So far I have been enjoying the new v6 beta!
Only issue I have been seeing is that my network overview does not seem to populate any mac addresses.
Is this expected behavior? The only mac addresses are for local device (docker ips, localhost). All other clients just show ip-192.168.xx.xx or ip-fde8:xx::xx.
I have tried both docker version and script installation (on ubuntu) and both seem to have the same results. My log is from a docker on alpine installation I was trying, but all have the same in the hardware address column. Everything works fine as far as I can tell except this. I ran pihole -d but the log was not uploaded. Not sure if that is the right way for v6. Here is the log: pihole-v6 pastebin
Hello! I do have some 2601 addresses. Those are all addresses assigned by OpenWRT from the /60 prefix given by my ISP - so inside my local network.
I do not have any open router ports and was not able to ping my pihole from outside (at least not from my phone, or port scanner apps.)
My ipv6 dns advertises a ULA address.
I'm guessing that these shown up because I have a port forward to route all lookups to my DNS. So, it seems like if I (or another device) run a lookup to an external resolver directly like dig google.com @2606:4700:4700::1111 (cloudflare dns v6) the device uses the external IP since it thinks its routing to the internet?
Please upload a debug log and post just the token URL that is generated after the log is uploaded by running the following command from the Pi-hole host terminal:
https://tricorder.pi-hole.net/xgcjWGMD/
I did a fresh non-docker install on a test proxmox ubuntu system. Still get the same ip-192.168.xx.xx as hardware address.
This option is not in my GUI, but pihole -d worked.
As mentioned, those are public GUA IPv6 addresses (range 2000::/3), i.e. even if the machines reside in your network, they are routable globally.
If all those client GUAs showing up in your Pi-hole do carry your own IPv6 prefix, then at least your Pi-hole has not been accessed by arbitrary public clients.
However, your debug log confirms your statement of propagating an IPv6 ULA address as local DNS server, making it rather unexpected that clients would use their GUA to talk to Pi-hole (and not their ULA).
This may indicate that your observation lies with your firewall, as you've already suspected:
Depending on that rule, it may also explain why Pi-hole cannot associate a correct MAC address with requests that have been forwarded by it.
I saw this note on the openwrt dnsmasq configuration page under the add-mac option.
The MAC address can only be added if the requester is on the same subnet as the dnsmasq server. Note that the mechanism used to achieve this (an EDNS0 option) is not yet standardised, so this should be considered experimental. Also note that exposing MAC addresses in this way may have security and privacy implications.
I am not using dnsmasq as a forwarder here. But perhaps this is a general rule?
My next step is to try using my openwrt dnsmasq as a forwarder and then adding add-subnet=32,128 and add-mac to my openwrt.
Assuming that would mean that your router's firewall forcefully redirects DNS requests on port 53 to your Pi-hole, then your router's dnsmasq would not be involved at all.
You'd have to investigate your firewall rules instead.
Here I find that enabling additional ipv6 support inserts piholes IPv6 address in /etc/resolv.conf. which ends up as a configured DNS server in my windows clients. Without the additional support enabled they use the link local addresses contained in my routers RA.
To confirm the content of my RAs I ran Wireshark. Whether additional support is turned on or off, I only see RAs from my router. This seems to conflict with: Enable this option to enable IPv6 support for the Pi-hole DHCP server. This will allow the Pi-hole to hand out IPv6 addresses to clients **and also provide IPv6 router advertisements (RA) to clients**. This option is only useful if the Pi-hole is configured with an IPv6 address.
