2degrees UFB on pfsense - need help creating DHCPv6 static mappings

Forums › 2degrees (including Slingshot, Orcon, Flip, Stuff Fibre, MyRepublic, 2talk and Vocus) › 2degrees UFB on pfsense - need help creating DHCPv6 static mappings

andicniko

10 posts

Wannabe Geek

#289758 27-Sep-2021 21:07

Hi all,

I have a fitlet2 running pfsense 2.5.2. It is successfully connected to the internet using the attached settings (thanks 2degrees and everyone kind enough to explain things on geekzone!).

IPV6 is working since I last set things up, and all my clients obtain an address without any issues.

If it's relevant:

I am in Wellington and connected to the Chorus fibre network here
I do not have a static IP address (but will gladly pay for one if it help solve my issues)
I have attached my WAN interface settings, my LAN interface settings, and the default DHCPv6 settings

Question: Can someone explain how to create a DHCPv6 static mapping for a client on my LAN?

Why?

I have a RPI4 running pihole on my LAN, and want to point to it as a DNS server for all my clients.

This was straightforward for IPV4. I created a static mapping for the RPI4 and listed that as a DNS server in the DHCP server settings. But now that I have clients with IPV6 addresses, they don't seem to be using the pihole as their DNS server. I have assumed whatever is giving them an IPV6 address isn't yet pointing to the RPI4 as a DNS server.

Note my pihole did work when I only had IPV4. But I would like to keep IPV6 (i.e. prefer not to disable it). It's something new, and I am keen to learn how to make it work.

What happens when I try create a DHCPv6 static mapping?

I have tried to add a DHCPv6 static mapping for the RPI4. I can find it in my list DHCPv6 leases, and give it a static IP of ::2 (which is outside of the specified range, in my case, ::1000 to ::2000) in my DHCPv6 settings.

But the RPI4 just keeps its IP of 2406:e003:e01:9000::1f7c.

I have tried to force the RPI4 to get its static IPV6 address and request a new one with the following commands, but none of them helped:

dhclient -6 -r eth0; dhclient -6 eth0
/etc/init.d/networking restart
ifdown eth0; ifup eth0

Just a few things I don't understand that could be the problem

If I understand things correctly (unlikely...):

2degrees has a DHCPv6 server that gives me a prefix delegation
I'm thinking of the prefix delegation as the first part of an IPV6 address (2406:e003:e01:9000::), with my various clients *somehow* getting assigned various addresses within that
But I don't think I understand how those client addresses are assigned

Does the DHCPv6 server on my system even assign IPV6 addresses to my clients, or is this done by the 2degrees' DHCPv6 server? If it's the latter, does that mean I have no ability to specify who gets what addresses within the prefix delegation?

I think it's pretty clear I don't know what I'm doing, but I'm keen to learn! Thanks in advance, any help is appreciated.

Attachments

WAN interface settings: https://cdn.geekzone.co.nz/imagessubs/1b6d85c2e5b57bf8d7a6d9dd08e26ff9.jpg and https://cdn.geekzone.co.nz/imagessubs/d068a99f260a08ee1b20d6c17c27a472.jpg

LAN interface settings: https://cdn.geekzone.co.nz/imagessubs/6f17f422e5284d14df4ff752370def82.jpg

DHCPv6 settings (blank defaults): https://cdn.geekzone.co.nz/imagessubs/74424519acef4255b8b7c5eaed635f2d.jpg

DHCPv6 leases: https://cdn.geekzone.co.nz/imagessubs/50e29bdd0922c103fd29d673ba753e29.jpg

DHCPv6 static mapping attempt: https://cdn.geekzone.co.nz/imagessubs/b8151db90531491a785f332f493f142b.jpg

fe31nz

1232 posts

Uber Geek

#2785365 28-Sep-2021 01:51

I do not know anything about pfsense, but I do have DHCPv6 working on my Edgerouter ER4. I found that with DHCPv6, that there is a problem where both the device and DHCPv6 server remember the old IPv6 they had and will keep using that even after you set up a manual DHCPv6 address assignment. So what I often had to do was to disconnect the device, and sometimes even reboot it, and when it was disconnected, restart the DHCPv6 server (or reboot the router).

As well, for DHCPv6 to work, you have to set up the router to be sending the correct "autoconfig" flags (the M and O bits) in its ICMPv6 RA (Router Advertisement) packets. Devices will automatically configure link-local IPv6 addresses (fe80::/10) when they boot, but they will only create a global unicast IPv6 address (one that can send and receive from IPv6 addresses that are not on the local subnet) when they receive an RA packet. If they do not immediately receive an RA packet, they will send an RS (Router Solicitation) broadcast packet to request that an RA be sent. If the M bit is on in the RA packet they receive, they will do a DHCPv6 request to get an IPv6 address, otherwise they will self generate a "stateless" IPv6 address and then test to make sure it is unique on the local subnet. If the O bit is on in the RA packet, they will do a DHCPv6 request to get other necessary or useful information that can be provided over DHCPv6, such as the addresses of DNS servers, NTP servers, and heaps of other things. Unlike DHCP, with DHCPv6 a device can request the optional information without requesting an address, so the RA M and O bits are independent of each other. And there is also an option for the RA packets to carry the DNS server addresses also. I have my ER4 set up to send the DNS server addresses in both the RA packets and DHCPv6 packets, so that devices that do not do DHCPv6 (such as Android devices) will get the DNS server addresses.

Before you can assign DHCPv6 addresses, you first have to delegate an IPv6 prefix to each of the subnets that your router provides. I have static IPv4 and IPv6 addresses, so I have just done static assignments of the IPv6 prefixes, but if you are getting your IPv6 prefix from 2Degrees dynamically, it can change, and you will need to set up prefix delegation. How that works is that 2Degress will send you a prefix delegation from their assigned IPv6 address. It will usually be a /56 address - that means that the top 56 bits of the IPv6 address is the prefix delegated to you by 2Degrees, and your router assigns the remaining 72 bits of the IPv6 addresses. By convention, the addresses used on each subnet are supposed to be /64 addresses, where the upper 64 bits designate the subnet and the lower 64 bits designate the device on that subnet. In theory you can use other than a /64 on a subnet, but do not do that! Almost all devices will assume a /64 for the subnet and many will be broken if it is anything other than a /64. So the top 56 bits of your IPv6 addresses will be delegated by 2Degrees, and the bottom 64 bits will be used to address the devices on the subnet, leaving the middle 8 bits to be used to select the subnets in your network, allowing for up to 256 different subnets. I reserved subnet 0 for special uses and numbered my subnets from 1 upwards. My subnet 1 is my "Outer" subnet where my guest connections occur, and my subnet 2 is my "Inner" subnet where trusted devices connect. My subnets 3 and 4 are currently unused and subnet 5 is my IoT subnet where untrusted devices like IoT devices are connected. Each subnet has its own RA settings and DHCPv6 server settings. You will need to set up pfsense to assign your subnet numbers for each of your subnets, and to use the delegated prefix for the upper 56 bits.

An additional complication is DUIDs. DHCP on IPv4 uses the MAC address to distinguish between devices and select the IPv4 address to be used. IPv6 uses a DUID value sent in the DHCPv6 packets. The DUID is generated by the device and there are lots of options for how it is generated. But finding what it is so that you can put it into the DHCPv6 address tables is very difficult. And if you have a PC that dual boots, the DUID for each operating system will be different - they will each generate their own DUID. And if you ever to a full reinstall of an OS (or factory reset a device), it will generate a new DUID. It can be possible on real operating systems on PCs to manually control or assign the DUID, but in Windows Microsoft has a history of breaking that mechanism and when they do, the DUID will be generated again using whatever options they have selected and will change on you. And with most other devices, you will have no control at all over the DUID generation. So it is best to just leave the devices to generate their own DUIDs and then discover what the value is and put that value into your DHCPv6 configuration. For dual boot PCs, there will be two entries with different DUIDs and the same IPv6 address assignment. What I do to find the DUIDs is to run tshark (or wireshark or tcpdump) on the router, set it to capture only ICMPv6 packets, and then connect the device. The DHCPv6 packets will be captured and you can then extract the DUID from them and put it into your DHCPv6 configuration. And because of the problem where devices keep on getting their old IPv6 address despite you setting a new manual DHCPv6 assigned address, each time you add a new device, you will probably need to restart the DHCPv6 server while the device is disconnected, and then capture the DHCPv6 packets when it connects to check that it is actually getting your newly assigned IPv6 address. Having to do this this is a great pain.

timmmay

20581 posts

Uber Geek

Trusted

Lifetime subscriber

#2785376 28-Sep-2021 07:15

I don't know much about this stuff, so take what others say over this. I'm just sharing what I've found by trial and error.

My Pi Hole has multiple ipv6 addresses by default and at least one of them seems to have remained static for some time. I'm not 100% and I haven't checked recently. I didn't do anything special though. My work computer on my home network has two of Pi Hole ipv6 addresses for DNS, twice for some reason, plus it's ipv4 address.

Just saying check you need to do the work before you spend a lot of time on it. I think devices IPv6 addresses tend to be more stable than IPv4.

alavaliant

222 posts

Master Geek

Subscriber

#2785495 28-Sep-2021 09:44

Sorry can't offer any direct advise on the issue. But I am pleased to hear that you have ipv6 working on with 2degrees on pfsense in general. A year or so back I tried and eventually gave up as at the time there didn't seem to be any known working settings for it under pfsense.

michaelmurfy

meow
13256 posts

Uber Geek

Moderator

ID Verified

Trusted

Lifetime subscriber

#2785506 28-Sep-2021 10:07

As per the above - you'll need a Static IP (Static IPv4 + /56 IPv6 Subnet) so you can assign a /64 prefix to your private networks. If you use SLAAC then the rest is rather seamless as all your devices should already be static enough (via device mac) for use straight-away (this is what I personally do on my network).

It is also important to pass through ICMPv6 on your router.

If you don't have a Static from 2degrees then IPv6 is not static for you.

Michael Murphy | https://murfy.nz
Referral Links: Quic Broadband (use R122101E7CV7Q for free setup)

Are you happy with what you get from Geekzone? Please consider supporting us by subscribing.
Opinions are my own and not the views of my employer.

DimasikTurbo

89 posts

Master Geek

ID Verified

#2785568 28-Sep-2021 11:43

I'm curios as well:

why are various clients *somehow* getting assigned various addresses within that

I'm with Orcon and observing similar picture, over the time some of the network devices are obtaining more then one ipv6 address. Why is it happening?

aseni

52 posts

Master Geek

#2785598 28-Sep-2021 12:35

andicniko:

2degrees has a DHCPv6 server that gives me a prefix delegation
I'm thinking of the prefix delegation as the first part of an IPV6 address (2406:e003:e01:9000::), with my various clients *somehow* getting assigned various addresses within that
But I don't think I understand how those client addresses are assigned
Does the DHCPv6 server on my system even assign IPV6 addresses to my clients, or is this done by the 2degrees' DHCPv6 server? If it's the latter, does that mean I have no ability to specify who gets what addresses within the prefix delegation?

Basically what happens is that your router uses DHCPv6 PD to request a prefix from 2D, and gets allocated a /56 (which is enough for 256 /64 subnets).

Your router then allocates one of the /64's for each IPv6-enabled interfaces, and uses ICMPv6 RA and DHCPv6 to allocate IPv6 addresses within the /64 to clients on each interface.

The clients can (and usually will) have multiple IPv6 addresses:

one local address with is used only for communicating in the local network and is not routable (no access to the Internet), in the FE80::/10 subnet;
one IP address assigned from your router DHCPv6 server (if enabled both in the client and router);
one or more SLAAC IP address (the router advertises the /64 prefix via ICMPv6 RA and the client picks the last half of the address, usually based on the interface MAC address, but can also be a random address if using IPv6 privacy extensions);

Re. your static mapping, check if your Pihole dynamic lease is still valid under Services/DHCPv6/Leases, the DHCPv6 server might be "preferring" the active lease vs the static one you created.

That being said, I'd advise against advertising the Pihole IPv6 for DNS. If your IPv6 allocation changes, you will have to trigger a dhcp/slaac renew in all clients to get the new IP.

Check your clients interface settings and see if they are getting any IPv6 DNS servers beside your Pihole IPv4 address, it might be that you are advertising the DNS servers you are getting from 2D either via RA or DHCPv6.

Check the DNS settings on your pfSense System/Settings/General page, make sure you have your Pihole IPv4 address and nothing else under "DNS servers", and you have "Allow DNS server list to be overridden by DHCP/PPP on WAN" disabled.

Not entirely sure about the configuration names btw, I am using OPNsense, which is similar but not exactly the same.

aseni

52 posts

Master Geek

#2785602 28-Sep-2021 12:46

DimasikTurbo:

I'm curios as well:

why are various clients *somehow* getting assigned various addresses within that
I'm with Orcon and observing similar picture, over the time some of the network devices are obtaining more then one ipv6 address. Why is it happening?

IPv6 privacy extensions use random IP address to avoid privacy issues with addresses based on the interface MAC address.

These random IP addresses change over time, so the client will usually have one "active" address which it will use to establish new connections and one "deprecated" IP address (the previous random IP address). The deprecated address is kept for a while so already established connections don't break during the transition to the new active address.

Quic Broadband

Move to New Zealand's best fibre broadband service (affiliate link). Free setup code: R587125ERQ6VE. Note that to use Quic Broadband you must be comfortable with configuring your own router.

andicniko

10 posts

Wannabe Geek

#2785869 28-Sep-2021 20:21

Thanks everyone, this has explained a lot! Success.

DHCPv6 static mapping does work as attempted (the devices just needed some time/persuading to use it)

As suggested, I disconnected the RPI4, reset everything, and voila. Once I connected the RPI4 the static mapping worked and it is using the address I assigned to it.

The RPI4 still has its old address, but luckily aseni explained why this is the case. Your other suggestions were also very helpful thanks.

Pointing to the RPI4's IPV6 address does the trick (in Services / DHCPv6 Server & RA / LAN / DHCPv6 Server). When I do this, clients no longer get the 2degrees supplied DNS servers - this was happening if I only pointed to the IPV4 address (I assume this was some kind of fallback behavior where).

I can confirm my router advertisement mode is as suggested

My router advertisement mode (found under Services / DHCPv6 Server & RA / LAN / Router Advertisements) is set to "Assisted", which is described as "The firewall will send out RA packets and addresses can be assigned to clients by DHCPv6 or SLAAC."

Based on that, I assume this is equivelent to setting the M and O bits, and means ICMPv6 is being used/passed through. Other possible modes are described here: https://docs.netgate.com/pfsense/en/latest/services/dhcp/ipv6-ra.html

I will ask 2degrees for a static IP

I'm signing up for a static IP as I write this, to ensure my prefix won't change.

Seems I have to use the full IPV6 address when pointing to the RPI4 as a DNS server. If the prefix is liable to change this is a problem.

I will also run a VPN server on this network, so a static ip will make life easier in more ways than one.

Finally, should I use only SLAAC to obtain static addresses on my local network (given the prefix will soon be static)?

Do I effectively have two options for assigning static addresses on my local network?

DHCPv6 (i.e. my current settings with static mappings in my dhcpv6 server settings); and
Using SLAAC?

And if I wanted to use only SLAAC to avoid the effort of manually mapping addresses, do I need to:

Disable the DHCPv6 server in interface LAN (in Services / DHCPv6 Server & RA / LAN / DHCPv6 Server)?
Change my router advertisement mode to one of the following?
- "Stateless DHCP", which is described as "The firewall will send out RA packets and addresses can be assigned to clients by SLAAC while providing additional information such as DNS and NTP from DHCPv6."
- "Unmanaged", which is described as "The firewall will send out RA packets and clients are directed to assign themselves IP addresses within the interface subnet using SLAAC. DHCPv6 is disabled in this mode."
- Or just leave it as "Assisted", which is described as "The firewall will send out RA packets and addresses can be assigned to clients by DHCPv6 or SLAAC."

Are there any significant downsides to using only SLAAC? It sounds much simpler than manually mapping addresses, given that I won't be able to remember/recognise an IPV6 address anyway.

fe31nz

1232 posts

Uber Geek

#2785991 29-Sep-2021 01:58

andicniko:

I will ask 2degrees for a static IP

I'm signing up for a static IP as I write this, to ensure my prefix won't change.

Seems I have to use the full IPV6 address when pointing to the RPI4 as a DNS server. If the prefix is liable to change this is a problem.

I will also run a VPN server on this network, so a static ip will make life easier in more ways than one.

When you get a static assignment, the addresses will be different from your current dynamic ones, as they are assigned from different address blocks. So you will need to change any locations where the addresses are used staticly rather than delegated dynamically. Make sure you create a document that tells you where all such addresses are, and keep adding to it every time you use a static address. Otherwise when (many years later) you do need to change your static IPv4/IPv6 addresses, you will spend months having little things not work and have to track down the problem and then curse that it is yet another place where a static address was used. Unfortunately, there is no way to avoid all use of static IP addresses as various bits of important software require them. Even if you are running your own DNS servers, there are still places where an IP address has to be used and a DNS name will not work.

andicniko:

Finally, should I use only SLAAC to obtain static addresses on my local network (given the prefix will soon be static)?

Do I effectively have two options for assigning static addresses on my local network?

DHCPv6 (i.e. my current settings with static mappings in my dhcpv6 server settings); and
Using SLAAC?

And if I wanted to use only SLAAC to avoid the effort of manually mapping addresses, do I need to:

Disable the DHCPv6 server in interface LAN (in Services / DHCPv6 Server & RA / LAN / DHCPv6 Server)?
Change my router advertisement mode to one of the following?

"Stateless DHCP", which is described as "The firewall will send out RA packets and addresses can be assigned to clients by SLAAC while providing additional information such as DNS and NTP from DHCPv6."
"Unmanaged", which is described as "The firewall will send out RA packets and clients are directed to assign themselves IP addresses within the interface subnet using SLAAC. DHCPv6 is disabled in this mode."
Or just leave it as "Assisted", which is described as "The firewall will send out RA packets and addresses can be assigned to clients by DHCPv6 or SLAAC."

Are there any significant downsides to using only SLAAC? It sounds much simpler than manually mapping addresses, given that I won't be able to remember/recognise an IPV6 address anyway.

In the above description of your available RA settings, "Stateless DHCP" appears to be M=0 and O=1. "Unmanaged" is M=0 and O=0. "Assisted" appears to be M=1 and O=1.

If you have any Android devices, you will either need to root them and install a DHCPv6 app, or let them use SLAAC addresses. For what I consider to be bad/spurious reasons, Google has decided that Android will never be supporting DHCPv6. On a DHCPv6 enabled network (RA bit M on), any device that is not DHCPv6 capable will normally drop back to using SLAAC to assign itself IPv6 addresses. But you may get unlucky and find a device that will see the M bit and disable SLAAC, but then not assign an IPv6 address at all because it can not do DHCPv6. If so, you will need to have such devices run on a separate subnet where the M bit is off. If they are WiFi devices (which they most likely will be), you can just create another SSID on your WiFi that does not use DHCPv6. The downside of doing that is that since it is on a different subnet, it will not be able to see the broadcast traffic on your main subnet, and various protocols and options that require broadcast packets will not work. The most immediately obvious one is SMB networking (Microsoft file sharing), where discovery of SMB servers does not work. You can still access SMB servers, but you have to manually supply the address. Also, if you run media servers, they will likely also be invisible, and depending on the protocol they are using, they may not be accessible at all from a different subnet, or may require the use of a smart Ethernet switch that can do IGMP multicast snooping.

SLAAC addresses are usually fairly stable, but they can change. And they are almost always very hard to type in if you ever need to, as they do not normally have any blocks of 0 bits in them that can be replaced with the :: notation. I use DHCPv6 wherever possible as I have my own (internal and external) DNS servers and never want the address the DNS server is set up with to change to something else. So I assign an address in the DNS config and copy that over to my DHCPv6 config. I also turn off all options for the use of "privacy" addresses and such like, so that IPv6 traffic to and from the device will only ever use either its link-local (fe80::/10) address or its DHCPv6 assigned address. In my DNS setup, I also assign names to the link-local IPv6 addresses when I am trying to debug network problems. That means that Wireshark packet captures will show the DNS name rather than a very hard to understand IPv6 address - it makes debugging so much easier and faster. DNS servers also offer the option of having devices register their current IP address with the DNS server when they connect to the network. I have not experimented with that, but I suspect it will only work with a limited number of devices that support the DNS protocol required for that. For ease of debugging, I also assign my IPv4 and IPv6 addresses using the same subnet and device number, so for example my "lith" Ubuntu box is 10.0.2.12 and xxxx:xxxx:xxxx:xx02::12. So in both cases, the 2 is the subnet number and 12 is the device number. This does waste quite a few IPv6 addresses on each subnet, but who cares about that - there are millions to spare.

aseni

52 posts

Master Geek

#2786438 29-Sep-2021 16:45

andicniko:

Finally, should I use only SLAAC to obtain static addresses on my local network (given the prefix will soon be static)?

I have seen client that support only SLAAC, and clients that had issues with SLAAC, so I use both on my home network. YMMV, if you have no issues with SLAAC, you can disable the DHCPv6 server on the LAN.

andicniko:

Do I effectively have two options for assigning static addresses on my local network?

DHCPv6 (i.e. my current settings with static mappings in my dhcpv6 server settings); and
Using SLAAC?

Are there any significant downsides to using only SLAAC? It sounds much simpler than manually mapping addresses, given that I won't be able to remember/recognise an IPV6 address anyway.

A few pointer here:

SLAAC can't be used to allocate static addresses, the router advertises the prefix and the client is responsible for picking the actual address (using the interface MAC address and/or the random procedures). MAC address based SLAAC addresses are fairly static, but they will change if your interface MAC address changes or if there is another device with the same IPv6 address in the network for example. They are also very hard to type, so I'd advise against relying on it.
You don't need static mapping for all DHCPv6 clients, only the ones you want to keep static (same as a DHCPv4 reservation). If the router doesn't have a reservation for the client DUID, it will assign an address from the range you set on the DHCPv6 server.
Once you have your static allocation from 2D, you can set your router IPv6 address to static on the LAN interface, and use static IP addresses on the clients too, where it makes sense.

Say you received this prefix from 2D: 2001:db8:abcd:ef00::/56, you can use any /64s between 2001:db8:abcd:ef00::/64 and 2001:db8:abcd:efff::/64.

So your router LAN address can be, for example 2001:db8:abcd:ef01::ffff/64, your DHCPv6 range can be 2001:db8:abcd:ef01::1000/64 to 2001:db8:abcd:ef01::1fff/64 and your servers could use 2001:db8:abcd:ef01::1/64, 2001:db8:abcd:ef01::2/64, 2001:db8:abcd:ef01::3/64, ...

Easy to manage and easier to type... 😄 Just make sure you take notes of which addresses you are already using to avoid conflicts.