[solved] RA Subnets

JKnott

ULA is routeable, but not over the Internet, just like RFC1918 addresses. It's link local addresses that's aren't routeable.

Bob.Dig

@jknott But that is what I meant, I couldn't even use the ULA locally on pfSense, couldn't even ping another host on another local interface.
So what did I do wrong? That is what I hope to find out here, please no more useless replies.

JKnott

@bob-dig

Run Packet Capture, filtering on ICMP6, to see what's happening. You should see RAs for both GUA and ULA prefixes.

Bob.Dig

@jknott I am not good at looking at Packet Captures, so shouldn't I see that ULA in Diagnostics Routes in the first place?

JKnott

@bob-dig

I use packet capture all the time and it's not hard to read. Given that you can't even ping on the local network, it's not a routing issue. It sounds more like those addresses aren't even working. Can you see them on the devices?

Here's a capture I just ran. When you open it with Wireshark and examine the router advertisements, you'll see prefixes listed for both the GUA and ULA addresses. If you don't see the ULA, it will never work.

packetcapture (13).cap

Bob.Dig

@jknott said in RA Subnets:

It sounds more like those addresses aren't even working. Can you see them on the devices?

Yes, Devices got them.

Bob.Dig

@jknott So I think it is a routing problem. And so again my question, a last time, can you see the prefix in Diagnostics / Routes. I would think that at least the interface itself would show there.

JKnott

@bob-dig

Here's what I have:

Bob.Dig

@jknott And I got those only where I have Static IPv6 Configuration set (with ULA), but not on that interface, which has track interface for GUA and ULA in RA Subnet. The ULA prefix doesn't show up in pfSense.

Also the interface only got the GUA.

JKnott

@bob-dig

Where are you looking? The web interface doesn't show them, but ifconfig does.

Bob.Dig

@jknott said in RA Subnets:

but ifconfig does.

Ok, trying it right now, but ifconfig is showing the same as the webinterface, so no ULA I set on ra subnet, just the GUA via track interface.

I guess, no one does that, GUA by track interface and ULA by ra subnet? Or are my settings wrong?

I also use the DHCPv6 Server and have a static mapping configured, so I want to use both.

JKnott

@bob-dig

You wouldn't track the interface for ULA, as you manually assign it on the Router Advertisement page. When you track an interface, the prefix is provided by the ISP and they'd have nothing to do with your ULA, though they might have them on the WAN interface.

You have to ensure you actually have a ULA address on the interface. If you have that, then try pinging another ULA on the same subnet. Once you have that, then you can try routing between subnets.

Bob.Dig

@jknott I have none, I have a GUA.

So it is a bug.

JKnott

@bob-dig

Have you specified a ULA prefix (starts with fc or fd), with a /64 subnet size on the Router Advertisements page? If so, the prefix should be included in the RAs. This is why I asked you to do a packet capture, to ensure the RA includes the ULA prefix. If that's there, then any IPv6 capable device on the network should get a ULA address, in addition to GUA. And no, it's not a bug. I have no problem getting ULA addresses on my networks.

Just run Packet Capture for a few minutes, filtering on ICMP6 and post here, so I can read it.

Bob.Dig

@jknott Please, you obviously not reading my posts and not looking at the screenshots provided. Sure, I resist doing something I don't know much about, but I also already gave a good reason for not doing it, because it is already wrong in pfSense, I don't need to capture traffic for that in the first place.

Bob.Dig

2.5.1 didn't fixed it.

JeGr

@bob-dig I only see that you entered it in the RA settings. What about pfSense itself? Where is the ULA for that interface set up? Screens please. Seems more that you are simply doing it wrong :)

Bob.Dig

@jegr Hey Jens, that is why I am asking.
But to be honest, where else to put it? Like I said, interface is on track for the GUA, so...

JeGr

@bob-dig said in [Bug] RA Subnets:

But to be honest, where else to put it? Like I said, interface is on track for the GUA, so...

You are throwing things together that have nothing to do with each other. Yes, putting it in RA seems fine. So you're handing out ULAs to clients. Yay. But without you handing one to pfsense itself, how are you thinking that it should receive packets from those IP6s? Magically? ;)

How about simply giving pfSense an appropriate ULA IP6 via an IP ALIAS as you want it to serve two different prefixes? How else do you think the interface will get an IP6 from that ULA if you don't configure it there yourself? ;)

Also your firewall rules will not work in "normal" ways anymore as "<lan> network" alias won't magically include the second prefix on that interface, only the one configured via Interface setup. So watch your rules, too!

Bob.Dig

@jegr I am trying this right now, never used an IP alias before. lets see if I succeed.