Netgate SG-1000 microFirewall

Author Topic: Unique Local Addresses?  (Read 1950 times)

0 Members and 1 Guest are viewing this topic.

Offline JKnott

  • Hero Member
  • *****
  • Posts: 983
  • Karma: +36/-4
    • View Profile
Re: Unique Local Addresses?
« Reply #30 on: July 20, 2017, 10:17:46 am »
Did you use an alias to create that address on pfSense?  When I did that and rebooted, I lost my GUA on the LAN interface.  I had no problem setting RA to provide the ULA prefix.

Quote
I then gave my PC a ipv6 ula address of  fd31:8d49:5cc9:5133::100

I didn't have to do that.  With RA configured for the ULA, all my devices got an address automagically.

Offline johnpoz

  • Hero Member
  • *****
  • Posts: 14462
  • Karma: +1339/-200
  • Not a pfSense employee, they cannot fire me...
    • View Profile
Re: Unique Local Addresses?
« Reply #31 on: July 20, 2017, 01:31:12 pm »
That is fine I did not go that route for a simple test, this is not something I would setup on my network.  I just use my global IPs I get from HE that fall under my /48

Its quite possible you have problems with creating an alias if your using tracking for your IPv6 on your lan side interfaces and your prefix changes from your ISP.  Wouldn't a simple solution to just be create an alias for your ULA only.  Then just create multiple rules 1 for your global that you get from tracking "lan net" "optX net" etc.. and your alias with your ULA network(s) in them.

The scenarios where you want want the same rules for your global and your ula would be rare that you would want them in the same alias isn't it?  Why not just use ANY on your lan side for your source if that is the case that you just want to allow IPv6..

Other than play/learning - what exactly are you looking to accomplish?
- An intelligent man is sometimes forced to be drunk to spend time with his fools.
- Please don't PM me for personal help
- if you want to say thanks applaud or https://www.freebsdfoundation.org/donate/
1x SG-2440 2.3.4_p1 (work)
1x SG-4860 2.4.2-RELEASE-p1 (home)

Offline JKnott

  • Hero Member
  • *****
  • Posts: 983
  • Karma: +36/-4
    • View Profile
Re: Unique Local Addresses?
« Reply #32 on: July 20, 2017, 03:05:17 pm »
Regardless of rules etc., it shouldn't be difficult/impossible to set up an alias, along with RA for the ULA prefix.  Also, setting up an alias shouldn't kill the GUA on the LAN interface.  As I mentioned, RA works fine for ULA, but an address is not assigned to the LAN interface and creating an alias kills the router for IPv6.  A business user may have reasons for routing ULA between sites via VPN.  PfSense won't allow that, as far as I can see.

Offline johnpoz

  • Hero Member
  • *****
  • Posts: 14462
  • Karma: +1339/-200
  • Not a pfSense employee, they cannot fire me...
    • View Profile
Re: Unique Local Addresses?
« Reply #33 on: July 20, 2017, 03:48:53 pm »
"A business user may have reasons for routing ULA between sites via VPN.  PfSense won't allow that, as far as I can see."

Why is that.. I just created a gateway to my ULA box the 5133::100 address, I then created a route saying hey if you want to go to 5134::/64 talk to the gateway... I then did a sniff and pinged from pfsense to a 5134::100 address and it sent the traffic from its vip 5133::1 address to 5134:100 to the mac of my 5133:100 box..  So sure looks like that is routing to me.

If it was via a vpn connection, then would have its own vpn interface, etc. any could for sure create routes that go down that tunnel to get to a ULA range.

So I am still confused as to what is not working, or then trying to create some alias that has both your Global address that you got via a TRACK interface network?  And this is changing on you??  Are you saying you can not create a alias with your IPv6 global address and your ULA..

Sorry not seeing what your issue is.
« Last Edit: July 20, 2017, 03:52:26 pm by johnpoz »
- An intelligent man is sometimes forced to be drunk to spend time with his fools.
- Please don't PM me for personal help
- if you want to say thanks applaud or https://www.freebsdfoundation.org/donate/
1x SG-2440 2.3.4_p1 (work)
1x SG-4860 2.4.2-RELEASE-p1 (home)

Offline awebster

  • Sr. Member
  • ****
  • Posts: 356
  • Karma: +54/-0
    • View Profile
Re: Unique Local Addresses?
« Reply #34 on: July 20, 2017, 04:10:47 pm »
Quote
So I am still confused as to what is not working
Have a look at https://redmine.pfsense.org/issues/5999, that is just the tip of the iceberg.
But more specifically having a virtual IP set on an interface that is also tracking the WAN.  Similarly if an interface is a DHCP client and also needs a VIP we get into the same situation.

Basically, as has been discussed before, IPv6 is fundamentally different than IPv4 in some of the basic principles, starting with the fact that an interface can and does have more than one IP address, this is defined in the RFCs.   It can have a mixture of any number of ULAs, GUAs and a link-local addresses. Consequently, the software needs to be aware of this and make intelligent choices, or allow the user to dictate, based on this fact.
Many of the functionalities in pfSense, and quite possibly the underlying FreeBSD OS, are just "enhanced" versions of their IPv4 counterpart and haven't necessarily taken this requirement to heart.   As the redmine ticket indicates, there is much work to be done to bring the code base up-to full to par so that expected IPv6 behavior works.


I'm thinking that a work-around in JKnott's case might be to assign the ULA range to a separate interface and plug it into the same L2 as the LAN interface. 
--A.

Offline JKnott

  • Hero Member
  • *****
  • Posts: 983
  • Karma: +36/-4
    • View Profile
Re: Unique Local Addresses?
« Reply #35 on: July 20, 2017, 04:13:14 pm »
Quote
So I am still confused as to what is not working, or then trying to create some alias that has both your Global address that you got via a TRACK interface network?  And this is changing on you??  Are you saying you can not create a alias with your IPv6 global address and your ULA..

Once again.  I can set up ULA with RA, no problem, but the pfSense LAN interface doesn't get an IPv6 address.  When I create an alias on the pfSense LAN port, for the ULA, I cannot even ping it.  It simply doesn't respond.  Worse, when I reboot the firewall, I lose the GUA address on the WAN port.  Up the thread, someone else posted some links that showed problems with alias addresses on pfSense.

So, what I'm trying to do is
a) create the ULA with RA - this works
b) get a working ULA address on the LAN interface.  This doesn't work.

Can you ping from a device on a ULA only to the firewall?  And to the VPN?

I spent all yesterday afternoon, trying to just be able to ping a ULA address on the pfSense LAN interface, without success.  This is decribed further up the list.

However, I'll try again and see what happens.

Offline JKnott

  • Hero Member
  • *****
  • Posts: 983
  • Karma: +36/-4
    • View Profile
Re: Unique Local Addresses?
« Reply #36 on: July 20, 2017, 04:33:12 pm »
I just tried it and the same thing happens.  I cannot even ping the firewall ULA and after rebooting it, I lose IPv6 to my network.  PfSense is busted!!!

Offline JKnott

  • Hero Member
  • *****
  • Posts: 983
  • Karma: +36/-4
    • View Profile
Re: Unique Local Addresses?
« Reply #37 on: July 21, 2017, 02:26:12 pm »
One thing I just thought of.  It may not be necessary for pfSense to have a ULA to route from the ULA prefix.  Routing is still done via the link local address.  I'll have to see if I can figure out some way to test this.  I may have to dust off my Cisco 2600 router.

Offline johnpoz

  • Hero Member
  • *****
  • Posts: 14462
  • Karma: +1339/-200
  • Not a pfSense employee, they cannot fire me...
    • View Profile
Re: Unique Local Addresses?
« Reply #38 on: July 22, 2017, 06:13:52 am »
" just tried it and the same thing happens.  I cannot even ping the firewall ULA and after rebooting it, I lose IPv6 to my network.  PfSense is busted!!!"

Maybe your pfsense is busted.. But this is not the case with mine.. Add ULA address as VIP.. Works as it should - can ping it to that address (if firewall rules allow it) and routes just fine..

What your saying makes ZERO sense - how would adding a vip cause such an issue??  Be it a ula or another global, etc..
- An intelligent man is sometimes forced to be drunk to spend time with his fools.
- Please don't PM me for personal help
- if you want to say thanks applaud or https://www.freebsdfoundation.org/donate/
1x SG-2440 2.3.4_p1 (work)
1x SG-4860 2.4.2-RELEASE-p1 (home)

Offline JKnott

  • Hero Member
  • *****
  • Posts: 983
  • Karma: +36/-4
    • View Profile
Re: Unique Local Addresses?
« Reply #39 on: July 22, 2017, 11:07:52 am »
I don't know why it's happening, but it happened twice.  Also, as mentioned in other posts, there apparently is a problem.  And I created the alias by clicking on Firewall > Virtual IPs.

Offline johnpoz

  • Hero Member
  • *****
  • Posts: 14462
  • Karma: +1339/-200
  • Not a pfSense employee, they cannot fire me...
    • View Profile
Re: Unique Local Addresses?
« Reply #40 on: July 22, 2017, 11:31:17 am »
And what did you pick for the type of VIP?
- An intelligent man is sometimes forced to be drunk to spend time with his fools.
- Please don't PM me for personal help
- if you want to say thanks applaud or https://www.freebsdfoundation.org/donate/
1x SG-2440 2.3.4_p1 (work)
1x SG-4860 2.4.2-RELEASE-p1 (home)

Offline JKnott

  • Hero Member
  • *****
  • Posts: 983
  • Karma: +36/-4
    • View Profile
Re: Unique Local Addresses?
« Reply #41 on: July 22, 2017, 12:36:41 pm »
And what did you pick for the type of VIP?

IP Alias

Offline JKnott

  • Hero Member
  • *****
  • Posts: 983
  • Karma: +36/-4
    • View Profile
Re: Unique Local Addresses?
« Reply #42 on: October 12, 2017, 12:28:08 pm »
With pfSense 2.4.0, I can now add a ULA alias on my LAN interface, without losing Internet access.  It appears there was a problem with the previous version.

Offline JKnott

  • Hero Member
  • *****
  • Posts: 983
  • Karma: +36/-4
    • View Profile
Re: Unique Local Addresses?
« Reply #43 on: October 12, 2017, 03:32:00 pm »
^^^^
Looks like I spoke too soon.  As before, after a reboot, the problem returns.  However, one thing I noticed is the default route on my computer changes, from the main LAN to a VLAN interface on my pfSense router.  I'm not sure what causes this, as the VLAN has a different prefix from the ULA on the main LAN.

Why would the default route change?  I checked the router.priority for each RA and the VLAN is set to low and main LAN set to normal.

Offline JKnott

  • Hero Member
  • *****
  • Posts: 983
  • Karma: +36/-4
    • View Profile
Re: Unique Local Addresses?
« Reply #44 on: October 12, 2017, 04:16:43 pm »
It's currently working, with the ULA alias.  I have no idea why it's working now and not before.

I set the mail RA priority to high, but IP -6 route show shows both the main LAN and VLAN to have medium preference:

default via fe80::1:1 dev eth0  proto ra  metric 1024  expires 58sec hoplimit 64 pref medium
default via fe80::216:17ff:fea7:f2d3 dev vlan3  proto ra  metric 1024  expires 51sec hoplimit 64 pref medium

Shouldn't that reflect the router priority setting, which is high for main LAN and low for VLAN3?

My computer is running OpenSUSE Linux.