Sending Solicit on pppoe0
send so
licit to ff02::1:2%pppoe0
reset a timer on pppoe0, state=SOLICIT, timeo=6, retrans=72361
Sending Solicit on pppoe0
send solicit to ff02::1:2%pppoe0
reset a timer on pppoe0, state=SOLICIT, timeo=7, retrans=144580
Shortly afterwards, the LAN interfaces lose their delegated IPv6 prefixes and radvd reports errors such as:
radvd_configure_do(manual) found no suitable IPv6 address on opt11(ice0)
radvd_configure_do(manual) found no suitable IPv6 address on opt3(vlan011)
radvd_configure_do(manual) found no suitable IPv6 address on opt6(vlan050)#!/usr/local/bin/php
<?php
/*
* Copyright (C) 2003-2005 Scott Ullrich <sullrich@gmail.com>
* All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions are met:
*
* 1. Redistributions of source code must retain the above copyright notice,
* this list of conditions and the following disclaimer.
*
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
* INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
* AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
*/
require_once("config.inc");
require_once("auth.inc");
require_once("filter.inc");
require_once("interfaces.inc");
require_once("util.inc");
require_once("system.inc");
exit_on_bootup();
if ($argc < 3) {
exit;
}
// Workaround for an issue where a physical LINK_UP/LINK_DOWN event on a LAN
// interface causes OPNsense to trigger IPv6 WAN processing on pppoe0.
//
// In my setup, powering off a device directly connected to ice0/ice1/ice2
// can indirectly trigger DHCPv6-PD reconfiguration on the unrelated PPPoE WAN,
// resulting in loss of IPv6 connectivity.
//
// Ignoring DEVD link events from these LAN interfaces completely prevents
// the unwanted DHCPv6-PD reset/reconfiguration.
//
// This is only a workaround for debugging/reporting purposes.
$ignored_interfaces = [
'ice0',
'ice1',
'ice2',
];
$action = $argv[1];
$device = $argv[2];
// Stop processing LAN carrier events before they can propagate further
// through rc.linkup and eventually affect WAN IPv6/DHCPv6-PD handling.
if (in_array($device, $ignored_interfaces, true)) {
log_msg(sprintf(
"DEVD: Ignored Ethernet %s event for %s to avoid DHCPv6-PD reset",
$action,
$device
));
exit;
}
function handle_argument_group($action, $device)
{
global $config;
$interface = convert_real_interface_to_friendly_interface_name($device);
if (empty($interface)) {
return;
}
if (empty($config['interfaces'][$interface])) {
return;
}
if (!isset($config['interfaces'][$interface]['enable'])) {
return;
}
switch ($action) {
case 'stop':
log_msg(sprintf("DEVD: Ethernet detached event for %s(%s)", $interface, $device));
interface_suspend($interface);
break;
case 'start':
log_msg(sprintf("DEVD: Ethernet attached event for %s(%s)", $interface, $device));
interface_configure(false, $interface, true, true);
break;
default:
log_msg(sprintf("DEVD: The action parameter passed is wrong (%s)", $action), LOG_ERR);
break;
}
}
handle_argument_group($action, $device);Quote from: Seimus on Today at 07:22:35 PMQuote from: dirtyfreebooter on August 12, 2026, 12:11:29 AMi tried this and couldn't get the custom application to hit. i assume i am setting things up wrong.
i tried adjusting the custom app like 10x different ways. when i go back to the live sessions after updating custom app / policy, i still just see the entry allowed (green shield)
Custom apps in ZA are broken. And for some time now.
I already did open a ticket (21.10. 2025) for it, but it's in a backlog.
Regards,
S.
Quote from: dirtyfreebooter on August 12, 2026, 12:11:29 AMi tried this and couldn't get the custom application to hit. i assume i am setting things up wrong.
i tried adjusting the custom app like 10x different ways. when i go back to the live sessions after updating custom app / policy, i still just see the entry allowed (green shield)