Project

General

Profile

Bug #3074

DHCPv6 traffic blocked on LAN with DHCPv6 relay enabled

Added by Doktor Notor about 7 years ago. Updated over 6 years ago.

Status:
Resolved
Priority:
Normal
Assignee:
-
Category:
-
Target version:
-
Start date:
07/05/2013
Due date:
% Done:

100%

Estimated time:
Affected Version:
2.1-IPv6
Affected Architecture:

Description

Looking at this part of filter.inc, I don't think it deals with this configuration correctly.
@
  1. allow access to DHCPv6 server on {$oc['descr']}
  2. We need inet6 icmp for stateless autoconfig and dhcpv6
    pass quick on \${$oc['descr']} inet6 proto udp from fe80::/10 to fe80::/10 port = 546 label "allow access to DHCPv6 server"
    pass quick on \${$oc['descr']} inet6 proto udp from fe80::/10 to ff02::/16 port = 546 label "allow access to DHCPv6 server"
    pass quick on \${$oc['descr']} inet6 proto udp from fe80::/10 to ff02::/16 port = 547 label "allow access to DHCPv6 server"
    pass quick on \${$oc['descr']} inet6 proto udp from ff02::/16 to fe80::/10 port = 547 label "allow access to DHCPv6 server"
if ((is_array($config['dhcpdv6'][$on]) && isset($config['dhcpdv6'][$on]['enable'])) || isset($oc['track6-interface'])) {
$ipfrules .= <<&lt;EOD

EOD;
if (is_ipaddrv6($oc['ipv6'])) {
$ipfrules .= <<<EOD
pass in quick on \${$oc['descr']} inet6 proto udp from fe80::/10 to {$oc['ipv6']} port = 546 label "allow access to DHCPv6 server"
pass out quick on \${$oc['descr']} inet6 proto udp from {$oc['ipv6']} port = 547 to fe80::/10 label "allow access to DHCPv6 server"

EOD;
@

Regardless, traffic from fe80::/10 port 546 to ff02::/16 port 547 gets blocked. The LAN is configured with static IPv6.

Relevant part of the configuration:

<dhcpdv6>
<lan>
<ramode>assist</ramode>
<rapriority>medium</rapriority>
<rainterface/>
</lan>
</dhcpdv6>


<dhcrelay6>
<enable/>
<interface>lan</interface>
<server>2001:470:6f:xxx:yyy::zzz</server>
</dhcrelay6>

dhcprelay-fix-test.patch (725 Bytes) dhcprelay-fix-test.patch Jim Pingle, 07/05/2013 09:54 AM

Associated revisions

Revision 86573a24 (diff)
Added by Jim Pingle about 7 years ago

Correct DHCPv6 rules test to also include a check for DHCPv6 relay. Fixes #3074

Revision 0ee96a45 (diff)
Added by Jim Pingle about 7 years ago

Correct DHCPv6 rules test to also include a check for DHCPv6 relay. Fixes #3074

History

#1 Updated by Doktor Notor about 7 years ago

#2 Updated by Jim Pingle about 7 years ago

The attached patch should fix it, but it would be better to test it before committing. Let us know if it helps.

#3 Updated by Doktor Notor about 7 years ago

All good now... thumbs up! :) Proper rules generated and DHCPv6 traffic no longer blocked on ifaces with relay enabled:

@47 pass quick on vr0 inet6 proto udp from fe80::/10 to fe80::/10 port = dhcpv6-client keep state label "allow access to DHCPv6 server" 
@48 pass quick on vr0 inet6 proto udp from fe80::/10 to ff02::/16 port = dhcpv6-client keep state label "allow access to DHCPv6 server" 
@49 pass quick on vr0 inet6 proto udp from fe80::/10 to ff02::/16 port = dhcpv6-server keep state label "allow access to DHCPv6 server" 
@50 pass quick on vr0 inet6 proto udp from ff02::/16 to fe80::/10 port = dhcpv6-server keep state label "allow access to DHCPv6 server" 
@51 pass in quick on vr0 inet6 proto udp from fe80::/10 to 2001:470:6f:x:y::z port = dhcpv6-client keep state label "allow access to DHCPv6 server" 
@52 pass out quick on vr0 inet6 proto udp from 2001:470:6f:x:y::z port = dhcpv6-server to fe80::/10 keep state label "allow access to DHCPv6 server" 
@61 pass quick on ath0_wlan0 inet6 proto udp from fe80::/10 to fe80::/10 port = dhcpv6-client keep state label "allow access to DHCPv6 server" 
@62 pass quick on ath0_wlan0 inet6 proto udp from fe80::/10 to ff02::/16 port = dhcpv6-client keep state label "allow access to DHCPv6 server" 
@63 pass quick on ath0_wlan0 inet6 proto udp from fe80::/10 to ff02::/16 port = dhcpv6-server keep state label "allow access to DHCPv6 server" 
@64 pass quick on ath0_wlan0 inet6 proto udp from ff02::/16 to fe80::/10 port = dhcpv6-server keep state label "allow access to DHCPv6 server" 
@65 pass in quick on ath0_wlan0 inet6 proto udp from fe80::/10 to 2001:470:u:v:w:x:y:z port = dhcpv6-client keep state label "allow access to DHCPv6 server" 
@66 pass out quick on ath0_wlan0 inet6 proto udp from 2001:470:u:v:w:x:y:z port = dhcpv6-server to fe80::/10 keep state label "allow access to DHCPv6 server" 

#4 Updated by Jim Pingle about 7 years ago

  • Status changed from New to Feedback
  • % Done changed from 0 to 100

#6 Updated by Chris Buechler over 6 years ago

  • Status changed from Feedback to Resolved

Also available in: Atom PDF