IPv6 and /etc/resolv.conf

[johnpoz]

@JonathanLee again so? what does that have to do with price of tea in china or your issue? Let see oh yeah nothing ;)

[JonathanLee]

@johnpoz I can't get squid to resolve ipv6 only to ipv6

it resolves ipv4 to ipv6 only.

I see the attempts hit the proxy on ipv6 and go to 409 errors. So I showed the sockets to help isolate that there is in fact something listening on ipv6.

(/assets/uploads/files/1722377486648-screenshot-2024-07-30-at-13.37.40.png) login-to-view login-to-view login-to-view login-to-view

Everything is set if i use no proxy it works pure ipv6

[johnpoz]

@JonathanLee Why are you even setting a dns when your client is explicitly pointing to a proxy?

When a client points to a proxy explicitly its not the one doing dns..

Where did you come up with that address for dns? :: would be the network address more than likely.. Not a host address..

2001:xxxx:xxxx:192::/64 or 2001:xxxx:xxxx:192:0:0:0:0 is the wire, not a host.

Can pfsense even talk to the internet via IPv6.. Can you ping say ipv6.l.google.com which resolves to 2607:f8b0:4009:819::200e

Those are all 443 sites its trying to go to.. so your splicing? This thread doesn't belong in IPv6 - it belongs in the proxy section, moving...

[JonathanLee]

@johnpoz

Thanks for the reply IPv6 is like a new motorcycle that you want to test out on every path to me.

Ping6 with dual stack enabled pfsense plus 24.03

login-to-view

You mention that I can't point to the network.. did I assign the interface subnets incorrectly?

login-to-view

login-to-view

Did I configure the /48 subnet into 2 networks incorrectly on the static assignments on the interfaces? Should it not be the wire?

[JonathanLee]

@johnpoz Why is it allowing me to assign the full wire and or network to the interface as a host address? If it allows this that could cause issues with other items also, should this be part of error handling, what is weird is it works, everything works like this. Could something be spoofed and have the wire address assigned to it? that could cause confusion..

Should the interface static address be the wire or prefix with::10 or something? If I do subnet::1 I loose my full dhcp range

[johnpoz]

@JonathanLee Man its a been awhile since done anything with this, because I just use an actual host address ::253 which lines up with my IPv4 address on the pfsense interface.

But I believe all zeros like that :: considered the anycast address with IPv6. And believe is valid is why they don't throw up a warning..

I believe rfc5375 is what you prob want to look at..

login-to-view

I would think a "proxy" would want a normal unicast address.

Maybe that is causing you some issues? And I think there is something when doing splits and differences in NS used by the proxy and the client..

If me I would put a normal unicast host address on your interface.. I am not a big proxy user, I use to do it for a living back in the day.. Ran global web filtering for a fortune 500 company.. And have used pretty much every proxy under the sun.. But I got out of that many years ago and really only do actual networking now. Routing and switching..

Reason I moved this to the proxy section, this isn't specific an issue with IPv6 in routing or firewalling or even dns.. You more than likely will find someone else here doing proxy with IPv6 that will be better help than me.

[JonathanLee]

@johnpoz thanks that helps a ton.

login-to-view

I was using all zeros :(

[johnpoz]

@JonathanLee so its working now? Yeah that is kind of good idea, use the port your using for proxy ;) hahah

I believe I have mentioned this before.. I line up the IPv6 addresses I do use on my network (play and test) to match..

So my IPv6 /48 from HE 2001:470:xxxx:xxxx::/48 I turn that into my /64 by making the 5th segment match so my /64 would be

my lan IP192.168.9.253/24
2001:470:xxxx:xxxx:9::253/64

Another segment of mine
my dmz IP192.168.3.253/24
2001:470:xxxx:xxxx:3::253/64

My roku vlan 192.168.7.253/24
2001:470:xxxx:xxxx:7::253/

etc.. My main pc on my lan is
192.168.9.100/24
2001:470:xxxx:xxxx:9::100/

[JonathanLee]

@johnpoz how do you assign a dhcp range if you don mind me asking? I set my interface to end in :1 and my range was all messed up.

"For example, use 2001:db8:1111:2222::1 for the LAN IPv6 address if the Routed /64 is 2001:db8:1111:2222::/64."

"Enter a range of IPv6 IP addresses inside the new LAN IPv6 prefix"

So in my case
2001:xxx:xxxx::192:: - 2001:xxxx:xxxx:192:ffff:ffff:ffff:ffff

I want 2001:xxxx:xxxx:192:168:1:1:a for my interface so i could set my range as
2001:xxx:xxxx:192:168:1::-
2001:xxx:xxxx:192:168:1:ffff:ffff

I am going to have to recreate all my static assignments now

[JonathanLee]

@johnpoz same issue with the recommendations. I went as far this time to disable IPv4 on the proxy server itself and get a pcap file it is like the proxy doesn’t know where to forward the traffic. It is weird

[johnpoz]

@JonathanLee well couple things I notice about what you listed there with your 409 errors. They are all cnames, and they have round robin answers on the cname, ie multiple IPs.

And can tell you right now that foxnews one is never going to work because it doesn't have a IPv6 address. So no if trying to do IPv6 with that its never going to work..

My opinion with IPv6 and proxy, just like normal IPv6 is its not really ready for prime time.. There are vast amounts of major player sites that don't even have IPv6 versions. Your going to run into issues - how the client normally handles it is dual stacked, and something that doesn't have IPv6 it uses IPv4.. it makes the switch on its own.. etc..

When doing splice you can have issues with when the host name not matching, etc..

You could also be running into issues with browser doing doh on its own.. And getting different responses for dns, etc..

https://docs.netgate.com/pfsense/en/latest/troubleshooting/squid.html#sites-not-loading-with-splice-error-409-in-access-log

Personally I wouldn't if you really want to proxy, even allow clients to use IPv6.. Its not like its a requirement or anything.. Can you name one major resource that requires IPv6? Just 1?? Not talking about some guys personal website he is hosting only on ipv6 because his isp doesn't have IPv4 address space to give to clients or they use cgnat, etc.

[Gertjan]

@johnpoz said in IPv6 and /etc/resolv.conf:

Can you name one major resource that requires IPv6? Just 1??

Let me think .... => got it : Humanity !?!

[JonathanLee]

Thanks for the clarification because it works perfectly with dual stack. This was more of a can I make some clients only IPv6. But when in dual stack it only works IPv4 clients to IPv6 sites and never IPv6 to IPv6. I enabled pure IPv6 and Squid terminates with this error..

The error it shows when I activate IPv6 only mode not dual stack is

Error: no forward proxy ports configured

Squid terminated

The errors in the pcap act like they require a udp 443 I have DoH blocked for major DoH servers. Again that is like wack a mole. The IPv6 only works once the proxy is removed. So the error is isolated into Squid. I have tested old packages and knew they seem to have the same issues. I was reading it might require SLLAC enabled and I currently have it set to managed. I might test this out today. Goal is to have it work with IPv6 only mode and proxy traffic.

Some users also added this to the configuration.

acl localnet src fc00::/7
acl localnet src fe80::/10

[johnpoz]

@Gertjan said in IPv6 and /etc/resolv.conf:

Humanity

hahaah - yeah I agree ipv6 is the future, etc. Problem is now that all the mobile stuff has been moved over to IPv6.. Stuff where there are billions of clients, etc. There is no financial push to move the rest.. You got some company that owns plenty of IPv4 space for their needs.. Why should should they move to IPv6, and not like they can just drop all their IPv4 space, etc.. There is no benefit for them - its money, its work, its time that they could be working on other things, etc..

Companies do not just invest in moving to something new, unless they are going to get something out of it.. Which currently that something is not really there other than they could get off the no IPv6 shame list ;)

My isp doesn't even offer IPv6 - and I have not heard any sort of even hint that its down the road, etc..

[JonathanLee]

If I enable SLLAC I have to make new ACLs because devices all create temp addresses over managed it gets my assigned IPv6 no change with testing same result. IPv6 only ->to IPv6 sites nothing works no sites.

[JonathanLee]

@johnpoz @Gertjan if you want to check out the pcap file it just says conflict

I do block DoH on known major players like wack a mole. So ignore that and QUIC is also blocked HTTP3. Thus DoH over HTTP3 is also blocked.

Outside of that it should work right?

It acts like the firewall can't respond to clients backwards

<---The 007 File Is now Gone--->

Client we are looking at is

2001:xxx.xxxx:a:192:168:1:5 ----> accessing [2001:xxx:xxxx:a:192:168:1:1]:3128

That is the IPv6 only client it can't get web traffic with it set to use the IPv6 proxy ran same in pfSense Plus 24.03 and 23.05(my favorite version) they all do the same thing with Squid 6.6(version with security fixes) and or Squid 5.8 (old working version that has status page)

WARNING THIS MESSAGE WILL SELF DESTRUCT AFTER YOU READ THE PCAP

Please reply when you look at this so I can delete this file

[johnpoz]

@JonathanLee yeah that seems to this

https://www.squid-cache.org/Doc/config/host_verify_strict/

[JonathanLee]

@johnpoz I never enabled that, maybe it is on by default for IPv6...

[JonathanLee]

@johnpoz turned if off same results

[JonathanLee]

@johnpoz
Maybe it’s because it’s HE tunnel and Squid doesn’t know what to do with the connections that connect to the IPv6 interface address?

Does it require

acl localnet src fc00::/7
acl localnet src fe80::/10