weird ipv6 gateway status + DHCPv6 acting flaky

tahirmehmoodkhokhar

so i've been banging my head on this ipv6 thing on my sg‑1100. after latest update the ipv6 gateway shows “unknown” even tho pings to ipv6 DNS work fine. tried restarting the gateway service, rebooted box, even removed/re‑added the ipv6 config, but it still randomly flips to unknown. dhcpv6 seems to get a lease sometimes but then stops renewing. this is annoying bc ipv4 is rock solid and nothing else on the network is acting up. idk if this is a bug in the new backend or just my setup. anyone else seen ipv6 status go weird like this? any thoughts?

Gertjan

@tahirmehmoodkhokhar said in weird ipv6 gateway status + DHCPv6 acting flaky:

after latest update the ipv6 gateway shows “unknown” even tho pings to ipv6 DNS work fine. tried restarting the gateway service, rebooted box, even removed/re‑added the ipv6 config, but it still randomly flips to unknown

Even if ICMPv6 used by IPv6 has a way more important role, a device - yours or the ones on the ISP side, are not obliged to answer to a ping request.

As you know you can ping using IPv6 to a known DNS, use 'traceroute' - the IPv6 version, to this DNSv6 and get an IPv6 device as close as possible, one that does reliably answer to ping (v6). Use that as your monitoring IPv6.

Or just trust your IPv6 (ISP) connection and switch motoring of, presuming its always on.

w0w

@tahirmehmoodkhokhar

Hi there! Is your WAN configured for DHCP, or is it something like PPPoE? IPv6 seems to have been completely broken for me since 26.03 RC, but I’m using a multi-WAN configuration.

hazelemily

That does sound like it could be related to the update, especially if IPv6 connectivity itself remains usable while the gateway status says “unknown.” I’d check whether the WAN still has its global IPv6 address and delegated prefix when the status flips, rather than relying only on the gateway indicator.

DHCPv6 renewal can also be a little different from IPv4 DHCP because prefix delegation and router advertisements are involved. pfSense has had fixes around IPv6 address/RA changes, so I’d be curious what exact pfSense version you’re running.

If the WAN address and PD disappear when the lease fails, that points more toward the DHCPv6/ISP side; if they remain and only the gateway monitor says “unknown,” it may just be a gateway-status/monitoring issue.

Gertjan

@hazelemily said in weird ipv6 gateway status + DHCPv6 acting flaky:

rather than relying only on the gateway indicator

This indicator is the result of a script called dpinger :
You can see it with :

ps aux | grep dpinger

You can clearly see one forIPv4 and one for IPv4 (not considering multiple WAN interfaces).

It uses the ordinary ping (or ping6) command, and specified is the originating IP, and destination IP.
It wannts to recevieve a reply for every ping (ICMP) packet it send. Missed packets, or delayed packets, are accounted for.
If to many start to miss, or the delay goes to much up (you can specifies these delays and counts), the the interface looses its :

indicator.
You, as the admin, have a mission (if you accept it ^^) : better be sure the adress that was elected as the desination IP, actually does reply when IVMP packets are send to it.
It's known : ISP IPv4 gateway IP do'nt always reply with ICMP reply âckets when they receive a ICMP request packet (for IPv4, handling ICMP is somewhat optional).
With IPv6, this changed, as ICMPv6 is very important for IPv6.

If ICMPv6 packets don't come back, consider your IPv6 'uplink' as bad.

What you can doi : pick yourself a known good static IPv6, and use that.
For example :

where "2001:41d0:dead:beef::3" is an IPv6 that I own (== rent, for a dedicated data centre based server). It's known to be always 'up', I am the admin of that server.

Btw : 'PD's (= a prefix ?) are used for pfSense LAN type interfaces.
The pfSense WAN just gets a GUA out of a dedicated PD, a /64 address space, the one reserved for link between the upstream router and pfSense-WAN.

And yes, it's known, there are many ISP out there with a what I call 'broken' IPv6 stack.
Lucky me, here in France they start to do thing nearly right after a messy full decade pure IPv6 madness.