<![CDATA[pfSense IPv6 RA RDNSS lifetime is too short (not compliant with RFC8106)]]>Is there a way to configure the lifetime for IPv6 RA RDNSS fields (type 25 and 31) in the pfSense IPv6 RA server? It appears that the default behaviour with pfSense is too short, and does not comply with RFC8106.

pfSense only offers three configurable values in the "Router Advertisement" UI - the "Minimum RA interval" (default 5 seconds), "Maximum RA interval" (default 20 seconds), and "Router lifetime" (default 3 * maximum RA interval).

Using these defaults, RA packets it sends have a router lifetime of 60 seconds as expected. However, the RDNSS fields have a lifetime of only 20 seconds! This causes them to occasionally expire if an RA packet is lost or if there is any jitter on the network.

RFC6106 specified that the lifetime SHOULD be bounded as: MaxRtrAdvInterval <= Lifetime <= 2*MaxRtrAdvInterval

RFC8106 superceded this specifically to address this problem, and specifies that the value of Lifetime SHOULD by default be at least:
3 * MaxRtrAdvInterval

The pfSense behaviour (as tested with 2.4.5-RELEASE-p1) barely meets the RFC6106 recommendation, and is way below what RFC8106 considers the minimum for reliable operation.

Altering the MaxRtrAdvInterval in the pfSense UI doesn't help - pfSense appears to always set the lifetime of the RDNSS fields equal to MaxRtrAdvInterval.

]]>https://forum.netgate.com/topic/158615/pfsense-ipv6-ra-rdnss-lifetime-is-too-short-not-compliant-with-rfc8106RSS for NodeTue, 17 Mar 2026 02:58:53 GMTWed, 25 Nov 2020 18:40:21 GMT60<![CDATA[Reply to pfSense IPv6 RA RDNSS lifetime is too short (not compliant with RFC8106) on Fri, 02 Apr 2021 23:49:05 GMT]]>@fabrizior I didn’t know it was a thing :) Thanks for the information.

]]>https://forum.netgate.com/post/975948https://forum.netgate.com/post/975948Fri, 02 Apr 2021 23:49:05 GMT<![CDATA[Reply to pfSense IPv6 RA RDNSS lifetime is too short (not compliant with RFC8106) on Fri, 02 Apr 2021 14:52:23 GMT]]>@yaleman

Thanks for the details!

A question though: is there a reason not to use the System_Patches package to make these kinds of enhancements in releases prior to those containing the new code revisions/commits?

Seems a lot easier than managing this stuff manually to me.

e.g

  1. Make a backup of /etc/inc/services.inc
  2. Review the diff for the actual source commit and copy the URL for the "unified diff" link at the bottom of the page
  3. Install the System_Patches package
  4. Add a Patch (System > Patches; Add New Patch)
    Description: RADVD set AdvRDNSSLifetime. Fixes #11105
    URL/Commit ID: https://redmine.pfsense.org/projects/pfsense/repository/revisions/54b3109f0b1978e22866117b6d93715eb8d78c29/diff?format=diff
  5. Click Save
  6. Click "Fetch" for the newly added patch entry and wait for it to update.
  7. Click "Test" and review output
  8. Click "Apply"
  9. Restart the RADVD service
  10. Verify with a grep for "AdvRDNSSLifetime" in /var/etc/radvd.conf - one entry per interface
]]>https://forum.netgate.com/post/975863https://forum.netgate.com/post/975863Fri, 02 Apr 2021 14:52:23 GMT<![CDATA[Reply to pfSense IPv6 RA RDNSS lifetime is too short (not compliant with RFC8106) on Tue, 30 Mar 2021 13:31:22 GMT]]>I posted a hacky fix for this here on my blog, looks like the fix might be in production in 2.5.1? You can edit the PHP that generates radvd.conf so normal service restarts won't break the file - PHP's running as root so you can't stop it writing over it.

]]>https://forum.netgate.com/post/975320https://forum.netgate.com/post/975320Tue, 30 Mar 2021 13:31:22 GMT<![CDATA[Reply to pfSense IPv6 RA RDNSS lifetime is too short (not compliant with RFC8106) on Thu, 03 Dec 2020 14:53:09 GMT]]>@JKnott It still seems to be overwritten - I did a "chmod 444 /var/etc/radvd.conf", and the permissions seem to have stuck ("-r--r--r--"), but the contents of the file have reverted to the defaults after restarting the service.

]]>https://forum.netgate.com/post/949251https://forum.netgate.com/post/949251Thu, 03 Dec 2020 14:53:09 GMT<![CDATA[Reply to pfSense IPv6 RA RDNSS lifetime is too short (not compliant with RFC8106) on Thu, 03 Dec 2020 13:40:13 GMT]]>@csmith

What happens if you make it read only, after you make the change?

]]>https://forum.netgate.com/post/949230https://forum.netgate.com/post/949230Thu, 03 Dec 2020 13:40:13 GMT<![CDATA[Reply to pfSense IPv6 RA RDNSS lifetime is too short (not compliant with RFC8106) on Thu, 03 Dec 2020 12:41:09 GMT]]>How can I make changes to the "radvd.conf" to work around this?

I've tried editing the file, but it appears that every time the service is restarted via the pfSense GUI, the file is regenerated and my changes are lost.

I've tried searching for a way to restart the service via the CLI but to no avail.

]]>https://forum.netgate.com/post/949222https://forum.netgate.com/post/949222Thu, 03 Dec 2020 12:41:09 GMT<![CDATA[Reply to pfSense IPv6 RA RDNSS lifetime is too short (not compliant with RFC8106) on Thu, 26 Nov 2020 11:47:24 GMT]]>Thanks for confirming, and opening the bug!

]]>https://forum.netgate.com/post/947772https://forum.netgate.com/post/947772Thu, 26 Nov 2020 11:47:24 GMT<![CDATA[Reply to pfSense IPv6 RA RDNSS lifetime is too short (not compliant with RFC8106) on Thu, 26 Nov 2020 06:11:24 GMT]]>https://redmine.pfsense.org/issues/11105

]]>https://forum.netgate.com/post/947733https://forum.netgate.com/post/947733Thu, 26 Nov 2020 06:11:24 GMT<![CDATA[Reply to pfSense IPv6 RA RDNSS lifetime is too short (not compliant with RFC8106) on Thu, 26 Nov 2020 00:48:02 GMT]]>I am seeing this as well.

The radvd.conf is getting generated without AdvRDNSSLifetime defined, which from what I can find SHOULD default to 2*MaxRtrAdvInterval from what I am reading but it seems it is using just the MaxRtrAdvInterval.

Adding AdvRDNSSLifetime {3*MaxRtrAdvInterval} to the config should fix it, and not require waiting for radvd to be fixed.

Making this,

	RDNSS 2001:470:****:1::3 2001:470:****:2::8 { };

into this.

	RDNSS 2001:470:****:1::3 2001:470:****:2::8 {
	AdvRDNSSLifetime 3060 
	};
]]>https://forum.netgate.com/post/947690https://forum.netgate.com/post/947690Thu, 26 Nov 2020 00:48:02 GMT