OPNsense Forum

English Forums => General Discussion => Topic started by: bipiq on March 17, 2022, 10:20:30 AM

Title: dhcpv6 blocked by firewall
Post by: bipiq on March 17, 2022, 10:20:30 AM
My dhcpv6 seems being blocked by firewall. Every time I try to connect to the network (I mean on linux `nmcli connection up myconnection0`) the log live view show me this:
(https://s1.328888.xyz/2022/03/17/9eaEO.png)
If I'm not mistaken the ipv6 address ff02::16 should be something relevant to dhcpv6, and therefore should not be blocked.
I also noticed there is some default floating rules:
(https://s1.328888.xyz/2022/03/17/9ueFQ.png)
However these rules' protocol is ipv6-icmp other than icmp, which was blocked and logged.
What should I do to solve this?
Title: Re: dhcpv6 blocked by firewall
Post by: bimbar on March 17, 2022, 02:06:33 PM
I'm pretty sure that DHCPv6 is ff02::2 (all routers).
Title: Re: dhcpv6 blocked by firewall
Post by: levconz on March 20, 2022, 07:18:56 PM
Since the last 2 updates and additional automatic rules added I found similar issues. I'm posting with screenshots to show my work.  The floating I added the fe80::/10 to ff02::/16 due to Auto Rule wasn't working for me.  The LAN I had to clone and delete the original Defaults to get them to work again.  The WAN I added "Allow All ICMP Inbound", Disabled BOGONS on WAN Interface (because AUTO Rule  was blocking my WAN GW address fe80::yada:yada from my ISP to LAN ff02::1 Multicast address, then manually enter the bogons rules.  Hope this will help you.  Been a learning experience for me...
Title: Re: dhcpv6 blocked by firewall
Post by: levconz on March 20, 2022, 07:24:25 PM
BTW...  Below is a filter log showing before (bogons enabled) and after (bogons disabled) in reference to WAN Interface and auto generated rules for bogons and bogons6.

2022-03-20T13:16:56-04:00   Informational   filterlog   89,,,b579a47ecb727243a964c96ea06cd06a,igb7,match,pass,in,6,0xe0,0x00000,1,icmp,1,36,fe80::2b0:yada:yada:5419,ff02::1,truncated-ip6=36   
2022-03-20T13:14:51-04:00   Informational   filterlog   70,,,730b04035be750d29de5c32523480cf5,igb7,match,block,in,6,0xe0,0x00000,1,icmp,1,36,fe80::2b0:yada:yada:5419,ff02::1,truncated-ip6=36
Title: Re: dhcpv6 blocked by firewall
Post by: levconz on March 20, 2022, 07:29:28 PM
Last note to add... If using a bridge for multiple lan ports, I would enable "link-local address"