OPNsense Forum

Archive => 22.7 Legacy Series => Topic started by: YipieKaie on July 29, 2022, 08:11:46 PM

Title: Cannot forward link local ipv6 addresses on mobil phone
Post by: YipieKaie on July 29, 2022, 08:11:46 PM
The uppdate went well accept this?
Thx for a good joob

OPNsense 22.7_4-amd64
FreeBSD 13.1-RELEASE
OpenSSL 1.1.1q 5 Jul 2022

firewall: do not emit link-local address on IPv6 network outbound NAT

cannot forward src fe80:1::9c68:c6ff:fe81:a8b3 dst 2a03:2880:f00a:8:face:b00c:0:2 nxt 6 rcvif em0 outif em1

Title: Re: Cannot forward link local ipv6 adress
Post by: franco on July 30, 2022, 09:15:20 PM
Geez, I hate this issue. ;)

I think I know what's wrong if you can confirm the issue persists after a reboot of 22.7.


Cheers,
Franco
Title: Re: Cannot forward link local ipv6 address
Post by: YipieKaie on July 31, 2022, 01:25:35 AM
Yes it does, dont help reboot

//Peter
Title: Re: Cannot forward link local ipv6 adress
Post by: franco on July 31, 2022, 01:09:52 PM
Hi Peter,

Untested patch at https://github.com/opnsense/core/commit/b5bda2bda

Will try to confirm on Monday.


Cheers,
Franco
Title: Re: Cannot forward link local ipv6 address
Post by: YipieKaie on July 31, 2022, 07:40:53 PM
Thx Franco it will be interesting!
I hope it works

Tjoooo
//Peter
Title: Re: Cannot forward link local ipv6 adress
Post by: franco on August 01, 2022, 10:18:01 AM
Small typo there it seems:

https://github.com/opnsense/core/commit/fe52702a8b0

So patch command is:

# opnsense-patch b5bda2bda fe52702a8b0

After a filter reload the issue should be gone.


Cheers,
Franco
Title: Re: Cannot forward link local ipv6 address
Post by: YipieKaie on August 01, 2022, 10:58:31 AM
Hello again Franco

I did the patch but sorry to say
same problem persists

//Peter
Title: Re: Cannot forward link local ipv6 adress
Post by: franco on August 01, 2022, 11:11:38 AM
Hi Peter,

Not sure if this applied correctly or was reconfigured properly or some other issue at play...

# grep -n 'inet6.*-to*fe80' /tmp/rules.debug

This would show all bad rules (if they still exist).


Cheers,
Franco
Title: Re: Cannot forward link local ipv6 address
Post by: YipieKaie on August 01, 2022, 11:53:25 AM
Hello Franco

Here is the file

//Peter
Title: Re: Cannot forward link local ipv6 adress
Post by: franco on August 01, 2022, 11:55:25 AM
That's just the start of the file :D I simply need the output of "grep -n 'inet6.*-to*fe80' /tmp/rules.debug" (there may be none which is what should be the case).


Cheers,
Franco
Title: Re: Cannot forward link local ipv6 address
Post by: YipieKaie on August 01, 2022, 02:21:38 PM
Did you get the file Franco?

//Peter
Title: Re: Cannot forward link local ipv6 address
Post by: YipieKaie on August 01, 2022, 03:07:20 PM
Hi Franco
I have now a mismatch checksum in my Rule .php
after the patch?

//Peter

***GOT REQUEST TO AUDIT HEALTH***
Currently running OPNsense 22.7_4 (amd64/OpenSSL) at Mon Aug  1 15:04:14 CEST 2022
>>> Check installed kernel version
Version 22.7 is correct.
>>> Check for missing or altered kernel files
No problems detected.
>>> Check installed base version
Version 22.7 is correct.
>>> Check for missing or altered base files
No problems detected.
>>> Check installed repositories
OPNsense
>>> Check installed plugins
os-theme-cicada 1.29
os-theme-rebellion 1.8.8



>>> Check locked packages
No locks found.
>>> Check for missing package dependencies
Checking all packages: .......... done
>>> Check for missing or altered package files
Checking all packages: ....
opnsense-22.7_4: checksum mismatch for /usr/local/opnsense/mvc/app/library/OPNsense/Firewall/Rule.php
Checking all packages......... done
>>> Check for core packages consistency
Core package "opnsense" has 63 dependencies to check.
Checking packages: .
Title: Re: Cannot forward link local ipv6 adress
Post by: franco on August 01, 2022, 03:11:21 PM
Where did you send it? The modification of Rule.php is expected at least.


Cheers,
Franco
Title: Re: Cannot forward link local ipv6 address
Post by: YipieKaie on August 01, 2022, 03:19:50 PM
Sorry Franco missunderstand you about the file  ;D

I have now put back a backup and run the patch again
so fahr no fault really dont know what was going wrong
and no mismatch of the Rule.php any longer


//Peter
Title: Re: Cannot forward link local ipv6 adress
Post by: franco on August 01, 2022, 03:25:01 PM
Hi Peter,

Thanks, I cannot find any indication of the problem with the patch at hand.

The only rule where the patch still applies is:

pass in log quick on em0 inet6 from {(em0:network),fe80::/10} to {any} keep state label "b868871c1924b50b684c1addaeb35adb" # : Default allow LAN IPv6 to any rule

and that doesn't have a "route-to" or "reply-to".

It seems we either hit a dead end or an older issue.


Cheers,
Franco
Title: Re: Cannot forward link local ipv6 address
Post by: YipieKaie on August 01, 2022, 03:30:35 PM
I have now put back a backup and run the patch again
so fahr no fault really dont know what was going wrong
and no mismatch of the Rule.php any longer

20min now no more fault on screen i think its working

Thx alot Franco for the help

//Peter
Title: Re: Cannot forward link local ipv6 address
Post by: YipieKaie on August 01, 2022, 04:59:41 PM
Crap now its back again

I post the Rule.php anyway if you wana take a look

//Peter
Title: Re: Cannot forward link local ipv6 adress
Post by: muchacha_grande on August 01, 2022, 08:46:50 PM
Hi, I have the same problem. It has been happening for a long time.
I use OPNSense virtualized on ESXi and the virtual console is filled with these messages.

Title: Re: Cannot forward link local ipv6 address
Post by: YipieKaie on August 02, 2022, 12:03:28 AM
Hi muchacha_grande

Did you upd to OPNsense 2.7_4?
I did not have any problem before i upd

Did you read what Franco wrote?

Small typo there it seems:

https://github.com/opnsense/core/commit/fe52702a8b0

So patch command is:

# opnsense-patch b5bda2bda fe52702a8b0

After a filter reload the issue should be gone.


//Peter
Title: Re: Cannot forward link local ipv6 adress
Post by: muchacha_grande on August 02, 2022, 01:04:33 AM
Hi @YipieKaie

Quote from: YipieKaie on August 02, 2022, 12:03:28 AM
Did you upd to OPNsense 2.7_4?
I'm running 22.7_4 already.

Quote from: YipieKaie on August 02, 2022, 12:03:28 AM
Did you read what Franco wrote?

Small typo there it seems:

https://github.com/opnsense/core/commit/fe52702a8b0

So patch command is:

# opnsense-patch b5bda2bda fe52702a8b0

After a filter reload the issue should be gone.


//Peter
I'll give a try to these patches...

thank you.
Title: Re: Cannot forward link local ipv6 adress
Post by: franco on August 02, 2022, 12:54:35 PM
If the issue existed piror to 22.7 we might be chasing shadows here.

For one, conceptionally the message is just what it is: an information that link local packets cannot be forwarded to a global IPv6 address. This is a fact and probably not an operational issue.

Instead, let's try to pin down the message in the network stack:

https://github.com/opnsense/src/blob/3edcfbc578fd9df737aac660ea0aa85b680a8123/sys/netinet6/ip6_forward.c#L202-L231

This is very likely caused by the "route-to" (firewall rule gateway) setting, something that might need to be prevented inside pf code itself. If you set a gateway rule without a matching address link-local address on the interface could match as well causing this to happen in the first place (despite the explicit link-local handling we have added in 22.7).


Cheers,
Franco
Title: Re: Cannot forward link local ipv6 address
Post by: YipieKaie on August 02, 2022, 01:00:14 PM
Hello again m8

After spending a bit more of time i know what my problem
is, its the mobile phones that dont get any IPV6 IP
only a link local address. so its something wrong
in OPNsense  i think. This was ok before upd to 22.7

//Peter
Title: Re: Cannot forward link local ipv6 adress
Post by: franco on August 02, 2022, 01:02:24 PM
I tend to disagree, unless you have a packet capture with a GUA destination and a link-local source but then it's the phone not the OPNsense? oO


Cheers,
Franco
Title: Re: Cannot forward link local ipv6 address
Post by: YipieKaie on August 02, 2022, 01:08:15 PM
Yoo Franco

But something must have been changed in22.7
because it was working before and i have not
changed anything in the setup.

And the strange is that its only 2a03:2880 facebook
address that fuck this up no other addresses


//Peter
Title: Re: Cannot forward link local ipv6 adress
Post by: franco on August 02, 2022, 01:18:53 PM
Well, the basic question now is what device is fe80:1::9c68:c6ff:fe81:a8b3 and why does it insist on connecting to facebook using the wrong source address (scope)?


Cheers,
Franco
Title: Re: Cannot forward link local ipv6 address
Post by: YipieKaie on August 02, 2022, 01:37:42 PM
If i take my old phone

fe80:1::4e66:41ff:fec4:aabd <get this lnik lokal
4c:66:41:c4:aa:bd < mac address


i dont know why the only thing i know is
it started after update 22.7
Title: Re: Cannot forward link local ipv6 adress
Post by: franco on August 02, 2022, 02:05:24 PM
So 22.7 makes the phone send invalid IPv6 packets by messing up its scope addressing? While I agree that it may not get a GUA to pull this off it shouldn't be sending this and I have the feeling a Facebook app is involved as well?


Cheers,
Franco
Title: Re: Cannot forward link local ipv6 address
Post by: YipieKaie on August 02, 2022, 02:36:06 PM
Could be like you say an app but if its an app
it should give same problem when i use my pc
at facebook i presume, but it doesn´t

//Peter
Title: Re: Cannot forward link local ipv6 adress
Post by: muchacha_grande on August 02, 2022, 03:37:55 PM
In my case I can confirm that all link local addresses are from smart phones and tablets. All of them Lineage OS except for one that still has Android.
None of the devices gets IPv6 because I'm not using SLAAC, just DHCPv6.
But it seems that they are sending some IPv6 packets using the link local...
Title: Re: Cannot forward link local ipv6 address
Post by: YipieKaie on August 02, 2022, 03:52:06 PM
Thx muchacha_grande for the input

I still think that its 22.7 makes the phone sending
invalid IPv6 packets by messing up its scope addressing

Or maybe it have been like this all the time but not
sending it to the console until the new upd 22.7.

But i am confused why its only the facebook Ip if
surfing on Tradera nothing happend but immediately
when starting facebook it pop up at the console

Even it looks like it send some check every 10-20 min
when facebook is not active (closed) on the phone

//Peter
Title: Re: Cannot forward link local ipv6 address
Post by: YipieKaie on August 02, 2022, 04:18:53 PM
More testing ;D

Its Facebook and Messenger that make
the console popup so its not only Facebook
its all facebook related IP adddresses.

Title: Re: Cannot forward link local ipv6 addresses on mobil phone
Post by: franco on August 15, 2022, 03:19:35 PM
I think the only reason the console messages appear now in 22.7 is because we allow "link-local" origin for LAN interface in default IPv6 rule, which lets through these crappy phone packets with invalid addressing where they were previously discarded.

You can take your 22.1.x and add a default allow for IPv6, from "fe80::/10" network and watch the same happen on 22.1 most likely.


Cheers,
Franco