Messages

[Routing -> Diagnostics -> General -> IPv6 routes]

I recently configured BGP (via os-frr) in order to peer with my ISP so they can properly install an IPv6 route for my /48 prefix. I announce the /48, they announce ::/0, everything works, we are all happy.

But I notice this on Routing -> Diagnostics -> General -> IPv6 routes:



For every single IPv6 that the firewall sees, either internal or public, I get a new /128 entry that is not removed. Right now, after frr has been running for about 12 hours since the last restart, it is showing 6000+ entries. They roughly show up every 20 secs (NDP related?).

Is this normal behavior? Please note these are not currently installed in the kernel, only show up in zebra:

Code Select Expand

root@opnsense1:~ # netstat -rn6 | grep -c fdXX:XXXX:XXXX:XXXX::XXXX
0
root@opnsense1:~ # vtysh -c "show ipv6 route fdXX:XXXX:XXXX:XXXX::XXXX"
Routing entry for fdXX:XXXX:XXXX:XXXX::XXXX/128
Known via "kernel", distance 0, metric 0
Last update 00:01:03 ago
Flags: None
Status: Installed
* directly connected, vmx0_vlan788
Routing entry for fdXX:XXXX:XXXX:XXXX::XXXX/128
Known via "kernel", distance 0, metric 0
Last update 00:01:58 ago
Flags: None
Status: Installed
* directly connected, vmx0_vlan788
Routing entry for fdXX:XXXX:XXXX:XXXX::XXXX/128
Known via "kernel", distance 0, metric 0
Last update 00:02:34 ago
Flags: None
Status: Installed
* directly connected, vmx0_vlan788

...

(222 similar entries in total)(Yes, I know it's pointless to obfuscate ULAs)

Is this just cosmetic or something is leaking badly?

Thanks!

Thanks to a Reddit post I made (!) I was contacted this week by some tech guru in my ISP and they agreed to configure proper routing of the /48 prefix via BGP, over a /127 network. And now everything works fine, which is great news.

But at the same time, it means I cannot properly test the static prefix patch to ndp-proxy-go, as I don't have anymore a static prefix I can proxy. My apologies! And thanks again.

That's awesome, thanks! I will give it a try next week and will report back.

I could definitely do NAT66 but NPT is a much cleaner solution.

ndproxy works perfectly for my scenario except that it doesn't work for multiple LANs (I don't fully understand the reason behind this).

If ndp-proxy-go had some sort of "manual mode" where you could set similar parameters as ndproxy, I think that would cover it, given that it supports multiple LANs.

Thanks for the reply!

Of course it would be great (not just for me, but for the community) to have additional functionality available. Unfortunately I don't think I can help with Go programming but if you ever decide to implement this, count on me for testing.

EDIT: by the way, my provider doesn't assign anything via SLAAC or DHCPv6. Only a static assignment.

[TL;DR:]

TL;DR: my ISP doesn't understand IPv6

After weeks of insisting, my company's ISP (IPlan from Argentina, full name and shame here), has decided to comply to their advertised offer and enabled IPv6 on our business-class internet service. They provided a public /48 (great), but it is statically assigned and not routed (not great). So we ended up with an on-link /48, without DHCPv6 (so no prefix delegation), and they refuse to even put a static route to my router. Just the plain /48 living on my WAN interface, with an address in the /48 being the default gateway for the whole /48. Period.

I escalated this to the highest level and they don't seem to even understand what I am talking about. Of course we are looking for a different ISP, but what are my options to make this setup a bit useful in the meantime? My internal network has ULA addresses and I am not planning to give internal devices GUAs for a number of reasons.

The plan was to use NPT with ndproxy and this in fact works fine, but ndproxy has a limitation that it works for only one internal network (and we have many).

ndp-proxy-go does not seem to work with ULA + NPT (I get the message "skip learn fdfd:xxxx:xxxx:xxxx::xxxx (not in allowed RA prefixes)" when trying to proxy ULA addresses). Am I missing something?

ndppd sounds like it might work but it's not available as an OPNsense package and I would prefer to avoid tinkering too much with the underlying FreeBSD (I don't want this to break in an upgrade, etc)

Any other alternatives or ideas?
Thanks!