Messages

I dug deep into many sources, many attempts to configure my opnsense, completely reinstalling it, running it directly from installer medium and so on.

My findings:
1) the unwanted address seems to be the vodafone kabel net that seems to be configured automatically via slaac (that i cannot deactivate since freebsd kernel apparently auto-accepts slaac RAs on interfaces)
2) the reason why i have ipv6 working in the beginning and after a while it stops could be that the docsis modem potentially ignores the prefix delegation lease request. since it is not extended it just silently expires and i have not working ipv6 anymore eventhough i still have this "seemingly valid" slaac configured provider address.

I even managed to completely reset my opnsese to factory and the v6 seemed to work at first...but after i made enough changes to have the config i used to have (multiple wireguard instances, a couple of outboud nat rules in hybrid outbound nat setup, dnsmasq deactivated, kea configured to serve dhcpv6 based on interface v6 subnet, RAs configured to WAN: router only, LAN: assisted, at some point i loose the ipv6 connectivity. PLUS my static gateway for one of my wireguard interfaces and respective firewall rule stopped routing traffic from 1 client (1 internal host that should only use the wireguard tunnel for all outbound traffic) through the wireguard but instead route it through wan even though i configured it correctly as before (i even tried the whole thing with ablank firewall and then import the old firewall configuration i previously exported to csv)

my current other problem (even on 25.7.11_9) is, that since i get these two provider IPs , my LAN network works with ipv6, but my opnsense cant communicate with ipv6 outside my own networks since it defaults to use the wrong ipv6 interface address (the x:8101:... address) instead fo the correct one.
i know, i could use nat66 to pin all outbound traffic from my opnsense itself to use the correct IPv6 address, but somehow that breaks as well after a while (i guess, when the lease expires)

things i still haven'T tried:
deactivate slaac on WAN/the whole system all together (i dont want to deactivate it completely, but maybe only for wan?) in tunables. maybe someone could give me some advice whether i should trie that as well?

best regards

hello again!

so i finally had the time to tackle the upgrade to 26.7 and do some testing while not being dependent on ipv6 for a little wile and still the same problem:

i get an IPv6 address on WAN but not on lan, neither with track interface nor with identity association.
also i cannot ping anything via IPv6 from the console on the opnsense itself.

current IPs i get on the WAN:
x:8101:3ff:fc7c:2a5:69ff:fe87:c47a/64
fe80::2a5:69ff:fe87:c47a/64

and my IPv4/30


what could i do next to get this working?
any ideas?

I did that: change to only  Request prefix only and send prefix hint and also set optional prefix to 3 but still i get those three IPs:
x:8101:3ff:fc7c:2a5:69ff:fe87:c47a/64
x:908:c21a:df03:2a5:69ff:fe87:c47a/64
fe80::2a5:69ff:fe87:c47a/64

not sure where the x:8101:3ff:fc7c:: comes from

i currently still use 25.7 whilst all the tests...not sure if it is worth a try to upgrade to 26.7 and see if there my v6 problems go away?

for privacy reasons i leave the first block out (it is the same for both /128 and /64)
my v6 addresses on WAN are:
x:8101:3ff:fc7c:2a5:69ff:fe87:c47a/64
x:908:f000:83f::9d5/128

my v6 subnet my provider communicated to me via letter:
x:908:c21a:df00::1

the LAN IPv6 adress is:
x:908:c21a:df00:2a5:69ff:fe87:c47b/64
yes i do run my opnsense under truenas scale but the NICs are directly passed through to the VM and it is a dual NIC PCIe card with 2 intel i-226V NICs

is it still a "complication"? i don't see why that should be the case if the network hardware is a directly passed through and not virtualized part.
i do not have any network bridges either

the truenas host system does not use the PCIe card at all (passthrough so the truenas kernel doesn't load the modules for the card either)

Thanks for the reply.

My current situation is this:
I have a static /30 IPv4 and static IPv6 subnet from my ISP (Vodafone business in BaWü Germany) (but no texactly sure whether /56, /59 or /62 since those are common prefix lengths that customers could get according to my research. i configured /56 and it works)

When on 25.7 all just works fine but when upgrading I didn't get neither IPv4 nor v6 address but when I clicked on the renew button in the interfaces overview my opnsense got the whole shebang. correct IPv4 and v6 and everything works fine in the beginning. I can connect to hosts that are only v6 and also other hosts that are only v4.

after a while not actively using the v6 I realize that I can't connect to v6 hosts via ssh anymore nor can I ping them.
not from my main client in my LAN net nor directly from my opnsense terminal.
in Interfaces overview the IPs are still shown on the WAN interface but as mentioned, only IPv4 remains working and reboots/removing and plugging back in the cable wont fix the issue

I didn'T configre "request only prefix" only "send prefix hint"

on 25.7 i see 3 v6 IPs/networks:
a public  /128 and /64 and a fe80:/64
also I see a fe80: IP as a gateway

on my LAN interface I assigned prefix ID 0 and on my other 2 networks the IDs  1 and 2

are these helping information?
should I provide some more specifics?

best regards

LAN: track interface = the opnsense doesn'T do squat for the clients

But as i already wrote:
IPv6 doesn'T work!
not even on the opnsense itself!

forget about the LAN interface or the clients

also: identity association doesn'T work either

and i wont use it as long as i have to manually configure the whole shitload of IPs, RA, Gateways and so on....what medieval bullshit is that...dhcp was invented for a reason...

so please, tell me how to further debug the WAN interface so the opnsense can communitate via IPv6 again...
when that is fixed, i guess if LAN still wont work I'm open to suggestions but i highly doubt that that will still be the case

Well actually I thought I did say: DHCP (so for v6 its DHCPv6 on WAN) and track interface on LAN

I don't get a v6 IP on my LAN interface after the v6 breaks and the ipv6 traffic on connected devices to the LAN interface doesn't work either

Hi!

I was running opnsense 25 for a good while and everything worked fine, now i tried to update to the current version 26.1.11_10 and all seemed fine at first.

I still had to manually tell my WAN interface to reload so I could get a DHCP lease from my ISP but then I got an IPv4 address and an IPv6 address and routes/dns and I was finally happy (I tried upgrading from 25 to 26 twice in the past with the same result as now!).
i could ping IPv4 and IPv6 hosts and generally use IPv6 sites normally.

Then, a few hours later (maybe 2 or 3) i realize that my IPv6 is not working anymore!
But I still have an IP...forcefully renewing the WAN interface didn't help.

IPv4 traffic still works like a charm.

the last 2 times I tried this upgrade I ended up ditching 26.1 and reverted back to my older opnsense 25 because i couldn'T solve the problem.
I am annoyed by this because it is obviously something that changed from opnsense 25 to 26 since when i revert to a backup from before the upgrade it works again with no problem.

On a side note:
I get a static public IPv4 and a static /56 prefix from my ISP
EDIT:
my configuration:
opnsense VM running on TrueNAS scale with dual intel i-226 NIC directly passed through to the VM
previously working version: 25.7.11_9 (Commit   2e9ac2def)
I have WAN and LAN configured on the 2 NICs, WAN DHCP on v4 and v6 (DHCPv6)
LAN uses Track WAN Interface for v6
I use ISC-DHCP for lan addresses and unbound for dns resolving

Could someone PLEASE help me with that issue?

Best regards