Freebox Server (Ultra V9/ Pop V8/ Delta V7 / Revolution V6 / Mini 4K)

Hello Marco,

The requests aren’t being stopped by the firewall, and in the first case I can see them exiting the firewall correctly, while in the second case the firewall detects no incoming traffic.

Are you doing any filtering on ICMPv6 traffic in OPNsense ? The Iliadbox will respond with an ICMPv6 Redirect when it receives a packet from a device that is destined for a host in different local prefix. This informs the sender of a better route to use to reach the destination.

Regarding the second case (firewall not seeing any traffic from a device in the Iliadbox LAN), it looks like the sender is ignoring ICMPv6 Redirects. Googling suggests Windows at least has a knob to accept/ignore such redirects (HKLM\System\CurrentControlSet\Services\Tcpip\Parameters\EnableICMPRedirect), although I am not sure what the default value is. What operating systems are you using ?

edit: If you're using Windows, checking the behaviour with the firewall disabled is worth testing.

I’ve been testing this both from Windows and Ubuntu and I get the same results, so the Windows Firewall should be out of the equation.

Not necessarily. Because traffic flows in both directions, if one host ignores the ICMPv6 Redirect, then it may properly receive packets but fail to send the responses to the proper destination.

Since the OPNsense device is effectively a router, you could have it advertise a route to the delegated prefix in the Iliadbox LAN. This sample configuration for radvd will send router advertisements containing a Route Information Option (RIO) field:

interface em0 {
  AdvSendAdvert on;
  AdvDefaultPreference low;
  route 2001:db8:a:b::/64 {
  };
};

Where em0 is the interface on OPNsense connected to the Iliadbox LAN. This way, hosts should learn the direct route to reach the delegated prefix (2001:db8:a:b::/64).

Unfortunately, this may not be sufficient as support for RIO depends on the host. On Ubuntu, the accept_ra_rt_info_max_plen defaults to 0, which means that all RIOs are ignored. Setting it to 128 makes the above configuration work in my test setup.

I'd make sure both IPv4 and IPv6 forwarding is enabled. This is probably already the case otherwise clients behind OPNsense wouldn't be able to reach the Internet, but it's an easy check to make. Remember these are separate sysctl settings.

I suggest temporarily disabling the actual firewalling on OPNsense, so you know whether you're debugging a routing issue or a firewalling one.

While I’m still not able to reach inside the firewall from the LAN, at least the firewall is seeing the request, so this is a big progress.

How are you checking this ? Is that a ping to the firewall itself ?

Have you tested from inside the firewall to the LAN ?

I usually reach for tcpdump to debug this sort of problems. For example, when running a ping from the LAN to inside the firewall, can you see the packets exit the "inner" interface ?
For reference, that would be (as root): tcpdump -ni <interface_name> icmp6
If you don't see them packets exit, it's likely a firewall issue.
If you see the packets exit, then either the target host is not receiving them (firewall issue on the host ? If you're testing using ping, remember Windows defaults to blocking incoming pings), or it is sending replies in the wrong direction.

I’ve set explicit rules in OPNsense to allow all ICMPv6 traffic, indeed pinging from a remote host I can reach inside my OPNsense network.

Do you pass all ICMPv6 traffic in all directions, or did you set specific IP prefixes ?

Hello Marco,

Thanks for reporting back and sharing the working configuration !