Messages

[WAN]

Hello !

As I changed my ISP to Orange, who doesn't offer IPv4 bridging but who offers ipV6 prefix delegation I started to implement IPv6 at home. I got some success for outbound connections: http://test-ipv6.com/ gives 10/10 and https://ipv6-test.com/ 15/20. In both tests I can see the IPv6 of my PC which sounds good.
Things get more complicated for incoming traffic. With https://tools.keycdn.com/ipv6-ping I'm able to ping only the IPV6 on the ISP box (2a01:cb1d:81cb:8200:8e19:b5ff:fe8a:c5e0).
Configuration details:
WAN
DHCPv6
Request only an IPv6 prefix: unchecked
Prefix delegation size: 64
Use IPv4 connectivity: unchecked
Send IPv6 prefix hint: checked

LAN
Track interface
IPv6 interface: WAN
IPv6 Prefix ID : 0
Allow manual adjustement of DHCPv6 and Router Advertisements: checked

Services/DHCPv6/LAN
Enable DHCPv6 server on LAN
Subnet   2a01:cb1d:81cb:82ec::
Subnet mask   64 bits
Current LAN IPv6 prefix   2a01:cb1d:81cb:82ec::
Available range   2a01:cb1d:81cb:82ec:: - 2a01:cb1d:81cb:82ec:ffff:ffff:ffff:ffff


Services/Router Advertisements/LAN
Router Advertisements: Managed

Note:I tried all other modes, too.

With those settings I end up with this:

WAN interface (wan, igb1)
Status   up
DHCP   up   Reload Release
MAC address   00:0d:b9:57:b7:b5 - PC Engines GmbH
MTU   1500
IPv4 address   192.168.1.10/24
IPv4 gateway   192.168.1.1
IPv6 link-local   fe80::20d:b9ff:fe57:b7b5/64
IPv6 address   2a01:cb1d:81cb:8200:20d:b9ff:fe57:b7b5/64
IPv6 delegated prefix   2a01:cb1d:81cb:82ec::/64
IPv6 gateway   fe80::8e19:b5ff:fe8a:c5e0
DNS servers   192.168.1.1
   2a01:cb1d:81cb:8200:8e19:b5ff:fe8a:c5e0

LAN interface (lan, igb0)
Status   up
MAC address   00:0d:b9:57:b7:b4 - PC Engines GmbH
MTU   1500
IPv4 address   192.168.2.254/24
IPv6 link-local   fe80::20d:b9ff:fe57:b7b4/64
IPv6 address   2a01:cb1d:81cb:82ec:20d:b9ff:fe57:b7b4/64


I did a tcpdump also to see what IPv6 traffic was flowing (I added a temp floating rule to allow all IPv6 traffic, just incase).
I noticed ICMP RA from the ISP box:

Frame 10: 158 bytes on wire (1264 bits), 158 bytes captured (1264 bits)
Ethernet II, Src: Arcadyan_8a:c5:e0 (8c:19:b5:8a:c5:e0), Dst: IPv6mcast_01 (33:33:00:00:00:01)
Internet Protocol Version 6, Src: fe80::8e19:b5ff:fe8a:c5e0, Dst: ff02::1
Internet Control Message Protocol v6
    Type: Router Advertisement (134)
    Code: 0
    Checksum: 0x75cc [correct]
    [Checksum Status: Good]
    Cur hop limit: 64
    Flags: 0x48, Other configuration, Prf (Default Router Preference): High
    Router lifetime (s): 600
    Reachable time (ms): 0
    Retrans timer (ms): 0
    ICMPv6 Option (Prefix information : 2a01:cb1d:81cb:8200::/64)
    ICMPv6 Option (Recursive DNS Server 2a01:cb1d:81cb:8200:8e19:b5ff:fe8a:c5e0)
    ICMPv6 Option (DNS Search List Option home)
    ICMPv6 Option (MTU : 1500)
    ICMPv6 Option (Source link-layer address : 8c:19:b5:8a:c5:e0)

Anything else I should look at to ensure routing is fine ? I4ll probably contact my SIP too, but I'm not too optimistic with them providing good support.

Thanks for your time !

Thanks ! Much clearer now.
Any idea on unbound returnin something else than 0.0.0.0 for blacklisted entries ?

V.

Hello,

I'm enjoying OPNSense for some days now on an ap2c2 and I'm wondering why CPU keeps increasing for several hours and then comes back to its initial value. Any explanation on this ?
Memory also has a cycle, but I link it to unbound which has a huge blacklist file generated by opnsense UI. By the way, is there a way to change the A address to something different than 0.0.0.0 ? Reporting on blacklisted adress would also be great.

Thanks for this great piece of software !