Messages

I have have two VLANs configured to seperate work traffic (myself and daughter) from home traffic. Currently I did have ISC DHCPv4 and DHCPv6 configured to supply both IPv4 and IPv6 traffic to work devices. After upgrading to 25.1.6_2 I performed a backup and then disabled ISC DHCPv4 and DHCPv6 and configured the same networks onto Kea DHCPv4 and DHCPv6. Initially with 25.1.6_2 I did managed to get an IPv4 and IPv6 address on my laptop but the lease did not appear. However after a power cycle the my laptop obtained an IPv4 and IPv6 address with both the IPv4 and IPv6 lease appearing; my daughter's laptop never obtained an IP address.
After upgrading to 25.1.6_4 I am able to obtain an IPv6 address but unable to obtain an IPv4 address, reverting to using ISC DHCP by restoring a backup IP addresses are always obtained.
If I power cycle 25.1.6_4 using the Kea backup, then my laptop does get IPv6 address immediately and then will get an IPv4 address, however only the IPv6 lease appears in Leases DHCPv6, nothing appears in Leases DHCPv4. If I restart the Kea DHCP service then I stop getting an IPv4 address and only obtain an IPv6 address

I have been running a pair of ISC Kea DHCPv4 and DHCPv6 servers on linux for over two years since ISC stopped maintaining ISC DHCP at the end of 2022. Personally very happy to switch because of the ISC Kea ability to handle DHCP Failover for DHCPv6 which was not supported in ISC DHCP.

Is it possible to modify or update to a later version the resource which is referenced by ARP table so that I can add missing Vendor mac prefix entries. Using maclookup.app I found that the 74:78:27 was assigned to Dell on 23rd September 2020, so it is not new being nearly three years old. Which raises the question how frequently the vendor mac prefix resource is updated.

Hi,
What I have found is that if a Router Advertisement includes a Network Prefix and an IPv6 client is configured with a static address, unless you configure the client to not accept router advertisements then the client will generate a SLAAC address if the Router Advertisement includes a network prefix.

The use of a network prefix is to inform the client to generate to either generate a SLAAC address or inform the client to use DHCPv6 stateful or stateless.

I found with Windows 2008 server configured with a static address, using RA I could get it to generate a SLAAC address. This was fixed in if I remember correctly in Server 2012 so it ignored the RA by default.

Hi

Great that you can disable autoconfiguration on your version of Windows 10.
Which version of Windows 10 are you testing? My wife's laptop Windows 10 will not disable Autoconfiguration.

Either way the Network Prefix should not be included in the Router Advertisement when Managed is selected and the DHCPv6 server on Opnsense is disabled.

The problem is that Autoconfiguration is enabled by default, on Linux it is easy to permanently disable acting on Router Advertisements but on Windows it is more problematic and all a rogue actor needs to do is to inject rogue router advertisements into an IPv6 network to cause havoc.

Hi

On Windows 10 the command which is supposed to disable autoconfiguration does not work

netsh interface ipv6 set interface "Local Area Connection" routerdiscovery=disabled

there is additional option which is supposed to take effect immediately or permanently and they do not work.

There is no reason for the Network Prefix to be included in the Router Advertisement when in router or managed mode.

As a result of the Router Advertisements ICMPv6 Option 134 including the Network Prefix is in Managed Mode this is causing Windows 10 clients which have been configured with Static IPv6 Addresses to generate SLAAC addresses.
Windows Auto Address configuration is enabled is enabled by default, and despite searching with Google I have not found a way to disable IPv6 auto address configuration when using static IPv6 addresses.

Configuring Router Advertisements to "Managed" I know does not disable Router Advertisements but the Router Advertisement should not include ICMP Option (Prefix Information) as this includes Valid Lifetime and Preferred Lifetime settings and is used by clients to generate SLAAC addresses.

ICMP Option (Prefix Information) should only be included when Router Advertisements are configured "Unmanaged", "Assisted" and "Stateless" when SLAAC is being used.

Further to the packet capture, expanding the ICMPv6 Option (Prefix information) it includes a Valid Lifetime and Preferred Lifetime information which is being used to get the DHCPv6 clients to generate a SLAAC address using the information.

When the Router Advertisements are set to Managed, SLAAC is disabled and the ICMPv6 Option (Prefix Information) should be advertised. The DHCPv6 Server should handle the allocation of IPv6 Addresses.

Hi,

I have my Opnsense 23.1.5_4 configured for IPv6 Router Advertisements as Managed, as I have separate pair of Kea Servers handling IPv6. I noticed that a Windows 10 PC was using SLAAC to automatically generate its own IP address.

When I performed a packet capture I found that the SLAAC Router Advertisements were coming from the Opnsense which I specifically had disabled by configuring as Managed.

I presume this is a bug.

I have updated to include the packet capture despite the Router Flags set to Managed and the Opnsense dhcp server being disabled it includes the Network Prefix to cause clients to generate their own SLAAC address

Hi,

Would it be possible for the System Packet information after selecting an interface, the packet graphs would split IPv4 so it displays IPv4 vertically above the line and IPv6 below the line to the same scale. So visually it is easy to compare IPv4 and IPv6 traffic volume.