pfSense

1. Description:
   When utilizing the newly introduced Feature #16914 to select a custom Virtual IP (VIP) as the "RA Interface" source, the pfSense configuration engine correctly applies the AdvRASrcAddress parameter block. However, a discrepancy occurs during the associated route ::/0 sub-block generation for that interface. When a custom VIP is selected, the parser hardcodes RemoveRoute off; and matches the AdvRoutePreference to the interface priority. In contrast, standard interface assignments correctly map this parameter to RemoveRoute on;.

Because RemoveRoute is explicitly disabled, the radvd daemon permanently injects a RIO payload tracking the entire physical interface socket scope (ex: interface igc0.20). Dual-stack client operating systems such as Windows 11 process this payload by populating an unwanted secondary default gateway bound to the raw hardware LLA of the firewall alongside the chosen VIP gateway.

While the client's routing tables can be aggressively manipulated using metric weights (setting Router Priority to High), the underlying configuration output remains incorrect and permanently pollutes downstream routing caches with asymmetric pathways.

1. Environment Data:
   Firewall Hardware: Netgate 6100
   OS Version: pfSense Plus 26.07-RELEASE (FreeBSD 16.0-CURRENT)

1. Steps to Reproduce:
   1. Create a custom IPv6 Link-Local IP Alias VIP (ex: fe80::20:1/128) bound to a VLAN interface parent.
   2. Navigate to Services > Router Advertisement, select the target interface tab, and choose the VIP in the "RA Interface" dropdown menu.
   3. Drop into the system shell and inspect the generated backend configuration file via cat /var/etc/radvd.conf.
   4. Observe that the interface block changes its default RemoveRoute logic from on to off.
   5. Check a connected Windows client machine. Note that while a standard ipconfig /all may mask the duplicate hardware route due to client-side priority optimizations, checking the true underlying routing table via netsh interface ipv6 show route reveals that the machine continues to track both default routes simultaneously.
   Be aware that neighbor cache may still show the old LLA until it expires.

1. Expected Behavior:
   When an explicit custom VIP override is assigned to the "RA Interface" field, the configuration parser should either omit the route ::/0 sub-block entirely, respect a WebGUI option to drop it, or preserve RemoveRoute on; to allow proper cleanup of the physical interface route bounds.

1. Observed configuration discrepancy (/var/etc/radvd.conf):

1. EXPECTED BEHAVIOR (Standard Interface Profile - igc0.10):
   interface igc0.10 {
   AdvSendAdvert on;
   ...
   route ::/0 {
   AdvRoutePreference medium;
   RemoveRoute on; <-- Correct routing table behavior
   };
   };

1. BUG ENCOUNTERED (Feature #16914 Interface Profile - igc0.20):
   interface igc0.20 {
   AdvSendAdvert on;
   AdvRASrcAddress {
   fe80::20:1; <-- Correctly assigned via #16914
   };
   ...
   route ::/0 {
   AdvRoutePreference high;
   RemoveRoute off; <-- BUG? Forces client retention of physical LLA gateway
   };
   };

1. Packet capture evidence:
   The issue can be seen in a packet trace of the generated Router Advertisement. While Feature #16914 correctly updates the packet's main header IP address, the radvd daemon simultaneously broadcasts two problematic sub-option payloads:

1. ICMPv6 Option (Route Information : High ::/0) [Type 24] - A redundant RIO tracking the base physical interface instance scope.
2. ICMPv6 Option (Source link-layer address) [Type 1] - An option payload explicitly transmitting the hardware MAC address of the physical parent interface (ex: 90:ec:77:1c:9d:5e).

Because these options specify the underlying hardware scope instead of suppressing them, client OSes process these payloads by mapping a secondary default route back to the physical interface LLA alongside the chosen VIP.

1. Windows client
   Note: Router Priority set to High to temporarily workaround the issue.

ipconfig /all
...
Default Gateway . . . . . . . . . : fe80::20:1%23
...

route -6 print
...

IPv6 Route Table ===========================================================================
Active Routes:
If Metric Network Destination Gateway
23 66 ::/0 fe80::20:1