How-to disable ipv6 dns server from dhcp (v4) server

hadrich · Jan 24, 2020, 7:32 PM

Hello
I have an issue with the dhcp server configured with 2 adresses ip for the dns server, but in the windows clients a third ipv6 address will be added and it is used as default and not working.
Thanks for the help!

johnpoz · Jan 24, 2020, 7:58 PM

And what is this ipv6 IP its pointing too? Are you running ipv6?

dhcpv4 doesn't hand out IPv6 dns! That would be via dhcpv6, or IPv6 can get its dns from SLAAC.. Via the RA.

hadrich · Jan 24, 2020, 8:09 PM

I don't use Ipv6 and the dns address was fe80::7e35:xxxx:xxxx:151a

johnpoz · Jan 24, 2020, 8:11 PM

fe80 is link local address. If you don't use ipv6, are you on windows - then uncheck for it to be used in your interface configuration.

hadrich · Jan 24, 2020, 8:23 PM

I have some visitor, and I don't want to Config anything in clients.
Note : when I plug any client directly to ISP router the connexion work fine.

johnpoz · Jan 24, 2020, 8:39 PM

Well your prob handing out RA via pfsense.. Or some other device and that is how your clients are getting the IPv6 dns.

JKnott · Jan 24, 2020, 8:45 PM

@hadrich said in How-to disable ipv6 dns server from dhcp (v4) server:

I don't use Ipv6 and the dns address was fe80::7e35:xxxx:xxxx:151a

That's a link local address and if you don't have IPv6 it won't be used for much. You can ignore it. Every IPv6 capable device will have one of those.

johnpoz · Jan 24, 2020, 8:47 PM

That is where is dns is pointing to, while I agree he should switch over to his other IPv4 dns when that doesn't answer. Its still not optimal to have IPv6 that doesn't work configured.

Either fix it so it works, or disable it is best... If he has no working IPv6 he shouldn't be handing link-local out for NS via RA..

hadrich · Jan 24, 2020, 9:56 PM

Thinks for your responses.
How-to disable Ipv6 or how-to Config RA.
I'm sorry, I don't understand very well Ipv6 and I don't use it.

JKnott · Jan 24, 2020, 10:21 PM

@johnpoz said in How-to disable ipv6 dns server from dhcp (v4) server:

That is where is dns is pointing to

How did that happen, unless someone configured it somewhere. An IPv4 DHCP server cannot be configured to do that and there would have to be IPv6 enabled on the network, not just LL addresses, for it to be configured on a router.

If he has no working IPv6 he shouldn't be handing link-local out for NS via RA..

If IPv6 is not enabled on the network, there shouldn't be any RAs to provide a DNS address. If there are RAs, there's an IPv6 enabled router somewhere.

johnpoz · Jan 24, 2020, 10:35 PM

Before we get all nuts... Lets make sure you just didn't set this on the client..

Lets see the output of ipconfig /all

hadrich · Jan 25, 2020, 8:54 AM

The output of ipconfig /all : (for local adapter)

Ethernet adapter Local Area Connection:

   Connection-specific DNS Suffix  . : xxxxx.local
   Description . . . . . . . . . . . : Intel(R) PRO/1000 MT Desktop Adapter
   Physical Address. . . . . . . . . : 08-00-XX-XX-XX-1D
   DHCP Enabled. . . . . . . . . . . : Yes
   Autoconfiguration Enabled . . . . : Yes
   Link-local IPv6 Address . . . . . : fe80::905b:ae6:53db:fc64%11(Preferred)
   IPv4 Address. . . . . . . . . . . : 192.168.183.171(Preferred)
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Lease Obtained. . . . . . . . . . : vendredi 24 janvier 2020 20:04:01
   Lease Expires . . . . . . . . . . : samedi 25 janvier 2020 11:34:08
   Default Gateway . . . . . . . . . : 192.168.183.254
   DHCP Server . . . . . . . . . . . : 192.168.183.254
   DHCPv6 IAID . . . . . . . . . . . : 235405351
   DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-25-BC-61-2B-08-00-XX-XX-XX-1D

   DNS Servers . . . . . . . . . . . : fe80::a76:ffff:feb3:aa72%11
                                       192.168.183.254
   NetBIOS over Tcpip. . . . . . . . : Enabled

johnpoz · Jan 25, 2020, 11:40 AM

And do you have dhvpv6 or RA enabled on pfsense?

hadrich · Jan 25, 2020, 11:49 AM

JKnott · Jan 25, 2020, 11:57 AM

@hadrich

What about the RA tab? IPv6 can use RDNSS to provide the DNS address.

johnpoz · Jan 25, 2020, 2:31 PM

Yeah but RAs would have to be running..

Do you see radvd running in Status / Services

Its not suppose to run if you don't have IPv6 setup on your lan interfaces.. Simple enough to sniff to see if your seeing the RAs - and from where..

JKnott · Jan 25, 2020, 2:31 PM

@johnpoz

Well, it's coming from somewhere. The OP can run Packet Capture or Wireshark, filtering on ICMP6, to see where and find out the MAC address.

johnpoz · Jan 25, 2020, 3:19 PM

^ agreed, which is why I gave an example of doing just that!

The sniff will give us positive proof/info of where its coming from.

hadrich · Jan 28, 2020, 12:28 PM

The result of : sudo tcpdump ip6

13:16:53.314987 IP6 fe80::ed39:2950:1669:fe0c > ff02::16: HBH ICMP6, multicast listener report v2, 1 group record(s), length 28
13:16:53.314993 IP6 fe80::ed39:2950:1669:fe0c > ff02::16: HBH ICMP6, multicast listener report v2, 1 group record(s), length 28
13:16:53.315092 IP6 fe80::fab1:56ff:feca:a7f > ff02::1:ff00:0: ICMP6, neighbor solicitation, who has ::, length 32
13:16:53.316529 IP6 fe80::ed39:2950:1669:fe0c > ff02::16: HBH ICMP6, multicast listener report v2, 1 group record(s), length 28
13:16:53.316533 IP6 fe80::ed39:2950:1669:fe0c > ff02::16: HBH ICMP6, multicast listener report v2, 1 group record(s), length 28
13:16:53.317795 IP6 fe80::ed39:2950:1669:fe0c.dhcpv6-client > ff02::1:2.dhcpv6-server: dhcp6 inf-req
13:16:53.317799 IP6 fe80::ed39:2950:1669:fe0c.dhcpv6-client > ff02::1:2.dhcpv6-server: dhcp6 inf-req
13:16:53.322526 IP6 fe80::ed39:2950:1669:fe0c > ff02::16: HBH ICMP6, multicast listener report v2, 1 group record(s), length 28
13:16:53.322530 IP6 fe80::ed39:2950:1669:fe0c > ff02::16: HBH ICMP6, multicast listener report v2, 1 group record(s), length 28
13:16:53.323345 IP6 fe80::ed39:2950:1669:fe0c.61385 > ff02::1:3.llmnr: UDP, length 28
13:16:53.323348 IP6 fe80::ed39:2950:1669:fe0c.61385 > ff02::1:3.llmnr: UDP, length 28
13:16:53.326481 IP6 fe80::a76:ffff:feb3:aa72.dhcpv6-server > fe80::ed39:2950:1669:fe0c.dhcpv6-client: dhcp6 reply
13:16:53.428126 IP6 fe80::ed39:2950:1669:fe0c.61385 > ff02::1:3.llmnr: UDP, length 28
13:16:53.428139 IP6 fe80::ed39:2950:1669:fe0c.61385 > ff02::1:3.llmnr: UDP, length 28
13:16:53.521076 IP6 :: > ff02::1:ff69:fe0c: ICMP6, neighbor solicitation, who has fe80::ed39:2950:1669:fe0c, length 24
13:16:53.521078 IP6 :: > ff02::1:ff69:fe0c: ICMP6, neighbor solicitation, who has fe80::ed39:2950:1669:fe0c, length 24
13:16:53.521120 IP6 fe80::ed39:2950:1669:fe0c > ip6-allrouters: ICMP6, router solicitation, length 16
13:16:53.521122 IP6 fe80::ed39:2950:1669:fe0c > ip6-allrouters: ICMP6, router solicitation, length 16
13:16:53.521191 IP6 fe80::ed39:2950:1669:fe0c > ff02::16: HBH ICMP6, multicast listener report v2, 2 group record(s), length 48
13:16:53.521197 IP6 fe80::ed39:2950:1669:fe0c > ff02::16: HBH ICMP6, multicast listener report v2, 2 group record(s), length 48
13:16:53.565274 IP6 fe80::ed39:2950:1669:fe0c > ff02::1:ffb3:aa72: ICMP6, neighbor solicitation, who has fe80::a76:ffff:feb3:aa72, length 32
13:16:53.565278 IP6 fe80::ed39:2950:1669:fe0c > ff02::1:ffb3:aa72: ICMP6, neighbor solicitation, who has fe80::a76:ffff:feb3:aa72, length 32
13:16:53.566265 IP6 fe80::a76:ffff:feb3:aa72 > fe80::ed39:2950:1669:fe0c: ICMP6, neighbor advertisement, tgt is fe80::a76:ffff:feb3:aa72, length 32

johnpoz · Jan 28, 2020, 1:08 PM

Well open that RA up and look at it with wireshark... Your dump not showing enough info.