pfSense as subrouter, track interface and routing problems

JKnott

With IPv6, the default route is set automagically. With SLAAC, it's provided by the router advertisements. You can see this, if you capture with Packet Capture, filtering on icmp6.

Spaylia

@JKnott I'm not asking about the default route, but a downstream route for Router 1, to send the responses to Router 2

When a client requests something, it goes:
Client -> router 2 -> router 1 -> internet

When the server answers
internet -> router 1 -> router 2 -> client

Do I need a route from router 1 to router 2 so the answer can be router back?

JKnott

@Spaylia

It will know the route to the next router, but not the network behind it. So, you'll have to configure the route for that network.

Spaylia

@JKnott Alright, I got it to work, it was a problem with the configuration of R1, after looking at the routes in R1, I noticed it wasn't delegating the prefix properly.

Although devices (mostly debian hosts) under R1 are still advertised with R2 (pfsense) WAN as a default route. Would you know if there's a way to see who advertised a route on debian?

JKnott

@Spaylia

Do a Packet Capture, filtering on icmp6. You will, after a few minutes, have some router advertisements, which provide the route. Examine the source MAC address to see where it's coming from.

Spaylia

@JKnott Makes sense, thank you!

Spaylia

@JKnott well, it comes from pfSense WAN somehow

2023-12-02 23:35:52.560376 xx:xx:xx:xx:xx:5d (oui Unknown) > 33:33:00:00:00:01 (oui Unknown), ethertype IPv6 (0x86dd), length 198: fe80::xxxx:xxff:fexx:xx5d > ip6-allnodes: ICMP6, router advertisement, length 144

5d is the MAC address/link local address of the WAN interface

JKnott

@Spaylia

That's not right. It can only be the LAN interface.

Spaylia

@JKnott Since I can't add a deny rule for router advertisement on WAN (I guess hidden rules come before to allow it), I added an ip6tables rule to deny icmpv6 type 134 (RA) from fe80::xxxx:xxff:fexx:xx5d to all clients in the WAN of pfsense, and I don't get the route anymore.

JKnott

@Spaylia

Well, I don't know what to say. It's a really strange system you have there. The MAC address comes from the NIC, not pfSense. So, if you're seeing the MAC, that is the 48 bit hardware address, on the LAN side, there must be some other path involved. This is why I asked you to provide the Packet Capture file, so that I can examine it in Wireshark.