Delegate IPv6 subnet to only specific MAC addresses
-
@Gertjan D'oh! I knew I had seen it, thanks.
Unfortunately this was broken twice this morning.
- my static route was no longer in the routing table
- DHCPv6 started handing out IPs again despite being set to allow only known clients.
In limited testing it looks like the problems were:
- DHCPv6 Server does not add a route for delegated prefixes to reserved IPs
- if I restart DHCPv6 Server, my static route is removed from the routing table
- I had to edit and save the route, to get it to work again
I kept banging on it. I set Router Advertisement to Managed so clients couldn't get an IP. However RA is still advertising prefixes to other routers, they are just failing.
At some point I re-saved the office router WAN interface and now that Delegated Prefix shows on the DHCPv6 Leases page. So maybe it was in some weird limbo state from above? I didn't try deleting the static route yet since we're into the workday.
However DHCPv6 Leases still shows leases and prefixes for other routers. Does it just not honor the "Deny Unknown Clients" setting?
Confused about the path forward, do I need to turn off DHCPv6 Server on the building router, and use a static route?
-
...and the route is gone again, don't know why.
Edit: Seems like all the DHCPv6 Server settings are ignored?
https://docs.netgate.com/pfsense/en/latest/services/dhcp/ipv6.html"The DHCPv6 daemon can only run and be configured on interfaces with a Static IP address, so if a tab for an interface is not present, check that it is enabled and set with a Static IP. It is not currently possible to adjust settings for tracked interface DHCP service."
I suppose one could read that as "shouldn't be visible" vs "we'll ignore everything". It does seem to be using the configured address pool though.
-
@SteveITS If you have static IPv6, use it. If it is dynamic then don't. Latter one is not running that well in pfSense. For instance, I get a new prefix every night. I have to reboot my pfsense via cron afterwards to get it working well. But with static IPv6, I don't see that (only have HE).
-
@Bob-Dig I can't really tell without going to the office and testing by booting the Comcast router, which kicks everyone off, but I think Comcast doesn't keep the routes after their router boots. They have a "static IPv6" /56 as they label it but it's handed out to their router automatically by them, and if I configure our pfSenses with all static then there isn't a way for me to configure a static route for the "self-delegated" IPV6, on the Comcast device. It only allows IPv4 routes.
Currently it's working with:
building WAN: DHCP6
building LAN: Track Interface
office WAN: static IPv6
office LAN: static IPv6
building router: needs static route for office LAN
building router: DHCPv6 Server off
building router: RA offI suspect when I was banging on it a month ago the Comcast router kept the route for the delegated prefix, until it booted. So having the building router Track Interface and request a /62 prefix hopefully will keep that route in the Comcast router. Guess I'll find out in the next few months if/when it restarts. And then the fix and that point is probably just to reacquire the building LAN IPv6.
Done automatically I expect it will all work just fine, the problem is we need control over how to hand out addresses.
There's also some sort of a bug I ran into again where if I add an IPv6 gateway on the WAN interface page, it flips the IPv4 gateway to Automatic and disconnects Internet (even though there's only one IPv4 gateway). But that's another story...
