Deutsche Telekom VDSL IPv6 having issues after upgrade to 24.7

[beisser]

hi guys,

im not sure how to describve this issue best so bear with me.
my ISP is Deutsche Telekom and im Using their PPPoE VDSL.
IPv6 was very stable until i upgraded to 24.7
now it looks like ip6 is sometimes working and sometimes not.
the ip address on the wan-interface is always there, which seems to be correct, and the connected computer also get ipv6 addresses correctly as far as i can tell from my testing.

if you try to use any ipv6 connection to the internet though its hit and miss.
if it works it will continue to work for considerable time and then suddenly simply stop for several seconds to minutes before coming back to life.

ipv4 at the same time has absolutely no issues at all.
by symptoms it looks like the firewall intermittently stops forwarding IPv6 and then continues on its own.
i would apreciate any tips on how to troubleshoot this.

[franco]

Hi,

Can you try this patch?

https://github.com/opnsense/core/commit/287c13beb

# opnsense-patch 287c13beb


Cheers,
Franco

[beisser]

does it require a reboot, or should it come into effect immediately?

[doktornotor]

For some meaningful testing, I'd suggest at least unplugging/replugging the WAN cable.

[franco]

> For some meaningful testing, I'd suggest at least unplugging/replugging the WAN cable.

Yes, good answer.


Cheers,
Franco

[beisser]

ok, will simply reboot the firewall, once i have time for it.
without it i dont see any visible effect of the patch.
will report back once i have rebooted

[franco]

It's not very uncommon to see no effect when this only pertains to IPv6 renew events.


Cheers,
Franco

[beisser]

i have rebooted the firewall about an hour ago and ipv6 seems to run stable now. at least i have not seen any outtages while monitoring outgoing icmp traffic.

i will continue to monitor, but so far its looking good.

[franco]

Thanks, if I get another independent confirmation I'll add that to the stable updates queue.

[beisser]

3 hours later my ipv6 is still going strong without issues.

[beisser]

just now i had a weird phenomenon.

i started my computer up after the night, it got an ipv6 ip from the correct prefix but couldnt reach the internet via ipv6.

i left a permanent ipv6 ping running and after a long time it started working just moments ago.
now im checking if it stays working.

there is a chance that this patch is only a partial fix. will reply later with more info.

while im writing this the ipv6 ping just failed again.

im not sure why it was working for the whole 12 hours yesterday after the patch and today its failing again.
the only thing that changed was a scheduled reboot of the firewall at 5 in the morning.

[meyergru]

I doubt that there is a problem at all because that is expected behaviour: With SLAAC in your LAN, the clients will pick up an IPv6 only after they receive a SLAAC broadcast that only gets transmitted every few seconds.

That is why I set the Minimum and Maximum Interval values to 200 and 600, respectively for Router Advertisements.

[beisser]

im doing additional testing right now from multiple machines and vms on my network and im seeing some weird stuff.

the firewall is virtualized on a promox host.

it seems all physical machines on the network are having ipv6 issues intermittently but at different times, while the vm which has been running for a long time doesnt seem to have any issues (for as long as i have been testing today).

what i also noticed is that restarting the router advertisement service in the gui brings back connectivity on all physical machines immediately.

and i still dont get why it worked flawlessly for the rest of the day yesterday after applying the patch and rebooting the firewall.

very confusing.

@meyergru the clients pick up addresses just fine. its the forwarding that gets interrupted and autoresumes at different intervals.

i just checked the intervals are set to 200 and 600 by default it seems (i never touched them).
also see above the weird behaviour i have noticed.

[beisser]

i found one physical machine which doesnt seem to have issues. its a proxmox backup server based on debian 12.

i have only been testing for an hour or two so far today, but this machine at least didnt experience issues.

so that limits the machines that have issues to all my 3 physical machines running windows 11.

i do have one more windows 10 laptop to test. will get that from the shelf and run additional tests.

[meyergru]

How do you hand out IPv6 on your LAN? SLAAC or DHCPv6 (or both?)

As Deutsche Telekom has dynamic IPv6, DHCPv6 can be problematic. If, for example, you offer DHCPv6 and a client uses it, it is up to the client to request a lease renewal, so it can be a long time after the prefix changes that the client uses the old prefix. With SLAAC only (aka "stateless"), this can be controlled by the minimum and maximum interval.

If you offer both (aka "assisted"), this can turn out to be different or different OSes. AFAIK, Promox itself does not use IPv6 at all per default, but VMs and LXCs can, if they want to. Thus I wonder: how did you verify that your Proxmox does not have any problems with IPv6?

Also, the virtualisation of your OpnSense can come into play as Proxmox contains a firewall as well.