IPv6AcceptRA = False default in LXC for IPv6 DHCP
- Thread starter b3nw
- Start date
-
- Tags
- ipv6 lxc lxc network
Hi,
router advertisements are part of SLAAC not DHCP, so you have to choose that instead.
If you have some special requirements, you can also completely disable proxmox control of the networking in the container by running
router advertisements are part of SLAAC not DHCP, so you have to choose that instead.
If you have some special requirements, you can also completely disable proxmox control of the networking in the container by running
touch /etc/systemd/network/.pve-ignore.eth0.network (in the container) and then edit /etc/network/interfaces.There are various threads about "IPv6AcceptRA" setting in (Ubuntu) LXCs defaulting to true for SLAAC and to false for DHCPv6. Let me emphasize that IPv6 router advertisements are neither part of SLAAC nor DHCPv6. RAs are the standard way for a client to get routes when joining a network, independent of the address configuration being static, SLAAC or DHCPv6.
For reference, the section Router Advertisements (Or: “Where is the DHCPv6 gateway option?”) in the pfSense documentation explains this quite well.
I agree that creating the
Proposal: Could an upcoming PVE version contain an "Accept IPv6 RA" checkbox in the container network configuration? That would allow to control that important IPv6 setting without having to block the whole container network configuration from being managed through the GUI or the API.
For reference, the section Router Advertisements (Or: “Where is the DHCPv6 gateway option?”) in the pfSense documentation explains this quite well.
I agree that creating the
/etc/systemd/network/.pve-ignore.eth0.network file stops PVE from changing the IPv6AcceptRA setting ... but it also blocks any change to the containers network configuration made from the PVE GUI (or trhough the API). It does that even without showing a warning if you attempt to change the container's network configuration through the PVE GUI.Proposal: Could an upcoming PVE version contain an "Accept IPv6 RA" checkbox in the container network configuration? That would allow to control that important IPv6 setting without having to block the whole container network configuration from being managed through the GUI or the API.
Nice catch, indeed, RA is part of Neighbour Dicovery [1], SLAAC is a separate RFC [2]
[1] https://datatracker.ietf.org/doc/html/rfc4861
[2] https://datatracker.ietf.org/doc/html/rfc4862
I think, especially the staff member who was in this conversation is "retired" (what a funny term, makes you feel like everyone goes straight O.A.P. from Proxmox), you better post this into Bugzilla as a request / bug (your call):
https://bugzilla.proxmox.com/
Thanks @esi_y for the bugzilla link! As I always try to be friendly, I will not declare it as a bug ... but as a feature request to make the IPv6AcceptRA property settable from the GUI / API.
As soon as I find time for it, I will raise a request and post a link here.
Until such a time as this bug is fixed this does the trick, at least for me . It enables RA when DHCPv6 is enabled which - assuming the announcement contains the managed flag as it should if there is a DHCPv6 server available - causes systemd-networkd to enable its DHCPv6 client. See also https://forum.proxmox.com/threads/debian-13-lxc-networking-service-failed.169430/post-806575 for this patch in its full context.
Code:
diff -u usr/share/perl5/PVE/LXC/Setup/Base.pm /usr/share/perl5/PVE/LXC/Setup/Base.pm
--- usr/share/perl5/PVE/LXC/Setup/Base.pm 2025-09-15 19:24:30.000000000 +0200
+++ /usr/share/perl5/PVE/LXC/Setup/Base.pm 2025-10-06 13:15:29.889124763 +0200
@@ -296,6 +296,7 @@
if (defined(my $ip = $d->{ip6})) {
if ($ip eq 'dhcp') {
$dhcp |= $DHCP6;
+ $accept_ra = 'true';
} elsif ($ip eq 'auto') {
$accept_ra = 'true';
} elsif ($ip ne 'manual') {