0

It's very strange that my CentOS cannot receive dhcpv6 reply message from dhcpv6 server. I have enabled the rule dhcpv6-client.

Every time I try to bring up the interface, dhcpv6 request messages are sent, but there is no dhcpv6 reply message received. I try to sniff the interface using wireshark, but still, I receive no dhcpv6 reply message, and I only discover dhcpv6 request message.

I guess it's the firewall block my packet. I can receive dhcpv6 reply message when I disable the firewalld service. But I don't know whether the firewall block the dhcpv6 request message or dhcpv6 reply message.

Besides, my centos don't handle ipv6 router advertisement packet every time. So I have to configure the default ipv6 gateway to access the Internet. This happends when the firewall is up or down. I tries to set net.ipv6.conf.enp7s0.accept_ra=2 and net.ipv6.conf.enp7s0.forwarding=0, but all of those are not work.

So, guys, I need your help, thanks!

-------------------edit 1(attach iptables configure)-------------------------

As far as I can concerned, firewalld use iptables as backends. The output of my ip6tables --list is as follows

Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     all      anywhere             anywhere             ctstate     RELATED,ESTABLISHED
ACCEPT     all      anywhere             anywhere            
INPUT_direct  all      anywhere             anywhere            
INPUT_ZONES_SOURCE  all      anywhere             anywhere            
INPUT_ZONES  all      anywhere             anywhere            
ACCEPT     ipv6-icmp    anywhere             anywhere            
REJECT     all      anywhere             anywhere             reject-with     icmp6-adm-prohibited

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     all      anywhere             anywhere             ctstate     RELATED,ESTABLISHED
ACCEPT     all      anywhere             anywhere            
FORWARD_direct  all      anywhere             anywhere            
FORWARD_IN_ZONES_SOURCE  all      anywhere             anywhere            
FORWARD_IN_ZONES  all      anywhere             anywhere            
FORWARD_OUT_ZONES_SOURCE  all      anywhere             anywhere            
FORWARD_OUT_ZONES  all      anywhere             anywhere            
ACCEPT     ipv6-icmp    anywhere             anywhere            
REJECT     all      anywhere             anywhere             reject-with         icmp6-adm-prohibited

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         
OUTPUT_direct  all      anywhere             anywhere            

Chain FORWARD_IN_ZONES (1 references)
target     prot opt source               destination         
FWDI_public  all      anywhere             anywhere            [goto] 
FWDI_public  all      anywhere             anywhere            [goto] 

Chain FORWARD_IN_ZONES_SOURCE (1 references)
target     prot opt source               destination         

Chain FORWARD_OUT_ZONES (1 references)
target     prot opt source               destination         
FWDO_public  all      anywhere             anywhere            [goto] 
FWDO_public  all      anywhere             anywhere            [goto] 

Chain FORWARD_OUT_ZONES_SOURCE (1 references)
target     prot opt source               destination         

Chain FORWARD_direct (1 references)
target     prot opt source               destination         

Chain FWDI_public (2 references)
target     prot opt source               destination         
FWDI_public_log  all      anywhere             anywhere            
FWDI_public_deny  all      anywhere             anywhere            
FWDI_public_allow  all      anywhere             anywhere            

Chain FWDI_public_allow (1 references)
target     prot opt source               destination         

Chain FWDI_public_deny (1 references)
target     prot opt source               destination         

Chain FWDI_public_log (1 references)
target     prot opt source               destination         

Chain FWDO_public (2 references)
target     prot opt source               destination         
FWDO_public_log  all      anywhere             anywhere            
FWDO_public_deny  all      anywhere             anywhere            
FWDO_public_allow  all      anywhere             anywhere            

Chain FWDO_public_allow (1 references)
target     prot opt source               destination         

Chain FWDO_public_deny (1 references)
target     prot opt source               destination         

Chain FWDO_public_log (1 references)
target     prot opt source               destination         

Chain INPUT_ZONES (1 references)
target     prot opt source               destination         
IN_public  all      anywhere             anywhere            [goto] 
IN_public  all      anywhere             anywhere            [goto] 

Chain INPUT_ZONES_SOURCE (1 references)
target     prot opt source               destination         

Chain INPUT_direct (1 references)
target     prot opt source               destination         

Chain IN_public (2 references)
target     prot opt source               destination         
IN_public_log  all      anywhere             anywhere            
IN_public_deny  all      anywhere             anywhere            
IN_public_allow  all      anywhere             anywhere            

Chain IN_public_allow (1 references)
target     prot opt source               destination         
ACCEPT     udp      anywhere             fe80::/64            udp dpt:dhcpv6-client ctstate NEW
ACCEPT     tcp      anywhere             anywhere             tcp dpt:ssh ctstate NEW

Chain IN_public_deny (1 references)
target     prot opt source               destination         

Chain IN_public_log (1 references)
target     prot opt source               destination         

Chain OUTPUT_direct (1 references)
target     prot opt source               destination 
6
  • If you are using wireshark and don't see a reply back, it is not your CentOS firewall that is a problem, but something outside of your server. Is DHCP running on the network? If so and you have managed switches or there is a router in between, they may have been configured to block DHCP traffic.
    – rocky
    Jun 22 '15 at 14:30
  • Thanks for your reply, @rocky. What I think is odd is that the DHCP reply message is received after I stop firewalld service. I suspect the firewall blocks my packet via this.
    – chunhui
    Jun 22 '15 at 14:34
  • Then possibly the firewall is blocking the outgoing request or the request isn't going on out on the right ethernet interface if there are several of them. But you say you see that in wireshark? So something isn't matching up. If you are using iptables, what does iptables --list show. And maybe you can show what wireshark is indicating.
    – rocky
    Jun 22 '15 at 14:37
  • @rocky Yes, firewalld seems use ip6tables as a tool, and it will configure ip6tables automatically. I also suspect the firewall blocked my outgoing packet. But I'm not familar with iptables and cannot confirm this. the output of ip6tables --list is very long. I have attached it as a part of the question.
    – chunhui
    Jun 22 '15 at 14:44
  • If everything works with the firewall off and it's just a matter of figuring out what's up in the firewall, then here is a suggestion. Just start removing stuff from the list. See the man page on iptables for how to install new rules.
    – rocky
    Jun 22 '15 at 15:05
0

Question 1 Solved: firewalld enable RPF by default, and the dhcpv6 reply messages are blocked by the RPF rule installed on table raw chain PREROUTING.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.