IPv6

• D

  IPv6 Tutorials
  • dwabraxus  

  2
  1
  Votes
  2
  Posts
  28506
  Views

  J

  Thanks for the tutorial :)
• C

  IPv6 test sites
  • cmb  

  20
  0
  Votes
  20
  Posts
  39939
  Views

  

  Why does this seem like spam to me.. Why does someone join a site just to advertise some site - other than just spam!!! I wouldn't hit that site with your ____ if you know what I mean! There is one thing if you have user X that has been here in the community, and then there is a thread that says hey where do you test Y.. suggesting a site, and then there is accounts that join, and same instant suggest go X.. I should just delete and ban this account.. But its not from IN, so will give the benefit of doubt... For now.
• T

  Multiple IPv6 Prefix Delegation over AT&T Residential Gateway for pfSense 2.4.5
  • ttmcmurry  

  25
  0
  Votes
  25
  Posts
  448
  Views

  T

  Glad to see that y'all got it working. :) Regarding why does it take so long to get an address .. My best guess is more at the AT&T RG's IPv6 stack is simply slow. The RG already knows what /60 is assigned. Delegating that out should be in the tenths of a second to a second to work, end-to-end. The reality is IPv6 is treated like a second class citizen by AT&T and if I'm being truthful, they have zero reason to prioritize developing a better, faster stack. Like chriv, I would be happy to interface with the ONT and be done with it. One of these days I wanted to do a repost of everything for a 'newer' version of pfSense .. since the forum moderators started locking thread edits.
• U

  Problem Loading web pages with ipv6
  • unemployed_ghost  

  12
  0
  Votes
  12
  Posts
  30
  Views

  U

  @Gertjan test-ipv6.com shows my ipv4 and ipv6 ip and score 10/10
• A

  No LAN IPv6 address with Track Interface on WAN
  • azaclauson  

  27
  0
  Votes
  27
  Posts
  101
  Views

  A

  @Jim-Coogan what ended up being a show stopper for me was my ISP only allocating a /64 range to my modem. For DHCPv6 relay to work with pfSense acting as a router you need to be able to use DHCPv6 with Prefix Delegation. To do that you need a bigger allocation than /64, e.g. /56 or /60 etc.
• M

  Automatically generated rules causing issues
  • MikeAce  

  3
  0
  Votes
  3
  Posts
  23
  Views

  M

  The bridged interfaces are ipv4 only. the issue is that the automatically generated rules are floating rules so they apply globally
• B

  Ipv6 - Is this roughly correct?
  • broor  

  8
  0
  Votes
  8
  Posts
  36
  Views

  

  Yeah as Jknott has stated its normal.. It is also possible that the wan never even gets global address, and just use link-local.. Im not a fan of that, I like to see a global address on my wan ;) There is plenty of IPs to go around ;) ISP can afford to assign a global to the transit network ;) edit: to expand on the sheer number of IPs.. A min assignment from RIR for an ISP is a /32 - I just got one for a ipv6 project we are doing from Arin.. That is 65K /48s ;) or 4 billion /64s.. Comcast got a /9 - which is 36 quadrillion /64s - you would think they can afford a few /64 for transit networks ;) And its not like they can't get more... It took a couple of weeks to get the /32 - all you have to do is show basic need.. And a basic plan on how your going to use them.. These ISPs telling users they can only get 1 /64 is just nuts... You can head over to HE and they will give you a /48 you can tunnel for free. I have had mine for over 10 years.. ISPs should have no issues giving users either a 48 or at min a /56 and using a global for their transit network.
• D

  This topic is deleted!
  • DiferMendos  

  4
  0
  Votes
  4
  Posts
  150
  Views
• 

  How does IPv6 negotiation over IPv4's PPPoE work?
  • skilledinept  

  22
  1
  Votes
  22
  Posts
  97
  Views

  

  What if you use a remote receiver? From experience I've learned that DDNS in pfSense, or any other appliance only works when you're "gentle" to it, meaning one hostname. As soon as you add additional hostnames, domains it'll fail to update them so I got a VPS and installed pfSense on it for the static IP they give you, starting at USD5/mo, sometimes less, it's the cheapest static address you can rent. I actually use it for the GIF to HurricaneElectric and tunnel both IPv4 and IPv6 to the local pfSense, I have about the same latency in local IPv4 as in tunneled IPv4 and (double-) tunneled IPv6. But where I'm going with this is: I also use my remote instance's public address as the monitor IP for the local WAN gateway. And since I can contact the remote instance locally through the tunnel, I get statistics on it with any tool, like from which IP a tunnel is has been brought up--which I know would only be mine. "Loopback" Stats. This data can be sent to a syslog server or queried through SNMP. You can query all sorts of data, I check consumption because the VPS has a data cap, I'm used to not having it because of my ISP so this is really handy, you can set it to notify you through a bot on Telegram, Matrix, classic email or a buttload of other integrations it has: The first one is LibreNMS, completely free, does SNMP and syslog, you don't need scripts or databases because it's meant to keep historic data, it's all there as long as you feed it. The second one is VMware's vRealize Log Insight, also free (*with purchase) it only does syslog but it's very comprehensive, king of syslogs, it can proxy the syslog to yet more servers and has this thing called agents, custom-made-on-site apps preconfigured to send data to it and reconfigurable remotely. It's very cool. LibreNMS is like a 2core/2G/20G VM if I'm not mistaken, Log Insight is much hungrier but you can tweak it before first starting it, I discovered. Both need fast disks.
• 

  IPv6 ping/traceroute from Windows 10 PCs
  • kesawi  

  3
  0
  Votes
  3
  Posts
  14
  Views

  

  @virgiliomi said in IPv6 ping/traceroute from Windows 10 PCs: Before I try to offer a reason, can I make a guess that you have Verizon FiOS? Edit: Never mind... I see you're not from the US. We have an ISP in part of the US that has an ICMP Traceroute issue (affects only Windows, not Linux/Mac since they use UDP instead of ICMP by default). I thought that might have been what you were experiencing.
• M

  Cannot get IPV6 to work on multiple vlans (DHCP6 on WAN with PD)
  • mcmikev  

  2
  0
  Votes
  2
  Posts
  25
  Views

  T

  I am not familiar with your ISP so can't be specific, but a few things to double check- You did set the prefix delegation under WAN/DHCP 6 CLIENT CONFIG, and try with prefix hint set ON and OFF?
• 

  Multiple ipv6-nets on LAN with DHCPv6
  dhcpv6 multiple nets • • horshack  

  14
  1
  Votes
  14
  Posts
  67
  Views

  

  @Hikari There's nothing to configure. It just works that way. Pfsense sends out the RA to provide the prefix and the device provides the lower 64 bits. Here are my addresses. I used my unique local addresses, instead of GUA, but the principle is the same. Take a look at the last line and see how it compares with the others. That line is the consistent one and is based on the MAC. inet6 fd48:1a37:2160:0:3c77:80bb:c0cf:522e/64 scope global temporary dynamic inet6 fd48:1a37:2160:0:5b:1416:435d:a8f5/64 scope global temporary deprecated dynamic inet6 fd48:1a37:2160:0:a4fe:df21:d0ee:c629/64 scope global temporary deprecated dynamic inet6 fd48:1a37:2160:0:2879:7de0:b225:47ad/64 scope global temporary deprecated dynamic inet6 fd48:1a37:2160:0:6c73:9d33:6451:150/64 scope global temporary deprecated dynamic inet6 fd48:1a37:2160:0:ecf2:1a5c:e064:3b/64 scope global temporary deprecated dynamic inet6 fd48:1a37:2160:0:494a:77f3:e5c0:2ca6/64 scope global temporary deprecated dynamic inet6 fd48:1a37:2160:0:76d4:35ff:fe5b:f5fa/64 scope global dynamic mngtmpaddr
• 

  pfSense as IPv6 client
  • michaelpietzsch  

  17
  0
  Votes
  17
  Posts
  135
  Views

  

  @Hikari The /x indicates the prefix length. Your LAN gets a /64 prefix, which means 64 bits for the network address, leaving 64 for the device within the LAN. A /128 means the entire 128 bits is prefix leaving no bits for more than 1 device. I doubt it would have anything to do with the MAC, as it's assigned by DHCP. If it was MAC based, it would be obvious. Your LAN gateway demonstrates the link local address is used, not a public address.
• N

  Multiple /64 ULA subnets sharing same WAN /64 prefix via NPTv6?
  • nva  

  6
  1
  Votes
  6
  Posts
  45
  Views

  H

  @JKnott said in Multiple /64 ULA subnets sharing same WAN /64 prefix via NPTv6?: It's amazing how CHEAP some ISPs are, considering the IPv6 address space is so vast. While my ISP initially provided a single /64, that was only temporary and they soon moved to /56. Then there's he.net, which will provide a /48 for free! Before my ISP offered IPv6, I used a tunnel and got a /56 again for free. BTW, the address space is so vast that every single person on earth could have over 4000 /48s and that's with only 1/8th of the entire address space assigned to anything. My ISPs don't even offer more expensive plans, not that I'd accept paying. A tech even told me that only government companies are forced to follow IPv6 standards. As it's a private ISP company, they can use proprietary protocols, and it's my problem if Internet doesn't work fully. Another one told me that I'm "welcome" to cancel the contract if I want to. Indeed, according to IPv6 standard, every ISP receives at least a /32 prefix. With it, these 2 ISPs have more /56 prefixes than IPv4 addresses. @nva said in Multiple /64 ULA subnets sharing same WAN /64 prefix via NPTv6?: My ISP only route single /64 subnet to resident connection. I'm planning to deploy ULA for each of my VLANs and then NPT to that public /64 prefix assigned by ISP. Do I need to worry about suffix conflict? Is there any drawbacks (e.g. latency...) in deploying ULA + NPt compared to just GUA via Track interface? The only problem i can think of is that I would need to manually adjust NPt entries every time my ISP routed prefix change and will try to get it working. Were you able to get it to work? That's what I was considering doing on my OpenWRT a couple years ago but got tired after 2 long fights with both ISPs. Now I'm considering moving to pfSense because of some BusyBox limitations. Are you able to update your VLANs prefixes when your ISP changes it? One ugly thing I consider doing is choosing a random /60 prefix from one of my ISPs /32 and setting it as base for my VLANs. ALAIK, some OSs will use IPv4 if only ULA is provided for them, because it implies that no Internet is available on IPv6, even if router manages ULA to GUA correctly. Using a global prefix that's not delegated to me breaks me from reaching out any device that's on that prefix, but I don't access any residential IP other than mine anyway.
• P

  IPv6 to internal routers and their networks - can prefix delegation and SLAAC work for them?
  • PhxAzCraig  

  7
  0
  Votes
  7
  Posts
  32
  Views

  

  @JKnott You can delegate prefixes. An address is assigned and the delegated prefix is routed to it. https://docs.netgate.com/pfsense/en/latest/services/dhcp/ipv6.html#dhcpv6-prefix-delegation
• 

  FIOS users waiting for IPv6... script to let you know when it's ready
  • luckman212  

  9
  2
  Votes
  9
  Posts
  1406
  Views

  

  Don't lose hope... it's been just less than a month since it started working for me, so they may have re-started testing.
• M

  Verizon Fios and IPV6, Which Settings Work?
  • mattlach  

  15
  0
  Votes
  15
  Posts
  73
  Views

  

  The only places I'm aware of it being available so far are select areas in Northern and Central VA (areas served by five different Verizon central offices have been confirmed) and Waltham MA (where a Verizon Technology Development Center is - or at least was - located). But determining what areas it might be available in is kind-of off topic for here since that's not directly pfSense-related. The settings to make it work are above, and there's also a script you can set up to detect when Verizon is sending out IPv6 router advertisements in your area. https://forum.netgate.com/topic/137478/fios-users-waiting-for-ipv6-script-to-let-you-know-when-it-s-ready There's a topic over in the FiOS forum on DSLReports that might be a better place for tracking availability. Don't feel the need to read all 2 years worth of posts... the most current list is within the last two pages (and was just quoted by someone on the last page). https://www.dslreports.com/forum/r32136440-Networking-IPv6-working
• D

  IPV6 No internet access - Mobile tethering / VM
  • donkeykong123  

  1
  0
  Votes
  1
  Posts
  12
  Views

  No one has replied

• D

  NPt not working on 6RD tunnel delegated addresses?
  • dlasher  

  16
  0
  Votes
  16
  Posts
  866
  Views

  

  Fixed in upstream, see https://redmine.pfsense.org/issues/10757
• J

  Neighbor Discovery Protocol (NDP) Proxy - Revisited
  • jasonArloUser  

  12
  1
  Votes
  12
  Posts
  304
  Views

  B

  You're right, I've built IPv6 into existing ISPs and rolled green field deployments as dual stack. It's not hard, except when it is. Regardless, that's a moot point when there is zero control over the ISP network. I can write my own package for NDP proxy as I did for a number of other packages back in the beginning of the pfSense project. My point is not that it is or isn't possible with pfSense, it's that .001% of users using pfSense have any say whatsoever over what their ISP does, much of which seems to defy logic and best practices, and having the flexibility to work around is a functional requirement for many.
• 

  IPv6 Router behind router
  • cashew  

  16
  1
  Votes
  16
  Posts
  61
  Views

  

  @cashew Please do a screen capture of your actual WAN and LAN settings, including Router Advertisements.
• C

  IPv6 SLAAC only
  • carloabelli  

  3
  0
  Votes
  3
  Posts
  38
  Views

  

  @carloabelli Unlike IPv4, ICMP is essential with IPv6. I have a rule on my WAN that allows all ICMP on both 4 & 6.
• 

  "kernel: cannot forward..." errors in system log
  • virgiliomi  

  5
  0
  Votes
  5
  Posts
  35
  Views

  

  Well... in the packet capture, the MAC address of the Ethernet frame matches the MAC address of the default gateway from my ISP (which is not unusual when dealing with packets being routed to you). But the IPv6 address is definitely not the same, and it doesn't appear to be an EUI64 address, so I can't match it to a MAC address. I do realize that I masked part of the address that would have identified that fact. It's likely a misconfiguration on my ISP's part... they only just got IPv6 up and running about a week ago, and it may not even be completed yet (But I've figured out how to make it work with pfSense, not knowing whether their own routers even work with it). It's kind-of annoying that this is logged in the general system log though...it'd be nice if it were in the routing log... but I assume since it's the kernel generating these messages, that's why it's in the system log.
• A

  pfSense box cannot access anything over ipv6, LAN clients can
  • AndrewReaganM  

  3
  0
  Votes
  3
  Posts
  29
  Views

  A

  That was exactly what I needed. Thank you so much!
• 4

  PPPoE IPv6 + Hurricane Electrics IPv6 - Assymmetric routing / no ping from External to pppoe assigned IPv6 Adddress possibile, despite that, everything is working...?
  • 4920441 0  

  12
  0
  Votes
  12
  Posts
  315
  Views

  M

  I have been working on a similar setup. Dual WAN IPv4+IPv6. I get native IPv4 from my ISP. For IPv6 I have been using Hurricane Electric for at least a decade. Recently, I stumbled upon a tunnel service that does both IPv4 and IPv6. This makes it possible to rather easily move services, yet keeping IPs the same, both IPv4 and IPv6. But that's more of a backstory. I have been researching quite the same problem you describe. Packets that are generated on the router (e.g. ICMP TTL Exceeded when doing a traceroute) should be sent back through the same interface they entered, but for IPv6, this doesn't work. It seems that in FreeBSD, the backing operating system for pfSense, this is simply not implemented for IPv6. There is code in review for this, but it may take some more time before that reaches FreeBSD itself, and consequently pfSense. Hope this helps.
• 

  Static IPv6rd but no joy with DHCPv6 RA
  • chase  

  4
  0
  Votes
  4
  Posts
  28
  Views

  

  With thanks to Netgate tech support, the solution was to turn off my interface's Block private networks and loopback addresses. Upon reflection, this does make sense and with it disabled, my DHCPv6 server with RA set to either managed or assisted is now responding to DHCPv6 client requests and issuing assignments. And yet, I will submit a feature request such that when the DHCPv6 Server is enabled, an alert should be posted saying "but you need to disable Block private networks and loopback addresses on the interface, otherwise the DHCPv6 server will never receive the incoming IPv6 client's request for a local RA server..."
• G

  Massive HTTP IPv6 connectivity issues
  • G.D. Wusser Esq.  

  19
  0
  Votes
  19
  Posts
  4308
  Views

  N

  This thread was 6 years old fyi.
• C

  pfSense does not reply to NS sent by ISP router, ISP does not respond to DHCPv6 request as a result
  • cnrd  

  9
  1
  Votes
  9
  Posts
  32
  Views

  

  @cnrd Then that 1st line would be duplicate address detection (DAD) and when there's no response it assumes the address is free. Later you see the multicast listener reports initially have the unknown source and then 1 with your address. Then there are DHCPv6 solicits, but no response. There should be advertisements from the DHCPv6 server, they're not there.
• E

  IPv6 behind Xfinity gateway
  • ebsense  

  14
  0
  Votes
  14
  Posts
  89
  Views

  

  @rajeshh That's called "dual stack" and will be needed for a while yet. If the games support IPv6, then it will work that way for you. The operating systems prefer IPv6, but will use IPv4 when necessary.
• R

  CARP IP not replying to NDP solicitations.
  • ryan-lake  

  2
  0
  Votes
  2
  Posts
  12
  Views

  R

  Of course as soon as I post this I redid it with a new vhid and a FULLY expanded ipv6 address. No :: no :0: and no :3: was done, that fixed it and my routes came up with the upstream router. I still would like to find that redmine issue so I can track the fix. If anyone knows the # I would appreciate it. Thanks
• R

  Sa6_recoverscope: embedded scope mismatch: sin6_scope_id was overridden
  • Rezin  

  6
  0
  Votes
  6
  Posts
  1434
  Views

  

  me too, what this is? Aug 24 05:38:00 kernel sa6_recoverscope: embedded scope mismatch: fe80:c::f298:38ff:fe93:d380%13. sin6_scope_id was overridden
• J

  IPv6 connectivity from LAN is lost after PPPoE reconnect
  • j.koopmann  

  18
  0
  Votes
  18
  Posts
  109
  Views

  

  @HG You also have to look at how often DHCPv6-PD executes and whether it does after PPPoE comes up. I have a capture of DHCPv6 at boot up and the first renewal and it's over 22 hours between them.
• J

  DS-Lite State in 2020
  ipv6 ipv4 dslite • • jan_berg  

  4
  1
  Votes
  4
  Posts
  33
  Views

  

  It's not supported on pfSense, though it is supported on TNSR (As a B4 or AFTR endpoint).
• T

  IPv6 Gateway always: Statyus:Unknown and RTT,RTTsd & Loss: Pending.
  • TauCeti  

  2
  1
  Votes
  2
  Posts
  94
  Views

  T

  Hey, I'm not sure if this is still relevant but restarting the service at status>gateways fixed it for me. However, I was already able to ping my IPv6 gateway from the diagnostics>ping tool.
• J

  Delegating IPv6 networks to a downstream router
  • jihartik  

  15
  2
  Votes
  15
  Posts
  123
  Views

  F

  @johnpoz Config is done and working as expected. Got a /48 from HE and /50 subnets to LAN. DHCPv6 Server & RA (/56 to downstream CPEs) RA Tested with Android 8/9, Android TV 7.1.2, iOS 9.3.6, Windows 10, Arch Linux, OpenWRT, and some others Home Gateways.
• M

  Cannot ping fe80::1 / discover a gateway in some KVM environments
  • mfld  

  2
  0
  Votes
  2
  Posts
  13
  Views

  No one has replied

• Q

  NDP not populating for Android devices on pfSense - no ipv6 access
  • qsystems  

  4
  0
  Votes
  4
  Posts
  23
  Views

  N

  @qsystems If you are using Unifi APs (Multicast Enhancement, rings bell for those) make sure you have the latest firmware loaded, they have had some issues with multicast recently and supposedly corrected with newer firmware.
• 

  Setup NAT64 in pfSense
  ipv6 nat64 dns64 • • imcdona  

  44
  1
  Votes
  44
  Posts
  4520
  Views

  

  Just FYI: the issue https://redmine.pfsense.org/issues/2358 got that pull request #4405 so it should go into review now.
• 

  Planning for IPv6 /48 allocation
  • kesawi  

  9
  0
  Votes
  9
  Posts
  91
  Views

  

  @kesawi said in Planning for IPv6 /48 allocation: My question for anyone who may know, is it possible to have two separate concurrent DHCPv6 scopes with pfSense and Windows? If so what do I need to do to get it to work? I doubt it, as there would be no way to determine which DHCPv6 server was desired. I assume if I give up on DHCPv6 and just go to SLAAC for both then ULA and GUA will still co exist? That's what I have. Also, if you have Android devices, you don't want to use DHCPv6. For some idiotic reason, Android doesn't support it. I have two internal DNS severs. Do I need to specify both their respective ULA and GUA addresses in the RA settings, or can I just specify the ULA addresses? You can use either GUA or ULA address. However, you don't have to specify an address as pfSense does that by default. It uses it's own address, unless you specify otherwise.
• I

  Router Still Giving out LAN IPv6 DNS Address
  • iap128  

  3
  0
  Votes
  3
  Posts
  53
  Views

  I

  @johnpoz Got it, thanks! Somehow totally missed that page. One DHCP lease renew later and everything seems to be working good now.