16:53.521197 IP6 fe80::ed39:2950:1669:fe0c > ff02::16: HBH ICMP6, multicast listener report v2, 2 group record(s), length 48
                                          13:16:53.565274 IP6 fe80::ed39:2950:1669:fe0c > ff02::1:ffb3:aa72: ICMP6, neighbor solicitation, who has fe80::a76:ffff:feb3:aa72, length 32
                                          13:16:53.565278 IP6 fe80::ed39:2950:1669:fe0c > ff02::1:ffb3:aa72: ICMP6, neighbor solicitation, who has fe80::a76:ffff:feb3:aa72, length 32
                                          13:16:53.566265 IP6 fe80::a76:ffff:feb3:aa72 > fe80::ed39:2950:1669:fe0c: ICMP6, neighbor advertisement, tgt is fe80::a76:ffff:feb3:aa72, length 32
                                          
                                          
                                          1 Reply Last reply Reply Quote 0
                                          • johnpoz
                                            johnpoz LAYER 8 Global Moderator last edited by

                                            Well open that RA up and look at it with wireshark... Your dump not showing enough info.

                                            An intelligent man is sometimes forced to be drunk to spend time with his fools
                                            If you get confused: Listen to the Music Play
                                            Please don't Chat/PM me for help, unless mod related
                                            2440 2.4.5p1 | 2x 3100 2.4.4p3 | 2x 3100 22.01 | 4860 22.01

                                            1 Reply Last reply Reply Quote 0
                                            • H
                                              hadrich last edited by

                                              Sorry for the long time to response because i was very busy and i take a time to understand wireshark and a little ipv6 😋. The problem come from another router that i disabled his dhcp service to use it as AP (wireless). Then i disabled its ipv6 to resolve the problem.

                                              1 Reply Last reply Reply Quote 0
                                              • First post
                                                Last post