IPv6 WAN Gateway monitoring reports 100% packet loss

JKnott

My gateway has a link local address, which won't work. You have to use a global address a bit further out. I did a traceroute to Google to find the first global address it passed through. That works fine here.

vsey

@jknott I think my problem lies a bit deeper, because I can't ping any ipv6 address on the Internet from pfsense itself. LAN works fine though, so I can ping ipv6 address from the LAN Network and I can ping the hosts in the LAN network from pfsense. So in summary my pfsense gets an ipv6 address on WAN but has no ipv6 connectivity to the Internet at all. When I do a ping for example to ipv6.google.com and a packet capture simultaneously I see the ping packages leafing but no response coming back

A Former User

@vsey

I only get the problem of the IPv6 gateway offline when I perform a reboot of my pfsense pc. Once I have saved my WAN settings again, the gateway monitoring starts working again and traffic is routed through pfsense. I do not use IPv6 NAT.
I have not checked using the Diagnostic ipv6 ping on the firewall, but all IPv6 clients on the LAN side are unable to ping any IPv6 address externally.

vsey

@vsey said in IPv6 WAN Gateway monitoring reports 100% packet loss:

@jknott I think my problem lies a bit deeper, because I can't ping any ipv6 address on the Internet from pfsense itself. LAN works fine though, so I can ping ipv6 address from the LAN Network and I can ping the hosts in the LAN network from pfsense. So in summary my pfsense gets an ipv6 address on WAN but has no ipv6 connectivity to the Internet at all. When I do a ping for example to ipv6.google.com and a packet capture simultaneously I see the ping packages leafing but no response coming back

Here is a packet capture of my ipv6 pings. One can see the Gateway pings and the pings I did to google but their is no response coming back and I don't know why

A Former User

@vsey

I had a power outage this morning due to a toaster tripping the earth leakage circuit breaker. When pfsense was booted the WAN IPv6 connection reported 100% packet loss while IPv4 reported everything fine. I tried using the diagnostic IPv6 ping and they all failed, in fact so did all IPv4 diagnostic pings. Went to the WAN interface, saved the settings, and applied them and everthing was working correctly. Pfsense is configured as a router, as I have a public ::/48, this is divided into multiple ::/64 so internal traffic passes through pfsense to my internet firewall router and then hits my ISP's network.

A Former User

@vortex21

Just upgraded to Version 22.05.r.20220609.1919 and after rebooting the IPv6 WAN Gateway monitoring failed again. So again I had to go to Interfaces -> WAN , then press Save and Apply Changes for the WAN gateway monitoring to work otherwise IPv6 traffic is blocked

Bob.Dig

@vortex21 Is your pfSense behind another router doing DHCP with IPv6? In this situation it was normal to fail for me too but a reboot of pfSense would solve that, not provoke that behavior. What monitoring IP are you using?

A Former User

@bob-dig

Hi,

No, DHCPv6 is not being used. If I reboot my firewall the IPV6 Gateway also fails so I have to manually re-save the WAN settings and then IPv6 will begin to work again.

I am using a static IP on my edge router both interfaces are statically assigned, I am using the private interface on the router as my monitoring IPv6 address.

A Former User

@vortex21

Hi, upgraded to release 22.05.r.20220614.0600 today and IPv6 WAN monitoring again failed requiring WAN interface having to be saved and then Apply Changes for it to start working again.

A Former User

@vortex21

Upgraded to 22.05.r.20220614.1944 and experienced the same problem. Also worth noting that unless Prefer to use IPv4 even if IPv6 is available (System -> Advanced -> Networking ) is enabled then upgrade will not complete.

A Former User

@vortex21

Just upgraded to 22.05.r.20220617.0613 but only after ensuring that Prefer IPv4 even if IPv6 is available is enabled in System -> Advanced -> Networking.
After applying update, I still lose connectivity to the IPv6 gateway. So that I have to save the WAN settings again to get the IPv6 gateway monitoring to work, this is with out changing any settings. From a monitoring perspective the RTT and RTTsd times are lower for IPv6 compared to IPv4.

luckman212

@vortex21 I think you might be seeing the same issue as I was here. You could try the linked PR #4595 to see if it helps your issue.

A Former User

@luckman212

Hi, tried applying the fix in the latest update of https://github.com/pfsense/pfsense/pull/4595. Unfortunately it did not fix the problem, I had to re-save the WAN interface settings and IPv6 GW Montoring worked

luckman212

@vortex21 How did you apply the fix? As it states in the PR notes, it probably won't work with the System Patches package alone due to the number of changes and the differences between the original files in pfS+ vs CE. So did you manually apply the changes to all the related files?

A Former User

@luckman212
Hi, followed the steps below

1 install cmdwatch:

 pkg add https://pkg.freebsd.org/FreeBSD:12:amd64/latest/All/cmdwatch-0.2.0_2.txz

download the script:

fetch https://gist.githubusercontent.com/luckman212/0fdea1cbdc0a561d781a52c7d34fb60d/raw/ffd321ef196fb1c919dd66700acdd4acc02b3e63/dpinger_static_routes.php
cmdwatch --interval=2 'php -q dpinger_static_routes.php'
php -a
include("config.inc");
install_cron_job('/usr/bin/nice -n20 /etc/rc.checkv6addrchange', true, "/1", '', '', '', '*', 'root', true);
After reboot, ran via ssh cmdwatch --interval=2 'php -q dpinger_static_routes.php'
Then checked GUI, IPv6 monitoring was offline, and I had to save WAN interface to fix monitoring issue.

luckman212

@vortex21 You are missing most of the important steps. You just downloaded the little helper script from the other PR which does nothing but display some info. You need to apply the patches in the linked commit that actually change the behavior. I know it might be a bit complicated- so I'll try to post a step by step.

Are you using pfSense+ or CE?

A Former User

@luckman212

Hi,

Currently running pfsense+ 22.05.r.20220617.0613

luckman212

@vortex21 I posted some new instructions on the PR#4595. I hope you're able to give them a try.

A Former User

@luckman212

Hi, I followed the instructions, applying the system patches and then the new patch. After rebooting, and login the IPv6 GW Monitoring was reporting 70% packet loss and as I watched it increased to 77% before I re-saved the WAN interface which fixed the problem.

luckman212

@vortex21 If your IPv6 WAN is down immediately after a fresh boot then something different is going on here. Can you send some more details?

how is your WAN6 configured- DHCP6, SLAAC, etc?
can you ssh in after rebooting your system and run ifconfig -v -- copy the output.
then, edit your interface and hit Save, and run ifconfig -v again and copy that too. Paste those outputs here (or if you don't want to post publicly, PM it to me)
what happens if you manually run /etc/rc.checkv6addrchange ? Does it give you an error? Does anything change after running that?