This topic

BT Smart Hub IPv6 Stateless forced DNS options

paulby — Fri, 23 Sep 2022 07:29:55 GMT

Greetings,

With regard to IPv6 enabled BT Home Hubs and Smart Hubs.

Please could I ask that the option to manage IPv6 is consistent with the options to manage IPv4 to allow for BT customers to manage DNS on both IP protocols?

IPv4 local/private addressing using DHCP can be completely disabled on the Home/Smart hubs allowing for the management of addressing and options to be provided by another service other than the Home/Smart hub. With IPv4 RFC1918 addresses that are NAT'd, it's fair to say that they'll never change on the home side of the router, this is good an reasonable, thank you. It's important to reiterate IPv4 RFC1918 addressing will likely never change on the home LAN so complete handoff of IPv4 RFC1918 address management to another device is possible.

However, with regard to IPv6 GUA addresses that could change at the behest of the network configuration, the BT Smart/Home Hub plays a more important role in the dynamic addressing of the downstream devices. It's the only thing in the network that authoritatively knows what the IPv6 GUA prefix is and should be at any point in time after BT remote reconfiguration/restarts etc. It's therefore reaasonable this device plays the role of the router providing ICMPv6 Router Advertisements with GUA prefix information to the home network to which devices are connected.

The specific issue is the ENFORCEMENT of the ICMPv6 Option when using both Stateless (most urgently), and Stateful IPv6 addressing options in the Advanced configuration.
This is a stateless RA packet from a Smart Hub 2, stateful shows the same option so I won't repost.
The stateless RA has the M and O bits set to 0 and 1 respectively which is fine.
Note the offending option set in bold

Internet Control Message Protocol v6
Type: Router Advertisement (134)
Code: 0
Checksum: 0xf488 [correct]
[Checksum Status: Good]
Cur hop limit: 64
Flags: 0x40, Other configuration, Prf (Default Router Preference): Medium
0... .... = Managed address configuration: Not set
.1.. .... = Other configuration: Set
..0. .... = Home Agent: Not set
...0 0... = Prf (Default Router Preference): Medium (0)
.... .0.. = Proxy: Not set
.... ..0. = Reserved: 0
Router lifetime (s): 180
Reachable time (ms): 0
Retrans timer (ms): 0
ICMPv6 Option (Prefix information : {GUA}::/64)
ICMPv6 Option (Recursive DNS Server fe80::d686:60ff:fe80:d6c4)
ICMPv6 Option (MTU : 1492)
ICMPv6 Option (Source link-layer address : d4:86:60:80:d6:c4)

I feel quite confident that the inclusion of the RDNSS option is not an IETF RFC requiremenet otherwise that would cause tension in Enterprise and Service Provider equipment.

So to allow your customers to manage DNS on BOTH IP protocols which is key to privacy and a great deal of threat management whilst still enjoying the service provided by the Home/Smart Hubs and the WiFi options that allow for excellent coverage without going to market for third party equipment could I please ask that this IPv6 option is removed to make IPv6 and specifically DNS management consistent with the IPv4 management of the devices. I would really appreciate this being considered in future firmware upgrades to the Smart/Home Hubs and to be updated as to the consideration of the request.

Kind Regards
Paul

Re: BT Smart Hub IPv6 Stateless forced DNS options

Keith_Beddoe — Fri, 23 Sep 2022 07:50:27 GMT

@paulby

Please bear in mind that this is only a BT Residential Customer to Customer forum, so any requests posted here, will not go to BT.

https://community.bt.com/t5/Announcements-Guides-Community/Welcome-to-the-BT-Community-Forum/td-p/1545504

Re: BT Smart Hub IPv6 Stateless forced DNS options

paulby — Fri, 23 Sep 2022 12:40:08 GMT

Thanks Keith,

Specifically then, do you know the right route to raise this request through? If you could share - if you know - then perhaps others with the same concern could follow the same route using the same language to mount pressure for the change.
Regards

Paul

Re: BT Smart Hub IPv6 Stateless forced DNS options

Keith_Beddoe — Fri, 23 Sep 2022 13:06:41 GMT

@paulby

BT do have a team which deal with these sorts of things. All I can do is to ask a moderator to respond here, and perhaps offer to pass the question to them.

Re: BT Smart Hub IPv6 Stateless forced DNS options

paulby — Fri, 23 Sep 2022 13:32:51 GMT

Thanks! Looking forward to hearing from you.

Re: BT Smart Hub IPv6 Stateless forced DNS options

Keith_Beddoe — Fri, 23 Sep 2022 13:44:47 GMT

@paulby

I am just a customer. The moderators are the only employees here, and they may reply on this thread.

Re: BT Smart Hub IPv6 Stateless forced DNS options

NeilO — Fri, 23 Sep 2022 14:13:11 GMT

@paulby and @Keith_Beddoe I've emailed a contact in the hub team highlighting this thread.

Thanks

Neil

Re: BT Smart Hub IPv6 Stateless forced DNS options

paulby — Tue, 04 Oct 2022 07:23:25 GMT

Hi Neil,

What did the hub team come back with?
I’m happy to raise the request formally through other more appropriate channels if it would make a more coherent outcome.
Do let me know.

Paul

Re: BT Smart Hub IPv6 Stateless forced DNS options

gspearson — Tue, 04 Oct 2022 08:32:50 GMT

I'd love to know what this is about!

Re: BT Smart Hub IPv6 Stateless forced DNS options

licquorice — Tue, 04 Oct 2022 08:45:57 GMT

The intricacies of IPv6, which is totally different to IPv4 in operation.

Re: BT Smart Hub IPv6 Stateless forced DNS options

paulby — Tue, 04 Oct 2022 09:56:08 GMT

Can I guide that reply slightly in that it's more about a lack of consisitency in protocol management on the BT Hub devices. As @licquorice says, IPv4 and IPv6 are different protocols. Because both are delivered, we have to pay attention to both. Your home devices on a BT Hub might use one, the other or both depending on the capabilities of the device.
BT do a very good job on the Hubs.
DNS queries - I would speculate - have "value" and are likely monetised by BT, which is all fair and good, but primarily BT require Hub connections to work with nothing else than a hub placed in the home. Totally fine maximum props to BT on that.
But to allow customers to choose their own DNS providers in IPv4, but not in IPv6 is quite strange and doesn't make any technical or policy sense.
This thread is about allowing the configuration to remove the ICMPv6 RDNSS advertisement to allow customers to choose their IPv6 DNS resolvers aswell as their own IPv4 resolvers as is already done. It's literally one step away from being the perfect service provider deployment - in my opinion of course 🙂 .
Ideally a new firmware update can be crafted which allows for the ICMPv6 RDNSS advertisement to be turned off.
Again, looking forward to hearing back from the Hub team.
Regards

Paul

Re: BT Smart Hub IPv6 Stateless forced DNS options

licquorice — Tue, 04 Oct 2022 11:22:36 GMT

I have re-read your original post and cnot sure I understand where the problem lies.

Currently BT do not have IPv6 DNS servers, they use IPv4 servers to serve both IPv4 and IPv6 addresses.

They also allow any third party IPv6 DNS server to be used

Re: BT Smart Hub IPv6 Stateless forced DNS options

paulby — Tue, 04 Oct 2022 14:15:51 GMT

@licquorice It'll take me some time to author a response to re-iterate the problem later should this not suffice.
In short, you're completely correct, BT don't seem to have their RDNS servers addressed with IPv6. That is by the by, really.
The BT hub uses v6 or v4 as the local (home side) transport and then forwards requests over v4 to the BT DNS servers.
BT also allow by default one to send queries to any UDP/TCP port from a device on the local network to any service you wish. That's great, the KEY here is that you have to configure each device to do so on either v6 or v4 by hand.

Because v6 is an end to end protocol and isn't translated by the Hub as with v4, the addressing on the "home" side of the hub is critical. Sure, you can use ULA - which is a whole separate subject - but the GUA prefix is advertised in stateless mode with the unwelcome addition of the ICMPv6 RDNSS. This protocol option in stateless mode is usually offered by some other service other than the Router announcing its v6 Router Advertisements. This is the nub of the problem.

I've partially gone in to details to assist your understanding but I believe the Hub team will have a very good idea about the issue described and I do hope they are considering the request aside from our dialogue. Perhaps @NeilO can give any ideas as to thoughts?

Paul

Re: BT Smart Hub IPv6 Stateless forced DNS options

NeilO — Tue, 04 Oct 2022 14:24:15 GMT

Hi, @paulby I've emailed our contact in the Hub team again today chasing this up.

Thanks

Neil

Re: BT Smart Hub IPv6 Stateless forced DNS options

licquorice — Tue, 04 Oct 2022 15:37:15 GMT

@paulby wrote:

@licquorice It'll take me some time to author a response to re-iterate the problem later should this not suffice.
In short, you're completely correct, BT don't seem to have their RDNS servers addressed with IPv6. That is by the by, really.
The BT hub uses v6 or v4 as the local (home side) transport and then forwards requests over v4 to the BT DNS servers.

Agreed
BT also allow by default one to send queries to any UDP/TCP port from a device on the local network to any service you wish. That's great, the KEY here is that you have to configure each device to do so on either v6 or v4 by hand.

Exactly, to use anything other than BT DNS, you have to configure it per device.

Because v6 is an end to end protocol and isn't translated by the Hub as with v4, the addressing on the "home" side of the hub is critical. Sure, you can use ULA - which is a whole separate subject - but the GUA prefix is advertised in stateless mode with the unwelcome addition of the ICMPv6 RDNSS. This protocol option in stateless mode is usually offered by some other service other than the Router announcing its v6 Router Advertisements. This is the nub of the problem.

I've partially gone in to details to assist your understanding but I believe the Hub team will have a very good idea about the issue described and I do hope they are considering the request aside from our dialogue. Perhaps @NeilO can give any ideas as to thoughts?

Paul

I'm probably missing something here, but that address is surely just the link local address of the hub, not a DNS server, just the gateway.

Re: BT Smart Hub IPv6 Stateless forced DNS options

licquorice — Tue, 04 Oct 2022 15:31:27 GMT

@paulby Does RFC 8106 shed any light?

Re: BT Smart Hub IPv6 Stateless forced DNS options

licquorice — Tue, 04 Oct 2022 15:53:57 GMT

Wireshark

ICMPv6 Option (Recursive DNS Server fe80::be30:d9ff:fe01:32f0)
Type: Recursive DNS Server (25)
Length: 3 (24 bytes)
Reserved
Lifetime: 60
Recursive DNS Servers: fe80::be30:d9ff:fe01:32f0
ICMPv6 Option (MTU : 1492)
ICMPv6 Option (Source link-layer address : bc:30:d9:01:32:f0)

Hub Manager

IPv6 LAN details

Link local address:

fe80::be30:d9ff:fe01:32f0/64

Re: BT Smart Hub IPv6 Stateless forced DNS options

paulby — Tue, 04 Oct 2022 16:03:10 GMT

Shed any light? Well, the RFC describes the process that's occuring to some degree if not exactly.
I'm 100% clear on what's occuring. Going back to the title of the thread, RDNSS options are being forced in lieu of running DHCPv6 services on the local segment. But as with turning off DHCPv4 if one is running DHCPv6 services on the segment this enforcement drives over the hopes of a legible configuration with two systems annoucing, one via the BT Hub and one of your own making. That's a very very poor outcome.

The three v6 configuration options (ULA aside) on the BT Hub are stateless (default), stateful and off. The only setting that removes the ICMPv6 RDNSS configuration is "off". This isn't useful as at that point the GUA address space is _completely_ manual and adrift from whatever GUA /56 maybe allocated on the BT Hub from that point on.
The setting I'm suggesting that is missing here is to turn off ICMPv6 RDNSS on Stateless v6 (perhaps even "Turn off RFC8106", but that may be a bit opaque). Maybe even better - Allow configuration of the ICMPv6 RDNSS setting to be a configurable v6 address other than the LLA address of the BT Hub. That! Now that would be really great. 🙂
DNS isn't forced on v4, so it doesn't make senses it's forced on v6 either technically or via policy.

Just to refocus, this is all about DNS. DNS is a key service on the modern Internet. Again, v4 configuration on the BT Hub gives you autonomy, and v6 should allow the same.

Many thanks.
Paul

Re: BT Smart Hub IPv6 Stateless forced DNS options

licquorice — Tue, 04 Oct 2022 16:17:41 GMT

@paulby wrote:

Just to refocus, this is all about DNS. DNS is a key service on the modern Internet. Again, v4 configuration on the BT Hub gives you autonomy, and v6 should allow the same.

Many thanks.
Paul

But it doesn't, you can't configure IPv4 DNS on the hub, only on each device. I must be missing something here, I can't see the difference between IPv4 and IPv6 with regard to autonomy.

Re: BT Smart Hub IPv6 Stateless forced DNS options

ptrduffy — Fri, 07 Oct 2022 16:16:24 GMT

If I'm understanding correctly, the OP would like to run his own DHCPv6 server on his local network, and use that to configure DNS for the local hosts. He can get similar behaviour on IPv4 by simply turning off DHCP on the Hub. It would appear that the only way to stop the Hub sending the DNS server details in IPv6 is by disabling IPv6 completely.

However, in the original post it would appear that the Hub's IPv6 RA message has the "O" bit set to 1. This indicates that "Other Information" is available to hosts via DHCPv6, so the hosts should be making a DHCPv6 request. So, my first question to the OP would be, are the hosts indeed making DHCPv6 requests?

If the hosts are making these requests, then there is the further complication that they will now end up with 2 DNS server addresses - one via the Hub RA message, and one from DHCP. I'm fairly certain that the relevant RFCs suggest that DHCP-delivered addresses should take precedence - but it's been a number of years since I worked in this area, and we could well be in the realms of something that is implementation dependent.

I think the OP's suggestion of an option to not send the DNS address in the RA message (or, even better, allow the address that is sent to be configurable) is a good idea.