Project

General

Profile

Actions
Copy link

Bug #3074

closed

DHCPv6 traffic blocked on LAN with DHCPv6 relay enabled

Added by Doktor Notor over 11 years ago. Updated over 10 years ago.

Status:
Resolved
Priority:
Normal
Assignee:
-
Category:
-
Target version:
-
Start date:
07/05/2013
Due date:
% Done:

100%

Estimated time:
Plus Target Version:
Release Notes:
Affected Version:
2.1-IPv6
Affected Architecture:

Description

Looking at this part of filter.inc, I don't think it deals with this configuration correctly.
@
  1. allow access to DHCPv6 server on {$oc['descr']}
  2. We need inet6 icmp for stateless autoconfig and dhcpv6
    pass quick on \${$oc['descr']} inet6 proto udp from fe80::/10 to fe80::/10 port = 546 label "allow access to DHCPv6 server"
    pass quick on \${$oc['descr']} inet6 proto udp from fe80::/10 to ff02::/16 port = 546 label "allow access to DHCPv6 server"
    pass quick on \${$oc['descr']} inet6 proto udp from fe80::/10 to ff02::/16 port = 547 label "allow access to DHCPv6 server"
    pass quick on \${$oc['descr']} inet6 proto udp from ff02::/16 to fe80::/10 port = 547 label "allow access to DHCPv6 server"
if ((is_array($config['dhcpdv6'][$on]) && isset($config['dhcpdv6'][$on]['enable'])) || isset($oc['track6-interface'])) {
                $ipfrules .= <<&lt;EOD

EOD;
if (is_ipaddrv6($oc['ipv6'])) {
$ipfrules .= <<<EOD
pass in quick on \${$oc['descr']} inet6 proto udp from fe80::/10 to {$oc['ipv6']} port = 546 label "allow access to DHCPv6 server"
pass out quick on \${$oc['descr']} inet6 proto udp from {$oc['ipv6']} port = 547 to fe80::/10 label "allow access to DHCPv6 server"

EOD;
@

Regardless, traffic from fe80::/10 port 546 to ff02::/16 port 547 gets blocked. The LAN is configured with static IPv6.

Relevant part of the configuration:

<dhcpdv6>
<lan>
<ramode>assist</ramode>
<rapriority>medium</rapriority>
<rainterface/>
</lan>
</dhcpdv6>


<dhcrelay6>
<enable/>
<interface>lan</interface>
<server>2001:470:6f:xxx:yyy::zzz</server>
</dhcrelay6>

Files

dhcprelay-fix-test.patch (725 Bytes) dhcprelay-fix-test.patch Jim Pingle, 07/05/2013 09:54 AM
Actions
Copy link

Also available in: Atom PDF