Can't enable Ipv6 gateway

[marco35]

Hi Guys,
very occasional poster here and for the most part OPNsense has been pretty faultless.

I have run in to an odd problem, in that I can no longer enable an IPv6 gateway.
System | Gateways | Single .. the gateway shows as 'pending'
It is setup with gateway monitoring pinging Google's DNS.
Every time I go in to the config screen, 'Disabled' is ticked. Unchecking that and saving results in 'offline'
Re-entering the config and again the disabled box is checked.
Pressing the arrow prior to 'name' returns the pending status, but it never enables.
Again going in to the config, we see the disabled box checked.
Restarting the gateway has no effect.
Restarting the firewall has no effect.

The history here is that is WAS working. The update prior to the one I applied today seemed to kill it. I put the issue on the back burner, but hoped a patch might resolve it. Well, we have had that further update and it is still broken.
We have a /48 from our upstream provider, and I have a /64 from that allocated to inside our network.

Any ideas as to what I should look at?

Thanks

[franco]

Sounds like a duplicated "gateway_item" in your /conf/config.xml file. Delete the wrong entry with the same name and it should work again.


Cheers,
Franco

[marco35]

Thanks for the quick reply.

I have taken a look as suggested, but I only see one entry in that XML file for this gateway.
I did remove it by editing that file, then doing a restart service in the web console.
I end up with the same issue in that the disabled tick box is checked, and any amount of trying to alter that doesn't seem to work.
I have done a cheeky edit to the XML and removed the line <disabled>1</disabled>
In the gateways | Single screen, I see the gateway now shows as pending.
However, the enabled triangle is still grey.
There are no ping times shown.
Pinging IPv6 from the command line gets a 'no route to host'
Going in to edit the gateway, again shows the tick box as disabled.

See below for an extract of the XML file...
    <gateway_item>
      <interface>wan</interface>
      <gateway>dynamic</gateway>
      <name>WAN1_IPv6</name>
      <priority>2</priority>
      <weight>1</weight>
      <ipprotocol>inet6</ipprotocol>
      <interval/>
      <descr/>
      <monitor>2001:4860:4860::8888</monitor>
      <disabled>1</disabled>
    </gateway_item>



The gateway doesn't show in the dashboard.

[franco]

> In the gateways | Single screen, I see the gateway now shows as pending.
> However, the enabled triangle is still grey.

This is highly unusual and not reproducible from my end. Enable and disable works as expected.

The "play" button is clickable doing the disable/enable from the list view. Also make sure that "disable gateway monitoring" us unchecked if you expect values.


Cheers,
Franco

[marco35]

Thanks again for the quick reply.

I attach a couple of screen prints for reference.
Today, I have found that if I hold the XML file open in the console by using a text editor - then the save button doesn't work on the GUI. Quite right - that was a bit of learing for me!

However, that isn't the issue. Still, every time I clear the disabled box, it reappears. Also, clicking the enable triangle doesn't change it from grey to green.

I suppose there may be something deeper in which means the IPv6 gateway can't be controlled.
The dashboard does show both the WAN and the LAN to have IPv6 configured... and as I say, this had been working previously.

[marco35]

Update: Even more odd.

I have a 'spare' IPv4 gateway that is to be used for a second WAN connection in due course.
At present, it doesn't have anything plugged in to the ethernet port.

That too shows as online, and trying to enable it either via the config screen or the 'play' button doesn't work.

Not too concerned about this at present, but it may add some extra info to help sort my IPv6 gateway issue.
I have one gateway up... I don't want to make changes there in case I end of disconnected!

[franco]

Thanks for the screenshot. At least now we know that behaviour is intentional:

https://github.com/opnsense/core/blob/5d29d382c26288a4c93584de800742dab85d84b8/src/opnsense/mvc/app/library/OPNsense/Routing/Gateways.php#L358-L368

mark defunct, disable in any case

I'm not entirely sure what defunct tries to tell use here. Can you talk about your WAN setup (IPv4 and IPv6 modes).

The easiest explanation is your IPv6 isn't connecting for whatever mode you set.


Cheers,
Franco

[marco35]

Okay, thanks for the pointers...

So, it looks like I should investigate the WAN1 interfaces.
This is PPPoE, has a static IPv6 address and uses IPv4 for connectivity is ticked.
 Indeed the static IPv6 address on the outside interface isn't pingable from the internet, nor the inside of the firewall.

Mybe our ISP has changed something and it just roughly coincided with the last firewall update (or only became applied at the point of that reboot).

[franco]

Switch to PPPoEv6. Your provider was giving you a router previously, but that changed with 23.1.7 (static mode remains a manual gateway mode).


Cheers,
Franco

[marco35]

Thanks, will try that.
Will have to wait a while as I have active VoIP sessions for some people on the phones here.
I would be unpopular if I dropped all those sessions.

[marco35]

Hi Franco,

Thanks for your info.
That was indeed the problem.
I hadn't spotted that there was a change required to move to PPPoEv6 on the interface config.

May I say you have provided great support here! Thanks again.

[franco]

Thanks

Reason for PPPoEv6 mode (introduced in 23.1) is to decouple the PPP information from the IPv6 modes a little as previously it was always sort of enabled wich can mess with routing when multiple fronts report their router or in your case taint a static setup which is hard to trace.

The first introduction was a little too intrusive so we had to dial it back a bit and slowly start removing double-use from it again. For now it remains a double-use for DHCPv6 and SLAAC modes as some providers require this for IPv6 to work at all.


Cheers,
Franco