One of the networks stops getting IPV6 address and DNS address after few times

[opnseeker]

I have OpnSense running on a Proxmox VM with multiple networks. These are not VLANs from OpnSense perspective as Proxmox vnets are used to hide them from OpnSense. In OpnSense they are all separate networks.

I use DNSMasq for DHCP and tried both native as well as separate router advertisements and both have the same problem.

I have IPV6 enabled on three networks - these are ULA addresses used for internal communication.

DMZ (VNET VLAN - one VM on a wired network)
- statically assigned IP4 and IP6 addresses using DHCP and DHCP6.  Slaac is used to generate addl. private outgoing IP6 addresses. (No issues)

Admin (VNET VLAN - fixed/known devices on wifi)
- statically assigned Ip4 and IP6 addresses using DHCP and DHCP6 (no Slaac) (no issues)

Home/LAN (all other devices using WiFi - this is not a VNET but untagged linux bridge created with a physical port on the machine)

All addresses on this network are dynamically assigned by DHCP for IPV4 which works.

In case of IP6, I tried many options (DHCP6, Slaac with Stateless DHCP for DNS address, both). In all cases, address assignment works few times after the changes are made in OpnSense and subsequently stops working.

When I check the log of DNSMasq there is RTR-Advert for the network address but no DHCP-Solicit from the clients after the first few times.

Any suggestions are appreciated.

I tried many times with all variations and I can't find a reason why it happens only on this network.

[opnseeker]

I switched Home and Admin such that now Admin uses the untagged network and Home uses tagged network.

Now the problem occurs on the Admin interface. It looks like this problem is specific to the untagged network.

Hope that generates some interest and suggestions.

[meyergru]

Maybe your switch or the FreeBSD network driver gets VLAN layers wrong. One should never mix tagged and untagged networks on the same physical NIC with FreeBSD. If you can, try to separate both (V)LANs on different NICs as untagged and tag only one of them on your managed switch.

[opnseeker]

I apologize for the late reply.

I have one NIC for LAN and one for WAN on the mini PC I am using. So, I unfortunately cannot separate tagged and untagged networks.

On the other hand, I have been using this setup with OpnSense (directly on the hardware) without Proxmox for multiple years. It has been working. In this case, I was using Opnsense to manage VLANs but the tagged and untagged (LAN/Home) networks were on the same NIC.

I recently switched to using Proxmox with VNets to simulate the VLANs over the default bridge network (vmbr1) in Proxmox attached to the hardware NIC. The same managed switch is used in both cases (it's an Asus router/AP with VLAN support).

The router advertisement problem is occurring with the default bridge network while VLANs using the VNETs are working fine.

Strange thing is that the devices on the network acquire IP6 addresses fine once or twice after DNSMasq is restarted and stop working until the next restart.

[meyergru]

I assume you have bridge-mcsnoop off like described here and that the bridge is VLAN-aware?