0

I've already asked this question on the #networking and #freebsd IRC channels on Freenode but nobody was able to answer my question and forwarded me over here as it seems this issue is kicky to solve.

I have a Proxmox hypervisor where are hosted LXC containers and KVM machines going from Debian 9, Arch Linux and Windows. All of them are bridged to the hypervisor and the IPv6 stack is working flawlessly with public IP addresses given by my ISP and routed directly to the VMs.

One of the VM I have is an OPNsense firewall appliance (based on FreeBSD 11.0-RELEASE-p8).

Contrary to the other LXC/KVM, the latter cannot ping any IPv6 machines outside those accessible directly from the bridge. As soon I try to ping either the gateway of my hypervisor (still in IPv6), or any other far away IPv6 hosts (e.g. google.com), I got the following error message:

[...]
ping6: sendmsg: No buffer space available
[...]
  • At first, I thought the issue was due to issues with VirtIO drivers (bundled with FreeBSD). So I switched to emulated Intel E1000 NIC, but the problem persists. (I'm back with VirtIO now).
  • A netstat -m reports the buffers as empty, so the problem doesn't come from here either.
  • Putting the interface down and up again or rebooting doesn't fix the issue.
  • I tested with a fresh FreeBSD and OpenBSD install (to avoid the OPNsense overlay), but the problem persists as well.

Pinging the VM either from the bridge or from a machine completely outside of the infrastructure doesn't respond, nor connect (i.e. I had started sshd on 2222, but weren't able to connect).

The FreeBSD host is configured like this:

ifconfig vtnet0 <ipv4>/32
route add <gw ipv4> -iface vtnet0
route add default <gw ipv4>

ifconfig vtnet0 inet6 <ipv6> prefixlen 64
route add -inet6 <gw ipv6> -iface vtnet0
route add -inet6 default <gw ipv6>

Please note all my GWs are outside of my IP subnets.

After applying these lines, the routes reported by netstat -rn are sensible to me. Nothing wrong.

I precise the pf firewall is completely disabled (pfctl -d). I want to make sure this is working flawlessly before enabling yet another level of failures. :)

Is there a bug somewhere in the BSD IPv6 stack as Linux is not complaining at all? This sounds weird as I think I'm not the only one in this situation and not the only one having GW outside their IP ranges.

Thanks in advance for your time / help.

Regards.

Asked on the freebsd-net mailing list as well

0

After some discussions with guys from the company behind OPNsense, I have been able to solve my issue.

My far gateway was in /56. Even if my IPv6 is not a /56, setting my IPv6 with a /56 prefix instead of the /64 fixed my issue.

This is due to the fact FreeBSD's IPv6 NDP implementation can't find gateways IPv6 address not considered as a direct neighbour.

-> Link to the thread on the FreeBSD mailing list.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.