IPv6 Question
-
I have a 6100 on comcast residential using the whole /60 - tracking wan on 16 vlans. One of the vlans is my LAN interface. If I put a host on a particular vlan, it get's the corresponding /64 ipv6 address via Router Advertisement. Works great. If I drop a host on a trunk port, the host gets an ipv6 address on my 1st vlan, or 'LAN' interface's /64. I don't want this to happen. What have I done wrong?
-
@johnnybinator well trunk quite often will have vlan 1 (default vlan) as native - ie not tagged. So yeah some client connected to a trunk port that has not be setup to understand tags, send tags etc.. Would send traffic untagged, what do you have set for the pvid on the trunk port this is the vlan that traffic would be on.
-
Is that the only way? Sometimes I don't want to set the native VLAN. I was hoping someone knew a trick to tell pfSense not to do that anymore.
-
@johnnybinator do what anymore? Unless its a vlan, it won't add a tag.. So incoming traffic that doesn't have a tag would hit the native interface..
Not sure what your asking - why would you have a port set to trunk if your only going to connect 1 device to it? Just put the port your connecting this device to as access and put that in whatever vlan you want. Now the device doesn't need to understand tags.
Just a bit confused on what your actually wanting to accomplish here?
-
@johnpoz Using vmware NSX-T, my edge router is getting an IPv6 address and I don't want it to. It's causing me hassles. I only want to get RA's and addresses where I want them not the default trunk.
-
This is why it's better to avoid tagged and untagged traffic on the same link. You can end up with unexpected consequences.
Just move LAN to a VLAN instead of having it untagged. Or some other VLAN if you've used VLAN1 externally (which you should never do!)
Steve
-
@johnpoz Thanks
-
@stephenw10 LAN is VLAN 11. I'm positive of it. That is why I'm so perplexed.
-
@johnnybinator so you don't want any devices on your lan to get IPv6? If that was the case why do you have IPv6 enabled on the lan interface?
Or you just wanting this device to not get IPv6 via the untagged traffic, but you want it to have IPv4 native?
Still not sure exactly what your asking.. Be it tagged or untagged. You don't want this device to get a IPv6 address?
You could always set native in the trunk to a dead vlan on the switch, but then untagged wouldn't work for IPv4.
-
@johnnybinator said in IPv6 Question:
LAN is VLAN 11. I'm positive of it. That is why I'm so perplexed.
That might be on your switch, my lan on my switch is vlan ID 9, but this is the default vlan on the switch and untagged.
Your saying your lan interface is a vlan, there is no IP set on the native interface?
-
@johnnybinator said in IPv6 Question:
@stephenw10 LAN is VLAN 11. I'm positive of it. That is why I'm so perplexed.
Mmm, sounds like something is leaking then or just misconfigured.
Can the host actually use the address it gets on the trunk port?
-
My LAN interface is on VLAN 11. I promise you. I do not have an interface that is not tied to a VLAN, besides WAN & NORD VPN on ipsec.
Keyboard-interactive authentication prompts from server:
End of keyboard-interactive prompts from server
Netgate 6100 - Serial: 2051210048 - Netgate Device ID: e6b7e9a44cc68a2e2e29*** Welcome to Netgate pfSense Plus 22.05-RELEASE (amd64) on pfSense ***
WAN (wan) -> igc1 -> v4/DHCP4: xx.xx.xx.xx/23
v6/DHCP6: xxxx:xxx:xxxx:xccx:711b:386f:1bc7:69c6/128
LAN (lan) -> ix0.11 -> v4: 10.200.0.254/24
v6/t6: xxxx:xxxx:xxxx:xxxx:0:92ec:77ff:fe21:2eba/64
VLAN6 (opt1) -> ix0.6 -> v4: 10.0.6.254/24
VLAN7 (opt2) -> ix0.7 -> v4: 10.0.7.254/24
VLAN8 (opt3) -> ix0.8 -> v4: 10.0.8.254/24
VLAN10 (opt4) -> ix0.10 -> v4: 10.0.10.254/24
v6/t6: xxxx:xxxx:xxxx:xxxx::92ec:77ff:fe21:2eba/64
VLAN20 (opt5) -> ix0.20 -> v4: 10.0.20.254/24
v6/t6: xxxx:xxxx:xxxx:xxxx:2:92ec:77ff:fe21:2eba/64
VLAN30 (opt6) -> ix0.30 -> v4: 10.0.30.254/24
v6/t6: xxxx:xxxx:xxxx:xxxx:3:92ec:77ff:fe21:2eba/64
VLAN40 (opt7) -> ix0.40 -> v4: 10.0.40.254/24
v6/t6: xxxx:xxxx:xxxx:xxxx:4:92ec:77ff:fe21:2eba/64
VLAN50 (opt8) -> ix0.50 -> v4: 10.0.50.254/24
v6/t6: xxxx:xxxx:xxxx:xxxx:5:92ec:77ff:fe21:2eba/64
VLAN60 (opt9) -> ix0.60 -> v4: 10.0.60.254/24
v6/t6: xxxx:xxxx:xxxx:xxxx:6:92ec:77ff:fe21:2eba/64
VLAN70 (opt10) -> ix0.70 -> v4: 10.0.70.254/24
v6/t6: xxxx:xxxx:xxxx:xxxx:7:92ec:77ff:fe21:2eba/64
VLAN80 (opt11) -> ix0.80 -> v4: 10.0.80.254/24
v6/t6: xxxx:xxxx:xxxx:xxxx:8:92ec:77ff:fe21:2eba/64
VLAN90 (opt12) -> ix0.90 -> v4: 10.0.90.254/24
v6/t6: xxxx:xxxx:xxxx:xxxx:9:92ec:77ff:fe21:2eba/64
VLAN100 (opt13) -> ix0.100 -> v4: 10.0.100.254/24
v6/t6: xxxx:xxxx:xxxx:xxxx:a:92ec:77ff:fe21:2eba/64
VLAN110 (opt14) -> ix0.110 -> v4: 10.0.110.254/24
v6/t6: xxxx:xxxx:xxxx:xxxx:b:92ec:77ff:fe21:2eba/64
VLAN120 (opt15) -> ix0.120 -> v4: 10.0.120.254/25
v6/t6: xxxx:xxxx:xxxx:xxxx:c:92ec:77ff:fe21:2eba/64
VLAN130 (opt16) -> ix0.130 -> v4: 10.0.130.254/24
v6/t6: xxxx:xxxx:xxxx:xxxx:d:92ec:77ff:fe21:2eba/64
VLAN140 (opt17) -> ix0.140 -> v4: 10.0.140.254/24
v6/t6: xxxx:xxxx:xxxx:xxxx:e:92ec:77ff:fe21:2eba/64
VLAN150 (opt18) -> ix0.150 -> v4: 10.0.150.254/24
v6/t6: xxxx:xxxx:xxxx:xxxx:f:92ec:77ff:fe21:2eba/64
VLAN160 (opt19) -> ix0.160 -> v4: 10.0.160.254/24
VLAN170 (opt20) -> ix0.170 -> v4: 10.0.170.254/24
VLAN180 (opt21) -> ix0.180 -> v4: 10.0.180.254/24
VLAN190 (opt22) -> ix0.190 -> v4: 10.0.190.254/24
VLAN200 (opt23) -> ix0.200 -> v4: 10.0.200.254/24
VLAN210 (opt24) -> ix0.210 -> v4: 192.168.250.254/24
DLVLAN (opt25) -> ix0.151 -> v4: 10.0.151.254/24
NORD_VPN (opt26) -> ovpnc1 -> v4: 10.8.3.4/24- Logout (SSH only) 9) pfTop
- Assign Interfaces 10) Filter Logs
- Set interface(s) IP address 11) Restart webConfigurator
- Reset webConfigurator password 12) PHP shell + Netgate pfSense Plus tools
- Reset to factory defaults 13) Update from console
- Reboot system 14) Disable Secure Shell (sshd)
- Halt system 15) Restore recent configuration
- Ping host 16) Restart PHP-FPM
- Shell
-
@stephenw10 yes. the host can ping6 on that interface to 2600:: but if I give the same interface an IPv4 address without tagging, I cannot ping out on IPv4.
-
@johnnybinator well that is odd..
I could see if the pvid on the port connected to your device was your lan vlan id, that could get to pfsense tagged as it leaves the port connected to pfsense.
But if that was what was happening then ipv4 should work as well, unless your rules on the lan interface didn't allow IPv4?
If the traffic was actually coming to pfsense untagged, and pfsense has nothing set on the native interface.. Then it shouldn't be able to get anything.
-
@johnpoz Yeah. Exactly.
-
So to be clear this happens when you connect a host to ix0 directly? Or some other down stream trunk link?
If it's something other than actually on ix0 on the firewall I'd guess there's something else bridging to it. It's all too easy to leak tagged traffic to untagged but much less likely to go the other way. And that would be required for ping6 to work obviously.
Steve
-
@stephenw10 This is through a switch that has a trunk port set up on the 6100 - 10Gb.
-
So you're connecting to a trunk port on the switch and there is a separate trunk to the 6100?
That sounds like a switch config problem then. That trunk port is untagged on VLAN11 somehow?
Doesn't explain how 6 works and v4 doesn't though. -
@stephenw10 exactly common config actually - pvid on a trunk is vlan X... As traffic enters the port untagged it gets put in vlan X.. Now when it leaves the switch to say the router it is tagged on vlan X.
But my same question that could explain what is happening - but doesn't explain why it doesn't work on ipv4.. Unless the firewall rules on lan on pfsense do not allow ipv4?
-
@johnpoz I have no PIVD set. No Native VLAN. Just straight Trunk. on the switch or the Host. I'm sure of it.
interface ethernet 1/25
description sm3_10G
switchport mtu 9216
switchport mode trunk
switchport trunk allowed vlan all
ipv6 nd ra suppress
