Thread Info
  • State Verified Answer
  • +1 person also asked this people also asked this
  • Replies 128 replies
  • Answers 2 answers
  • Subscribers 10 subscribers
  • Views 296290 views
  • Users 0 members are here
Options
Suggested

Open IPv6 Issues / questions

Ben

- will the fix for issue NUTM-7187 be included with 9.5?

- is there a fix in the works for IPv6 Connections where the WAN Port is supposed to use an address out of the delegated prefix? Currently users of such ISPs do not get any IPv6 address. (for esxample KPN netherlands)

- what about the ability to change/edit the UID for IPv6 Delegation Requests?

- what about long standing feature requests such as 6tunnel integration, lets encrypt - is that on the roadmap? Users, myself included had high hopes for 9.5 but this seems to be more than a maintance release.

 

thank you in advance.

Parents
  • +1

    Hi Ben, please see my answers inline below:

    Ben said:

    - will the fix for issue NUTM-7187 be included with 9.5?

     [BL]: The fix for NUTM-7187 is not included in this current UTM 9.5 beta version. We are actively working on the fix right now though, so as soon as we have a confirmed fix it will be included in a subsequent release.

    - is there a fix in the works for IPv6 Connections where the WAN Port is supposed to use an address out of the delegated prefix? Currently users of such ISPs do not get any IPv6 address. (for esxample KPN netherlands)

    [BL]: This should be supported today, unless the ISP is doing both stateless & stateful. Is that the case for you? If so, we are fixing that as part of NUTM-7187 as well.

    - what about the ability to change/edit the UID for IPv6 Delegation Requests?

    [BL]: Unfortunately this isn't part of this 9.5 release.

    - what about long standing feature requests such as 6tunnel integration, lets encrypt - is that on the roadmap? Users, myself included had high hopes for 9.5 but this seems to be more than a maintance release.

    [BL]: Lets Encrypt is on our current roadmap, but it's mainly planned as a WAF feature. As for 6tunnel integration, it's currently not planned for any specific release.

     

    thank you in advance.

     

  • 0 in reply to bobbylam

    Hi Bobby,

    Normally the ISPs router will then request /48 prefix and use a /64 from that prefix for the wan interface and a /64for the lan interface. So there are no other global ipv6 addresses than the ones from that /48.

    On the Sophos UTM, in my case I will only receive a link local IPv6 address via PPPoE. Using a tcpdump I have verified the UTM is not sending out a prefix request after the PPPoE has been established. Is it waiting for a advertised IPv6 address for the WAN interface first before it will do this? Because in this case it will never get it... And thus a IPv6 prefix will never be requested.

    If you want to have a look at my Sophos VM, or need some tcpdumps of the PPPoE setup let me know!

    Rene

  • 0 in reply to bobbylam

    Hi Bobby,

    my problem is completly solved, thank you again for the swift responses of you and your team :) 

    there are some improvement that could be made to ipv6, lots of great suggestions on the feature request section, as i do not know how much effort you can currently put in please allow me to just name a few

    - Sophos RED Server IPv6 to IPv6

    - "6tunnel" integration to translate incoming WAN IPv6 to IPv4 internally (For the WAF for example)

    - NatPDv6 (translate IPv6 subnets to internal IPv6 subnets via NAT)

    - adjust the licence count on IPv6 Adresses. Most OSs pull more than one single IPv6 and use up the 50 IPs addresses really fast, it makes it REALLY hard to test IPv6 or use on a day to day basis without having licence alerts all the time ;)

     

    final big question: will the XG gain from all these improvements also? Last time i tried iPv6 was completly broken on the XG in this scenario.

    ---

    Sophos UTM 9.3 Certified Engineer

  • 0 in reply to SanderRutten

    I think the last line in your route table shows your default route:

    default via fe80::2a0:a50f:fc78:5530 dev ppp0 proto ra metric 1024 expires 1559sec hoplimit 64

    So it seems it should be working for you.

  • 0 in reply to rklomp

    There is the magic word: Should :) It should indeed work. Except it isn't :( Or at least not always, it breaks very easily. 
    If I get it working again I will keep my hands of the settings for a while, and see if it keeps working. Or maybe it breaks anyway and has the reconnect/reboot no influence at all.

  • 0 in reply to SanderRutten

    @SanderRutten: Thanks so much for your help and log files. I am looking at it and will update ASAP. Thanks.

    @Ben: Thanks

  • 0 in reply to Duc Le

    Quick summary of findings in the SanderRutten latest logs:

     

    1) The default route over the ppp0/eth1 is there in the route table. So it is OK for now.

    My view: As IPv6 allows multiple default gateways. This is OK even though there is no RA.

    TBD: Keep an eye if the default route for ppp0 is missing. This is a no-no.

     

    2) Ping from 2001:981:9d6e:1::1 to 2a00:1450:400e:801::200e (I assumed this is the ping that you are concerned about):

    i) In the very first capture, packet# 304 failed to get ping-reply   // This is changed configuration

    ii) In the second capture (datestamp2), the packet#620 and packet #621 succeeds   // This is reboot

    iii) In the third capture. packet#189 failed to get a reply // After reconnect PPPoE

    My view: This looks quite strange since most of the stuff (system/UTM) looked OK

    To Do: See (3)

     

    3) Also, I saw in the log the following message (system log): dhclient6: send_packet6: Operation not permitted

    My view: more than likely it is iptables rule. This might impact the (2) above as well

    To Do: SanderRutten

    a) Please dump out the iptables when it is working and when it is not working and include them in this thread.

    Sorry that I forgot about the iptables stuff. I made the mistake of making the assumption that it is OK. I just want to make sure this time

    b) When ping fails, can you check the stattisctis of sending and receiving on the eth1 to see they are going up

     

    4) Rebind issue 

    My view: to be deal with once 2 is out of the way

     

    5) The ps look fines

     

    Thanks a lot SanderRutten for your help and sorry for my mistake of overlooking the iptables stuff.

    Also please let me know your ideas, comments or questions. Thanks again.

  • 0 in reply to Duc Le

    Hi Le,

    Attached are the iptables rules (iptables --list) 

    iptables_ipv6_disabled.txt - IPv6 completely disabled
    iptables_ipv6_enabled.txt - IPv6 enabled and configured. Not working.
    iptables_ipv6_reconnected.txt - Reconnected PPPoE, not working.
    iptables_ipv6_reboot.txt - The magic reboot got my IPv6 up and running again.

    Not much difference in each output.

    Just like before, if I now recoonect my PPPoE, or even reboot, it doesn't work anymore unless I disable IPv6 for a while and reconfigure everything, and reboot.

    dhclient6 the cause?
    One thing I just noticed in yesterdays ipv6.log:

    2017:04:22-08:42:56 router ipv6_watchdog[4280]: Started dhclient6 -P (pid 4858)
    And a few minutes later:
    2017:04:22-08:51:15 router ipv6_watchdog[4280]: dhclient6 (pid 4858) has died

    So this made me think.. Was my connection working during that time? Did I reconnect my PPPoE connection?
    Since I currently have a working IPv6 connection after the reboot, I cheched the log:

    2017:04:23-10:16:58 router ipv6_watchdog[4290]: Started dhclient6 -P (pid 4851)
    Reconnected PPPoE, and my IPv6 connectivity was broken again. In the log:
    2017:04:23-10:39:17 router ipv6_watchdog[4290]: dhclient6 (pid 4851) has died

    This could be a problem.
    Can I try to start it manually? I found the binary in /var/sec/chroot-dhcpc/usr/sbin/ but -P is not a valid option?

    iptables.zip

  • 0 in reply to SanderRutten

    Hi SandyRutten,

        Thanks so much for your help. It is appreciated.

        You are right in that we need to deal with "dhclient6 has died" and I will look into it.

        But in the meantime, the DHCPv6 and ICMPv6 traffics seems to be dropped as you can see

        from your previous 1781.Logs.zip in the captures (first and third) that did not work, there is

        no DHCPv6 traffics captured at all; while the second capture had DHCPv6 in it and we did get a prefix

        from DHCPv6 Server. So it is more probable that it is the iptables involved.

        Sorry to say it was my mistake not to mention to dump out both IPv4 and IPv6 iptables.

        Can you do the followings:

        1) Dump out the ip6tables (both working and non-working) and attach them to this thread

        2) Clear out the ip6tables (ip6tables -F) and try ping6 again

        Thank You so much and sorry for my omission. Thanks again.

  • 0 in reply to Duc Le

    Hello,

    Attached are the ip6table outputs. 
    Order of the logfiles: 

    ip6tables_not_working.txt - IPv6 was already in a broken state since yesterday, so not working.
    ip6tables_not_working_after_flushing.txt - Not working, after ip6tables -F
    ip6tables_after_reboot_working.txt - Working after a reboot.
    ip6tables_reconnect_pppoe_not_working.txt - Broken again after reconnecting PPPoE manually
    ip6tables_after_reboot2_not_working.txt - Still broken after a reboot.

    Did a quick compare on the logs, and the ip6tables output is the same in each case, extept the one after flushing it, that one is empty :)

    Still wondering why it sometimes helps to reboot, and sometimes not. I mean, if it is for example dhclient6 which crashes after reconnecting PPPoE, and doesn't get restarted anymore, I would think that *every* reboot would start dhclient6 again. But right now 1 out of .. multple reboots seems to do "fix" the connection.
    But that's what we are here for :)

    ip6tables.zip

  • 0 in reply to SanderRutten

    Hi SanderRutten,

       Thanks and you are right. The ip6tables dumps are the same between

       ip6tables_after_reboot_working.txt and ip6tables_adter_reboot2_not_working.txt;

       Is there anyway I can log into your system and debug with you? If possible, it would

       be great. Thx.

     

       If I have access to your system while it is not working, then I would keep an eye on the

       default route since to get to "2a00:1450:400e:801::200e"; a default route might be needed.

       Also, I need to see how far to packet (ping6) travels the IP stack by duping out the counter on

       ip6table or on the eth1 interface.

     

       I would add the following rule to the ip6table:

       ip6tables --table filter --insert OUTPUT 1 -j LOG --log-prefix "ICMP_OUTPUT:" --log-level 7

       ip6tables --table nat --insert POSTROUTING 1 -j LOG --log-prefix "ICMP_POST:" --log-level 7

       // This allows us to see the ICMPv6 packet hits the OUTPUT chain (first) and POSTROUTING chain (last) before hitting the hardware interface 

     

        then for each ping6: dmesg command   to see the output of the log  

  • 0 in reply to Duc Le

    Hi Le,

    Just sent you the login details for my UTM. 
    Already added the two ip6table rules. Tried to ping6 google.com, dmesg output attached.

    Kind regards,

    Sander

    Fullscreen dmesg.txt Download 
    [32711.333847] ICMP_OUTPUT:IN= OUT=eth0 SRC=2001:0981:9d6e:0001:0000:0000:0000:0001 DST=2001:0981:9d6e:0001:d5c2:a358:31e0:a6e7 LEN=553 TC=0 HOPLIMIT=64 FLOWLBL=0 PROTO=UDP SPT=53 DPT=57757 LEN=513
[32711.456834] ICMP_OUTPUT:IN= OUT=eth0 SRC=2001:0981:9d6e:0001:0000:0000:0000:0001 DST=2001:0981:9d6e:0001:d5c2:a358:31e0:a6e7 LEN=259 TC=0 HOPLIMIT=64 FLOWLBL=0 PROTO=UDP SPT=53 DPT=51561 LEN=219
[32712.044663] ICMP_OUTPUT:IN= OUT=eth0 SRC=2001:0981:9d6e:0001:0000:0000:0000:0001 DST=2001:0981:9d6e:0001:d5c2:a358:31e0:a6e7 LEN=521 TC=0 HOPLIMIT=64 FLOWLBL=0 PROTO=UDP SPT=53 DPT=65523 LEN=481
[32712.051273] ICMP_OUTPUT:IN= OUT=eth0 SRC=2001:0981:9d6e:0001:0000:0000:0000:0001 DST=2001:0981:9d6e:0001:d5c2:a358:31e0:a6e7 LEN=531 TC=0 HOPLIMIT=64 FLOWLBL=0 PROTO=UDP SPT=53 DPT=64634 LEN=491
[32716.015921] ICMP_OUTPUT:IN= OUT=eth0 SRC=2001:0981:9d6e:0001:0000:0000:0000:0001 DST=2001:0981:9d6e:0001:d5c2:a358:31e0:a6e7 LEN=64 TC=0 HOPLIMIT=255 FLOWLBL=0 PROTO=ICMPv6 TYPE=136 CODE=0
[32716.340549] ICMP_OUTPUT:IN= OUT=eth0 SRC=fe80:0000:0000:0000:021a:8cff:fe49:1608 DST=2001:0981:9d6e:0001:d5c2:a358:31e0:a6e7 LEN=72 TC=0 HOPLIMIT=255 FLOWLBL=0 PROTO=ICMPv6 TYPE=135 CODE=0
[32719.602387] ICMP_OUTPUT:IN= OUT=ppp0 SRC=2001:0981:9d6e:0001:0000:0000:0000:0001 DST=2a00:1450:4009:080f:0000:0000:0000:200e LEN=104 TC=0 HOPLIMIT=64 FLOWLBL=0 PROTO=ICMPv6 TYPE=128 CODE=0 ID=27397 SEQ=1
[32719.602415] ICMP_POST:IN= OUT=ppp0 SRC=2001:0981:9d6e:0001:0000:0000:0000:0001 DST=2a00:1450:4009:080f:0000:0000:0000:200e LEN=104 TC=0 HOPLIMIT=64 FLOWLBL=0 PROTO=ICMPv6 TYPE=128 CODE=0 ID=27397 SEQ=1
[32720.014982] ICMP_OUTPUT:IN= OUT=eth0 SRC=fe80:0000:0000:0000:021a:8cff:fe49:1608 DST=fe80:0000:0000:0000:9584:0a8e:371a:73ee LEN=64 TC=0 HOPLIMIT=255 FLOWLBL=0 PROTO=ICMPv6 TYPE=136 CODE=0
[32720.609683] ICMP_OUTPUT:IN= OUT=ppp0 SRC=2001:0981:9d6e:0001:0000:0000:0000:0001 DST=2a00:1450:4009:080f:0000:0000:0000:200e LEN=104 TC=0 HOPLIMIT=64 FLOWLBL=0 PROTO=ICMPv6 TYPE=128 CODE=0 ID=27397 SEQ=2
[32721.617441] ICMP_OUTPUT:IN= OUT=ppp0 SRC=2001:0981:9d6e:0001:0000:0000:0000:0001 DST=2a00:1450:4009:080f:0000:0000:0000:200e LEN=104 TC=0 HOPLIMIT=64 FLOWLBL=0 PROTO=ICMPv6 TYPE=128 CODE=0 ID=27397 SEQ=3
[32722.625206] ICMP_OUTPUT:IN= OUT=ppp0 SRC=2001:0981:9d6e:0001:0000:0000:0000:0001 DST=2a00:1450:4009:080f:0000:0000:0000:200e LEN=104 TC=0 HOPLIMIT=64 FLOWLBL=0 PROTO=ICMPv6 TYPE=128 CODE=0 ID=27397 SEQ=4
[32723.632963] ICMP_OUTPUT:IN= OUT=ppp0 SRC=2001:0981:9d6e:0001:0000:0000:0000:0001 DST=2a00:1450:4009:080f:0000:0000:0000:200e LEN=104 TC=0 HOPLIMIT=64 FLOWLBL=0 PROTO=ICMPv6 TYPE=128 CODE=0 ID=27397 SEQ=5
[32724.536578] ICMP_OUTPUT:IN= OUT=eth0 SRC=2001:0981:9d6e:0001:0000:0000:0000:0001 DST=2001:0981:9d6e:0001:d5c2:a358:31e0:a6e7 LEN=448 TC=0 HOPLIMIT=64 FLOWLBL=0 PROTO=UDP SPT=53 DPT=61611 LEN=408
[32724.546787] ICMP_OUTPUT:IN= OUT=eth0 SRC=2001:0981:9d6e:0001:0000:0000:0000:0001 DST=2001:0981:9d6e:0001:d5c2:a358:31e0:a6e7 LEN=460 TC=0 HOPLIMIT=64 FLOWLBL=0 PROTO=UDP SPT=53 DPT=62161 LEN=420
[32725.026543] ICMP_OUTPUT:IN= OUT=eth0 SRC=fe80:0000:0000:0000:021a:8cff:fe49:1608 DST=fe80:0000:0000:0000:9584:0a8e:371a:73ee LEN=72 TC=0 HOPLIMIT=255 FLOWLBL=0 PROTO=ICMPv6 TYPE=135 CODE=0
[32727.044946] ICMP_OUTPUT:IN= OUT=eth0 SRC=2001:0981:9d6e:0001:0000:0000:0000:0001 DST=2001:0981:9d6e:0001:d5c2:a358:31e0:a6e7 LEN=560 TC=0 HOPLIMIT=64 FLOWLBL=0 PROTO=UDP SPT=53 DPT=56127 LEN=520
[32727.064740] ICMP_OUTPUT:IN= OUT=eth0 SRC=2001:0981:9d6e:0001:0000:0000:0000:0001 DST=2001:0981:9d6e:0001:d5c2:a358:31e0:a6e7 LEN=520 TC=0 HOPLIMIT=64 FLOWLBL=0 PROTO=UDP SPT=53 DPT=65449 LEN=480
[32727.065520] ICMP_POST:IN= OUT=ppp0 SRC=2001:0981:9d6e:0001:d5c2:a358:31e0:a6e7 DST=2a02:26f0:007b:048a:0000:0000:0000:1abd LEN=72 TC=0 HOPLIMIT=63 FLOWLBL=62641 PROTO=TCP SPT=49897 DPT=80 WINDOW=64800 RES=0x00 SYN URGP=0
[32730.169517] ICMP_POST:IN= OUT=ppp0 SRC=2001:0981:9d6e:0001:d5c2:a358:31e0:a6e7 DST=2605:0380:0032:0351:0000:0000:0000:000e LEN=72 TC=0 HOPLIMIT=63 FLOWLBL=55324 PROTO=TCP SPT=49898 DPT=5938 WINDOW=64800 RES=0x00 SYN URGP=0
[32733.090322] ICMP_POST:IN= OUT=ppp0 SRC=2001:0981:9d6e:0001:d5c2:a358:31e0:a6e7 DST=2a02:26f0:007b:048c:0000:0000:0000:201a LEN=72 TC=0 HOPLIMIT=63 FLOWLBL=840252 PROTO=TCP SPT=49899 DPT=80 WINDOW=64800 RES=0x00 SYN URGP=0
[32735.011479] ICMP_OUTPUT:IN= OUT=eth0 SRC=fe80:0000:0000:0000:021a:8cff:fe49:1608 DST=fe80:0000:0000:0000:9584:0a8e:371a:73ee LEN=64 TC=0 HOPLIMIT=255 FLOWLBL=0 PROTO=ICMPv6 TYPE=136 CODE=0
[32742.415121] ICMP_OUTPUT:IN= OUT=eth0 SRC=2001:0981:9d6e:0001:0000:0000:0000:0001 DST=2001:0981:9d6e:0001:d5c2:a358:31e0:a6e7 LEN=259 TC=0 HOPLIMIT=64 FLOWLBL=0 PROTO=UDP SPT=53 DPT=53744 LEN=219
[32743.774562] ICMP_OUTPUT:IN= OUT=ppp0 SRC=2001:0981:9d6e:0001:0000:0000:0000:0001 DST=2a00:1450:4009:080f:0000:0000:0000:200e LEN=104 TC=0 HOPLIMIT=64 FLOWLBL=0 PROTO=ICMPv6 TYPE=128 CODE=0 ID=33541 SEQ=1
[32743.774595] ICMP_POST:IN= OUT=ppp0 SRC=2001:0981:9d6e:0001:0000:0000:0000:0001 DST=2a00:1450:4009:080f:0000:0000:0000:200e LEN=104 TC=0 HOPLIMIT=64 FLOWLBL=0 PROTO=ICMPv6 TYPE=128 CODE=0 ID=33541 SEQ=1
[32744.559620] ICMP_OUTPUT:IN= OUT=eth0 SRC=fe80:0000:0000:0000:021a:8cff:fe49:1608 DST=fe80:0000:0000:0000:9584:0a8e:371a:73ee LEN=108 TC=0 HOPLIMIT=64 FLOWLBL=0 PROTO=UDP SPT=547 DPT=546 LEN=68
[32744.559640] ICMP_POST:IN= OUT=eth0 SRC=fe80:0000:0000:0000:021a:8cff:fe49:1608 DST=fe80:0000:0000:0000:9584:0a8e:371a:73ee LEN=108 TC=0 HOPLIMIT=64 FLOWLBL=0 PROTO=UDP SPT=547 DPT=546 LEN=68
[32744.564693] ICMP_OUTPUT:IN= OUT=eth0 SRC=2001:0981:9d6e:0001:0000:0000:0000:0001 DST=2001:0981:9d6e:0001:d5c2:a358:31e0:a6e7 LEN=72 TC=0 HOPLIMIT=255 FLOWLBL=0 PROTO=ICMPv6 TYPE=136 CODE=0
[32744.774004] ICMP_OUTPUT:IN= OUT=ppp0 SRC=2001:0981:9d6e:0001:0000:0000:0000:0001 DST=2a00:1450:4009:080f:0000:0000:0000:200e LEN=104 TC=0 HOPLIMIT=64 FLOWLBL=0 PROTO=ICMPv6 TYPE=128 CODE=0 ID=33541 SEQ=2
[32745.009590] ICMP_OUTPUT:IN= OUT=eth0 SRC=fe80:0000:0000:0000:021a:8cff:fe49:1608 DST=ff02:0000:0000:0000:0000:0000:0000:0001 LEN=120 TC=0 HOPLIMIT=255 FLOWLBL=0 PROTO=ICMPv6 TYPE=134 CODE=0
[32745.509003] ICMP_OUTPUT:IN= OUT=eth0 SRC=2001:0981:9d6e:0001:0000:0000:0000:0001 DST=2001:0981:9d6e:0001:d5c2:a358:31e0:a6e7 LEN=72 TC=0 HOPLIMIT=255 FLOWLBL=0 PROTO=ICMPv6 TYPE=136 CODE=0
[32745.773781] ICMP_OUTPUT:IN= OUT=ppp0 SRC=2001:0981:9d6e:0001:0000:0000:0000:0001 DST=2a00:1450:4009:080f:0000:0000:0000:200e LEN=104 TC=0 HOPLIMIT=64 FLOWLBL=0 PROTO=ICMPv6 TYPE=128 CODE=0 ID=33541 SEQ=3
[32746.508762] ICMP_OUTPUT:IN= OUT=eth0 SRC=2001:0981:9d6e:0001:0000:0000:0000:0001 DST=2001:0981:9d6e:0001:d5c2:a358:31e0:a6e7 LEN=72 TC=0 HOPLIMIT=255 FLOWLBL=0 PROTO=ICMPv6 TYPE=136 CODE=0
[32746.581196] ICMP_POST:IN= OUT=ppp0 SRC=2001:0981:9d6e:0001:d5c2:a358:31e0:a6e7 DST=2a01:0111:2003:0000:0000:0000:0000:0052 LEN=72 TC=0 HOPLIMIT=63 FLOWLBL=656277 PROTO=TCP SPT=49923 DPT=80 WINDOW=64800 RES=0x00 SYN URGP=0
[32746.773595] ICMP_OUTPUT:IN= OUT=ppp0 SRC=2001:0981:9d6e:0001:0000:0000:0000:0001 DST=2a00:1450:4009:080f:0000:0000:0000:200e LEN=104 TC=0 HOPLIMIT=64 FLOWLBL=0 PROTO=ICMPv6 TYPE=128 CODE=0 ID=33541 SEQ=4
[32747.421369] ICMP_OUTPUT:IN= OUT=eth0 SRC=fe80:0000:0000:0000:021a:8cff:fe49:1608 DST=2001:0981:9d6e:0001:d5c2:a358:31e0:a6e7 LEN=72 TC=0 HOPLIMIT=255 FLOWLBL=0 PROTO=ICMPv6 TYPE=135 CODE=0
[32747.611615] ICMP_POST:IN= OUT=ppp0 SRC=2001:0981:9d6e:0001:d5c2:a358:31e0:a6e7 DST=2a01:0111:f330:1790:0000:0000:0000:0a01 LEN=72 TC=0 HOPLIMIT=63 FLOWLBL=712704 PROTO=TCP SPT=49926 DPT=443 WINDOW=64800 RES=0x00 SYN URGP=0
[32747.773307] ICMP_OUTPUT:IN= OUT=ppp0 SRC=2001:0981:9d6e:0001:0000:0000:0000:0001 DST=2a00:1450:4009:080f:0000:0000:0000:200e LEN=104 TC=0 HOPLIMIT=64 FLOWLBL=0 PROTO=ICMPv6 TYPE=128 CODE=0 ID=33541 SEQ=5
[32748.087268] ICMP_POST:IN= OUT=ppp0 SRC=2001:0981:9d6e:0001:d5c2:a358:31e0:a6e7 DST=2a02:26f0:007b:048f:0000:0000:0000:1abd LEN=72 TC=0 HOPLIMIT=63 FLOWLBL=719581 PROTO=TCP SPT=49927 DPT=80 WINDOW=64800 RES=0x00 SYN URGP=0
[32749.564888] ICMP_OUTPUT:IN= OUT=eth0 SRC=fe80:0000:0000:0000:021a:8cff:fe49:1608 DST=fe80:0000:0000:0000:9584:0a8e:371a:73ee LEN=72 TC=0 HOPLIMIT=255 FLOWLBL=0 PROTO=ICMPv6 TYPE=135 CODE=0
[32750.007995] ICMP_OUTPUT:IN= OUT=eth0 SRC=fe80:0000:0000:0000:021a:8cff:fe49:1608 DST=fe80:0000:0000:0000:9584:0a8e:371a:73ee LEN=64 TC=0 HOPLIMIT=255 FLOWLBL=0 PROTO=ICMPv6 TYPE=136 CODE=0

Reply
  • 0 in reply to Duc Le

    Hi Le,

    Just sent you the login details for my UTM. 
    Already added the two ip6table rules. Tried to ping6 google.com, dmesg output attached.

    Kind regards,

    Sander

    Fullscreen dmesg.txt Download 
    [32711.333847] ICMP_OUTPUT:IN= OUT=eth0 SRC=2001:0981:9d6e:0001:0000:0000:0000:0001 DST=2001:0981:9d6e:0001:d5c2:a358:31e0:a6e7 LEN=553 TC=0 HOPLIMIT=64 FLOWLBL=0 PROTO=UDP SPT=53 DPT=57757 LEN=513
[32711.456834] ICMP_OUTPUT:IN= OUT=eth0 SRC=2001:0981:9d6e:0001:0000:0000:0000:0001 DST=2001:0981:9d6e:0001:d5c2:a358:31e0:a6e7 LEN=259 TC=0 HOPLIMIT=64 FLOWLBL=0 PROTO=UDP SPT=53 DPT=51561 LEN=219
[32712.044663] ICMP_OUTPUT:IN= OUT=eth0 SRC=2001:0981:9d6e:0001:0000:0000:0000:0001 DST=2001:0981:9d6e:0001:d5c2:a358:31e0:a6e7 LEN=521 TC=0 HOPLIMIT=64 FLOWLBL=0 PROTO=UDP SPT=53 DPT=65523 LEN=481
[32712.051273] ICMP_OUTPUT:IN= OUT=eth0 SRC=2001:0981:9d6e:0001:0000:0000:0000:0001 DST=2001:0981:9d6e:0001:d5c2:a358:31e0:a6e7 LEN=531 TC=0 HOPLIMIT=64 FLOWLBL=0 PROTO=UDP SPT=53 DPT=64634 LEN=491
[32716.015921] ICMP_OUTPUT:IN= OUT=eth0 SRC=2001:0981:9d6e:0001:0000:0000:0000:0001 DST=2001:0981:9d6e:0001:d5c2:a358:31e0:a6e7 LEN=64 TC=0 HOPLIMIT=255 FLOWLBL=0 PROTO=ICMPv6 TYPE=136 CODE=0
[32716.340549] ICMP_OUTPUT:IN= OUT=eth0 SRC=fe80:0000:0000:0000:021a:8cff:fe49:1608 DST=2001:0981:9d6e:0001:d5c2:a358:31e0:a6e7 LEN=72 TC=0 HOPLIMIT=255 FLOWLBL=0 PROTO=ICMPv6 TYPE=135 CODE=0
[32719.602387] ICMP_OUTPUT:IN= OUT=ppp0 SRC=2001:0981:9d6e:0001:0000:0000:0000:0001 DST=2a00:1450:4009:080f:0000:0000:0000:200e LEN=104 TC=0 HOPLIMIT=64 FLOWLBL=0 PROTO=ICMPv6 TYPE=128 CODE=0 ID=27397 SEQ=1
[32719.602415] ICMP_POST:IN= OUT=ppp0 SRC=2001:0981:9d6e:0001:0000:0000:0000:0001 DST=2a00:1450:4009:080f:0000:0000:0000:200e LEN=104 TC=0 HOPLIMIT=64 FLOWLBL=0 PROTO=ICMPv6 TYPE=128 CODE=0 ID=27397 SEQ=1
[32720.014982] ICMP_OUTPUT:IN= OUT=eth0 SRC=fe80:0000:0000:0000:021a:8cff:fe49:1608 DST=fe80:0000:0000:0000:9584:0a8e:371a:73ee LEN=64 TC=0 HOPLIMIT=255 FLOWLBL=0 PROTO=ICMPv6 TYPE=136 CODE=0
[32720.609683] ICMP_OUTPUT:IN= OUT=ppp0 SRC=2001:0981:9d6e:0001:0000:0000:0000:0001 DST=2a00:1450:4009:080f:0000:0000:0000:200e LEN=104 TC=0 HOPLIMIT=64 FLOWLBL=0 PROTO=ICMPv6 TYPE=128 CODE=0 ID=27397 SEQ=2
[32721.617441] ICMP_OUTPUT:IN= OUT=ppp0 SRC=2001:0981:9d6e:0001:0000:0000:0000:0001 DST=2a00:1450:4009:080f:0000:0000:0000:200e LEN=104 TC=0 HOPLIMIT=64 FLOWLBL=0 PROTO=ICMPv6 TYPE=128 CODE=0 ID=27397 SEQ=3
[32722.625206] ICMP_OUTPUT:IN= OUT=ppp0 SRC=2001:0981:9d6e:0001:0000:0000:0000:0001 DST=2a00:1450:4009:080f:0000:0000:0000:200e LEN=104 TC=0 HOPLIMIT=64 FLOWLBL=0 PROTO=ICMPv6 TYPE=128 CODE=0 ID=27397 SEQ=4
[32723.632963] ICMP_OUTPUT:IN= OUT=ppp0 SRC=2001:0981:9d6e:0001:0000:0000:0000:0001 DST=2a00:1450:4009:080f:0000:0000:0000:200e LEN=104 TC=0 HOPLIMIT=64 FLOWLBL=0 PROTO=ICMPv6 TYPE=128 CODE=0 ID=27397 SEQ=5
[32724.536578] ICMP_OUTPUT:IN= OUT=eth0 SRC=2001:0981:9d6e:0001:0000:0000:0000:0001 DST=2001:0981:9d6e:0001:d5c2:a358:31e0:a6e7 LEN=448 TC=0 HOPLIMIT=64 FLOWLBL=0 PROTO=UDP SPT=53 DPT=61611 LEN=408
[32724.546787] ICMP_OUTPUT:IN= OUT=eth0 SRC=2001:0981:9d6e:0001:0000:0000:0000:0001 DST=2001:0981:9d6e:0001:d5c2:a358:31e0:a6e7 LEN=460 TC=0 HOPLIMIT=64 FLOWLBL=0 PROTO=UDP SPT=53 DPT=62161 LEN=420
[32725.026543] ICMP_OUTPUT:IN= OUT=eth0 SRC=fe80:0000:0000:0000:021a:8cff:fe49:1608 DST=fe80:0000:0000:0000:9584:0a8e:371a:73ee LEN=72 TC=0 HOPLIMIT=255 FLOWLBL=0 PROTO=ICMPv6 TYPE=135 CODE=0
[32727.044946] ICMP_OUTPUT:IN= OUT=eth0 SRC=2001:0981:9d6e:0001:0000:0000:0000:0001 DST=2001:0981:9d6e:0001:d5c2:a358:31e0:a6e7 LEN=560 TC=0 HOPLIMIT=64 FLOWLBL=0 PROTO=UDP SPT=53 DPT=56127 LEN=520
[32727.064740] ICMP_OUTPUT:IN= OUT=eth0 SRC=2001:0981:9d6e:0001:0000:0000:0000:0001 DST=2001:0981:9d6e:0001:d5c2:a358:31e0:a6e7 LEN=520 TC=0 HOPLIMIT=64 FLOWLBL=0 PROTO=UDP SPT=53 DPT=65449 LEN=480
[32727.065520] ICMP_POST:IN= OUT=ppp0 SRC=2001:0981:9d6e:0001:d5c2:a358:31e0:a6e7 DST=2a02:26f0:007b:048a:0000:0000:0000:1abd LEN=72 TC=0 HOPLIMIT=63 FLOWLBL=62641 PROTO=TCP SPT=49897 DPT=80 WINDOW=64800 RES=0x00 SYN URGP=0
[32730.169517] ICMP_POST:IN= OUT=ppp0 SRC=2001:0981:9d6e:0001:d5c2:a358:31e0:a6e7 DST=2605:0380:0032:0351:0000:0000:0000:000e LEN=72 TC=0 HOPLIMIT=63 FLOWLBL=55324 PROTO=TCP SPT=49898 DPT=5938 WINDOW=64800 RES=0x00 SYN URGP=0
[32733.090322] ICMP_POST:IN= OUT=ppp0 SRC=2001:0981:9d6e:0001:d5c2:a358:31e0:a6e7 DST=2a02:26f0:007b:048c:0000:0000:0000:201a LEN=72 TC=0 HOPLIMIT=63 FLOWLBL=840252 PROTO=TCP SPT=49899 DPT=80 WINDOW=64800 RES=0x00 SYN URGP=0
[32735.011479] ICMP_OUTPUT:IN= OUT=eth0 SRC=fe80:0000:0000:0000:021a:8cff:fe49:1608 DST=fe80:0000:0000:0000:9584:0a8e:371a:73ee LEN=64 TC=0 HOPLIMIT=255 FLOWLBL=0 PROTO=ICMPv6 TYPE=136 CODE=0
[32742.415121] ICMP_OUTPUT:IN= OUT=eth0 SRC=2001:0981:9d6e:0001:0000:0000:0000:0001 DST=2001:0981:9d6e:0001:d5c2:a358:31e0:a6e7 LEN=259 TC=0 HOPLIMIT=64 FLOWLBL=0 PROTO=UDP SPT=53 DPT=53744 LEN=219
[32743.774562] ICMP_OUTPUT:IN= OUT=ppp0 SRC=2001:0981:9d6e:0001:0000:0000:0000:0001 DST=2a00:1450:4009:080f:0000:0000:0000:200e LEN=104 TC=0 HOPLIMIT=64 FLOWLBL=0 PROTO=ICMPv6 TYPE=128 CODE=0 ID=33541 SEQ=1
[32743.774595] ICMP_POST:IN= OUT=ppp0 SRC=2001:0981:9d6e:0001:0000:0000:0000:0001 DST=2a00:1450:4009:080f:0000:0000:0000:200e LEN=104 TC=0 HOPLIMIT=64 FLOWLBL=0 PROTO=ICMPv6 TYPE=128 CODE=0 ID=33541 SEQ=1
[32744.559620] ICMP_OUTPUT:IN= OUT=eth0 SRC=fe80:0000:0000:0000:021a:8cff:fe49:1608 DST=fe80:0000:0000:0000:9584:0a8e:371a:73ee LEN=108 TC=0 HOPLIMIT=64 FLOWLBL=0 PROTO=UDP SPT=547 DPT=546 LEN=68
[32744.559640] ICMP_POST:IN= OUT=eth0 SRC=fe80:0000:0000:0000:021a:8cff:fe49:1608 DST=fe80:0000:0000:0000:9584:0a8e:371a:73ee LEN=108 TC=0 HOPLIMIT=64 FLOWLBL=0 PROTO=UDP SPT=547 DPT=546 LEN=68
[32744.564693] ICMP_OUTPUT:IN= OUT=eth0 SRC=2001:0981:9d6e:0001:0000:0000:0000:0001 DST=2001:0981:9d6e:0001:d5c2:a358:31e0:a6e7 LEN=72 TC=0 HOPLIMIT=255 FLOWLBL=0 PROTO=ICMPv6 TYPE=136 CODE=0
[32744.774004] ICMP_OUTPUT:IN= OUT=ppp0 SRC=2001:0981:9d6e:0001:0000:0000:0000:0001 DST=2a00:1450:4009:080f:0000:0000:0000:200e LEN=104 TC=0 HOPLIMIT=64 FLOWLBL=0 PROTO=ICMPv6 TYPE=128 CODE=0 ID=33541 SEQ=2
[32745.009590] ICMP_OUTPUT:IN= OUT=eth0 SRC=fe80:0000:0000:0000:021a:8cff:fe49:1608 DST=ff02:0000:0000:0000:0000:0000:0000:0001 LEN=120 TC=0 HOPLIMIT=255 FLOWLBL=0 PROTO=ICMPv6 TYPE=134 CODE=0
[32745.509003] ICMP_OUTPUT:IN= OUT=eth0 SRC=2001:0981:9d6e:0001:0000:0000:0000:0001 DST=2001:0981:9d6e:0001:d5c2:a358:31e0:a6e7 LEN=72 TC=0 HOPLIMIT=255 FLOWLBL=0 PROTO=ICMPv6 TYPE=136 CODE=0
[32745.773781] ICMP_OUTPUT:IN= OUT=ppp0 SRC=2001:0981:9d6e:0001:0000:0000:0000:0001 DST=2a00:1450:4009:080f:0000:0000:0000:200e LEN=104 TC=0 HOPLIMIT=64 FLOWLBL=0 PROTO=ICMPv6 TYPE=128 CODE=0 ID=33541 SEQ=3
[32746.508762] ICMP_OUTPUT:IN= OUT=eth0 SRC=2001:0981:9d6e:0001:0000:0000:0000:0001 DST=2001:0981:9d6e:0001:d5c2:a358:31e0:a6e7 LEN=72 TC=0 HOPLIMIT=255 FLOWLBL=0 PROTO=ICMPv6 TYPE=136 CODE=0
[32746.581196] ICMP_POST:IN= OUT=ppp0 SRC=2001:0981:9d6e:0001:d5c2:a358:31e0:a6e7 DST=2a01:0111:2003:0000:0000:0000:0000:0052 LEN=72 TC=0 HOPLIMIT=63 FLOWLBL=656277 PROTO=TCP SPT=49923 DPT=80 WINDOW=64800 RES=0x00 SYN URGP=0
[32746.773595] ICMP_OUTPUT:IN= OUT=ppp0 SRC=2001:0981:9d6e:0001:0000:0000:0000:0001 DST=2a00:1450:4009:080f:0000:0000:0000:200e LEN=104 TC=0 HOPLIMIT=64 FLOWLBL=0 PROTO=ICMPv6 TYPE=128 CODE=0 ID=33541 SEQ=4
[32747.421369] ICMP_OUTPUT:IN= OUT=eth0 SRC=fe80:0000:0000:0000:021a:8cff:fe49:1608 DST=2001:0981:9d6e:0001:d5c2:a358:31e0:a6e7 LEN=72 TC=0 HOPLIMIT=255 FLOWLBL=0 PROTO=ICMPv6 TYPE=135 CODE=0
[32747.611615] ICMP_POST:IN= OUT=ppp0 SRC=2001:0981:9d6e:0001:d5c2:a358:31e0:a6e7 DST=2a01:0111:f330:1790:0000:0000:0000:0a01 LEN=72 TC=0 HOPLIMIT=63 FLOWLBL=712704 PROTO=TCP SPT=49926 DPT=443 WINDOW=64800 RES=0x00 SYN URGP=0
[32747.773307] ICMP_OUTPUT:IN= OUT=ppp0 SRC=2001:0981:9d6e:0001:0000:0000:0000:0001 DST=2a00:1450:4009:080f:0000:0000:0000:200e LEN=104 TC=0 HOPLIMIT=64 FLOWLBL=0 PROTO=ICMPv6 TYPE=128 CODE=0 ID=33541 SEQ=5
[32748.087268] ICMP_POST:IN= OUT=ppp0 SRC=2001:0981:9d6e:0001:d5c2:a358:31e0:a6e7 DST=2a02:26f0:007b:048f:0000:0000:0000:1abd LEN=72 TC=0 HOPLIMIT=63 FLOWLBL=719581 PROTO=TCP SPT=49927 DPT=80 WINDOW=64800 RES=0x00 SYN URGP=0
[32749.564888] ICMP_OUTPUT:IN= OUT=eth0 SRC=fe80:0000:0000:0000:021a:8cff:fe49:1608 DST=fe80:0000:0000:0000:9584:0a8e:371a:73ee LEN=72 TC=0 HOPLIMIT=255 FLOWLBL=0 PROTO=ICMPv6 TYPE=135 CODE=0
[32750.007995] ICMP_OUTPUT:IN= OUT=eth0 SRC=fe80:0000:0000:0000:021a:8cff:fe49:1608 DST=fe80:0000:0000:0000:9584:0a8e:371a:73ee LEN=64 TC=0 HOPLIMIT=255 FLOWLBL=0 PROTO=ICMPv6 TYPE=136 CODE=0

Children
  • 0 in reply to SanderRutten

    Hi SanderRutten,

       Thanks a lot for allowing ssh into the UTM.

       Here is a quick summary:

       1) When I inherited the system from this morning, the ping6 to google.com did not work despite

            the facts all seemed to be fine with UTM.

            a) ip6table logging indicated that the ip6table passed all the ICMPv6 to the hardware interface

            b) The tcpdump indicated that it captured ICMPv6 on the hardware interface

            However there were never responses from google.com 

             UNTIL

        2) About 5 hours into debugging the system, i.e. verifying system thru:

            a) dmesg to see the ip6table logging of ICMPv6 traffic

            b) ip -6 route see the default route for PPPoE

            c) tcpdump -i eth1 for pppoe traffics

            d) tcpdump -i ppp0 for ICMPv6 traffics

            e) ps -elaf | egrep 'dhc|watch|ppp'

             They all indicated that the traffics were sent to the other end of PPPoE connection but there was no response,

     

             THEN out of no where, ping6 started to work like a charm. It has been going strong for over 1 hour now.

             I will let it go for a while and let you know when I am back tomorrow.

     

             Hence at this point, it is a puzzle while it started to work; everything from UTM seemed to indicate that it should

             work. So going forward, is there anyway can you confirm that the ICMPv6 packets do get on the wire, i.e.

             port mirroring on the upstream switch (if there is a switch between UTM and ISP) or somehow working with ISP to

             determine it; I just want to make sure that UTM sends out the ICMPv6 packet to eliminate upstream issue.

     

              That's all for now. Please let me know your comments, ideas or questions.

              Again, thanks so much for your help.

     

  • 0 in reply to Duc Le

    Hello Le,
    Thanks again for looking into the problem!
    Can try a port mirror, although I have never used it. (I'm not a standard home user but neither a network tech :P)

    My network setup is: ISP > Switch Port1 > Switch Port2 > Sophos SG125w WAN port
    I have setup a port mirror for port 2. When I'm home tonight I can hopefully capture with my laptop attached to the mirrored port and run wireshark.

    I sure hope we will find something, but to be honest I doubt that we will find a cause here.
    When I connect my OpenWRT router, IPv6 works. If I power on my OPNSense firewall, it also works. When testing PFSense for a short while, it also worked.

  • 0 in reply to SanderRutten

    Hi SanderRutten,

       Thanks for your help.

       The ping6 testing is still going strong for almost 16 hours now. Every ping was fine (about 56000).

     

       I am in the same boat with you, i.e. I don't feel comfortable when things start not to work and start to work

       without any apparent reasons. So I am not letting up this issue. On my side, I am still looking for possible hypothesis

       as to why it does not work. I will update ASAP.

     

       Thanks for the port mirroring work. Good luck.

        Also, please let me know your thinking. It is appreciated. Thx.

     

    Edit:

    New additional info updated at 2:00PM Vancouver time and 10:00PM German Time:

    1) The ping6 is going strong for full 24 hours now; sending out close to 80K pings without problem

    2) At this time, the prefix renew was also successful for the same prefix after 12 hour renewal interval from 10:00AM to 10:00PM German time

    So far so good.

  • 0 in reply to Duc Le

    Hi Le,

    Little update on the 6rd: 

    I was in touch with a fellow sophos community member. He is using "Deutsche Glasfaser" which offers IPv6 via 6rd.

    We managed to get an IPv6 Address for the WAN Interface so far which is working fine. What does not work is getting a route for the Internal LAN Interfaces (but we didnt really try cause of time issue)

    For the 6rd i think we can manage to establish that with a small script that calculates the own prefix via the CGN IPv4 and the Provider /32 IPv6 network. 

    If an integration into the UTM Webadmin was to happen it would probably be required beeing able to enter the Provider IPv6 Prefix, 6rd IPv4 Gateway and Netmask into a GUI mask. Since the Kernel requirements and basic working is allready in, maybe it would be easier to considerate integrating this.

    ---

    Sophos UTM 9.3 Certified Engineer

  • 0 in reply to Ben

    Hi Ben,

       Thanks for your suggestion and I think I sort of understand it;

       But team decision is needed on this and I will pass it on.

       Your input is much appreciated. Thanks again.

  • 0 in reply to Duc Le

    Hi All,

    Have not been following the thread for the last week. What is the current status?

    As I can see there is an issue for  that causes traffic to stop sometimes?

    Did you manage to resolve the static route issue? Or is that just working now for you?

     

    I think for me the only issue is the default route. I have not noticed any disruptions in traffic once I add the default myself. 

     

    Regards,

    René

  • 0 in reply to rklomp

    Updated Summary:

    SanderRutten System:

       This system has been working for almost 3 full days now without problem. We can see the DHCPv6 renew and traffics are flowing.

       Le: Still looking for explanation as to why it did not work prior to April 25, 2:00PM Vancouver Time.

    Rklomp System:

       The default route is the issue. and it had been added by manual.

       Le: Manual adding default route is good for now. But we need to make it work without having adding the default route manually

       Rene:

           1) Can Le get into your system and debug without when the default route is missing? Thanks

           2) What is the static route issue? More info, please. Thanks.

    Ben System:

       It had been reported this system is fine

     

     

  • 0 in reply to Duc Le

    @  SanderRutten

    Updates wrt SanderRutten System

    One potential cause of the ICMPv6 did not work prior to April 25 2:00PM Vancouver time is following:

    The "pppoe" negotiation between the UTM and ISP somehow did not succeed, i.e. the UTM did not have an local link IPv6 address (LL) on the ppp0 interface;

    Only from this LL, dhclient6 can ask for a PD. Since there was no LL, there was no PD. Hence no IPv6 traffics was possible due to DSP not giving a PD.

    This scenario can be verified by various system log messages:

    i)  dhclient6: no link-local Ipv6 address for ppp0

    ii) dhclient6: send_packet6: Operation not permitted // even though the ip6table looks fine

     

    Action: Even the system is working fine now for almost 3 full days. Le needs to reconnect (PPPoE) to watch the negotiation.

    Are you (SanderRutten) OK with me to push the "button" to reconnect Interface on PPPoE? Thanks and please let me know ASAP.

  • 0 in reply to Duc Le

    Hi Le,

    Sorry for the delayed reply, has been quite some busy days at work last few days so I haven't had time to capture my switch port yet. Do you still want me to do that?

    And about reconnecting my connection: Go ahead! Even multiple times if needed.

  • 0 in reply to SanderRutten

    Thanks a lot SanderRutten,

        Thanks for your help.

        No need to do mirroring.

        Since no PD, hence no traffics (outbound is OK, mirroring will show this. However, inbound is not since DSP does not know how to route).

Unfiltered HTML