IPV6 Interface Addresses

[mooh]

Running OPNsense 23.10.3-amd64 on DEC750 appliances I just noticed that all interfaces use the same interface identifiers when set to "track interface", i.e. the leading 64 bits are as expected (56 bit prefix + 8 bits tracking id) but the least 64 bits are the same on all (EDIT: VLAN) interfaces, including WAN.

Technically, that's fine but I'm wondering if this is a good default because it makes guessing interface addresses trivial for attackers as there is only 8 bits of uncertainty and - let's face it - in practice no uncertainty at all because tracking IDs usually go from 0 to n.

Maybe my settings are wrong, but I would expect all networking devices - including router interfaces - on my network to use privacy extensions or at least MAC based identifiers in order to prevent these attacks. So basically, all interfaces should have essentially random interface identifiers.

What do you folks think? Is there something wrong with my configuration?

[Maurice]

Guessable interface addresses shouldn't be a concern, a security strategy should never depend on keeping IP addresses "secret".

Privacy extensions are not commonly used on routers, only on hosts. The interface identifiers are based on the MAC address (EUI-64). If all VLANs use the same underlying NIC, they share the same MAC address and as a result the same interface identifier. You can spoof the MAC address for individual VLANs though.

Cheers
Maurice

[mooh]

Thank you for responding. I agree, obscurity is not security but it doesn't hurt to have, either.

With interface identifiers based on MAC addresses I understand why all virtual interfaces on the same physical interface are the same, but in my case even the identifier part of the WAN is the same as all virtual LAN interfaces, even though it is on another physical interface (and is based on the LAN MAC).

Thinking about it, my WAN interface uses PPPoE and thus doesn't have a MAC. Is OPNsense recycling the MAC bits from another interface in that case?

[Maurice]

Yes, the MAC address of the system's first Ethernet interface is used for creating the interface identifiers of some "virtual" interfaces (as well as the system's DUID).