Strange behavior with IPv6 on PPPoE [was: DynDNS for IPv6 not working]

[schnipp]

Hello,

I have problems to register the IPv6 address of the firewalls WAN interface to my DynDNS operator. I got the following results:

• Registering the IPv4 address using the built-in DynDNS client (Custom) works fine
• Registering the IPv6 address using the built-in DynDNS client (Custom v6) fails
• Triggering the IPv6 registration URL via command line using curl works fine

A packet capture shows that the DynDNS client does not communicate with the server, but the log file shows the following error message, even though the WAN interface has a public IPv6 address assigned:

opnsense: /services_dyndns_edit.php: Dynamic DNS (<hostname>) There was an error trying to determine the public IP for interface - wan(ix0). Probably interface is not a WAN interface.

Update URL: https://update.spdyn.de/nic/update?hostname=xxxx&myip=%IP%&user=xxxx&pass=yyyy

Does anybody has similar problems?

[schnipp]

PPPoE (pppoe0) interface is a virtual one on top of ethernet (ix0)

The DynDNS configuration "Custom v6" tries to gather the ipv6 address from the ix0 interface instead of pppoe0 if I understand the logfiles correctly.

Has anybody successfully running DynDNS with "Custom v6" profile?

[franco]

This looks like your fix... https://github.com/opnsense/plugins/commit/007b64c5258e6e1d1

So which version of DynDNS plugin are you running?


Cheers,
Franco

[schnipp]

I use plugin version 1.13 (under Opnsense 19.1.4). So, the fix is already in place.

[franco]

Okay, let me have a closer look then.

[franco]

Apr 3 17:45:17   opnsense: /services_dyndns_edit.php: Dynamic DNS (foobar) There was an error trying to determine the public IP for interface - wan(pppoe0). Probably interface is not a WAN interface.
Apr 3 17:45:17   opnsense: /services_dyndns_edit.php: Dynamic DNS (foobar): running get_failover_interface for wan. found pppoe0
Apr 3 17:45:17   opnsense: /services_dyndns_edit.php: Dynamic DNS (foobar): IP address could not be extracted
Apr 3 17:45:17   opnsense: /services_dyndns_edit.php: Aborted IPv6 detection: no address for pppoe0
Apr 3 17:45:17   opnsense: /services_dyndns_edit.php: Dynamic DNS: updatedns() starting

Looks ok to me, but it needs "Use IPv4 connectivity" in WAN settings... Which begs the question: what is your WAN setup and is it working? oO


Cheers,
Franco

[schnipp]

My configuration:

Interface PPP (PPPoE) on top of ix0 (Ethernet):


Block private networks:yes
Block bogon networks: yes
IPv4 Configuration Type: PPPoE
IPv6 Configuration Type: SLAAC
Use IPv4 connectivity: no


I have also tested the option "Use IPv4 connectivity: yes" but saw no difference in network communication (wireshark)

[franco]

Is this a side-effect from secure IPv6 addressing?

Need ifconfig of pppoe0 and igb0 to see why that's not picking up anything.

But "saw no difference in network communication" makes me worry a bit about how IPv6 works here at all. Are you sure it works fine? Sending curl over IPv4 with IPv6 attached in the URL is not a clear confirmation.


Cheers,
Franco

[schnipp]

Do you mean "privacy extensions" with "secure IPv6" addressing? I tested first without privacy extensions and afterwards with, no difference.

But I did a test with ifconfig on the console. I removed all public IPv6 addresses from interface "pppoe0" and added one of the previously assigned public IPv6 addresses to the ethernet interface "ix0" (parent interface of "pppoe0"). Afterwards, I forced a DynDNS update for the "Custom v6" profile, which successfully registered the public IPv6 address of "ix0"

This shows that the DynDNS client tries to extract the publich IPv6 from the wrong interface (parent interface of "pppoe0" instead of "pppoe0" itself).

Additionally: Adding a second alias to "ix0" (and in a second try an additional link local address) showed that the first non link local address is extracted and used for DynDNS registration.


Edit:
With "Use IPv4 connectivity" I understand, that the IPv6 configuration is done over IPv4 or PPP-config. Maybe there is a misunderstanding. "saw no difference in network communication" means that IPv6-SLAAC is still done via IPv6 multicast.

[schnipp]

I have created a bug report in github: https://github.com/opnsense/plugins/issues/1296

[schnipp]

Maybe the issue does not rely in the DynDNS plugin because I saw some more strange behavior regarding IPv6. As already mentioned the ethernet interface "ix0" is parent of the virtual ppp interface "pppoe0".

• SLAAC is working fine for pppoe0 (uses the offered prefix by my ISP via PPP configuration)
• Switching from SLAAC to Static IPv6 on "pppoe0" shows strange behavior
• The static IPv6 is assigned to "ix0" instead of "pppoe0" (checked with ifconfig)
• Console overview after SSH login show that the static IPv6 is assigned to "ix0" and "pppoe0" 
• Using DHCPv6 is not working at all, no DHCPv6 request packets seen on wire
• rtsold is watching on "ix0": Is that correct?

Maybe opnsense has problems to distinguish "pppoe0" from "ix0"?

Any ideas or hints?

[schnipp]

A friend has the following cascade "ix0" -> "ix0_vlan7" -> "pppoe0" and has tested to assign a static IPv6 to the interface "pppoe0".

Again, on his opnsense installation the IPv6 address is also assigned to the parent interface of "pppoe0" which is "ix0_vlan7".

[glasi]

I also have had problems with IPv6 in OPNsense. Miraculously, my problems seem to have disappeared after I played around a bit with the settings DHCPv6, SLAAC and static IPv6 in the WAN interface configuration.

Currently, I'm using a dual stack configuration with IPv4 Configuration Type PPPoE and IPv6 Configuration Type SLAAC.

Nevertheless, I can confirm the schnipp's observations.

• Registration of an IPv6 address with the built-in DynDNS client (Custom v6) failed.
• Static IPv6 was bound to the wrong interface (ix0_vlan7 instead of pppoe).
  

On top of that I also had issues using IPv6 as internet protocol in an IPsec configuration. In this case the link local address of the WAN interface (instead of its unique global address) has been assigned to the 'left' parameter in ipsec.conf.

Despite everything looks fine right now, I'm nonetheless worried that something is (partly) broken with regards to IPv6. Unfortunately I have not been able to reproduce the problems so far.

[franco]

To me this points to SLAAC incorrectly selecting the interface when the address is grabbed or simply always defaulting to the hardware interface. It's hard to confirm without a responsive setup.


Cheers,
Franco

[schnipp]

As I already mentioned this is not only related to SLAAC, even configuring a static IPv6 incorrectly assigns that address to the parent interface.

However, this problem does no persist permanently because registration the IPv6 address of the pppoe interface currently works fine.

Any ideas?