-
Notifications
You must be signed in to change notification settings - Fork 759
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
[Bug] IPv6: dhcp6c does not pick up advertised routes #1668
Comments
|
Discussion about this topic is going on in |
|
I found the reason why it's not working in my case ... OpenVPN also listens on UDP:546: I stopped OpenVPN and immediately after next solicit request the IP was set. Best regards, |
|
WTF -- to verify I have saved/applied interface WAN again while OpenVPN was stopped: And after the new address was set we have even more processes on 546: Both sleep and sh belong to /var/db/rrd/updaterrd.sh ... |
|
I don't know why but I think something is not working correctly with configd. See the open filedescriptors of these processes -- it seems as if the FDs 0-6 and 8,9 are shared between all these processes. |
|
FYI: I have updated to 17.1.9 and it did not change the situation. As expected I still have to stop OpenVPN, then after some time IPv6 is configured and apinger, ntpd, ... and OpenVPN are restarted automatically. |
|
I have the same problem here. I cant use openvpn because it uses port 546. |
|
FYI: you can enable OpenVPN again ... only if you save an interface or restart OPNsense you have to stop OpenVPN service (leave it configured) and then OpenVPN service is started again automatically once the IPv6 address has been received. Edit: fixed typo ... restart OPNsense ... |
|
Hey! thanks for your help. when I activate openvpn (vpn/openvpn/uncheck deactivate) the openvpn service seems to be stopped and then my ipv6 connections gets lost. |
|
Basically I do it like this (with OpenVPN enabled and running):
Then after some time I see in the Lobby that LAN interface has IPv6 address and dhcpd6, ntpd and openvpn services are started again. Best regards, |
|
But this is only a workaround ... I am also waiting on this issue finally being fixed. Because sometimes IPv6 just stops working. Right now it's not that critical because most sites are not IPv6 only ... but that time will come ... |
|
Thanks, I will try it! |
|
That worked for me, thanks! |
|
@fichtner Hi Franco, do you have any idea why all these processes are listening on port udp:546 as well? My only guess is that these processes/shells are started somehow by configd and inherit the port somehow ... but this is FreeBSD, I am at home on Linux systems ... so I have no clue how to continue debugging. OPNsense is the first time that I have access to a FreeBSD system and I really like OPNsense. If you want me to test something I surely can help. Thanks a lot and best regards, |
|
Hi Jochen, Have been trying to find something in the OpenVPN code, but it does not seem to be a problem there at all. Configd seems unlikely, I've never heard of inheriting sockets before. Maybe some sort of fd leaking that we could prevent with FD_CLOEXEC ? That would likely be in dhcp6c, it issues the reload via its script to /usr/local/etc/rc.newwanipv6 Cheers, |
|
@Space2Man just out of curiosity... can you try this? |
|
Try this one instead... it looks promising. |
|
@fichtner I will test it tonight ... don't want to cut the route over which I am connecting while not at home :) |
|
@Space2Man sure, no problem. I can still see a stray sh / pyhton27 listening on 546 when configd_ctl.py is being called. There is something really fishy with dhcp6c (on FreeBSD 11), but now that is contained on the client side of the backend and the restart of services is not tainted anymore, which is what you said caused this in the first place. Fingers crossed :) |
|
@fichtner Wohooo, patch applied, rebooted, logged in 5s after it responded to ping again ... and ... IPv6 address is set! Checked with sockstat ... no one else is listening ... save/apply on WAN interface, switch to Dashboard --> IPv6 is already there (same address as before). Find attached the logfile from a save: This looks way better from my point of view ... But do you have an idea how I can fix the issue with MTU I have? I have to setup mtu=1486 on my Linux boxes so they are able to connect to all IPv6 sites on the internet. Is dhcp6c maybe missing some part of the advertise where the MTU is included? Not sure what opt_86 is used for ... Thanks a lot! |
|
Thanks a lot Franco! works4me Can I donate somewhere? ;) |
|
Thanks guys, that makes 3 positive tests. 😊
This is a workaround, I would like to find and fix the dhcp6c leak and plug it instead as the current fix could potentially deadlock configd. It's currently impossible, but we never know what we run into in the future.
Jochen... maybe extra VLAN tag or IPv6 extension header in the way. You could clamp the value under firewall: settings: normalisation. Some people even suggest IPv6 as low as 12xx byte.
The donation page is here...
https://opnsense.org/donate/
Thanks!
Franco
… On 20. Jul 2017, at 19:36, zitlo ***@***.***> wrote:
Thanks a lot Franco! works4me
Can I donate somewhere? ;)
—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub, or mute the thread.
|
|
@fichtner I noticed one other thing ... for the first time now both LAN and WAN have a real IPv6 address ... |
|
@Space2Man I have seen this on my install as well, even before the fix. It's weird, but there was no downside here so I ignored it. Prefix-only on WAN mostly matters for the upstream DHCP, I think the address in this case comes from the delegated LAN prefix? |
|
@fichtner LAN has 2a03:f580:c888:eef1:... and WAN has 2a03:f580:c888:ee00 ... not sure if it's from the same PD ... request goes for a /60 net. |
|
But I can confirm that I am able to access IPv6 systems both direct from LAN and via Squid (which should use the WAN IP). |
|
in that case not, funky :) |
|
Thanks, I can confirm that dhcp6c is now the only process listening on port 546: However It seems that some statements in
I verified that |
|
@ldldr this is strange, it works from here, also it should always write something like "request domain-name-servers;" in the file. do you have local modifications? |
|
@fichtner not that I know of. How is interfaces.inc invoked? I'd like to debug this from the command line although I have not much experience with php. Is there a possibility to step through the code or watch variables as they get assigned like |
|
Unfortunately not. Can you dump your interfaces.inc code in more detail? It's really odd the config file has a closing "}" which it can only reach if all was executed, but it misses unconditional prints in between... |
|
I often debug using file_put_contents('/tmp/debugfile', @file_get_contents('tmp/debugfile') . "new message\n"); |
|
@ldldr Are you using Advanced Options for dhcp6c? Someone told me long time ago that Advanced Options are broken ... |
|
I verified that I have installed this version and yes I used advanced options to enable debugging. Without debugging it works: What is the problem with |
|
@ldldr do you mind sharing your config.xml portion again now to see what changed? |
|
I just noted that nothing has changed in the config.xml. Debugging is still enabled. The only thing that changed was that I selected basic before hitting save. |
|
ah, adv_dhcp6_config_advanced causes the other config to be overwritten: https://github.com/opnsense/core/blob/master/src/etc/inc/interfaces.inc#L3162-L3165 |
|
@fichtner now I see I have looked at the wrong place. $dhcp6cconf is set from DHCP6_Config_File_Advanced(): |
|
ack, I'll see what we can do about that |
|
oh, you were faster ;) |
|
it's called teamwork! :) |
|
That's why I love open source :) |
|
I have this weird problem again: dhcp6c is listening on 546 but sending on a random port, 18892 this time: The UDP checksum is also wrong even though I disabled hardware checksum offloading. Needless to say that dhcp6c does not see the reply to port 18892: |
|
I have another problem. radvd.pid is not created and radvd is started over and over again: |
|
Please ignore the last post. This happens when radvd is started with the -d option. My fault. |
|
Fix has been merged to stable branches, will even hit 17.7.11. Advanced config issue moved to #1735 to close this. |
|
Thanks everyone for helping to get this right! :) |
Hi,
I have upgraded to OPNsense 17.1.8 and everything is running fine except of IPv6 prefix delegation. My OPNsense box (running on a KVM virtual machine with vfio passthrough of a 4-port HP 364 NIC) is working fine except that the OPNsense box does not pick up an IPv6 delegation prefix from the FritzBox.
I am fighting with this since the early beginning of the 17.1 series. After IPv6 address renewal on the Fritzbox (which get's a /56 prefix from the provider) OPNsense does not pick up the new prefix. After a long time it seems to pick up the prefix at some point in time (at least 17.1.7 did :) ).
Find attached some network traces from both the FritzBox (LAN) and the OPNsense box (WAN).
Best regards,
The text was updated successfully, but these errors were encountered: