[SOLVED] IPV6 address assignment not working

[RandyT]

Greetings all. First post to forum.

New to IPv6 so some gaps in knowledge may be an issue here. I've consciously not posted on another thread that is reporting similar issues although I think that thread is describing an issue that is a bit further along in the IPv6 configuration process. https://forum.opnsense.org/index.php?topic=32263.0

I'm running 23.1.1_2. I did not try to setup IPv6 before the upgrade to 23.1 so no idea if this is a new issue introduced by 23.1.

I've spent about a week working on this off and on. My ISP is Spectrum. They of course pointed the finger at the customer owned cable modem (Netgear CM1000) and insisted I needed to replace that with their own which I have done. Symptoms remain the same.

I've followed a couple of guides to configure IPv6. Here are a couple of links:
https://www.reddit.com/r/OPNsenseFirewall/comments/xmurda/psa_howto_ipv6_on_spectrum_formerly_twc_time/
https://homenetworkguy.com/how-to/configure-ipv6-opnsense-with-isp-such-as-comcast-xfinity/

I've attached screencaps to show the following:

1. dhcp6c logging "transmit failed: Can't assign requested address" which is not particularly helpful.
2. Firewall is not blocking any icmp-v6 which I understand is the requirement in the assignment chatter.
3. Packet capture appears to show possible attempt to assign a /64 address. This does not change if I specify a different prefix hint.

Would appreciate any help here. I have applied the patch mentioned in the above thread but it has not changed the behavior here.

[Greelan]

You've explained very little about your own setup so hard to comment. Eg what sort of prefix does your ISP give you? What configuration have you set up in OPNsense? Is your ISP modem a pure modem or a modem/router? If the latter is it bridged? Note that with IPv6 sometimes even bridging does not fully pass through IPv6 - you have to disable IPv6 on the modem/router before bridging to ensure it doesn't pinch the prefix.

[RandyT]

As mentioned, I am currently working with the Spectrum supplied cable modem which is a Hitron EN2251. I've been unable to pull up a web interface on the modem thus far. The Netgear modem I had been running for about 4 years was a pure modem and ran in bridged mode. I am assuming this device is the same, but currently I know a lot less about it than the Netgear.

The screencap I sent of the packet capture. Am I reading that correctly to see that it attempted to assign a /64 prefix?

I've read everything from /56 to only a /64 coming from Spectrum. As of yet, I have not been able to get deep enough into their support team to get a straight answer. I continue to work on that. Needing to jump through this hoop of using their modem. Would like to be armed with a few more details before the next painful call.

[IsaacFL]

I have had Spectrum ipv6 working for a couple years.  They provide a /56 prefix.

Spectrum is a conglomeration of different providers so might depend where you are at.  I have it working in Southern California (formerly TWC) and also Florida (formerly Brighthouse)

I am just using cable modem provided by Spectrum.

One gotcha is that the cable modem will lock to a specific router, if you switch routers.  In that case, sometimes a power cycle of the cable modem will cause it to work with a new router.  Or logging into the Spectrum website, and remotely resetting the cable modem.

I've attached my WAN interface and LAN interface settings.

[RandyT]

Thanks for this @IsaacFL. I've basically have mirror of what your config is with some slight differences. Made changes to match yours in case they were issues and do not have any different result.

However, I can report that a Linux laptop that I connected to the modem had no trouble getting an IPv4 and IPv6 address after applying your hint about powering off the modem to get it to release the router. Thanks for that.

So I think we can rule out the modem as being a potential problem. I did find the modem sitting at 192.168.100.1 but cannot get a UI pulled up on a web browser. I port scanned it and see it listening on both 80 and 443 but it just will not respond. ??

The address assignment that the Linux laptop got was a /64 prefix. Not sure if that is indication of what is available to me or the result of not providing a prefix hint.

I assume you are running  23.1?

[IsaacFL]

there is no web ui on the Spectrum modem so far as I have been able to tell. The ports show open but they are not?

the /64 your linux is getting is the default, if you do not send the /56 prefix hint.

I am running the latest opnsense:
OPNsense 23.1.1_2-amd64
FreeBSD 13.1-RELEASE-p6
OpenSSL 1.1.1t 7 Feb 2023

You might make sure that you have a wan rule to allow icmpv6 source "any" to destination "wan address"?

Other than that the biggest issue is always the cable modem locking onto your linux machine.  Sometimes requires multiple power cycles of the cable modem and simultaneous opnsense reboot. Watch the console and you should see the ipv6 assignments on the console.

[RandyT]

To follow up the question on firewall, I had created rules for each icmp6 type, but for fun added a rule to pass all icmp6. It makes no difference. Looking at the firewall log for all icmp6 type proto, everything is passing.

I've attached below images of my current WAN firewall rules as well as a shot of firewall log file showing all icmp6 traffic passing.

I'm at a loss here. To recap current status.

1. Am able to receive an ipv6 address assignment on a Linux laptop connected directly to the cable modem.

2. Unable to get an ipv6 assignment on very basic opnsense config with a WAN interface and a LAN interface. No VLANs or other complexity added at this point.

3. Running on Protectli FW4B which has 4x Intel I211 NICs

4. dhcp6c continues to log "transmit failed: Can't assign requested address"

I'm at a loss for what is going on here. Open to any suggestions to help further debug this.

[RandyT]

Would someone mind commenting on my advanced settings for firewall? I don't remember changing anything here other than to "Allow IPv6" and would appreciate it if someone could comment as to what default (or preferred) settings should be. Screencap attached.

Thanks

[RandyT]

Follow-up here on my progress.

After much hair tearing over past week I finally decided to revert back to 22.7. After doing a clean install of 22.7 and then applying a backup made prior to the update to 23.1 I am happy to say that IPv6 just worked.

I think there are clearly issues with IPv6 in 23.1.1.

Marking solved.

[dfw3xam1n3r]

Indeed.