OPNsense Forum
English Forums => General Discussion => Topic started by: schnipp on March 27, 2019, 07:39:30 pm
-
Hello,
I have problems to register the IPv6 address of the firewalls WAN interface to my DynDNS operator. I got the following results:
- Registering the IPv4 address using the built-in DynDNS client (Custom) works fine
- Registering the IPv6 address using the built-in DynDNS client (Custom v6) fails
- Triggering the IPv6 registration URL via command line using curl works fine
A packet capture shows that the DynDNS client does not communicate with the server, but the log file shows the following error message, even though the WAN interface has a public IPv6 address assigned:
opnsense: /services_dyndns_edit.php: Dynamic DNS (<hostname>) There was an error trying to determine the public IP for interface - wan(ix0). Probably interface is not a WAN interface.
Update URL: https://update.spdyn.de/nic/update?hostname=xxxx&myip=%IP%&user=xxxx&pass=yyyy
Does anybody has similar problems?
-
PPPoE (pppoe0) interface is a virtual one on top of ethernet (ix0)
The DynDNS configuration "Custom v6" tries to gather the ipv6 address from the ix0 interface instead of pppoe0 if I understand the logfiles correctly.
Has anybody successfully running DynDNS with "Custom v6" profile?
-
This looks like your fix... https://github.com/opnsense/plugins/commit/007b64c5258e6e1d1
So which version of DynDNS plugin are you running?
Cheers,
Franco
-
I use plugin version 1.13 (under Opnsense 19.1.4). So, the fix is already in place.
-
Okay, let me have a closer look then.
-
Apr 3 17:45:17 opnsense: /services_dyndns_edit.php: Dynamic DNS (foobar) There was an error trying to determine the public IP for interface - wan(pppoe0). Probably interface is not a WAN interface.
Apr 3 17:45:17 opnsense: /services_dyndns_edit.php: Dynamic DNS (foobar): running get_failover_interface for wan. found pppoe0
Apr 3 17:45:17 opnsense: /services_dyndns_edit.php: Dynamic DNS (foobar): IP address could not be extracted
Apr 3 17:45:17 opnsense: /services_dyndns_edit.php: Aborted IPv6 detection: no address for pppoe0
Apr 3 17:45:17 opnsense: /services_dyndns_edit.php: Dynamic DNS: updatedns() starting
Looks ok to me, but it needs "Use IPv4 connectivity" in WAN settings... Which begs the question: what is your WAN setup and is it working? oO
Cheers,
Franco
-
My configuration:
Interface PPP (PPPoE) on top of ix0 (Ethernet):
Block private networks:yes
Block bogon networks: yes
IPv4 Configuration Type: PPPoE
IPv6 Configuration Type: SLAAC
Use IPv4 connectivity: no
I have also tested the option "Use IPv4 connectivity: yes" but saw no difference in network communication (wireshark)
-
Is this a side-effect from secure IPv6 addressing?
Need ifconfig of pppoe0 and igb0 to see why that's not picking up anything.
But "saw no difference in network communication" makes me worry a bit about how IPv6 works here at all. Are you sure it works fine? Sending curl over IPv4 with IPv6 attached in the URL is not a clear confirmation.
Cheers,
Franco
-
Do you mean "privacy extensions" with "secure IPv6" addressing? I tested first without privacy extensions and afterwards with, no difference.
But I did a test with ifconfig on the console. I removed all public IPv6 addresses from interface "pppoe0" and added one of the previously assigned public IPv6 addresses to the ethernet interface "ix0" (parent interface of "pppoe0"). Afterwards, I forced a DynDNS update for the "Custom v6" profile, which successfully registered the public IPv6 address of "ix0"
This shows that the DynDNS client tries to extract the publich IPv6 from the wrong interface (parent interface of "pppoe0" instead of "pppoe0" itself).
Additionally: Adding a second alias to "ix0" (and in a second try an additional link local address) showed that the first non link local address is extracted and used for DynDNS registration.
Edit:
With "Use IPv4 connectivity" I understand, that the IPv6 configuration is done over IPv4 or PPP-config. Maybe there is a misunderstanding. "saw no difference in network communication" means that IPv6-SLAAC is still done via IPv6 multicast.
-
I have created a bug report in github: https://github.com/opnsense/plugins/issues/1296 (https://github.com/opnsense/plugins/issues/1296)
-
Maybe the issue does not rely in the DynDNS plugin because I saw some more strange behavior regarding IPv6. As already mentioned the ethernet interface "ix0" is parent of the virtual ppp interface "pppoe0".
- SLAAC is working fine for pppoe0 (uses the offered prefix by my ISP via PPP configuration)
- Switching from SLAAC to Static IPv6 on "pppoe0" shows strange behavior
- The static IPv6 is assigned to "ix0" instead of "pppoe0" (checked with ifconfig)
- Console overview after SSH login show that the static IPv6 is assigned to "ix0" and "pppoe0" :'(
- Using DHCPv6 is not working at all, no DHCPv6 request packets seen on wire
- rtsold is watching on "ix0": Is that correct?
Maybe opnsense has problems to distinguish "pppoe0" from "ix0"?
Any ideas or hints?
-
A friend has the following cascade "ix0" -> "ix0_vlan7" -> "pppoe0" and has tested to assign a static IPv6 to the interface "pppoe0".
Again, on his opnsense installation the IPv6 address is also assigned to the parent interface of "pppoe0" which is "ix0_vlan7".
-
I also have had problems with IPv6 in OPNsense. Miraculously, my problems seem to have disappeared after I played around a bit with the settings DHCPv6, SLAAC and static IPv6 in the WAN interface configuration.
Currently, I'm using a dual stack configuration with IPv4 Configuration Type PPPoE and IPv6 Configuration Type SLAAC.
Nevertheless, I can confirm the schnipp's observations.
- Registration of an IPv6 address with the built-in DynDNS client (Custom v6) failed.
- Static IPv6 was bound to the wrong interface (ix0_vlan7 instead of pppoe).
On top of that I also had issues using IPv6 as internet protocol in an IPsec configuration. In this case the link local address of the WAN interface (instead of its unique global address) has been assigned to the 'left' parameter in ipsec.conf.
Despite everything looks fine right now, I'm nonetheless worried that something is (partly) broken with regards to IPv6. Unfortunately I have not been able to reproduce the problems so far.
-
To me this points to SLAAC incorrectly selecting the interface when the address is grabbed or simply always defaulting to the hardware interface. It's hard to confirm without a responsive setup.
Cheers,
Franco
-
As I already mentioned this is not only related to SLAAC, even configuring a static IPv6 incorrectly assigns that address to the parent interface.
However, this problem does no persist permanently because registration the IPv6 address of the pppoe interface currently works fine.
Any ideas?
-
I think I found it while reviewing something else:
https://github.com/opnsense/core/commit/fc2ea5dee
# opnsense-patch fc2ea5dee
Does that work for you?
Cheers,
Franco
-
Still trying to reproduce the issues...
-
Hi franco,
thanks, I'll check this next week and report back.
-
This patch also indicates an issue even more so than the other one: https://github.com/opnsense/core/commit/05bb00812
Cheers,
Franco
EDIT: But might not be working. Sorry for stabbing in the dark. This is still eludes common sense somehow.
-
So, I tested both patches (fc2ea5dee and 05bb00812), but still noch difference in behavior. In general after boot up no IPv6 address is assigned to the pppoe interface using SLAAC, after performing a pppoe reconnect the address is properly assigned to the pppoe interface.
Further obversations:
- SLAAC (without "Use IPv4 connectivity"): DynDNS cannot identify the correct WAN interace and tries to use the IPv6 from the parent interface (ix0)
- SLAAC (with "Use IPv4 connectivity"): DynDNS works fine and properly registers the IPv6 address of the pppoe interface
- Configuring the pppoe interface with a static IPv6 incorrectly assigns the configured IPv6 address to the parent interface (ix0)
I looks like there are still problems with identifying the correct interface and possibly some more bugs. Does anybody have an idea, how to debug the scripts running in the background?
-
I think SLAAC assignment itself is broken away from our code somehow, but I can't easily inspect this because PPPoE and SLAAC is pretty circumstantial and I don't have access to it. :(
Cheers,
Franco
-
I think it is not related to SLAAC and PPPoE only, because when setting a static IPv6 address for the interface pppoe0 in the GUI, the address is assigned to the parent interface ix0. The same behavior occurs if the static IPv6 address is set for a VLAN child interface of ix0.
@franco: Do you have an idea, how to easily debug some of the scripts?
-
To me it seems you are describing leaving "Use IPv4 connectivity" unchecked. The setting exists for SLAAC, Static IPv6 and DHCPv6.
Cheers,
Franco
-
Oh, I am not sure if this option was activated with static IPv6 and DHCP. I'll do a new series of tests at end of next week and report again.
-
Ok, and if you are on 19.1.7 can you ping me on https://github.com/opnsense/core/issues/2267 as I have all the code ready now and we can get to the bottom of it.
Cheers,
Franco
-
Thanks, next monday I can start testing the pppoe patches.
Going ahead in this thread and start testing the assignment of IPv6 addresses to the network interfaces need some more time, because I am very busy at the moment.