Is there a firewall setting that may need tweaking to get ndp-proxy NA's to go through? They aren't making it to the upstream interface, and I think that will solve my issue.
I'm certain I'm doing something wrong. I'm also certain this is as much a Comcast/XFinity issue as it is an OPNsense one.
I'm using OPNsense 26.4.2p3. I have a Comcast Business class with static IPs. I have a /29 for ipv4 and a /56 for ipv6. Comcast will only permit me to request prefix delegations no larger than /59. Packet captures show if I request multiple /59 PD's, Comcast says I have them.
However, only ipv6 /64's in the firstly requested /59 fully route.
For those that fail, remote packet captures show the packets making it to my Comcast modem and failing.
Packet captures on my OPNsense box's WAN interface, show Comcast sending a neighbor solicitation packet and not getting a reply. NOTE: for anything in the first PD requested, Comcast does not send NS requests. It just sends the packets to OPNsense.
After frequent attempts to set this up and knocking parts of my family's internet out, I am just trying on one isolated test system.
I tried setting up os-ndp-proxy-go to have Comcast as the upstream interface and the downstream interface as the one connected to my test system as the downstream.
In that setup, via packet captures on OPNsense, I see Comcast send an NS to my WAN. I see OPNsense send an NS to my test system. I see my test VM send a Neighbor Advertisement. I do not see an NA go out my WAN interface.
NDP Proxy debug logs say that it is forwarding the NA to the upstream.
Custom WAN dhcpv6.conf:
interface igb0 {
send ia-na 0;
send ia-pd 0;
send ia-pd 1;
send ia-pd 2;
request domain-name-servers;
request domain-name;
script "/var/etc/dhcp6c_wan_script.sh";
};
id-assoc na 0 {
};
id-assoc pd 0 {
prefix 2603:XXXX:XXXX:XX60::/59 infinity;
prefix-interface igb2 {
sla-id 26;
sla-len 5;
ifid 1;
};
prefix-interface igb1 {
sla-id 0;
sla-len 5;
};
prefix-interface igb3 {
sla-id 30;
sla-len 5;
};
};
id-assoc pd 1 {
prefix 2603:XXXX:XXXX:XXe0::/59 infinity;
prefix-interface ix2 {
sla-id 1;
sla-len 5;
};
};
id-assoc pd 2 {
prefix 2603:XXXX:XXXX:XX20::/59 infinity;
};
NDP Proxy settings:
ndp_proxy.png
NDP Proxy log saying it is forwarding the NA:
ndp_proxy_log.png