odd ipv6 routing issue

[techpro2004]

So I have successfully enabled ipv6 on my network except for 2 systems. both have intel nics. and if I run ping -6 ipv6.google.com they both resolve the ip address but do not pass any data. both are running sunvalley 2. one of the systems only has homeseer installed. the other has other programs but not homeseer. both are on 24/7 any advice is welcome. thanks.

edit: ipconfig shows an ipv6 address but no data is passed. thanks.

[JKnott]

@techpro2004

Why don't people have even issues?

Have you run a packet capture, to see what's happening? Can you ping other devices on your LAN? Can you try test-ipv6.com to see what the results are?

[techpro2004]

I can successfully ping -6 other devices on my lan. Not sure what to look for in a packet capture file can not ping -6 wan test-ipv6.com shows 10/10 on the working computers but on these 2 it shows 0/10. it does show my dns is good though. thanks.

[johnpoz]

@techpro2004 so why would you think its a pfsense issue, if other devices on this network work via IPv6?

If it was a pfsense issue, no devices would work.

Why/How could pfsense single out 2 devices - and say sorry no internet for you via IPv6, but the machine next to you - sure he can have internet via IPv6..

So your clients get a valid IP in the prefix on this interface?

Your saying it worked, and then you rebooted the machine and it doesn't work - so it didn't get an IPv6 in this prefix after reboot? Would be the most likely explanation for the problem.

These 2 machines that are not working are running sunvalley 2 version of windows 11, the other machines running windows 10? They are not running the 22H2 version of windows 11?

[techpro2004]

most of the machines are running sunvally 2, working and non working. the others run linux. the machines in question show an ipv6 address in ipconfig but in pfsense/status/dhcpv6 leases, it does not show up. thanks.

[johnpoz]

@techpro2004 and is this IPv6 it show in the prefix that is on this interface? Or is it just a link local address?

[JKnott]

@techpro2004 said in odd ipv6 routing issue:

Not sure what to look for in a packet capture

Filter on the MAC address and ICMP6 to see the packet going out and if there's a response from either the target or pfsense.

[techpro2004]

it is an actual ipv6 address not link local.

I have attached a screen shot from wireshark. not sure what to look for:

this machine has a dual port nic. the other is single.

[JKnott]

@techpro2004

Since you're using Wireshark you don't have to worry about the MAC address. I only mentioned that in case you were using Packet Capture in pfsense.

Here's part of what you'd see. I pinged Google and the requests and replies are shown. If there were some problem, you might see an ICMP message from pfsense or beyond.

[techpro2004]

without mac filtering on pfsense i get this

wan

12:40:59.871538 IP6 2600:4040:9afe:9c00:3eec:efff:fe3c:e916 > 2600:4040:9af0:400:d602:ce46:7c60:2ea0: ICMP6, destination unreachable, unreachable address 2600:4040:9afe:9c00:549f:26ff:fedc:a99, length 93
12:41:12.357996 IP6 fe80::3eec:efff:fe3c:e917 > fe80::3e61:4ff:fe04:2cb4: ICMP6, neighbor solicitation, who has fe80::3e61:4ff:fe04:2cb4, length 32
12:41:12.363982 IP6 2600:4040:9af0::1 > fe80::3eec:efff:fe3c:e917: ICMP6, neighbor advertisement, tgt is fe80::3e61:4ff:fe04:2cb4, length 24
12:41:13.734544 IP6 2600:4040:9afe:9c00:3eec:efff:fe3c:e916 > 2600:4040:9af0:400:ad:c23c:1afe:f92: ICMP6, destination unreachable, unreachable address 2600:4040:9afe:9c00:549f:26ff:fedc:a99, length 102

lan

12:43:51.743616 IP6 2600:4040:9afe:9c00:3eec:efff:fe3c:e916 > 2600:4040:9afe:9c00:513f:e541:8dd8:32ee: ICMP6, neighbor solicitation, who has 2600:4040:9afe:9c00:513f:e541:8dd8:32ee, length 32
12:43:51.743856 IP6 2600:4040:9afe:9c00:513f:e541:8dd8:32ee > 2600:4040:9afe:9c00:3eec:efff:fe3c:e916: ICMP6, neighbor advertisement, tgt is 2600:4040:9afe:9c00:513f:e541:8dd8:32ee, length 32
12:43:55.865398 IP6 2600:4040:9afe:9c00:7954:fcee:8a9f:bb6c > ff02::1:ff3c:e916: ICMP6, neighbor solicitation, who has fe80::3eec:efff:fe3c:e916, length 32
12:43:56.193142 IP6 fe80::a0f1:7778:958f:e558 > ff02::1:ff3c:e916: ICMP6, neighbor solicitation, who has fe80::3eec:efff:fe3c:e916, length 32
12:43:56.655690 IP6 2600:4040:9afe:9c00::1587 > 2600:4040:9afe:9c00:3eec:efff:fe3c:e916: ICMP6, neighbor solicitation, who has 2600:4040:9afe:9c00:3eec:efff:fe3c:e916, length 32
12:43:56.655704 IP6 2600:4040:9afe:9c00:3eec:efff:fe3c:e916 > 2600:4040:9afe:9c00::1587: ICMP6, neighbor advertisement, tgt is 2600:4040:9afe:9c00:3eec:efff:fe3c:e916, length 24
12:43:56.704211 IP6 2600:4040:9afe:9c00:7954:fcee:8a9f:bb6c > ff02::1:ff3c:e916: ICMP6, neighbor solicitation, who has fe80::3eec:efff:fe3c:e916, length 32
12:43:57.201453 IP6 fe80::a0f1:7778:958f:e558 > ff02::1:ff3c:e916: ICMP6, neighbor solicitation, who has fe80::3eec:efff:fe3c:e916, length 32
12:43:57.697283 IP6 2600:4040:9afe:9c00:7954:fcee:8a9f:bb6c > ff02::1:ff3c:e916: ICMP6, neighbor solicitation, who has fe80::3eec:efff:fe3c:e916, length 32
12:43:58.192367 IP6 fe80::a0f1:7778:958f:e558 > ff02::1:ff3c:e916: ICMP6, neighbor solicitation, who has fe80::3eec:efff:fe3c:e916, length 32
12:43:59.714466 IP6 2600:4040:9afe:9c00:7954:fcee:8a9f:bb6c > ff02::1:ff3c:e916: ICMP6, neighbor solicitation, who has fe80::3eec:efff:fe3c:e916, length 32
12:44:00.690822 IP6 2600:4040:9afe:9c00:7954:fcee:8a9f:bb6c > ff02::1:ff3c:e916: ICMP6, neighbor solicitation, who has fe80::3eec:efff:fe3c:e916, length 32
12:44:01.192689 IP6 2600:4040:9afe:9c00:3eec:efff:fe3c:e916 > 2600:4040:9afe:9c00::1587: ICMP6, neighbor solicitation, who has 2600:4040:9afe:9c00::1587, length 32
12:44:01.192933 IP6 2600:4040:9afe:9c00::1587 > 2600:4040:9afe:9c00:3eec:efff:fe3c:e916: ICMP6, neighbor advertisement, tgt is 2600:4040:9afe:9c00::1587, length 32
12:44:01.703178 IP6 2600:4040:9afe:9c00:7954:fcee:8a9f:bb6c > ff02::1:ff3c:e916: ICMP6, neighbor solicitation, who has fe80::3eec:efff:fe3c:e916, length 32
12:44:03.708535 IP6 2600:4040:9afe:9c00:7954:fcee:8a9f:bb6c > ff02::1:ff3c:e916: ICMP6, neighbor solicitation, who has fe80::3eec:efff:fe3c:e916, length 32
12:44:04.697691 IP6 2600:4040:9afe:9c00:7954:fcee:8a9f:bb6c > ff02::1:ff3c:e916: ICMP6, neighbor solicitation, who has fe80::3eec:efff:fe3c:e916, length 32
12:44:05.703067 IP6 2600:4040:9afe:9c00:7954:fcee:8a9f:bb6c > ff02::1:ff3c:e916: ICMP6, neighbor solicitation, who has fe80::3eec:efff:fe3c:e916, length 32
12:44:06.692817 IP6 fe80::7954:fcee:8a9f:bb6c > ff02::1:ff3c:e916: ICMP6, neighbor solicitation, who has fe80::3eec:efff:fe3c:e916, length 32
12:44:07.699262 IP6 2600:4040:9afe:9c00:7954:fcee:8a9f:bb6c > ff02::1:ff3c:e916: ICMP6, neighbor solicitation, who has fe80::3eec:efff:fe3c:e916, length 32
12:44:07.766260 IP6 fe80::3eec:efff:fe3c:e916 > ff02::1:ffdc:a99: ICMP6, neighbor solicitation, who has 2600:4040:9afe:9c00:549f:26ff:fedc:a99, length 32
12:44:08.705047 IP6 2600:4040:9afe:9c00:7954:fcee:8a9f:bb6c > ff02::1:ff3c:e916: ICMP6, neighbor solicitation, who has fe80::3eec:efff:fe3c:e916, length 32
12:44:08.765518 IP6 fe80::3eec:efff:fe3c:e916 > ff02::1:ffdc:a99: ICMP6, neighbor solicitation, who has 2600:4040:9afe:9c00:549f:26ff:fedc:a99, length 32
12:44:09.327734 IP6 2600:4040:9afe:9c00:a0f1:7778:958f:e558 > ff02::1:ff3c:e916: ICMP6, neighbor solicitation, who has fe80::3eec:efff:fe3c:e916, length 32
12:44:09.698999 IP6 2600:4040:9afe:9c00:7954:fcee:8a9f:bb6c > ff02::1:ff3c:e916: ICMP6, neighbor solicitation, who has fe80::3eec:efff:fe3c:e916, length 32
12:44:09.769572 IP6 fe80::3eec:efff:fe3c:e916 > ff02::1:ffdc:a99: ICMP6, neighbor solicitation, who has 2600:4040:9afe:9c00:549f:26ff:fedc:a99, length 32
12:44:10.193935 IP6 2600:4040:9afe:9c00:a0f1:7778:958f:e558 > ff02::1:ff3c:e916: ICMP6, neighbor solicitation, who has fe80::3eec:efff:fe3c:e916, length 32
12:44:10.704596 IP6 2600:4040:9afe:9c00:7954:fcee:8a9f:bb6c > ff02::1:ff3c:e916: ICMP6, neighbor solicitation, who has fe80::3eec:efff:fe3c:e916, length 32
12:44:11.198181 IP6 2600:4040:9afe:9c00:a0f1:7778:958f:e558 > ff02::1:ff3c:e916: ICMP6, neighbor solicitation, who has fe80::3eec:efff:fe3c:e916, length 32
12:44:11.694641 IP6 2600:4040:9afe:9c00:7954:fcee:8a9f:bb6c > ff02::1:ff3c:e916: ICMP6, neighbor solicitation, who has fe80::3eec:efff:fe3c:e916, length 32
12:44:12.205018 IP6 2600:4040:9afe:9c00:a0f1:7778:958f:e558 > ff02::1:ff3c:e916: ICMP6, neighbor solicitation, who has fe80::3eec:efff:fe3c:e916, length 32
12:44:12.696961 IP6 2600:4040:9afe:9c00:7954:fcee:8a9f:bb6c > ff02::1:ff3c:e916: ICMP6, neighbor solicitation, who has fe80::3eec:efff:fe3c:e916, length 32
12:44:13.190706 IP6 2600:4040:9afe:9c00:a0f1:7778:958f:e558 > ff02::1:ff3c:e916: ICMP6, neighbor solicitation, who has fe80::3eec:efff:fe3c:e916, length 32

[techpro2004]

tracert results

bad

good

same network.

[JKnott]

@techpro2004 said in odd ipv6 routing issue:

without mac filtering on pfsense i get this

I guess you missed my point on using Wireshark vs Packet Capture. With Packet Capture, you'll see all traffic, not just the computer you're testing with. So, you'd use the MAC address to filter it out from the noise. You don't have to do that if you're using Wireshark on the computer you're pinging from. Which method are you using to capture those packets? Either way, if you run the capture when you start pinging, you should see the pings going out and any response, as I did in my example. I could be wrong, but I don't see any pings in your example. When I did my test, there were other things besides ping, but I took only the portion of the capture that showed the pings and replies. If you're using Wireshark, you can also use display filters to show only what you want, even though other stuff was captured.

[techpro2004]

the first example was in wireshark and i was using the filters i ran ping -6 ipv6.google.com in both cases while the capture was running. not sure why it did not show up.

[JKnott]

@techpro2004

The usual method is to start the capture, run ping for several cycles and then stop the capture. If you're capturing ICMP6, as you appear to be doing, then you should see some pings in the capture.

[johnpoz]

@techpro2004 said in odd ipv6 routing issue:

not sure why it did not show up.

Because from the trace you show that it can not talk to the gateway, has no mac address for what it thinks it gateway is. So it can not send a ping without anyplace to send it.

[techpro2004]

so how do I fix it.

[techpro2004]

and why did pfsense supply that info to some of my systems but not the others.

[techpro2004]

Just rechecked my config. only lan has an ipv6 address not opt* however lan and opt* are bridged. Does this matter?

[johnpoz]

@techpro2004 said in odd ipv6 routing issue:

and why did pfsense supply that info to some of my systems but not the others.

What is different about these systems? Are they connected different, wifi or wired? Do you have any sort of bridge setup..

What exactly is the pfsense IP address for this network? What is the IP address of the system no working.. I see devices asking for this fe80::3eec:efff:fe3c:e916

12:44:10.193935 IP6 2600:4040:9afe:9c00:a0f1:7778:958f:e558 > ff02::1:ff3c:e916: ICMP6, neighbor solicitation, who has fe80::3eec:efff:fe3c:e916, length 32
12:44:10.704596 IP6 2600:4040:9afe:9c00:7954:fcee:8a9f:bb6c > ff02::1:ff3c:e916: ICMP6, neighbor solicitation, who has fe80::3eec:efff:fe3c:e916, length 32
12:44:11.198181 IP6 2600:4040:9afe:9c00:a0f1:7778:958f:e558 > ff02::1:ff3c:e916: ICMP6, neighbor solicitation, who has fe80::3eec:efff:fe3c:e916, length 32

Which I assume is pfsense, since the address would seem to be the link local of what is being sent to in your trace that works..

fe3c:e916

however lan and opt* are bridged. Does this matter?

Why would you have anything bridged?

[techpro2004]

it is bridged as my entire house is wired for ethernet so I have cables going to each room and I did not want to use a switch so I built a 12port router out of an old server and 3x i350-t4 nics and installed pfsense on it.