Messages

1

German - Deutsch / Re: IPv6 Routing

« on: May 17, 2020, 10:43:48 pm »

Früher verwendete der Provider eine Fritzbox und bei dieser konnte man die Firmware "zurücktauschen" und die Einstellungen wieder einlesen. Aktuell verwenden sie eine Box von "Sagemcom Broadband SAS". Ich habe bei dieser Box schon all die einfachen Sachen wie Port Scan etc versucht, um vielleicht doch ein Hintertürchen zu finden, leider ohne erfolg. Zugangsdaten für PPPoE geben sie auch keine heraus.

Als letzter Hinweis, der Provider Router selber erhält diese IPv6 zuweisung:

Code: [Select]

Delegated Prefix 2001:171b:226e:d7e0::/60
CPE LAN IPv6 Address 2001:171b:226e:d7e0:2e79:d7ff:fe6d:fb43

Ich will eher keine "hacky Solution" auf meinem Opnsense damit es irgendwie mit IPv6 läuft. Ich war mir bis jetzt nicht sicher wo das Problem lag, aber jetzt werde ich mal mit dem Provider doch noch reden müssen.

Vielen Dank Maurice für deine Hilfe!

Ich werde diesen Thread weiter verfolgen und allfällige Neuigkeiten posten.

2

German - Deutsch / Re: IPv6 Routing

« on: May 17, 2020, 09:23:36 am »

Danke für die Erläterung Maurice, IPv6 ist neu für mich. Beim Router kann ich fast nichts einstellen. IpV6 ein/aus und einen Host ins IpV6 DMZ stellen. Ich habe das Letztere für Opnsense auch aktiv.
Deine Feststellung ist korrekt das mein Opensense am LAN vom Router hängt.
Ich hab hier im Forum und in der Doku gelesen das für IPv6 es genügt das ich nur ein Prefix requeste und das WAN Interface keine Globale IPv6 Adresse braucht. Oft auch in kombination mit einem 64er Prefix, dieser müsste doch für das Opnsense LAN genügen, oder verstehe ich hier wieder etwas falsch?

3

German - Deutsch / Re: IPv6 Routing

« on: May 16, 2020, 09:25:31 pm »

Jetzt bin ich etwas verwirrt.
Was ist mit dem Prefix fdaa:bbcc:ddee:0::/64 auf dem WAN? Wieso wird dieser nicht für das WAN verwendet?
Ich hab leider ein DSL Router vom Provider (Sunrise CH) den ich nicht "eliminieren" kann.

4

German - Deutsch / Re: IPv6 Routing

« on: May 16, 2020, 08:49:21 pm »

Danke für den Input Maurice.

Die Zuordnung sieht folgendermassen aus:

LAN

Code: [Select]

inet6 fe80::20d:b9ff:fe42:ea20%igb0 prefixlen 64 scopeid 0x1
inet6 2001:171b:226e:d7e0:20d:b9ff:fe42:ea20 prefixlen 64

WAN

Code: [Select]

inet6 fe80::20d:b9ff:fe42:ea21%igb1 prefixlen 64 scopeid 0x2
inet6 fdaa:bbcc:ddee:0:20d:b9ff:fe42:ea21 prefixlen 64 autoconf
inet6 2001:171b:226e:d7e0:20d:b9ff:fe42:ea21 prefixlen 64 autoconf

Meine Workstation erhält dann diese Adressen

Code: [Select]

        inet6 2001:171b:226e:d7e0:6087:ecec:fb70:433a  prefixlen 64  scopeid 0x0<global>
        inet6 fe80::9489:c6c0:ff31:2d15  prefixlen 64  scopeid 0x20<link>
        inet6 2001:171b:226e:d7e0::1f50  prefixlen 128  scopeid 0x0<global>
        inet6 2001:171b:226e:d7e0:5114:7456:4793:97fa  prefixlen 64  scopeid 0x0<global>

Nach meinem Verständnis sieht es vernünftig aus.

5

German - Deutsch / IPv6 Routing

« on: May 15, 2020, 09:44:45 am »

Ich versuche momentan IPv6 zum laufen zu bekommen und obwohl die grundsätzliche Konfiguration in Ordnung sein sollte funktioniert etwas mit dem routing nicht.

WAN Konfiguration:

Code: [Select]

IPv4 DHCP
IPv6 DHCP6

- Request only an IPv6 prefix
- Prefix delegation size 64
- Send IPv6 prefix hint
- Prevent release
- Enable debug
LAN Konfiguration:

Code: [Select]

IPv4 Static

IPv6 Track Interface
- IPv6 Interface WAN
- IPv6 Prefix ID 0

Adress-Übersicht:
WAN:
IPv6 Link Local   fe80::20d:x:x:x / 64
IPv6 address   fdaa:bbcc:x:0:x:x:x:x1 / 64
+ 2001:171b:x:x:x:x:x:x / 64
manchmal auch + 2001:171b:x:x:x:x:x:x / 128

LAN:
IPv6 Link Local   fe80::20d:x:x:x / 64
IPv6 address 2001:171b:x:x:x:x:x:x / 64

Geräte im LAN erhalten eine Adresse mit 2001:171b:...... wie erwartet

Pingen mit IPv6
- opnsense zu google.com --> OK
- opnsense zu hosts in LAN --> NOK
- hosts in LAN zu hosts in LAN --> OK
- hosts in LAN zu opnsense --> NOK
- hosts in LAN zu google --> NOK

Ich sehe keine Geblockten ICMP Packete im Firewall Log

Ich habe auch schon während dem Pingen auf dem LAN gesnifft und folgendes gesehen:

Code: [Select]

LAN
igb0 11:59:24.850584 IP6 2001:1715:dddd:dddd:dddd:dddd:dddd:a83 > 2001:dddd:dddd:dddd:ddd:dddd:dddd:ea20: ICMP6, echo request, seq 5, length 64
LAN
igb0 11:59:25.809997 IP6 fe80::dddd:dddd:dddd:2d15 > 2001:dddd:dddd:dddd:ddd:dddd:dddd:ea20: ICMP6, neighbor solicitation, who has 2001:dddd:dddd:dddd:ddd:dddd:dddd:ea20, length 32
LAN
igb0 11:59:25.810137 IP6 fe80::ddd:dddd:dddd:ea20 > fe80::dddd:dddd:dddd:2d15: ICMP6, neighbor advertisement, tgt is 2001:dddd:dddd:dddd:ddd:dddd:dddd:ea20, length 24
LAN
igb0 11:59:25.878063 IP6 2001:dddd:dddd:dddd:dddd:dddd:dddd:a83 > 2001:dddd:dddd:dddd:ddd:dddd:dddd:ea20: ICMP6, echo request, seq 6, length 64
Ist das ein routing Problem?

6

20.1 Legacy Series / Re: IPv6 challenge

« on: April 23, 2020, 09:00:58 am »

To exclude any previous missconfiguration I did reinstall opnsense.
Configuration as follows:

OPT1, OPT2 disabled

WAN

Code: [Select]

IPv4 DHCP
IPv6 DHCP6

- Request only an IPv6 prefix
- Prefix delegation size 64
- Send IPv6 prefix hint
- Prevent release
- Enable debug

LAN

Code: [Select]

IPv4 Static

IPv6 Track Interface
- IPv6 Interface WAN
- IPv6 Prefix ID 0

Opnsense does receive a /64 and has a valid IPv6 on the LAN interface
Hosts on the LAN receive multiple IPv6 addresses.

Ping with IPv6
- opnsense to google.com --> OK
- opnsense to hosts in LAN --> NOK
- hosts in LAN to hosts in LAN --> OK
- hosts in LAN to opnsense --> NOK
- hosts in LAN to google --> NOK

I don't see any blocked ICMP packets by opnsense.

I did run a packet capture on the LAN while pinging

Code: [Select]

LAN
igb0 11:59:24.850584 IP6 2001:1715:dddd:dddd:dddd:dddd:dddd:a83 > 2001:dddd:dddd:dddd:ddd:dddd:dddd:ea20: ICMP6, echo request, seq 5, length 64
LAN
igb0 11:59:25.809997 IP6 fe80::dddd:dddd:dddd:2d15 > 2001:dddd:dddd:dddd:ddd:dddd:dddd:ea20: ICMP6, neighbor solicitation, who has 2001:dddd:dddd:dddd:ddd:dddd:dddd:ea20, length 32
LAN
igb0 11:59:25.810137 IP6 fe80::ddd:dddd:dddd:ea20 > fe80::dddd:dddd:dddd:2d15: ICMP6, neighbor advertisement, tgt is 2001:dddd:dddd:dddd:ddd:dddd:dddd:ea20, length 24
LAN
igb0 11:59:25.878063 IP6 2001:dddd:dddd:dddd:dddd:dddd:dddd:a83 > 2001:dddd:dddd:dddd:ddd:dddd:dddd:ea20: ICMP6, echo request, seq 6, length 64

Could this be a routing issue?

7

20.1 Legacy Series / Re: IPv6 challenge

« on: April 21, 2020, 08:23:21 pm »

I guess I did run into same issue as discussed here: https://forum.opnsense.org/index.php?topic=7719.0
The problem was that I acidentally assigned the physical LAN interface to a second one. Even this was not enabled it did mess up packet routing internally I guess. I'm now able to ping the OPNSENSE LAN/WAN after removing this misshap.
But I'm still not able to ping the ADSL router nor hosts on the internet.
Any hints on this?

8

20.1 Legacy Series / Re: IPv6 challenge

« on: April 21, 2020, 04:23:02 pm »

Let me replay to my own post with a partial solution.

Enabling and studiying the DHCPc log revealed this:

Code: [Select]

OPNsense dhcp6c[78038]: advertise contains NoAddrsAvail status
OPNsense dhcp6c[78038]: Sending Solicit

this hintem me to this post: https://forum.opnsense.org/index.php?topic=11680.0

1. Go to Interfaces:Setting and select 'Insert a new LLT DUID' in the DHCP Unique identifier setting. Save and reboot.

afterwards found this in the log:

Code: [Select]

OPNsense dhcp6c[78038]: advertise contains NoPrefixAvail status
OPNsense dhcp6c[78038]: Sending Solicit

This was my fault, because of trying out things I had set the prefix to a wrong value. Change back to 64 and LAN interface got an IPv6 addr.

Now a new problem appeared in the log:

Code: [Select]

2020-04-21T13:48:03 opnsense: /usr/local/etc/rc.newwanipv6: The command '/usr/local/sbin/unbound -c '/var/unbound/unbound.conf'' returned exit code '1', the output was '[1587476883] unbound[53061:0] error: bind: address already in use [1587476883] unbound[53061:0] fatal error: could not open ports'
2020-04-21T13:48:03 opnsense: /usr/local/etc/rc.newwanipv6: The command '/usr/local/opnsense/scripts/dns/unbound_dhcpd.py --domain 'localdomain.home'' returned exit code '1', the output was 'Unable to lock on the pidfile.'

Regarding network connectivity, my clients get a IPv6 address and can ping each other. OPENSENSE and internet hosts can't be pinged. Any hints on this?

9

20.1 Legacy Series / IPv6 challenge

« on: April 21, 2020, 01:47:04 pm »

Hello,
I'm a happy user of opnsense since the beginning (came from mono, pfsense and others) and usually everything I've tried works mostly out of the box.

Currently I decided to finally hit the road with IPv6 as well and experience some strange behaviour where I'm not sure what it is causing it. In advance, I'm new to IPv6 and have just started lerning about it.

In advance, IPv4 is working ok and everything below is related to IPv6.

My networking setup and configuration:

The ADSL router is provided by the ISP with a heavily customized web ui. But still, it features quite some posiiblities to setup things up.

Internet --- ADSL (Router from ISP, limited access) --- ISP LAN ---- (wan) OPNSENSE (lan) ---- My LAN (Clients)

ADSL router
=========
ADSL router is configured to have the OPNSENSE in its DMZ for IPv4/6
Below information is reported by the router (generic IPv6 info):
Delegated Prefix: 2001:171b:x:y::/60
CPE LAN IPv6 Address: 2001:171b:x:y:z:z:z:z

OPNSENSE
==========
General:
- OPNsense 20.1.4-amd64
- Configuration was reset to default before attempting to setup for IPv6
- Firewall and system setting enabled for IPv6

WAN:
- Request only an IPv6 prefix (64)
- Send IPv6 prefix hint

LAN:
- IPv4 --> Static
- IPv6 Configuration Type --> Track Interface
- Track IPv6 Interface --> IPv6 Interface --> WAN / IPv6 Prefix ID --> 0
- Allow manual adjustment of DHCPv6 and Router Advertisements --> ON
(Router advertisement is on and when I get an IPv6 address on the LAN interface DHCP starts, I was able to configure it so that clients on the lan received an IPv6 address)

Interface Overview:
WAN:
IPv6 Link Local   fe80::20d:x:x:x / 64
IPv6 address   fdaa:bbcc:x:0:x:x:x:x1 / 64
+ 2001:171b:x:x:x:x:x:x / 64
sometimes as well + 2001:171b:x:x:x:x:x:x / 128

LAN:
IPv6 Link Local   fe80::20d:x:x:x / 64
Gateways:
at any time WAN_DHCP6 --> fe80::x:x:x:x

Clients in my LAN
##################
In the case of OPNSENSE assigning an adress to the LAN I was able to configure DHCPv6 and my clients in the LAN got an IPv6 address in the range 2001:171b:...... as one would expect

Summary of observations
#####################
1. By rebooting the router, putting interface up/down at some point OPNSENSE assigns an address to its LAN interface. Currently I'm not able to clearly reproduce it. If assigned, then a reboot of opensense removes the address. But most of the time it does not assign a IPv6 to the LAN.
2. At any time I can ping google.com or my router from OPNENSENSE on IPv6
3. When the IPv6 gets assigned to the LAN and DHCP6 assigns adresses to my clients they are able to ping each other on the LAN but not OPENSENSE nor the internet
4. Another weird thing is that sometimes I see in the firewall log blocked ICMP entries from the LAN for IPv6. All automatic rules are there.

Questions
########
- Does anybody have a clue what is going on here or point me to further infos?
- Does above setup/configuration confuse OPNSENSE somehow that it messes up IPv6 interface tracking for LAN?
- Why is IPv6 traffic not leaving the LAN?

Thanks in advance for any inputs!