IPv6 on USB ethernet "gadget"

artenpie

I have a Raspberry Pi Zero configured as a USB "ethernet gadget", connected to my (fully patched) pfSense+ 23.01 router via the USB port. (The router is a 4-ethernet port APU4. I use the Pi as a "gadget" to run Pi-Hole without sacrificing an ethernet port.)

I have pfSense configured to support that "ue" port with DHCP and DHCPv6/RA. I have the pi configured (via dhcpcd.conf on the pi) with static IPv4 and IPv6 (ULA) addresses, all within the address ranges configured for the ue port in pfSense.

From my PC, I can ping the pi on its static IPv4 address (192.168.4.120). I cannot ping it on its static IPv6 ULA address.

If I ssh into the pi and issue "ifconfig", I get this:

usb0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 192.168.4.120  netmask 255.255.255.0  broadcast 192.168.4.255
        inet6 fd04:dead:beef:1234:71fe:f21a:a123:b456  prefixlen 64  scopeid 0x0<global>
        inet6 fe80::9400:b451:1bb9:d71a  prefixlen 64  scopeid 0x20<link>
        ether 00:de:60:32:35:1b  txqueuelen 1000  (Ethernet)

The fd04 address is set statically on the pi by dhcpcd.conf (as is the 192.168.4.120 address). Note there are no other IPv6 addresses present (there should be from DHCPv6/SLAAC).

When I try pinging via IPv6 from the Pi0, I get:

pi@raspberrypi0:~ $ ping6 google.com
ping6: connect: Network is unreachable

On the same physical APU device, this same pi works correctly as an ethernet gadget with OPNsense (it gets both ULA and global addresses from the router, in addition to the static addresses I assign in dhcpcd.conf). It also works correctly with Linux-based routers (OpenWRT and VyOS). In all of those cases, I simply used the same configuration steps I used with the physical ethernet ports, and it "just worked". Not so with pfSense.

I have checked my configuration carefully, and I believe it to be correct. The physical ethernet ports work properly. Anything else I can try to get the USB "ue" port working correctly, or is this a bug in pfSense?

artenpie

More testing seems to indicate an IPv6 issue in pfSense. On ue0 (the USB port acting as an ethernet port), DHCP and static addresses work for IPv4, but neither works for IPv6.

I did find a workaround, if someone comes searching in the future. I created a bridge between igb1 (physical ethernet LAN port) and ue0 (USB port acting as an ethernet port), plus an interface group including igb1, ue0, and the bridge itself.

After I set up the firewall rules to pass traffic from the bridge (and also one outbound for the interface group), I am getting SLAAC/DHCPv6 addresses on the Pi, both global and ULA (as well as static addresses), and am able to ping the pi via IPv4 and IPv6. I am also able to ping out from the pi via IPv6 - for example, 'ping6 google.com' works from the pi's console.

artenpie

Quick follow-up: I deleted the Interface Group as not needed, and set the system tunable to filter on the bridge. Works fine.

Dobby_

@artenpie
NETGEAR GS305 - 5 Port LAN Switch unmanaged ~20 €
NETGEAR GS305E - 5 Port LAN Switch Web managed ~25 €

And all will be fine.

artenpie

@dobby_
Thanks, switches aren't the issue (I have several). I'm just trying to minimize electricity costs. At $0.50/kWh it adds up.