IPv6 DHCP server connection issue with nftables firewall

NFT
1

I’m having trouble with my IPv6 DHCP connection when using nftables. Here’s what’s going on:

My nftables config seems okay for most things. But when I run dhclient -6, I only see outgoing messages:

XMT: Creating Rebind, time passed: 606790 ms.
XMT:  X-- IA_NA 1e:dd:f2:18
XMT:  | X-- Renew request  +3600
XMT:  | X-- Rebind request +5400
...

The problem is I’m not getting any Advertise messages back. It’s weird because everything works fine when I turn off nftables.

I’ve double-checked my config and I’m pretty sure the issue is there somewhere. But I can’t figure out what’s wrong.

Does anyone know what might be causing this? I’d really appreciate some help figuring out why my IPv6 DHCP isn’t working with nftables on. Thanks!

2

Have you checked your nftables rules for DHCPv6 specifically? I had a similar issue and found that I needed to explicitly allow incoming traffic on UDP port 547 for DHCPv6 to work properly. Try adding a rule like this to your nftables config:

udp dport 547 accept

This should allow the Advertise messages from the DHCP server to get through. Also, make sure you’re not inadvertently blocking ICMPv6 traffic, as that can cause issues with IPv6 connectivity. If you’re still having trouble after adding the rule, you might want to temporarily set your input policy to accept and then add specific deny rules. This can help isolate which rule is causing the problem.

3

hey mate, check if ur nftables lets dhcpv6 in. add rule for udp port 547 and dont block icmpv6. if striles still occur, flip input policy to accept and then add deny rules to spot the culprit. good luck!

4

hey there! have you thought about using tcpdump to see whats actually happening on the network? it might give you some clues about where things are going wrong. you could try something like:

tcpdump -i eth0 -n udp port 547

(replace eth0 with your network interface)

this will show you the dhcpv6 traffic and might help pinpoint if the packets are even reaching your machine. if you see outgoing packets but no responses, thats a big hint!

also, have you checked if your router/dhcp server is actually configured to hand out ipv6 addresses? sometimes thats the culprit and not the firewall at all.

let us know what you find out! im really curious to see what the issue turns out to be.