Configuring IPV6 When Using a Bridge --SOLVED--

[aranthus]

Hi all, I'm fairly new to opsense, though I've been running it in my home for the past 6 months or so.  I am running it on a 6 port box, of which I am using 4 ports.  One port is assigned to the WAN interface and I have a bridge created under the interfaces which has the other three ports as members.

So my interfaces include:
WAN1
BRDG
LAN1
LAN2
LAN3

IPV4 has been working all this time, and even using the opnsense docs and various tutorials (like this one: https://homenetworkguy.com/how-to/configure-ipv6-opnsense-with-isp-such-as-comcast-xfinity/) I am still having some trouble, mostly I think because of the bridge.

I have IPV6 connectivity on my WAN1 interface (confirmed by using CLI on the box to ping -6 servers and netstat -nr6), and my logic was that I needed to setup the bridge with 'track interface' and setup router advertisements, and that this would open that interface to the members of the bridge.

But it's not working out like that...  Should I instead be setting up a separate 'track interface' IPV6 setup for each of the members of the bridge (LAN1, LAN2, and LAN3, using different prefixes)?

Any advice would be very welcome, thank you!!!

[Patrick M. Hausen]

No, no, no! All layer 3 configuration MUST go on the bridge interface. That includes IPv4 and IPv6. Your physical bridge members are just layer 2 ports like in a switch. A bridge member MUST NOT have any IP address.

Did you set the two mandatory tunables as documented in step 6?

https://docs.opnsense.org/manual/how-tos/lan_bridge.html

[aranthus]

Thank you for clarifying! Yes, I had set the tunables when I created the bridge originally, and I just verified those are still set correctly...

[aranthus]

I should have added - I also just confirmed that all of my bridge members not doing any IP config (neither 4 nor 6).

[aranthus]

Ok, since I know now that I am setting up the correct interface, some of my other details include:

WAN1: DHCPv6, with Send Prefix Hint checked

BRDG: IPv6 set to 'track interface' with parent interface of WAN1, assigned a prefix ID of 1, allowed manual adjustment of DHCPv6 and Router Assignments.

Under RA for BRDG, I have RA set to 'assisted', source address as automatic, checked 'advertise default gateway', under DNS options checked 'Use the DNS config of the DHCPv6 server'

Under interfaces->settings I have 'allow IPv6' checked

Under firewall rules for BRDG, I have a default to allow all IPV6 to any rule (with a similar rules for IPV4)

[aranthus]

Here is a look at my interfaces table too... Even though under interfaces, for the bridge members, none of them have any kind of IPv4 or IPv6 configuration set (they are all set to 'none'), the interfaces table appears to show IPv6 assignments to each bridge member interface... Does that point to a problem in my config perhaps? I tried a lot of different configs, and backed them out - are those IPv6 assignments something that didn't get cleared when they should have been?

...

[aranthus]

--SOLVED--
I was reading the comments in the IPv6 tutorial I shared the link to earlier - and came across this nugget buried half way down the comment trail:

When using a bridge, you need to check "Enable link-local address in the bridge settings" in the bridge settings

That makes so much sense in hindsight considering the way IPv6 is supposed to work... I updated that one checkbox and voila! It all works now.  Just wanted to share in case anyone else struggles with this :-)

Thank you!