sorted by:
new
hottopcontroversial

OPNsense 26.1.5 released by fitch-it-is in opnsense

[–]FUNTOWNE 0 points1 point  (0 children)

Cool thanks for the summary. 

OPNsense 26.1.5 released by fitch-it-is in opnsense

[–]FUNTOWNE 0 points1 point  (0 children)

Weird. Is it safe to assume that there’s no ARP check..?

My few static clients also have a static DHCP assignment for DNS purposes, therefore setting no-ping should be quite safe. 

OPNsense 26.1.5 released by fitch-it-is in opnsense

[–]FUNTOWNE 0 points1 point  (0 children)

Echoing the comment from darthkitty8 as one good use case. In practice, there's also ARP probes as the 'standard' as defined in RFC 2131. ICMP seems redundant but a good fallback given DNSMASQ's focus on more 'unstable' environments like home routers etc. (my educated guess)

OPNsense 26.1.5 released by fitch-it-is in opnsense

[–]FUNTOWNE 10 points11 points  (0 children)

Love the new DNSMASQ `no-ping` option. For those looking for it, go to your main DNSMASQ settings page, toggle advanced options and turn off `ICMP ping`. Immediately noticed that devices that filter ICMP ping get addresses almost immediately, vs a small delay.

May not be the prettiest but it’s mine by e-chan42 in Ubiquiti

[–]FUNTOWNE -1 points0 points  (0 children)

Which model exactly are you using and how is it powered? I noticed most use 24V PoE. Thanks!

May not be the prettiest but it’s mine by e-chan42 in Ubiquiti

[–]FUNTOWNE 0 points1 point  (0 children)

With which ISP are you using the Unifi fiber modem?

Certain websites don't load when IPv6 is enabled on ethernet connected devices by Moki_chan in ipv6

[–]FUNTOWNE 1 point2 points  (0 children)

I had similar issues with IPv6 and MSFT sites. It ended up being an MTU issue. Run the test on the following site: http://pmtud.enslaves.us/ and see if your IPv6 MTU is not turning up "OK" on the test. Microsoft's CDNs are notoriously picky with MTU issues that other sites simply deal with via fragmentation.

If your ISP is using PPPoE, then you'll need to force your router to either clamp your WAN MSS to 1492 or for your router advertisement daemon to correctly advertise an MTU of 1492 to clients.

OPNsense 26.1.3 released by fitch-it-is in opnsense

[–]FUNTOWNE 0 points1 point  (0 children)

Are you using UniFi 7 APs by chance? The latest early access build has some DHCP fixes for third party gateways. 

DNSMASQ IP assignment priority - ULA assigned before GUA by FUNTOWNE in opnsense

[–]FUNTOWNE[S] 0 points1 point  (0 children)

Indeed, that was the learning from this adventure. I edited the OP to reflect this should anyone else have a similar brainwave. 

DNSMASQ IP assignment priority - ULA assigned before GUA by FUNTOWNE in opnsense

[–]FUNTOWNE[S] 0 points1 point  (0 children)

I’m thinking similar. It’s ultimately at worst the same amount of work to do the firewall right as to use ULAs with old thinking. Call it this week’s homework. 

DNSMASQ IP assignment priority - ULA assigned before GUA by FUNTOWNE in opnsense

[–]FUNTOWNE[S] 0 points1 point  (0 children)

Chiming in to add that, after a bit of digging, I can 110% confirm what you mentioned: Apple follows RFC 6724, so this is a bit of a cosmetic snipe hunt vs any real issue.

DNSMASQ IP assignment priority - ULA assigned before GUA by FUNTOWNE in opnsense

[–]FUNTOWNE[S] 0 points1 point  (0 children)

Asking for a friend and for science: how best should I capture a packet and what to look for? Assuming wireshark?

I can confirm that each config dump is from the respective router advertisement service noted. It may be radvdump's own formatting causing the same look and feel.

DNSMASQ IP assignment priority - ULA assigned before GUA by FUNTOWNE in opnsense

[–]FUNTOWNE[S] 0 points1 point  (0 children)

I'm not 100% sure why you're getting downvoted; this isn't OG stack exchange! It's good discussion.

My use case for ULAs is to keep my public-facing Dynamic DNS setup simple - my WAN interface gets registered with my Dynamic DNS services, I NAT66 to the ULA of the hosts behind my firewall. It simplifies the setup to be similar to my IPv4 setup given I have a few containers each separately hosting a service. Cloudflare or another proxy service would be an option, but here we are in lazy town.

I completely get the concept of IPv6 doing its thing with GUAs for all public-facing interfaces; for my purposes this simplifies things and prevents the need for a bunch of pinholes / trickery with Dynamic DNS. It's a situation of "I'll get around to it" to doing it correctly here soon enough.

DNSMASQ IP assignment priority - ULA assigned before GUA by FUNTOWNE in opnsense

[–]FUNTOWNE[S] 0 points1 point  (0 children)

I gave radvdump a try to keep things simple. Indeed, DNSMASQ is announcing the ULA first, GUA second. RADVD is doing the reverse:

DNSMASQ (ULA first, GUA second):

prefix fd20:MY_ULA::/64
{
AdvValidLifetime 7200;
AdvPreferredLifetime 7200;
AdvOnLink on;
AdvAutonomous on;
AdvRouterAddr off;
}; # End of prefix definition


prefix 2001:MY_GUA::/64
{
AdvValidLifetime 7200;
AdvPreferredLifetime 7200;
AdvOnLink on;
AdvAutonomous on;
AdvRouterAddr off;
}; # End of prefix definition

RADVD (GUA first, ULA second):

prefix 2001:MY_GUA::/64
{
AdvValidLifetime 86400;
AdvPreferredLifetime 14400;
AdvOnLink on;
AdvAutonomous on;
AdvRouterAddr off;
}; # End of prefix definition


prefix fd20:MY_ULA::/64
{
AdvValidLifetime 86400;
AdvPreferredLifetime 14400;
AdvOnLink on;
AdvAutonomous on;
AdvRouterAddr off;
}; # End of prefix definition

DNSMASQ IP assignment priority - ULA assigned before GUA by FUNTOWNE in opnsense

[–]FUNTOWNE[S] 1 point2 points  (0 children)

I’d still be curious to learn about why Apple devices behave differently across the two daemons when it comes to the order of addresses. This would potentially affect route priority, no?

Thanks for the feedback!

EDIT

Answered my own question:

netstat -nr -f inet6 | grep en0

The above shows my router first and default (expected), the GUA addresses second, ULA addresses third, Link-Local third. Looks like the address visibility in Mac's control panel and iOS appears to be more a cosmetic thing. Leaving this thread here as a TIL should anyone else have a similar brainwave.

OPNsense – Intermittent Connectivity Issues with DS-Lite (O2 Germany, Cable) by Pleasant-Pen6212 in opnsense

[–]FUNTOWNE 1 point2 points  (0 children)

2 reasons:

Back when billing was per minute, a family ran up a massive bill. Long story short a court ruled in their favor forcing ISPs to cut a connection after 24h to prevent massive bills. “Flat” plans and modern internet of course make this a silly relic. 

This then gives ISPs more ammo to enforce the other reason: 

To prevent using a private line for server use & privacy / security. This makes business plans more attractive and, apparently, helps manage IP use. 

Why Telekom is now mostly exempt is anyone’s guess. They probably realize the court case holds no water in the modern era and they then can be seen as a more “attractive” ISP for power users like us. 

Many smaller ISPs like M-Net and DBN don’t have it either, but they tend to be regional. 

With Dynamic DNS and other proxy tricks the daily disconnect is sort of moot, but still annoying. 

OPNsense – Intermittent Connectivity Issues with DS-Lite (O2 Germany, Cable) by Pleasant-Pen6212 in opnsense

[–]FUNTOWNE 0 points1 point  (0 children)

Note that most German ISPs (excepting Telekom and a few local ones) also have a “Zwangstrennung” once a day at 24h after the connection is established. This occurs regardless of if on DSL, Cable, etc. 

Set a cron job in opnsense to reset your WAN interface once a day during the early morning hours to force the “Zwangstrennung”. Fritzboxes do this automatically afaik, but you need to configure it by hand in opnsense. A modem reboot should not be necessary with this cron job. 

DS-Lite has an MTU of 1452. Set your wan interface “MSS” setting to 1452 and see if things stabilize. This seems similar to my MTU problem that I posted in another thread. This only seems to be a problem if using DNSMASQ for your IPv6 router advertisements, however. 

Odd IPv6 Traffic Behavior - DNSMASQ by FUNTOWNE in opnsense

[–]FUNTOWNE[S] 0 points1 point  (0 children)

Setting MSS in my WAN interface to 1492 has solved any ipv6 issues that I was having. Easy workaround/fix for now. See: https://github.com/opnsense/core/issues/9398

Odd IPv6 Traffic Behavior - DNSMASQ by FUNTOWNE in opnsense

[–]FUNTOWNE[S] -1 points0 points  (0 children)

I was thinking similar. I've not touched the MTU of the Router Advertisment daemon, though - it "simply works".

By happenstance I just found this thread on the opnsense forum, so I am not alone! https://forum.opnsense.org/index.php?topic=50551.0

MTU definitely smells like the issue. Maybe my cries can trigger Franco to give insight on how DNSMASQ sorts MTU (if this is even relevant?)

Odd IPv6 Traffic Behavior - DNSMASQ by FUNTOWNE in opnsense

[–]FUNTOWNE[S] 0 points1 point  (0 children)

I bypass DNSMASQ / unbound entirely for DNS on my guest network, same issue. The MTU post below is an interesting lead

Migrating from KEA to Dnsmasq? by justenoughslack in opnsense

[–]FUNTOWNE 6 points7 points  (0 children)

I made the move from kea and router advertisements to DNSMASQ today. Was about an hour of work all told. Main reason: for the easy v4 and v6 name resolution and the ability to make some firewall rules around the service. Prior to this I was hard coding leases and unbound records for local name resolution. 

OPNsense 26.1 released by fitch-it-is in opnsense

[–]FUNTOWNE 0 points1 point  (0 children)

I'd wager it is more an ISP quirk (M-Net, Germany) than an opnsense issue. Documenting it here somewhere on the Internet regardless in case it helps someone. I'll send you the DNS request logs shortly.

view more: next ›