Messages

nobody having any idea? especially on the 2nd question there must be some clarification? I guess it should also be put into documentation.

thanks,!

I use different IPs for each of the Gateways, yes. (1.1.1.1 and 8.8.8.8)

DNS used in System > Settings > General are not the same but an internal DNS server that does work properly.

It was not only a few messages but over a minute or so filling the whole screen, so I don't think it's a problem of individual packets getting lost though.

Reboot also didn't make a difference.

I had it also tried on two different setups. One using lot's of VLAN and the other one only with physical interfaces. In both cases I had the same symptoms. After the multi WAN config according to the guide, I was flooded with these error messages.

Following the manual to configure two WAN links for Load Balancing I am consistently running into an issue:
https://docs.opnsense.org/manual/how-tos/multiwan.html

As soon as I complete "Step 4 - Policy based routing" and hit "Apply" I get flooded with errormessages on the console:

Code Select Expand

arpresolve: can't allocate llinfo for <WAN IPv4> on vtnet1

It does not happen when I select "default" or any one of my existing WAN (v4) Gateways in the Gateway section. But whenever I select  the WAN Gateway Group defined in Step 2 of the guide, the error messages start coming.

I've seen some similar error messages reported in older threads but no resolution.

Any help would be appreciated!

Hi,
I wanted to setup my own rule for a bunch of DSCP codepoints as criteria.

I found in the ruleset definition under "Advanced features" a "Match TOS / DSCP"

However there are two questions:
1. can I use a single rule to define all my desired classifiers which would be DSCP 45, 46, 40, 56, and ECN bit ECT1 & CE (the later may not be supported [L4S])
2. there is a predefined setting in the drop down menu titled "Match TOS / DSCP = lowdelay". What exact DSCP matches are applied for that?

Thanks!

I think I see your point now with ULA, since my ISP just gave me a another set of IPv6 and looks like these are not permanent addresses so yeah I think you'd best ULA with DUID to create a solid address that you'd know.
[/quote]

As far as I can tell it does not matter if you use link-local or unique-local as long as the client is in the same subnet. of course the link-local won't be transported accross subnet boundries. But you automatically get a LL address which should be stable and good enough for the purpose of DNS resolution. But of course either would work.

I found the issue on my system that was causing one network segment to get both predefined IPv6 DNS addresses (Cloudflare 2606:4700:4700::1111 / ::1001) and my router's LAN address as a DNS server - on that LAN segment, I had inadvertently left Services/Router Advertisements/Router Advertisements (the first drop down) set to "Disabled".  When I set it to "Assisted", the router stopped sending out the LAN address as a DNS server, and only advertised the Cloudflare addresses I entered into the DNS Servers field.  So maybe that helps you, opns-sc0?

As I tried to explain above. Doing all settings in a manual way completely srews up things for me because on the DMZ Interface I either don't get an IP address at all, or some IP that is outside the PD scope from my ISP. No idea how that would even be possible. Pls see my post with the wireshark capture for the proof.

thanks for the very comprehensive description of your setup.

I basically got it running in a very similar way. What I do want however, is to take the public IPv6 Prefix Delegation of a 2a02...  /56 Network and subnet that into smaller /64 networks and assign each /64 to LAN and DMZ. So every device get's a (temporary) public IPv6 (not ULA).

This all works ok as long as I don't  set "Allow manual adjustment of DHCPv6 and Router Advertisements" and change DHCP parameters or SLAAC settings from "Router Advertisements". I can also fill in the Link-local of the DNS into the DHCPv6 and "Router Advertisements" sections. My devices pick up the DNS and work.

However If I do all of that, some clients (Synology NAS) on the DMZ will either not get an IPv6 address or as I can show from a capture, does get one outside of the /56 PD from OPNsense. See capture attached where the fe80 hands out two IPv6 subsequently which are not in the same /56 at all. So when manually configuring DHCPv6 and "Router Advertisements" something breaks. I guess that is a completely seperate IPv6 networking subject though.

If I stay away from this manual config, it works with the exception that I can't influence the DNS server sent to the clients. It does send always the IPv6 LAN address of the OPNsense in addition to my configured DNS servers. And that's the easier to solve problem I hope. I simply would like an option not to send the LAN or DMZ local interface on which unbound runs to the clients.

Hope I could make a more clear?

Hi,
I'm running 22.7.6 and have been playing with IPv6 for the last few days.

I get a PD /56 from my ISP.
When I leave the local IPv6 assignment to OPNsense (unselect " Allow manual adjustment of DHCPv6 and Router Advertisements") then the IP assignment to my clients work.

It will also send the 2 DNS server IP addresses (1*IPv4 + 1*IPv6 link-local) which are configured in System: Settings: General to the clients as expected. However in addition to that it also sends the LAN Interface IPv6 (2a02...) to the clients. This is undesirable because it will prevent my Adguard from being the only nameserver for my clients and also allow unbound to serve clients.

Is there a way to prevent this behaviour?

I've tried to mannually configure IPv6 behaviour (checkbox on " Allow manual adjustment of DHCPv6 and Router Advertisements"). However in my setup with LAN and DMZ networks on OPNsense I simply can't get IPv6 address asignment to work properly. I've tried Managed and Assisted modes but have seen all kind of weird behaviour including the assingment of an IPv6 that was not in the PD scope at all). I'm really frustrated with this and believe the manual options must be buggy.

Any help will be much appreciated!

thanks,
Tino

Thanks again franco for taking a look at the issue yesterday.

After another night of sleep I had a second thought.

Before I upgraded I did use Sensei / Zenamor. I can't really recall if it was the FreeBSD driver or the Realtek driver. After first seeing issues I simply switched to the Realtek drivers. Those are the ones I had running yesterday as well. Do you think it's worth going back to FreeBSD drivers to test if it's any better?

Currently whenever IDS is activated i get netmap_transmit ue0 drop mbuf that needs checksum offload errors on console.

thanks!

thanks, sent you a note.

I know this is a free product etc...

But really the IPv6 implementation with PD is completely broken as far as I can tell.

Just had a reboot of my L2 switch behind the OPNsense box and the drama of endless WAN ip address changes for IPv6 started all over again.

Can some of the developers at least acknolege that they are aware and working on it?

Thanks!

after a bit more digging I see that for example a loss of one of the ethernet links is causing the whole wan ip addr to be given up? is there a reason to do that?

log looks like this: <11>1 2022-01-30T16:40:46+01:00 opnsense.xyz.com opnsense 29446 - [meta sequenceId="1"] /usr/local/etc/rc.linkup: DEVD: Ethernet detached event for dynamic opt1(ue0)
<13>1 2022-01-30T16:40:47+01:00 opnsense.xyz.com dhcp6c 39756 - [meta sequenceId="2"] dhcp6c RELEASE on re0 - running newipv6
<13>1 2022-01-30T16:40:47+01:00 opnsense.xyz.com dhcp6c 47634 - [meta sequenceId="3"] dhcp6c RELEASE on re0 - running newipv6
<11>1 2022-01-30T16:40:47+01:00 opnsense.xyz.com opnsense 44614 - [meta sequenceId="4"] /usr/local/etc/rc.newwanipv6: IPv6 renewal is starting on 're0'
<11>1 2022-01-30T16:40:47+01:00 opnsense.xyz.com opnsense 44614 - [meta sequenceId="5"] /usr/local/etc/rc.newwanipv6: On (IP address: ) (interface: WAN[wan]) (real interface: re0).
<11>1 2022-01-30T16:40:47+01:00 opnsense.xyz.com opnsense 44614 - [meta sequenceId="6"] /usr/local/etc/rc.newwanipv6: Failed to detect IP for WAN[wan]
<11>1 2022-01-30T16:40:47+01:00 opnsense.xyz.com opnsense 50824 - [meta sequenceId="7"] /usr/local/etc/rc.newwanipv6: IPv6 renewal is starting on 're0'
<11>1 2022-01-30T16:40:47+01:00 opnsense.xyz.com opnsense 50824 - [meta sequenceId="8"] /usr/local/etc/rc.newwanipv6: On (IP address: ) (interface: WAN[wan]) (real interface: re0).
<11>1 2022-01-30T16:40:47+01:00 opnsense.xyz.com opnsense 50824 - [meta sequenceId="9"] /usr/local/etc/rc.newwanipv6: Failed to detect IP for WAN[wan]
<11>1 2022-01-30T16:40:48+01:00 opnsense.xyz.com opnsense 74830 - [meta sequenceId="10"] /usr/local/etc/rc.linkup: DEVD: Ethernet attached event for dynamic opt1(ue0)
<11>1 2022-01-30T16:40:48+01:00 opnsense.xyz.com opnsense 74830 - [meta sequenceId="11"] /usr/local/etc/rc.linkup: ROUTING: entering configure using 'opt1'
<11>1 2022-01-30T16:40:48+01:00 opnsense.xyz.com opnsense 74830 - [meta sequenceId="12"] /usr/local/etc/rc.linkup: ROUTING: IPv4 default gateway set to wan
<11>1 2022-01-30T16:40:48+01:00 opnsense.xyz.com opnsense 74830 - [meta sequenceId="13"] /usr/local/etc/rc.linkup: ROUTING: skipping IPv4 default route
<11>1 2022-01-30T16:40:48+01:00 opnsense.xyz.com opnsense 74830 - [meta sequenceId="14"] /usr/local/etc/rc.linkup: ROUTING: IPv6 default gateway set to wan
<11>1 2022-01-30T16:40:48+01:00 opnsense.xyz.com opnsense 74830 - [meta sequenceId="15"] /usr/local/etc/rc.linkup: ROUTING: skipping IPv6 default route
<13>1 2022-01-30T16:40:48+01:00 opnsense.xyz.com opnsense 74830 - [meta sequenceId="16"] plugins_configure ipsec (,opt1)
<13>1 2022-01-30T16:40:48+01:00 opnsense.xyz.com opnsense 74830 - [meta sequenceId="17"] plugins_configure ipsec (execute task : ipsec_configure_do(,opt1))
<13>1 2022-01-30T16:40:48+01:00 opnsense.xyz.com opnsense 74830 - [meta sequenceId="18"] plugins_configure dhcp ()
<13>1 2022-01-30T16:40:48+01:00 opnsense.xyz.com opnsense 74830 - [meta sequenceId="19"] plugins_configure dhcp (execute task : dhcpd_dhcp_configure())
<11>1 2022-01-30T16:40:48+01:00 opnsense.xyz.com opnsense 74830 - [meta sequenceId="20"] /usr/local/etc/rc.linkup: Warning! dhcpd_radvd_configure(auto) found no suitable IPv6 address on ue0
<11>1 2022-01-30T16:40:48+01:00 opnsense.xyz.com opnsense 74830 - [meta sequenceId="21"] /usr/local/etc/rc.linkup: Warning! dhcpd_radvd_configure(auto) found no suitable IPv6 address on re1
<13>1 2022-01-30T16:40:48+01:00 opnsense.xyz.com opnsense 74830 - [meta sequenceId="22"] plugins_configure dns ()
<13>1 2022-01-30T16:40:48+01:00 opnsense.xyz.com opnsense 74830 - [meta sequenceId="23"] plugins_configure dns (execute task : dnsmasq_configure_do())
<13>1 2022-01-30T16:40:48+01:00 opnsense.xyz.com opnsense 74830 - [meta sequenceId="24"] plugins_configure dns (execute task : unbound_configure_do())
<13>1 2022-01-30T16:40:50+01:00 opnsense.xyz.com dhcp6c 26064 - [meta sequenceId="25"] dhcp6c REQUEST on re0 - running newipv6
<11>1 2022-01-30T16:40:50+01:00 opnsense.xyz.com opnsense 32366 - [meta sequenceId="26"] /usr/local/etc/rc.newwanipv6: IPv6 renewal is starting on 're0'
<11>1 2022-01-30T16:40:50+01:00 opnsense.xyz.com opnsense 32366 - [meta sequenceId="27"] /usr/local/etc/rc.newwanipv6: On (IP address: 2a02:xxxx:xxxx::cba) (interface: WAN[wan]) (real interface: re0).
<13>1 2022-01-30T16:40:50+01:00 opnsense.xyz.com opnsense 32366 - [meta sequenceId="28"] plugins_configure dhcp (,inet6)
<13>1 2022-01-30T16:40:50+01:00 opnsense.xyz.com opnsense 32366 - [meta sequenceId="29"] plugins_configure dhcp (execute task : dhcpd_dhcp_configure(,inet6))
<13>1 2022-01-30T16:40:50+01:00 opnsense.xyz.com opnsense 32366 - [meta sequenceId="30"] plugins_configure hosts ()
<13>1 2022-01-30T16:40:50+01:00 opnsense.xyz.com opnsense 32366 - [meta sequenceId="31"] plugins_configure hosts (execute task : dnsmasq_hosts_generate())
<13>1 2022-01-30T16:40:50+01:00 opnsense.xyz.com opnsense 32366 - [meta sequenceId="32"] plugins_configure hosts (execute task : unbound_hosts_generate())
<11>1 2022-01-30T16:40:50+01:00 opnsense.xyz.com opnsense 32366 - [meta sequenceId="33"] /usr/local/etc/rc.newwanipv6: ROUTING: entering configure using 'wan'
<11>1 2022-01-30T16:40:50+01:00 opnsense.xyz.com opnsense 32366 - [meta sequenceId="34"] /usr/local/etc/rc.newwanipv6: ROUTING: IPv4 default gateway set to wan
<11>1 2022-01-30T16:40:50+01:00 opnsense.xyz.com opnsense 32366 - [meta sequenceId="35"] /usr/local/etc/rc.newwanipv6: ROUTING: setting IPv4 default route to xxx.xxx.28.1
<11>1 2022-01-30T16:40:50+01:00 opnsense.xyz.com opnsense 32366 - [meta sequenceId="36"] /usr/local/etc/rc.newwanipv6: ROUTING: keeping current default gateway 'xxx.xxx.28.1'
<11>1 2022-01-30T16:40:50+01:00 opnsense.xyz.com opnsense 32366 - [meta sequenceId="37"] /usr/local/etc/rc.newwanipv6: ROUTING: IPv6 default gateway set to wan
<11>1 2022-01-30T16:40:50+01:00 opnsense.xyz.com opnsense 32366 - [meta sequenceId="38"] /usr/local/etc/rc.newwanipv6: ROUTING: setting IPv6 default route to fe80::xxxx:xxxx:xxxx:d819
<11>1 2022-01-30T16:40:50+01:00 opnsense.xyz.com opnsense 32366 - [meta sequenceId="39"] /usr/local/etc/rc.newwanipv6: ROUTING: keeping current default gateway 'fe80::xxxx:xxxx:xxxx:d819%re0'
<13>1 2022-01-30T16:40:50+01:00 opnsense.xyz.com opnsense 32366 - [meta sequenceId="40"] plugins_configure monitor ()
<13>1 2022-01-30T16:40:50+01:00 opnsense.xyz.com opnsense 32366 - [meta sequenceId="41"] plugins_configure monitor (execute task : dpinger_configure_do())
<11>1 2022-01-30T16:40:50+01:00 opnsense.xyz.com opnsense 32366 - [meta sequenceId="42"] /usr/local/etc/rc.newwanipv6: The WAN_DHCP6 monitor address is empty, skipping.
<11>1 2022-01-30T16:40:50+01:00 opnsense.xyz.com opnsense 32366 - [meta sequenceId="43"] /usr/local/etc/rc.newwanipv6: The WAN_DHCP monitor address is empty, skipping.
<13>1 2022-01-30T16:40:52+01:00 opnsense.xyz.com opnsense 32366 - [meta sequenceId="44"] plugins_configure vpn (,wan)
<13>1 2022-01-30T16:40:52+01:00 opnsense.xyz.com opnsense 32366 - [meta sequenceId="45"] plugins_configure vpn (execute task : ipsec_configure_do(,wan))
<13>1 2022-01-30T16:40:52+01:00 opnsense.xyz.com opnsense 32366 - [meta sequenceId="46"] plugins_configure vpn (execute task : openvpn_configure_do(,wan))
<13>1 2022-01-30T16:40:52+01:00 opnsense.xyz.com opnsense 32366 - [meta sequenceId="47"] plugins_configure newwanip (,wan)
<13>1 2022-01-30T16:40:52+01:00 opnsense.xyz.com opnsense 32366 - [meta sequenceId="48"] plugins_configure newwanip (execute task : ntpd_configure_do())
<13>1 2022-01-30T16:40:52+01:00 opnsense.xyz.com opnsense 32366 - [meta sequenceId="49"] plugins_configure newwanip (execute task : opendns_configure_do())
<13>1 2022-01-30T16:40:52+01:00 opnsense.xyz.com opnsense 32366 - [meta sequenceId="50"] plugins_configure newwanip (execute task : openssh_configure_do(,wan))
<13>1 2022-01-30T16:40:52+01:00 opnsense.xyz.com opnsense 32366 - [meta sequenceId="51"] plugins_configure newwanip (execute task : unbound_configure_do(,wan))
<13>1 2022-01-30T16:40:53+01:00 opnsense.xyz.com opnsense 32366 - [meta sequenceId="52"] plugins_configure newwanip (execute task : vxlan_configure_interface())
<13>1 2022-01-30T16:40:53+01:00 opnsense.xyz.com opnsense 32366 - [meta sequenceId="53"] plugins_configure newwanip (execute task : webgui_configure_do(,wan))

I seem to have massive problems since upgrading related to IPv6 and prefix deligation.

It took me a while and I have in the meantime done a clean installation just to be sure.

What I believe to have found is that the system goes crazy whenever I enable "Allow manual adjustment of DHCPv6 and Router Advertisements" checkbox. I want to do some IPv6 DHCP experiments and also have some control of the anounced DNS servers in the RA. That's why I need / want to have some manual control.

However as soon as I enable the checkbox and apply the system starts to renew WAN IPv6 constantly changing the prefix deligation every few moments and causing 100% system load.

Has anybody else similar experience or tips for troubleshooting? I am about to go back to the previous version which has worked ok for me.

Thanks!

Since I didn't get a reply and if somebody runs into the same issue - here is the solution.

Under Interfaces LAN there is a menu item: Manual configuration

This needs to be enabled and voila you'll get DHCPv6 and Router Advertisement config options to appear.

From there it seems to work for me with IPv6 PD and setting my own DNS server (not OPNsense).

hope this will save somebody else hours of trialing...

Hi,
I've been struggeling the last couple of hours because I was trying to get IPv6 running. Basic config is running but I need to configure DHCPv6 for my local network.

However running
OPNsense 20.1.3-amd64
FreeBSD 11.2-RELEASE-p17-HBSD
OpenSSL 1.1.1d 10 Sep 2019
it seems that the menu entry to configure IPv6 DHCP has disappeared from the left navigation panel. Also I could no longer find the configuraiton for Router Advertisements.

So either I am missing somthing (like any configuration dependency) or there seems to be a bug which prevents the UI to show these items.

Note while playing around I happend to get to DHCPv6 config screen eventually (playing around on the still visible Leases section). Also the DHCPv6 relay lilnk appears on the left navigation pane.

Hope this is just a small bug and can be fixed quickly.
thanks!