Messages

1

General Discussion / Re: Beginner with IPv6 and struggle

« on: March 19, 2024, 06:38:25 am »

Ooo, 10ギガ, nice!
(I'm also in Nihon with weak in Nihongo - love to know all about your 10G ISP too, BTW).

I have had DS-Lite working with OPNSense (but not reliably enough for my daily use so far, when I'm not testing OPNSense directly I have an OpenWRT host holding the DS-Lite up in front of OPNSense (your machine would probably have ample resources to do both OPNSense + OpenWRT in virtualisation if you're game to try)).

Details of making the GIF tunnel are in my posts ie. https://forum.opnsense.org/index.php?topic=27935.msg136305#msg136305

My only problem is that establishing the tunnel seems to always require I manually restart one or other of the interfaces in OPNSense after booting. Once it's up it seems to work fine.

2

23.7 Legacy Series / Re: DS-Lite on 23.7.6+ (23.7.10_1)

« on: February 21, 2024, 12:33:19 am »

Sorry I've been absent Maurice.

I don't use IPv6 inside my LAN so I'm not sure.

I updated my test device to 24.1.2 and while the failure to establish the DS-Lite connection continues resolving it now does not happen by disconnecting the WAN and reconnecting it. But rather by disconnecting the DS-Lite interface  and reconnecting it.

I also noticed that there's something going on with the dhcp6 server seemingly in concert with the DS-Lite tunnel's connection.

I captured a slab of logs from boot through restarting the interfaces until DS-Lite was active in case they can be diagnostic. But this forum will not let me post that much text.

3

24.1 Legacy Series / Re: Problem installing 24.1 on Deciso DEC2640

« on: February 05, 2024, 04:37:21 pm »

It seems initiating the reboot just took over 15 minutes.

I had started an ssh session to the machine when it suddenly reset that connection and went down.

It has come back up as I would expect now.

But that extremely delayed reboot was knuckle-bitting.

4

24.1 Legacy Series / [Solved, kind of] Problem installing 24.1 on Deciso DEC2640

« on: February 05, 2024, 04:06:04 pm »

So it seemed to resolve itself. The reboot didn't happen for over 15 minutes from when the UI said it was rebooting. Which doesn't seem normal.

Hi, so after successfully upgrading my system at home I just tried with our work system on a Deciso DEC2640

The system said it had downloaded and would reboot multiple times.
Then said it was rebooting.
Then after some time it returned to the Dashboard with the uptime showing it had not rebooted.
Accessing System > Firmware > Status it again says
'Your device is rebooting
The upgrade has finished and your device is being rebooted at the moment, please wait...'
Before returning to the Dashboard with uptime showing no reboot has occurred.

How should I proceed?

(Please note I do not have physical access to the machine).

5

23.7 Legacy Series / Re: DS-Lite on 23.7.6+ (23.7.10_1)

« on: January 05, 2024, 06:52:39 am »

Ah… OpenWRT somehow includes SLAAC for interfaces set as DHCPv6
https://openwrt.org/docs/guide-user/network/ipv6/configuration

So I guess between that and what we saw from OPNsense with WAN set as SLAAC, that my ISP is actually using SLAAC.

Would you agree?

6

23.7 Legacy Series / Re: DS-Lite on 23.7.6+ (23.7.10_1)

« on: January 05, 2024, 04:48:29 am »

OK, I think you're on to something. Thanks again.

If I reconfigure WAN to have IPv4 set to none and IPv6 set to SLAAC we get DNS servers in the Interfaces > Overview > WAN
(Seems really weird though that OpenWRT is set to DHCPv6 and it brings up the IPv6 interface with DNS and the tunnel seemingly without hesitation)

Reconfiguring the interfaces seems to get DS-Lite to come up too.

But if I reboot with SLAAC configured, DS-Lite does not come up and we have no connection (I don't know why IPv6 on it's own doesn't work).

7

23.7 Legacy Series / Re: DS-Lite on 23.7.6+ (23.7.10_1)

« on: January 05, 2024, 02:31:54 am »

Here's the Interfaces > Overview > WAN from the testing OPNsense connected directly to the ONT.

It is getting obscured by the small resolution on the machine I'm testing with and the header and footer being rendered into frame by the browser. Sorry I don't have an easy way to get all the data on screen at once yet. Do you need the In/out packets (block) details?

8

23.7 Legacy Series / Re: DS-Lite on 23.7.6+ (23.7.10_1)

« on: January 05, 2024, 01:49:34 am »

Thank you both.

Maurice, here's the details of the IPv6 connection from the OpenWRT shim I use upstream of my in-service OPNsense:

Protocol: DHCPv6 client
Address: 2001:XYY:ZXXX:ZYXX:ZXYZ:XZYY:XZYX:ZXYY/64
Gateway: fe80::225:84ff:fe11:dac1
DNS 1: 2001:a7ff:5f01::a
DNS 2: 2001:a7ff:5f01:1::a

(I think the public IPv6 is all I should be worried to redact. Is that correct?)

So it appears I am being served a DHCPv6 address and IPv6 DNS servers with a /64 prefix.
I can see anythiing regarding SLAAC being involved.

(As an aside; I am unclear as to whether the /64 means I should have over eighteen quintillion addresses I can use internally or that I have one address from an over eighteen quintillion address pool the ISP has. IPv6 is still frustratingly unclear to me).

I will reconnect the testing OPNsense and get that screenshot of Interfaces > Overview > WAN for you shortly.

9

23.7 Legacy Series / Re: DS-Lite on 23.7.6+ (23.7.10_1)

« on: January 04, 2024, 01:32:15 am »

System > Log Files > Backend, Boot, General have no mention of rc.newwanipv6

Do you want me to look elsewhere?

System > Log Files > General; filtering for 'wan' (showing a period when plugging in the ONT to OPNsense already running (DS-Lite did not connect), then manually disabling and re-enabling the GIF interface (which made the DS-Lite connection work), then a reboot afterwhich DS-Lite was down again)

Code: [Select]

2024-01-04T00:08:28 Notice kernel <118> WAN (igc1) -> v4: 127.0.0.2/32
2024-01-04T00:08:28 Notice kernel <118> DSLiteWAN (gif0) ->
2024-01-04T00:08:24 Notice kernel <118>>>> Invoking start script 'newwanip'
2024-01-04T00:08:20 Notice kernel <118>Configuring WAN interface...
2024-01-04T00:08:19 Notice kernel <118>Configuring DSLiteWAN interface...done.
2024-01-04T00:03:01 Notice opnsense /interfaces.php: plugins_configure newwanip (execute task : webgui_configure_do(,opt1))
2024-01-04T00:03:01 Notice opnsense /interfaces.php: plugins_configure newwanip (execute task : vxlan_configure_do())
2024-01-04T00:03:01 Notice opnsense /interfaces.php: plugins_configure newwanip (execute task : unbound_configure_do(,opt1))
2024-01-04T00:03:01 Notice opnsense /interfaces.php: plugins_configure newwanip (execute task : openssh_configure_do(,opt1))
2024-01-04T00:03:01 Notice opnsense /interfaces.php: plugins_configure newwanip (execute task : opendns_configure_do())
2024-01-04T00:03:01 Notice opnsense /interfaces.php: plugins_configure newwanip (execute task : ntpd_configure_do())
2024-01-04T00:03:01 Notice opnsense /interfaces.php: plugins_configure newwanip (execute task : dnsmasq_configure_do())
2024-01-04T00:03:01 Notice opnsense /interfaces.php: plugins_configure newwanip (,opt1)
2024-01-04T00:03:00 Notice opnsense /interfaces.php: ROUTING: configuring inet6 default gateway on wan
2024-01-04T00:02:58 Notice opnsense /interfaces.php: plugins_configure monitor (execute task : dpinger_configure_do(,DS-WAN))
2024-01-04T00:02:58 Notice opnsense /interfaces.php: plugins_configure monitor (,DS-WAN)
2024-01-04T00:02:48 Notice opnsense /interfaces.php: plugins_configure newwanip (execute task : webgui_configure_do(,opt1))
2024-01-04T00:02:48 Notice opnsense /interfaces.php: plugins_configure newwanip (execute task : vxlan_configure_do())
2024-01-04T00:02:48 Notice opnsense /interfaces.php: plugins_configure newwanip (execute task : unbound_configure_do(,opt1))
2024-01-04T00:02:48 Notice opnsense /interfaces.php: plugins_configure newwanip (execute task : openssh_configure_do(,opt1))
2024-01-04T00:02:48 Notice opnsense /interfaces.php: plugins_configure newwanip (execute task : opendns_configure_do())
2024-01-04T00:02:48 Notice opnsense /interfaces.php: plugins_configure newwanip (execute task : ntpd_configure_do())
2024-01-04T00:02:48 Notice opnsense /interfaces.php: plugins_configure newwanip (execute task : dnsmasq_configure_do())
2024-01-04T00:02:48 Notice opnsense /interfaces.php: plugins_configure newwanip (,opt1)
2024-01-04T00:02:48 Notice opnsense /interfaces.php: ROUTING: configuring inet6 default gateway on wan

It really seems like all the settings are as the need to be to connect but the GIF interface is not being brought up without manual intervention.

10

23.7 Legacy Series / Re: DS-Lite on 23.7.6+ (23.7.10_1)

« on: January 02, 2024, 05:22:51 pm »

I have no idea what the forum is doing to these images. They're straight screen captures from Brave on MacOS.

Here they are again down sized.

11

23.7 Legacy Series / Re: DS-Lite on 23.7.6+ (23.7.10_1)

« on: January 02, 2024, 06:38:14 am »

Here are the GIF Tunnel Settings and the GIF Gateway Settings.

The GIF Remote Address is the IPv6 address for the AFTR host for our ISP dgw.xpass.jp

12

23.7 Legacy Series / Re: DS-Lite on 23.7.6+ (23.7.10_1)

« on: January 02, 2024, 06:37:30 am »

Here are screen captures of the WAN and GIF Interface settings
I don't know if there's a more concise way I could get this data from the CLI? I can't add all the screen captures together as the attachments are too large for the forum.

13

23.7 Legacy Series / Re: DS-Lite on 23.7.6+ (23.7.10_1)

« on: December 31, 2023, 05:46:03 am »

Thanks Maurice.

I am testing on a fresh install of 23.7 updated to 23.7.10_1.
This is on a Celeron J4125 with 12 gb of RAM with four Intel I225-V NICs.
Connecting to an NTT GE-PON ONU.

(My working set up is the same, but that OPNsense is far more heavily configured for our LAN environment. And OPNsense connects DHCP to a FriendlyElec R4S running OpenWRT which maintains the DS-Lite connection through the NTT GE-PON ONU).

What specifically should I detail for you?

14

23.7 Legacy Series / DS-Lite on 23.7.6+ (23.7.10_1)

« on: December 29, 2023, 05:42:57 pm »

I am once again working toward getting DS-Lite operating.
(And I have acquired a second device so that I can test and roll-back much more easily than before).

As per the release note I saw for 23.7.6; that

This update is a maintenance release improving the DS-Lite use via separate
GIF tunnels on top of IPv6-only connectivity.

And the referral from https://twitter.com/opnsense/ that I should follow my previous work to get it happening.
https://twitter.com/opnsense/status/1739902581055377705
https://forum.opnsense.org/index.php?topic=27935.msg136305#msg136305

Following this through (testing on OPNsense 23.7.10_1-amd64), I have found that the DS-Lite GIF tunnel does not connect instantly.
And in my case it does not connect without disabling and re-enabling the DS-Lite GIF interface after the parent WAN IPv6 interface is established.

Disabling and re-enabling the DS-Lite GIF interface after the parent WAN IPv6 interface is established does seem to reliably establish DS-Lite connectivity.

(But requiring manual intervention to establish the connection - ie after a power failure is a not an option for me in production).

@opnsense on Twitter told me

Yes it was missing an external connection trigger like a DHCPv6 renew. Now it should be up instantly (the IPv4 part).

Yet this does not seem to be the case.
Am I missing something or doing something wrong?
Is there a way I should be generating debugging or error data to diagnose this?

15

23.7 Legacy Series / Re: DS-Lite configuration - noob need help

« on: December 29, 2023, 05:12:30 pm »

I am also back to trying to get DS-Lite working well.

I have posted the way I have had some success with it here https://forum.opnsense.org/index.php?topic=27935.msg136305#msg136305

Use IPv4 connectivity should not be used. (You don't have any IPv4 until DS-Lite connects).

The trick seems to be that there's a race condition between the GIF interface tunnelling IPv4 and the WAN IPv6 interface. Which can be tweaked into line by disabling and re-enabling the GIF interface after the IPv6 WAN connection has succeeded.