ipv6 address and subnet configuration

Jay

feurry try adding these to /etc/rc.conf
ip6addrctl=YES ip6addrctl_policy=ipv6_prefer

Jay

Also you can add these for DHCP

dhcpcd=YES
dhcpcd_flags="-6 eth0"

You can replace eth0 to your network interface

feurry

Thanks @Jay

The dhcpcd flags didn't work. I don't even get an ipv4 address, so I'm not surprised the ipv6 didn't get an address. I have a static IP anyway, so manually configuring it is probably better.

ip6addrctl didn't seem to change anything either.

kim

The gateway must be on the same network as the host address. I would double check that the gateway and netmask are correct.

To configure a static IPv6 address, this is what I prefer to do on NetBSD 10.1 in /etc/rc.conf:

defaultroute='192.0.2.1'
ifconfig_eth0='
    inet 192.0.2.11/25
    inet6 2001:db8::11/64 alias
    # qa
    inet 192.0.2.12/25 alias
    inet6 2001:db8::12/64 alias deprecated
    # http
    inet 192.0.2.13/25 alias
    inet6 2001:db8::13/64 alias deprecated
    rtsol
'
dns_search='site.example.com example.com'
dns_nameservers='192.0.2.115 8.8.8.8 1.1.1.1'
dns_options='timeout:2 attempts:3 edns0 no-tld-query'

I'm using rtsol above as on my network the routers are discovered from Router Advertisements (RA). Note that I'm not setting ip6mode and I'm thus using the default of ip6mode=host. (The net.inet6.ip6.accept_rtadv sysctl no longer exists, as you've discovered.)

To use a static gateway for IPv6, you would remove the rtsol line from ifconfig_eth0, and set defaultroute6 instead:

defaultroute6='2001:db8::1'

But as I mentioned in the beginning, the default gateway must be on the same subnet as the host. This means that either the default gateway address or the the subnet mask (/64) you have is incorrect. (It is possible that /48 is the netmask you should use.)

Finally, please check your firewall rules. If the default gateway is reachable when you ping it, but then stops answering, it could be that your firewall is blocking IPv6 Neighbor Discovery (ND). You can inspect discovered neighbors with ndp(8):

ndp -a

You should see an entry for the gateway address, and its expiration time.

For the firewall rules, you could look at /usr/share/examples/npf/host-npf.conf or just make sure you allow the necessary ICMPv6.

Here is my firewall:

# @(#)/etc/npf.conf

alg "icmp"

procedure "log" {
    # Send log events to npflog0, see npfd(8)
    log: npflog0
}

group default {

    #
    # Allow select IPv4 ICMP.
    #
    pass in  final family inet4 proto icmp icmp-type echoreply    all
    pass in  final family inet4 proto icmp icmp-type unreach      all
    pass in  final family inet4 proto icmp icmp-type sourcequench all
    pass in  final family inet4 proto icmp icmp-type echo         all
    pass in  final family inet4 proto icmp icmp-type timxceed     all
    pass in  final family inet4 proto icmp icmp-type paramprob    all
    pass out final family inet4 proto icmp all

    #
    # Allow select IPv6 ICMP.
    #
    # ICMPv6 packets which must not be dropped, see
    # https://tools.ietf.org/html/rfc4890#section-4.4.1
    #
    pass in  final family inet6 proto ipv6-icmp icmp-type unreach         all
    pass in  final family inet6 proto ipv6-icmp icmp-type packet_too_big  all
    pass in  final family inet6 proto ipv6-icmp icmp-type timxceed        all
    pass in  final family inet6 proto ipv6-icmp icmp-type paramprob       all
    pass in  final family inet6 proto ipv6-icmp icmp-type echo            all
    pass in  final family inet6 proto ipv6-icmp icmp-type echoreply       all
    pass in  final family inet6 proto ipv6-icmp icmp-type rtsol           all
    pass in  final family inet6 proto ipv6-icmp icmp-type rtadv           all #
    pass in  final family inet6 proto ipv6-icmp icmp-type neighsol        all #
    pass in  final family inet6 proto ipv6-icmp icmp-type neighadv        all #
    pass in  final family inet6 proto ipv6-icmp icmp-type invneighsol     all
    pass in  final family inet6 proto ipv6-icmp icmp-type invneighrep     all
    pass in  final family inet6 proto ipv6-icmp icmp-type mcastlistenq    from fe80::/10
    pass in  final family inet6 proto ipv6-icmp icmp-type mcastlistenrep  from fe80::/10
    pass in  final family inet6 proto ipv6-icmp icmp-type mcastlistendone from fe80::/10
    pass in  final family inet6 proto ipv6-icmp icmp-type mcastlistenrep2 from fe80::/10
    pass in  final family inet6 proto ipv6-icmp icmp-type cga_sol         all
    pass in  final family inet6 proto ipv6-icmp icmp-type cga_adv         all
    pass in  final family inet6 proto ipv6-icmp icmp-type mcast_rtadv     from fe80::/10
    pass in  final family inet6 proto ipv6-icmp icmp-type mcast_rtsol     from fe80::/10
    pass in  final family inet6 proto ipv6-icmp icmp-type mcast_rtterm    from fe80::/10
    pass out final family inet6 proto ipv6-icmp all

    #
    # Allow everything else on loopback.
    #
    pass final on lo0 all

    #
    # Allow service ports.
    #
    pass stateful in final proto tcp to any port 80
    pass stateful in final proto tcp to any port 443

    #
    # Allow all outbound traffic.
    #
    pass stateful out final all

    #
    # Send back a reset only for new tcp connections.  Do not reset old
    # connections, so outgoing traffic can recreate the firewall state.
    #
    block return in final proto tcp flags S/SA all apply "log"

    # Default deny.
    block final all apply "log"

}

feurry

Thanks @kim

I do not have a firewall enabled, so that shouldn't be affecting anything.

with rstol, there's no default route found, whether I used /64 or /48 for my ip

rm /etc/mygate6

/etc/ifconfig.vioif0
inet 23.173.152.249 netmask 255.255.255.0
inet6 2602:fed2:7116:d82c::1 prefixlen 64 alias
rtsol

netstat -rn
Destination                             Gateway                        Flags    Refs      Use    Mtu Interface
::/104                                  ::1                            UGRS        -        -  33624  lo0
::/96                                   ::1                            UGRS        -        -  33624  lo0
::1                                     lo0                            UHl         -        -  33624  lo0
::127.0.0.0/104                         ::1                            UGRS        -        -  33624  lo0
::224.0.0.0/100                         ::1                            UGRS        -        -  33624  lo0
::255.0.0.0/104                         ::1                            UGRS        -        -  33624  lo0
::ffff:0.0.0.0/96                       ::1                            UGRS        -        -  33624  lo0
2001:db8::/32                           ::1                            UGRS        -        -  33624  lo0
2002::/24                               ::1                            UGRS        -        -  33624  lo0
2002:7f00::/24                          ::1                            UGRS        -        -  33624  lo0
2002:e000::/20                          ::1                            UGRS        -        -  33624  lo0
2002:ff00::/24                          ::1                            UGRS        -        -  33624  lo0
2602:fed2:7116:d82c::/64                link#1                         UC          -        -      -  vioif0
2602:fed2:7116:d82c::1                  link#1                         UHl         -        -      -  lo0
fe80::/10                               ::1                            UGRS        -        -  33624  lo0
fe80::%vioif0/64                        link#1                         UC          -        -      -  vioif0
fe80::216:3eff:fed7:cf50                link#1                         UHl         -        -      -  lo0
fe80::%lo0/64                           fe80::1                        U           -        -      -  lo0
fe80::1                                 lo0                            UHl         -        -      -  lo0
ff01:1::/32                             link#1                         UC          -        -      -  vioif0
ff01:2::/32                             ::1                            UC          -        -  33624  lo0
ff02::%vioif0/32                        link#1                         UC          -        -      -  vioif0
ff02::%lo0/32                           ::1                            UC          -        -  33624  lo0

I decided to move all the settings into /etc/rc.conf like you posted.

/etc/rc.conf
defaultroute="23.173.152.1"
defaultroute6="2602:fed2:7116::1"

ifconfig_vioif0="
    inet 23.173.152.249 netmask 255.255.255.0
    inet6 2602:fed2:7116:d82c::1 prefixlen 48 alias
"
dns_nameservers="9.9.9.9 2620:fe::fe"

add an alias

ifconfig vioif0 inet6 2602:fed2:7116:d82c::5 prefixlen 48 alias

Wait a few minutes until ping doesn't work. It works initially.

ping6 -S 2602:fed2:7116:d82c::5 google.com
PING6(56=40+8+8 bytes) 2602:fed2:7116:d82c::5 --> 2607:f8b0:4023:1002::66
^C
--- google.com ping6 statistics ---
2 packets transmitted, 0 packets received, 100.0% packet loss

ndp -a
Neighbor                                Linklayer Address  Netif Expire    S Fl
fe80::da67:d9ff:fe58:3d1b%vioif0        d8:67:d9:58:3d:1b vioif0 1s        D
2602:fed2:7116::1                       d8:67:d9:58:3d:1b vioif0 1s        D R

# ping the gateway
ping6 -S 2602:fed2:7116:d82c::5 2602:fed2:7116::1
PING6(56=40+8+8 bytes) 2602:fed2:7116:d82c::5 --> 2602:fed2:7116::1
16 bytes from 2602:fed2:7116::1, icmp_seq=0 hlim=64 time=2.481 ms
^C
--- 2602:fed2:7116::1 ping6 statistics ---
1 packets transmitted, 1 packets received, 0.0% packet loss
round-trip min/avg/max/std-dev = 2.481/2.481/2.481/0.000 ms

# ping works
ping6 -S 2602:fed2:7116:d82c::5 google.com
PING6(56=40+8+8 bytes) 2602:fed2:7116:d82c::5 --> 2607:f8b0:4023:1002::66
16 bytes from 2607:f8b0:4023:1002::66, icmp_seq=0 hlim=109 time=1.924 ms
16 bytes from 2607:f8b0:4023:1002::66, icmp_seq=1 hlim=109 time=1.941 ms
^C
--- google.com ping6 statistics ---
2 packets transmitted, 2 packets received, 0.0% packet loss
round-trip min/avg/max/std-dev = 1.924/1.933/1.941/0.012 ms

ndp -a
Neighbor                                Linklayer Address  Netif Expire    S Fl
2602:fed2:7116::1                       d8:67:d9:58:3d:1b vioif0 19s       R R

I noticed this neighbor comes and goes, fe80::da67:d9ff:fe58:3d1b%vioif0, and has the same linklayer address as the gateway 2602:fed2:7116::1, so I'm assuming it's one and the same. I have been able to ping with and without that neighbor being present, so I'm not sure why it comes and goes like that.

I've tried using ndp to manipulate the table, but I can't figure out how to use the program. All I was able to do was delete an entry with ndp -d fe80::da67:d9ff:fe58:3d1b%vioif0 I couldn't add one using ndp -s node1 2602:fed2:7116::1. I couldn't find any examples and don't know what a 'node' is. I was just hoping to make the neighbor 'permanent' because I noticed the 'Expire' time is really short.

I'm going to re-install one of the provider linux images and get some network details from that to post here.

feurry

Here's the ip information with host provided debian 12.0 install. I don't see anything different about it.
my address is /64, but for some reason netstat (which is deprecated) shows a /128

p addr
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
    link/ether 00:16:3e:d7:cf:50 brd ff:ff:ff:ff:ff:ff
    altname enp0s3
    altname ens3
    inet 23.173.152.249/24 brd 23.173.152.255 scope global eth0
       valid_lft forever preferred_lft forever
    inet6 2602:fed2:7116:d82c::1/64 scope global 
       valid_lft forever preferred_lft forever
    inet6 fe80::216:3eff:fed7:cf50/64 scope link 
       valid_lft forever preferred_lft forever


ip -6 route show
::1 dev lo proto kernel metric 256 pref medium
2602:fed2:7116:d82c::/64 dev eth0 proto kernel metric 256 pref medium
fe80::/64 dev eth0 proto kernel metric 256 pref medium
default via 2602:fed2:7116::1 dev eth0 metric 1024 onlink pref medium


netstat -rn6
Kernel IPv6 routing table
Destination                    Next Hop                   Flag Met Ref  Use If
::1/128                        ::                         U    256 2      0 lo
2602:fed2:7116:d82c::/64       ::                         U    256 1      0 eth0
fe80::/64                      ::                         U    256 1      0 eth0
::/0                           2602:fed2:7116::1          UGH  1024 2      0 eth0
::1/128                        ::                         Un   0   7      0 lo
2602:fed2:7116:d82c::1/128     ::                         Un   0   4      0 eth0
fe80::216:3eff:fed7:cf50/128   ::                         Un   0   2      0 eth0
ff00::/8                       ::                         U    256 6      0 eth0
::/0                           ::                         !n   -1  1      0 lo


ip neighbor
23.173.152.1 dev eth0 lladdr d8:67:d9:58:3d:1b REACHABLE 
fe80::da67:d9ff:fe58:3d1b dev eth0 FAILED 
2602:fed2:7116::1 dev eth0 lladdr d8:67:d9:58:3d:1b router REACHABLE 

cat /etc/network/interfaces
# The loopback network interface
auto lo
iface lo inet loopback

# The primary network interface
auto eth0
iface eth0 inet static
	address 23.173.152.249
	netmask 255.255.255.0
	post-up route add 23.173.152.1 dev eth0
	post-up route add default gw 23.173.152.1 dev eth0

iface eth0 inet6 static
	accept_ra 0
	address 2602:fed2:7116:d82c:0000:0000:0000:0001
	netmask 64
	gateway 2602:fed2:7116::1

Added an alias, and it works fine.

ip addr add 2602:fed2:7116:d82c::2/64 dev eth0

ping6 -I 2602:fed2:7116:d82c::2 google.com
PING google.com(lcdfwe-in-f138.1e100.net (2607:f8b0:4023:100b::8a)) from 2602:fed2:7116:d82c::2 : 56 data bytes
64 bytes from lcdfwe-in-f138.1e100.net (2607:f8b0:4023:100b::8a): icmp_seq=1 ttl=110 time=2.43 ms
64 bytes from lcdfwe-in-f138.1e100.net (2607:f8b0:4023:100b::8a): icmp_seq=2 ttl=110 time=2.46 ms
^C
--- google.com ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1001ms
rtt min/avg/max/mdev = 2.426/2.444/2.463/0.018 ms

rvp

feurry I think this is because the gateway is on a different subnet. I tried adding a route to the gateway, but that didn't help.

route add -inet6 2602:fed2:7116::1 2602:fed2:7116:d82c::1

Try adding an -interface flag to tell the kernel that that address is directly reachable on the i/f.

ifconfig vioif0 inet6 2602:fed2:7116:d82c::1 prefixlen 64 alias
route add -inet6 -interface 2602:fed2:7116::1 2602:fed2:7116:d82c::1        # <---
route add -inet6 default 2602:fed2:7116::1

feurry

Thanks @rvp

I tried something similar before, but didn't document it. Here's a few more attempts at getting the /64 to work.

Note: I restarted between tests. Starting with these settings.

/etc/rc.conf
defaultroute="23.173.152.1"
#defaultroute6="2602:fed2:7116::1"

ifconfig_vioif0="
    inet 23.173.152.249 netmask 255.255.255.0
    inet6 2602:fed2:7116:d82c::1 prefixlen 64 alias
"
dns_nameservers="9.9.9.9 2620:fe::fe"

#1 Adding -interface as suggested.

route add -inet6 -interface 2602:fed2:7116::1 2602:fed2:7116:d82c::1
route add -inet6 default 2602:fed2:7116::1

netstat -rn
Internet6:
Destination                             Gateway                        Flags    Refs      Use    Mtu Interface
::/104                                  ::1                            UGRS        -        -  33624  lo0
::/96                                   ::1                            UGRS        -        -  33624  lo0
default                                 2602:fed2:7116::1              UGS         -        -      -  vioif0
::1                                     lo0                            UHl         -        -  33624  lo0
::127.0.0.0/104                         ::1                            UGRS        -        -  33624  lo0
::224.0.0.0/100                         ::1                            UGRS        -        -  33624  lo0
::255.0.0.0/104                         ::1                            UGRS        -        -  33624  lo0
::ffff:0.0.0.0/96                       ::1                            UGRS        -        -  33624  lo0
2001:db8::/32                           ::1                            UGRS        -        -  33624  lo0
2002::/24                               ::1                            UGRS        -        -  33624  lo0
2002:7f00::/24                          ::1                            UGRS        -        -  33624  lo0
2002:e000::/20                          ::1                            UGRS        -        -  33624  lo0
2002:ff00::/24                          ::1                            UGRS        -        -  33624  lo0
2602:fed2:7116::1                       2602:fed2:7116:d82c::1         UHS         -        -      -  vioif0
2602:fed2:7116:d82c::/64                link#1                         UC          -        -      -  vioif0
2602:fed2:7116:d82c::1                  link#1                         UHl         -        -      -  lo0
fe80::/10                               ::1                            UGRS        -        -  33624  lo0
fe80::%vioif0/64                        link#1                         UC          -        -      -  vioif0
fe80::216:3eff:fed7:cf50                link#1                         UHl         -        -      -  lo0
fe80::%lo0/64                           fe80::1                        U           -        -      -  lo0
fe80::1                                 lo0                            UHl         -        -      -  lo0
ff01:1::/32                             link#1                         UC          -        -      -  vioif0
ff01:2::/32                             ::1                            UC          -        -  33624  lo0
ff02::%vioif0/32                        link#1                         UC          -        -      -  vioif0
ff02::%lo0/32                           ::1                            UC          -        -  33624  lo0

ping6 -S 2602:fed2:7116:d82c::1 2602:fed2:7116::1
PING6(56=40+8+8 bytes) 2602:fed2:7116:d82c::1 --> 2602:fed2:7116::1
ping6: sendmsg: Network is down

The first route add adds my address as a gateway, which seemed backward to me.

#2 Same as 1 but reversed the address order, and it fails to add the route. I guess I was wrong.

route add -inet6 -interface 2602:fed2:7116:d82c::1 2602:fed2:7116::1
route: writing to routing socket: Network is unreachable
add host 2602:fed2:7116:d82c::1: gateway 2602:fed2:7116::1: Network is unreachable

#3 Trying -ifa flag, I'm able to add the gateway in 1 command, but ping doesn't work.

route add -inet6 default -ifa 2602:fed2:7116:d82c::1 2602:fed2:7116::1

netstat -rn
Internet6:
Destination                             Gateway                        Flags    Refs      Use    Mtu Interface
::/104                                  ::1                            UGRS        -        -  33624  lo0
::/96                                   ::1                            UGRS        -        -  33624  lo0
default                                 2602:fed2:7116::1              UGS         -        -      -  vioif0
::1                                     lo0                            UHl         -        -  33624  lo0
::127.0.0.0/104                         ::1                            UGRS        -        -  33624  lo0
::224.0.0.0/100                         ::1                            UGRS        -        -  33624  lo0
::255.0.0.0/104                         ::1                            UGRS        -        -  33624  lo0
::ffff:0.0.0.0/96                       ::1                            UGRS        -        -  33624  lo0
2001:db8::/32                           ::1                            UGRS        -        -  33624  lo0
2002::/24                               ::1                            UGRS        -        -  33624  lo0
2002:7f00::/24                          ::1                            UGRS        -        -  33624  lo0
2002:e000::/20                          ::1                            UGRS        -        -  33624  lo0
2002:ff00::/24                          ::1                            UGRS        -        -  33624  lo0
2602:fed2:7116:d82c::/64                link#1                         UC          -        -      -  vioif0
2602:fed2:7116:d82c::1                  link#1                         UHl         -        -      -  lo0
fe80::/10                               ::1                            UGRS        -        -  33624  lo0
fe80::%vioif0/64                        link#1                         UC          -        -      -  vioif0
fe80::216:3eff:fed7:cf50                link#1                         UHl         -        -      -  lo0
fe80::%lo0/64                           fe80::1                        U           -        -      -  lo0
fe80::1                                 lo0                            UHl         -        -      -  lo0
ff01:1::/32                             link#1                         UC          -        -      -  vioif0
ff01:2::/32                             ::1                            UC          -        -  33624  lo0
ff02::%vioif0/32                        link#1                         UC          -        -      -  vioif0
ff02::%lo0/32                           ::1                            UC          -        -  33624  lo0

ping6 2602:fed2:7116::1
PING6(56=40+8+8 bytes) 2602:fed2:7116:d82c::1 --> 2602:fed2:7116::1
ping6: sendmsg: Network is down

I've been trying other things, but pretty much out of ideas.

On another note, I signed up with another provider and they created what they called a 'dedicated routing subnet' for me. They gave me an IP and gateway on the same subnet, and a separate subnet with a /48 for me to use. I am able to add aliases and everything works fine.

on that server

/etc/rc.conf
defaultroute6="2a0a:8dc0:3000:15::1"
ifconfig_vioif0="
    inet6 2a0a:8dc0:3000:15::2 prefixlen 126 alias
    inet6 2a0a:8dc0:3015::a prefixlen 48 alias
"

rvp

feurry The first route add adds my address as a gateway, which seemed backward to me.

Yes, that's right. As the route(8) man-page says:

     If the destination is directly reachable via an interface requiring no
     intermediary system to act as a gateway, the -interface modifier should
     be specified; the gateway given is the address of this host on the common
     network, indicating the interface to be used for transmission.

so, we're saying: to reach the directly-connected host 2602:fed2:7116::1 use the I/F whose address is 2602:fed2:7116:d82c::1. The FreeBSD route allows an I/F name instead of an address there, which makes this clearer. I'd hoped adding a special route would make a difference. But, since it didn't, you should ask on tech-net about this. Maybe the *BSDs work differently compared to Linux in this respect?

feurry

It's alive! (mostly)

One small change to #1. Instead of 7116::1 I used 7116::/48 and changed d82c::1 to d82c:: and I figured out how to use ndp.

route add -inet6 -interface 2602:fed2:7116::/48 2602:fed2:7116:d82c::
route add -inet6 default 2602:fed2:7116::1
ndp -s ggate d8:67:d9:58:3d:1b

To use ndp I figured out that a 'node' was an entry in /etc/hosts and you need the linklayer address (mac). I know the linklayer is d8:67:d9:58:3d:1b from previous testing/data.

cat /etc/hosts
2602:fed2:7116::1	ggate

and with that I can now use ndp -s ggate d8:67:d9:58:3d:1b to make an ndp entry!!

The bad news, it behaves just like before when I used /48 prefix on my address, and on my FreeBSD server. My connection drops after a few minutes until I ping the gateway again.

I thought the ndp entry would solve that, but apparently not. There has to be some reason it works on Linux but not on BSD.

feurry

This is solved! My vps provider uses virtualizor and apparently had a setting that was causing all these ipv6 problems. According to them "Virtualizor seems to have a block in the configuration. An unblock was applied for that IP."

The settings are pretty straight forward, but I'm posting them for clarity. Here's the working config using a link-local address for the gateway, which I was told is preferred.

/etc/rc.conf

defaultroute="23.173.152.1"
defaultroute6="fe80::da67:d9ff:fe58:3d1b%vioif0"

ifconfig_vioif0="
    inet 23.173.152.249 netmask 255.255.255.0
    inet6 2602:fed2:7116:d82c::1 prefixlen 64 alias
    inet6 2602:fed2:7116:d82c::2 prefixlen 64 alias
"

And here's a working version using the IP address of the gateway.

/etc/rc.conf

defaultroute="23.173.152.1"

ifconfig_vioif0="
    inet 23.173.152.249 netmask 255.255.255.0
    inet6 2602:fed2:7116:d82c::1 prefixlen 64 alias
    inet6 2602:fed2:7116:d82c::2 prefixlen 64 alias
    !route add -inet6 default 2602:fed2:7116::1 -connected -ifp vioif0
"

I need to thank everyone here for helping, the @tech-net list, and especially Christof, who walked me through using tcpdump and even provided a patch that got it working around the broken virtualizor settings. I don't think I would have convinced my provider the problem was on there end without the help of the NetBSD community.

Here's the thread from @tech-net. The short version is Linux sends neighbor advertisements like this. (from the IP)

2602:fed2:7116:d82c::5 > fe80::da67:d9ff:fe58:3d1b

NetBSD (and I believe Free and Open as well) send neighbor advertisements like this. (from the link-local address)

fe80::216:3eff:fed7:cf50 > fe80::da67:d9ff:fe58:3d1b

For whatever reason, virtualizor allows one but not the other, until the IP is unblocked.