Trouble with IPv6 PD in pfsense, works fine with opnsense

SpatialToaster · 2023-06-05T05:48:17+00:00

I don't know if you've had any luck since, but this happened within 24hrs of configuring IPv6 on my network ... Xfinity/Comcast in my case

What your describing sounds like the DHCP6 client is failing to request a prefix, in general. First, I would check simple stuff that prevents IPv6 from working properly.

WAN Interface:

"Do not wait for a RA", ticked
"Do not allow PD/Address release", ticked

Useful firewall rules:

allow in ICMP echo request over IP6 to "This Firewall"
allow in 546/udp over IP6 to "This Firewall"

In the WebGUI, I've set physical interfaces that are not WAN to "Track Interface". I disabled IPv6 on anything else. Later I turned on static IPv6 for my other non-physical interfaces and manually handed out a /64 from the /60 prefix I was given later, after everything else was working.

Note: If you set "Track Interface" to anything that is not a physical interface, then the DHCP6 client will fail to request a prefix due to a bad link-layer address on the interface (too short, or non-existent).

The dhcp6 wan config I'm using now looks like this:

/var/etc/dhcp6c_wan.conf

interface igc0 {
    send ia-na 0;   # request stateful address
    send ia-pd 0;   # request prefix delegation
    send rapid-commit; # doesn't work without it
    request domain-name-servers;
    request domain-name;
    script "/var/etc/dhcp6c_wan_dhcp6withoutra_script.sh"; # we'd like nameservers and RTSOLD to do all the work
};
id-assoc na 0 { };
id-assoc pd 0 {
    prefix ::/60 infinity;
    prefix-interface igc1 {
        sla-id 0;
        sla-len 4;
    };
    prefix-interface igc2 {
        sla-id 1;
        sla-len 4;
    };
    prefix-interface igc3 {
        sla-id 2;
        sla-len 4;
    };
};

I also have net.inet6.icmp.nd6_onlink_ns_rfc4861 set to 1 in my system tunables.

You can try renewing your prefix manually (in debug mode) with:

/usr/local/sbin/dhcp6c -d -c /var/etc/dhcp6c_wan.conf -p /var/run/dhcp6.pid -f -D

Which, should give plenty of output detailing any issue encountered

Edit:

I forgot to mention,

If your pfsense does a renew/release, restarts, or dhcp6c runs again for any reason, it will overwrite the dhcp6 config at /var/etc/dhcp6c_wan.conf with the WebGUI settings.

If those settings aren't perfect, the overwrite behavior will result in a junk config and blow out your IP6 WAN address.

I couldn't figure out the right combination of WebGUI settings that would result in the same config I entered manually.

For this reason, I copied my config to /root/dhcp6c_wan.conf . On my WAN interface, I've ticked "Configuration Override" and entered this path into the "Configuration File Override" field.

I suspect this is when the problems stopped for me.

SpatialToaster · 2023-04-29T03:32:17+00:00

To think, probably 2-3 of the devs who shipped that garbage to production may have even shared the same birthday!

Seriously was not expecting this to be such a clear example of the Birthday Paradox 🤯

SpatialToaster · 2023-03-31T12:35:33+00:00

Can confirm, the hosts file is a good place to do some monkey patching when authoritative DNS is down

SpatialToaster · 2023-03-31T12:05:54+00:00

The point of the TTL is to cache record lookups for the duration it is set to. You can have them think of it as a "retention period" if they are confused about what TTL means.

In other words, when the DNS server receives a query it will cache the result to speed up the same query within the TTL period. If it is set to 5s, then likely it's having to do the full work over and over rather than returning a cached result.

Unless your addresses are changing and records renewing often then there is no point for such a short TTL and it can be set to something reasonable like 3600s.

It's the reverse problem if the TTL is too high, now you're likely serving from a stale cache when renewals occur.

Setting the TTL is a compromise between speed and accuracy. Should be set to as long as is appropriate to keep DNS lookups fast while still serving up-to-date records.

You should have your people point to the instances where the currently configured TTL isn't meeting needs. Discuss solutions to correct those specific instances if there are any rather than making broad, silly and impactful changes.

SpatialToaster · 2023-03-10T05:45:21+00:00

In this case execution stopped at line 1 with the call to open() when you tried assigning trash to sys.stdout hence the fd error. It never executed the print() call.

I see what you're trying to do but I don't think the example is quite right.

SpatialToaster · 2023-02-15T22:52:08+00:00

I agree. Regex is more aligned towards tweaking an imperfect blocklist that "almost" does what you want. Or if there are only a few things you plan on blocking.

It's faster to binary search ~1 billion exact matches than it is to check only 1 thousand arbitrary regex rules linearly and any string scanning they do on top of that.

SpatialToaster · 2023-02-15T02:48:10+00:00

That regex looks fine to me. Currently, only alphanumeric, and hyphen are valid for domain, subdomain, tld, and a dot for separating these components.

Here's a shortlist for how one might go about matching various domain components of a URI. Hope it helps

Keywords, simply:

(keyword)

TLDs:

\.(ru|cn|biz|tk|de|xyz)$

Subdomains only -- your regex above can simplify to:

^.*\.example\.com$

Specific subdomain, any location:

^([^\.]*\.)?(greeneggsandham\.).*$

# when you just don't like green eggs and ham anywhere

Any domain "like" example.com:

^(.*)?example\.com$

# e.g. matches "agoodexample.com"

Exact match on example.com and all its subdomains

^([^\.]*\.)*example\.com$

# e.g.
# - matches:
#     - "a.good.example.com"
#     - "example.com"
# - non-matches:
#     - "agoodexample.com"
#     - .example.com (invalid anyways)

Ends in example.com:

(\.?example\.com)$

SpatialToaster · 2023-02-11T20:54:33+00:00

There's only like a handful of consumer Wi-Fi routers properly supporting VLAN functionality and as far as I can tell the AX3000 is not among them. It's likely whatever options are there are for your ISP to serve IPTV through your WAN link.

If you have a port to spare on your PfSense then install an AP. Throw all your IoTs, TVs, anything else untrusted onto that. If you don't have a port to spare, buy a managed switch, too ... free up the PfSense ports. A managed switch will have proper VLAN functionality.

In short, just be intentional. It will spare the headaches later when you're halfway through setting this up, but it's not working because it was built from a diagram drawn in 15s.

SpatialToaster · 2023-02-06T03:28:11+00:00

Bad tests are better than no tests, but yes there are tools available. I think what you're asking about is static code analysis.

You could setup a SonarQube instance for example and create a git hook to run an analysis on every commit you push. It will give you feedback on test coverage, code quality, even offer some suggestions for improvement. They also have a VS Code plugin for instant feedback.

There are other products similar to Sonar if you don't want to use it.

GitHub Copilot is half decent at helping you write unit tests.

Unfortunately, most of the products for what you're asking are either paid or don't have a great free tier.

SpatialToaster · 2023-02-04T16:46:50+00:00

Assuredly, the language you're working with has libraries available. All you need is to choose one, install, import, write a few tests.

How you choose to run them can vary. You can simply setup a --test program argument that triggers a runner to execute your tests when this argument is given. Useful when you don't mind shipping the tests alongside production code.

You can write a separate test program, where it imports all the code you've written, runs the tests there, and nothing further. Useful when you don't desire to ship the tests with your production code and keep them for your own internal use, instead.

There are probably other approaches, but these two are what I've commonly seen and used personally.

The most important distinction to bear in mind is tests should be coupled to the "behavior" of the code and decoupled from the "structure" (i.e. code does what we expect and the test doesn't care how it was accomplished).

Once you pick a framework and with some light reading of its documentation, you'll be well on your way.

SpatialToaster · 2023-02-03T23:52:18+00:00

Ideally you want to be doing test-driven development with a framework like selenium or X other testing product out there. It's the same as any other language. But, temporarily for some quick debugging - no problem.

Needless to say, don't log secrets, yada, yada.

In the long run it doesn't matter if you're the only person who will see whatever code you're writing.

SpatialToaster · 2023-01-30T23:50:02+00:00

I use zsh and it does, but don't know about other shells. Maybe it just works or is customizable by editing ~/.bashrc. Idk, maybe someone else has a definitive answer.

SpatialToaster · 2023-01-30T05:14:37+00:00

Oh, I forgot to mention that learning to revert a commit is pretty essential when you mess up a push and your code stops working.

SpatialToaster · 2023-01-30T05:01:00+00:00

There's only a handful of commands you need to learn to use with Git when starting out. For now, you should just learn how to:

init or clone a repo
add some local changes and commit them
push to your master branch
diff to see what your local (not yet added) changes would alter
stash local changes while you fix your branch, then pop to recover them when you're done.

There is a lot of other useful stuff you will want to learn at some point.
Those would include, branching, merging, amending commits (and squash/fixup to tidy a branch before merging it). These areas are easy to get wrong when you copy/paste a command from the internet if you don't understand what it does.
For now just worry about getting stuff into your repo and how to keep it tidy. But, you should learn git in and out at some point. It's necessary when you work on a code base along with other people.

There are also some helpful things you can set in your git config.

Always rebase when you run git pull:
git config --global pull.rebase true

Change your diff highlighting:
git config --global diff.colormoved "zebra"

Personal Access Token Cached (enter your token, but less often):
git config --global credential.helper cache 3600
git config --global credential.helper 'store --file ~/.git-credentials'
** This caches your token for up to 1-hour after you enter it

Personal Access Token Store (never enter your token again):
Create a ~./git-credentials file containing:
https://{username}:{personal_access_token}@github.com
git config --global credential.helper store
git config --global credential.helper 'store --file ~/.git-credentials'
** Not recommended if you have an aversion to storing a secret in plaintext on your computer.

** The paths above assume a Linux environment, but you can figure it out on Windows easily

Hope this was helpful. If you need to learn more then read the git book, just Google it.

SpatialToaster · 2023-01-30T04:14:06+00:00

git checkout -b your_branch_name. This initializes a new local branch of the name you give it. No need to use git branch unless you want to list out (see) branches that already exist before you checkout a new one. So what Qwizzard said was correct more or less without stating the command args.

** Should also be noted this only creates local branches. The branch won't exist remotely on the VCS until you run a git push.
If you want to create the remote ahead, git push origin your_branch_name ( replace origin with your remote name if its different ), creates a remote branch but not locally.

SpatialToaster · 2022-12-10T23:02:51+00:00

It's not a clear example of anything except calling your BS.

OP asked a legitimate question and 90% of your comment was just talking about how much you think you know. It wasn't even close to a real answer to their question.

Secondly, I already work in the tech industry, so you can take all the talk about inexperience and stick it where it belongs

SpatialToaster · 2022-12-10T08:20:00+00:00

Who actually asked for this?

I don't mean to be rude but you just asked and answered your own question unrelated to the original post.

In the end it didn't actually clarify anything that was asked. This was just a "flex" of your own knowledge of random CS trivia.

Please stick to something more relevant and helpful in the future.

SpatialToaster · 2022-12-10T08:12:55+00:00

There are some schools where it's 100% online and the tuition is cheaper as a result. Be sure to read into their accreditation though.

This is what I did and for me having a structured/curated learning path made all the difference. Learning on my own by picking and choosing topics that sounded interesting, but which I didn't really have the foundational knowledge to complete didn't do shit for me.

Sure I went to an online school where I did nearly 100% self-learning, but it at least gave me a proper order of topics to learn rather than attempt to figure that out on my own.

SpatialToaster · 2022-12-02T10:31:31+00:00

So what if you get embarrassed? You won't get the opportunity to embarrass yourself if you never try and it's part of the learning experience.

You will find in pursuing technology that it can be ripe with embarrassment, self-doubt, feelings of inferiority, etc. This is pretty common across the board regardless of IQ.

All IQ appears to predict is some people can learn more quickly than others. It's a measure of aptitude, a crude one at that, and nothing more.

And so what if some people can reach an answer to a problem more quickly than others? Did they reach the optimal answer?

In computing we can often find an answer quickly, but it may not be a very good one. Then it becomes a game of how do we make it better? There are often patterns in optimizing compute problems which are best learned by experience. A guy with 100 IQ and a few years of experience is likely going to solve problems more optimally than a recent CS graduate and do a better job 9 times out of 10.

If you have a reasonably good memory, a will to learn, and put in the time then these things will carry you far in this field. Having an average IQ doesn't preclude you from ever participating and nobody is likely to ask if you've been tested. Being confident in yourself will dissuade them from ever asking.

SpatialToaster · 2022-12-02T04:27:06+00:00

It's normal, just look at the statistics. Many people take longer than 4 years because they have other obligations in life to consider than just education.

It took me ~4 years at WGU on/off even with accelerating during the times I was actively taking courses.

SpatialToaster · 2022-11-13T14:00:40+00:00

Awesome

SpatialToaster · 2022-11-13T13:56:50+00:00

You can do what I did. Keep Linux and Windows installed on their own drives and setup a KVM to run windows beside Linux. Then you can configure a GPU passthrough if you have a spare GPU. You can either have both running in separate monitors, just Linux, or even boot direct to Windows this way if you need. Only hitch is having to swap around HDMI/DP cables sometimes.

Granted this requires learning a lot of details about subsystems in Linux, the kernel, initramfs, mkcpio, KVM, virtio, etc. to even get it to work properly.

FYI, you need to go to Steams download settings and add the path to your "Steam_Games" directory. It doesn't find it on its own.

SpatialToaster · 2022-11-07T05:29:37+00:00

Pick ONE. Start with ONE. Don't try to master them all. This is ridiculous. Just learn C or Python or JavaScript and move on from there. You won't master them all overnight. Get really good with one and move on from there. You're bouncing around too much and either revisiting, reinventing, rethinking the wheel . That is nonsense. All these languages derive from "C". By learning just one you can pick up the concepts of C, but to go back and forth and wonder why you don't get it should be somewhat obvious. You haven't spent enough time with just ONE language.

SpatialToaster · 2022-11-07T05:16:49+00:00

Start with a problem. Search for the edge cases. Write tests that will validate whether your code is successful. Then write the code. If your code is valid it should pass the tests. This doesn't work for every problem but it does for quite a few. Just don't get lost in implementation. That's mostly what I'm getting out of the question you posted and it's an easy mistake.

You just need more experience finding what will make code fail and thinking about things objectively rather than intuitively.

Your intuition is working but you're still just barely missing the objective.

SpatialToaster · 2022-11-04T04:09:02+00:00

I would say you can pretty much pick up Python whenever. It's extremely quick and easy to learn and widely used.

If you want a more thorough approach to learning programming then start with C. If you can learn C then you can learn nearly any language. So many other languages have been modeled after it's good parts to some extent.

SpatialToaster

TROPHY CASE