Disable downstream prefix delegation?

Started by schnipp, January 08, 2025, 05:21:16 PM

Previous topic - Next topic
I operate a Fritzbox in a dedicated VLAN with IPv4/IPv6. The Fritzbox is only used for VoIP and therefore only needs a single IPv4 and IPv6 address. Unfortunately, the Fritzbox always requests a delegation prefix. However, this is not necessary due to its operating mode.

Is it possible to disable downstream prefix delegation for certain interfaces?
OPNsense 24.7.11_2-amd64

The Fritzbox is configured as a LAN client? Then enable only DHCPv4 and SLAAC (router advertisements) and no DHCPv6. That should do it.
Deciso DEC750
People who think they know everything are a great annoyance to those of us who do. (Isaac Asimov)

I'd expect prefix delegation to only work if a "Prefix Delegation Range" is specified in the ISC DHCPv6 settings for the interface, but I noticed recently that if an interface is configured with "Track Interface", and "Manual Configuration" is not enabled, apparently a "Prefix Delegation Range" is chosen automatically, and it's seemingly invisible to the administrator (though the browser UI) - I only noticed it when I was poking around in the config files. This seems like a bug to me - it'd be easy to unknowingly use the same range for some other purpose and create a conflict (unless I'm missing something).

Quote from: Patrick M. Hausen on January 08, 2025, 05:48:18 PMThe Fritzbox is configured as a LAN client? Then enable only DHCPv4 and SLAAC (router advertisements) and no DHCPv6. That should do it.

The Fritzbox (7490) itself acts as a client but is configured in router mode. The latter is necessary to connect the Fritzbox to the upstream router (Opnsense) via an off the shelf wifi access point. In my eyes it should be configurable whether a (virtual) network offers delegation prefixes to devices. May I have overlocked something regarding configuration options?
OPNsense 24.7.11_2-amd64

If it can be useful to you.
i have an opnsense firewall. My isp connection is made through pppoe with public ip for ipv4 and with DHCP v6 with a /56 prefix delegation.
I have a fritzbox 7490 used only for voip. The fritzbox is setup as lan client and obtain one ipv4 and one ipv6 from opnsense.

Quote from: schnipp on January 09, 2025, 10:53:17 AMIn my eyes it should be configurable whether a (virtual) network offers delegation prefixes to devices. May I have overlocked something regarding configuration options?

I missed your last post on this. I probably wasn't clear enough before... if you enable "Manual Configuration" for the interface, and you do NOT specify a Prefix Delegation Range for ISC DHCPv6, prefix delegation should be effectively disabled (but if you don't enable "Manual Configuration", prefix delegeation may be transparently enabled in the background, which seems like a bug to me).

Quote from: caplam on January 17, 2025, 03:57:16 PMIf it can be useful to you.
i have an opnsense firewall. My isp connection is made through pppoe with public ip for ipv4 and with DHCP v6 with a /56 prefix delegation.
I have a fritzbox 7490 used only for voip. The fritzbox is setup as lan client and obtain one ipv4 and one ipv6 from opnsense.

Unfortunately, I am not able to setup the Fritzbox as a LAN-Client. Due to the spatial environment the Fritzbox uses wifi for upstream connection. Consequently, my Fritzbox has to operate in router mode (wifi client mode requires a Fritzbox mesh as uplink which is not applicable in this scenario).
OPNsense 24.7.11_2-amd64

Quote from: dseven on January 18, 2025, 01:18:07 PMI missed your last post on this. I probably wasn't clear enough before... if you enable "Manual Configuration" for the interface, and you do NOT specify a Prefix Delegation Range for ISC DHCPv6, prefix delegation should be effectively disabled (but if you don't enable "Manual Configuration", prefix delegeation may be transparently enabled in the background, which seems like a bug to me).

Yes, by switching to manual config as you mentioned prefix delegation is effectively disabled. Now, the Fritzbox only gets an IPv6 address and no prefix. Allowing a request of delegation prefixes by every device on an IPv6  tracked interface should not be the default behavior.
OPNsense 24.7.11_2-amd64