pfSense

Another issue that seems to be related to this is that firewall rules using "LAN net" and similar are not obeyed if you have multiple subnets with the ULA Virtual IPs. The code that generates the firewall rules appears to only be using the primary IPv6 address, which is the public prefix from track6. It looks like the code needs to handle all the IPv6 addresses on the interface and not just the first one, both for DHCPv6/RA and for generating firewall rules.

Any update on this? I would really like to be able to use ULA and GUA IPv6 addresses at the same time on my network, but this issue prevents me from doing so by making the GUA stop working whenever the router is rebooted.

Fixing this would help with the problems discussed in this forum post: https://forum.pfsense.org/index.php?topic=126978.0

See also: #8276

Did not realize that there was an issue as old as this when i first made my own tickets. This affects every version of pfsense until the very latest. The fix would be as simple as to not treat Virtual IPs as candidate addresses for actual configuration daemon and instead wait for tracked addressing to come up before writing radvd and dhcpd config.

This would NOT be difficult to implement and dismissing it as something to be addressed in the unforeseeable future is just shameful.

If it is "simple" and "not difficult", we would happily accept a pull request to fix the issue.

Jim Pingle wrote:

If it is "simple" and "not difficult", we would happily accept a pull request to fix the issue.

Well, I really don't know how to cleanly fix this, but from what I have seen, three steps are needed to fix it:

1. change the order of the IP's on the interfaces so the ULA is below the tracked IP
2. update the radvd.conf file
3. restart radvd

The first and last steps I can do with my ULA IP's hardcoded into a script. Sadly, I cannot figure out how to regenerate the radvd config file.

As far as I can tell there are too many assumptions placed on the order of the addresses on the interfaces.

There are two things in play that I see:

1. Generation of radvd.conf

2. Generation of pass "LAN interface" rules.

If the GUA from track interface is the first one listed in ifconfig, everything seems to work fine.

If the ULA address is listed first, everything pretty much breaks.

With a dynamic prefix delegation, even a relatively-stable one, standard practice is to use both ULA and GUA on inside interfaces as outlined in RFC7368 3.4.2.

I encountered this issue while attempting to host internal web services via IPv6 using a dynamic external IP address. My experiences are described in this forum post: https://forum.netgate.com/topic/138257/cannot-ping-pfsense-ula-from-subnet-without-ula-assigned-to-firewall.

I am a software developer, albeit absent any pfSense-specific insights, and would be willing to help craft a pull request if enough developers were interested in trying to resolve this. I think it will be challenging to resolve because it seems like there are still many places in the code base where it operates under the assumption that there will be only one primary address per interface as is the norm with IPv4 instead of the multiple addresses per interface as is the norm with IPv6. Together with the lack of dynamic NPT (https://redmine.pfsense.org/issues/4881), this means that IPv6 services cannot be hosted externally without a static IP address.

Jim Pingle wrote:

If it is "simple" and "not difficult", we would happily accept a pull request to fix the issue.

I don't know FreeBSD, but isn't there a route command to just add the additional static route to the interface without creating a VIP?

You don't need a VIP since they are both on the same link and the gateway for both of these prefixes is already defined to be fe80::1:1 anyway. If you look at the RA it is advertising itself for both subnets on the link local when you add the additional subnet on the Router Advertisements tab.

Say in your routes it shows:
2001:db8:abcd:dcba::/64 link#6

you just need to add a route for the added prefix so that you get:
2001:db8:abcd:dcba::/64 link#6
fdc0:ffee:5::1/64 link#6

The actual gateway is done by:
fe80::%hn1/64 link#6
fe80::1:1%hn1 link#6

Another issue that seems to be related to this is that firewall rules using "LAN net" and similar are not obeyed if
you have multiple subnets with the ULA Virtual IPs. The code that generates the firewall rules appears to only be using
the primary IPv6 address, which is the public prefix from track6. It looks like the code needs to handle all the IPv6
addresses on the interface and not just the first one, both for DHCPv6/RA and for generating firewall rules.

Fixed in #8256

What about main issue, pfSense_get_interface_addresses() needs to be improved to return all addresses or return the first non-vip address

https://gitlab.netgate.com/pfSense/pfSense/-/merge_requests/21

fixes/improvements:
- Show Track6IP correctly if there is no VIPs on the interface;
- Show PD on the `services_dhcpv6.php page`:
"Subnet Prefix Delegation (2001:db8:1111:fff0::/60)"

https://gitlab.netgate.com/pfSense/pfSense/-/merge_requests/35

PR has been merged. Thanks!

I can confirm that this seems to resolve the original problem that I was experiencing. Really appreciate the fix guys! Any chance we could get a dropdown to specify which prefix to use for the DHCPv6 server? In my network I use DHCPv6 to assign ULA addresses but the servers receive their global address via RA's.

Allen Balaj wrote:

I can confirm that this seems to resolve the original problem that I was experiencing. Really appreciate the fix guys! Any chance we could get a dropdown to specify which prefix to use for the DHCPv6 server? In my network I use DHCPv6 to assign ULA addresses but the servers receive their global address via RA's.

Please create a new feature request for this
See also #10715 and #10714

Thanks Viktor, I'll keep an eye on those feature requests. That said, I may have spoken too soon regarding this fix working as intended. With the latest nightlies, I am again seeing my GUA prefix drop off the LAN interface after a reboot. Let me know if you need any system-specific info.

Allen Balaj wrote:

Thanks Viktor, I'll keep an eye on those feature requests. That said, I may have spoken too soon regarding this fix working as intended. With the latest nightlies, I am again seeing my GUA prefix drop off the LAN interface after a reboot. Let me know if you need any system-specific info.

Works fine for me. What is your current pfSense snapshot version?
Please attach system.log and brief info about your interfaces.

Allen Balaj wrote:

I'm currently on 2.5.0.a.20201124.0050. My firewall is single LAN, single WAN, ~2 dozen VLANs, running atop a Proxmox VM with 2 virtualized network interfaces. See my system.log attached.

My LAN subnet is the only VLAN that I have currently have configured to advertise both the ULA and GUA prefixes, along with the corresponding VIP for routing.

Unable to reproduce, it works fine for me on 2.5.0.a.20210204.2250
You issue may be related to receiving DHCP6 packets on boot:

Nov 21 05:15:36 pfSense php[407]: rc.bootup: Unbound start waiting on dhcp6c.
Nov 21 05:15:37 pfSense php[407]: rc.bootup: Unbound start waiting on dhcp6c.
Nov 21 05:15:38 pfSense php[407]: rc.bootup: Unbound start waiting on dhcp6c.
Nov 21 05:15:39 pfSense php[407]: rc.bootup: Unbound start waiting on dhcp6c.
Nov 21 05:15:40 pfSense php[407]: rc.bootup: Unbound start waiting on dhcp6c.
Nov 21 05:15:41 pfSense php[407]: rc.bootup: Unbound start waiting on dhcp6c.

Return correct Track IPv6 address if >1 VIP on interface:
https://gitlab.netgate.com/pfSense/pfSense/-/merge_requests/124