WAN_DHCP6 learns OPNsense LAN link-local address as IPv6 gateway instead of FBox

[noclue68]

Hello,

I'm facing a very strange IPv6 issue and after extensive troubleshooting I cannot explain the behaviour anymore.

Topology:

Internet
  |
FRITZ!Box
  |
OPNsense WAN
  |
OPNsense LAN
  |
GS308E Switch
  |
Clients

Environment:

- OPNsense running as VM on Proxmox
- WAN and LAN are on separate virtual NICs
- WAN and LAN are connected to separate Proxmox bridges
- FRITZ!Box configured with Exposed Host
- DHCPv6-PD enabled

OPNsense NICs:

LAN:
MAC BC:24:11:89:92:3C

WAN:
MAC BC:24:11:E3:15:CE

FRITZ!Box:

MAC B4:FC:7D:50:16:A5

Problem:

System > Gateways shows:

WAN_DHCP6 (active)

Gateway:
fe80::be24:11ff:fe89:923c

However, fe80::be24:11ff:fe89:923c belongs to the LAN interface of OPNsense itself.

NDP confirms:

OPNsense LAN:
fe80::be24:11ff:fe89:923c
MAC bc:24:11:89:92:3c

FRITZ!Box:
fe80::b6fc:7dff:fe50:16a5
MAC b4:fc:7d:50:16:a5

The FRITZ!Box is visible and reachable via NDP, but OPNsense still installs its own LAN link-local address as the active WAN_DHCP6 gateway.

Additional log message:

RA with a lower CurHopLimit sent from
fe80::be24:11ff:fe89:923c
(current = 255, received = 64)
Ignored.

Already tested:

- Fresh OPNsense installation
- GS308E factory reset
- Same behaviour after reinstall
- WAN and LAN are separated
- FRITZ!Box link-local address visible in NDP
- Issue reproducible

Expected gateway:

fe80::b6fc:7dff:fe50:16a5

Actual gateway:

fe80::be24:11ff:fe89:923c

Has anyone seen OPNsense learning its own LAN link-local address as WAN_DHCP6 gateway before?

I would appreciate any ideas regarding DHCPv6-PD, Router Advertisements or gateway discovery in this setup.

Thanks.

[franco]

Network loop between WAN and LAN?

[noclue68]

That was my first suspicion.

However, WAN and LAN are on separate NICs and separate Proxmox bridges. I also factory-reset the managed switch and reproduced the issue on a fresh OPNsense installation.

NDP correctly discovers the FRITZ!Box:

fe80::b6fc:7dff:fe50:16a5
MAC b4:fc:7d:50:16:a5

but WAN_DHCP6 still installs

fe80::be24:11ff:fe89:923c

which belongs to the OPNsense LAN interface.

Could a layer-2 loop still explain this behaviour?

[Patrick M. Hausen]

Use a packet trace and look for router advertisements or DHCPv6 on the WAN interface.

[Monviech (Cedrik)]

Its most of the time a vlan trunk misconfiguration. If untagged and tagged frames are mixed, some weird stuff can happen, like leaking router advertisements between vlans.

https://docs.opnsense.org/manual/how-tos/vlan_and_lagg.html

Read this.