IPv6

• 

  Hetzner & pfSense
  hetzner • • samip537

  3
  0
  Votes
  3
  Posts
  305
  Views

  

  @heper said in Hetzner & pfSense: try to get the /56 anyways ... sometimes isp's say they only supply the /64 but in reality they'll route /56 prefix for each customer if you setup the dhcp-client to get a /56, it might just work or get another isp or spend the €50 I won't get any IPv6 prefix from DHCPv6 as it's static only configuration, so your idea does not apply. EDIT: They are routing my prefix though a link local address which my WAN interface is lacking. :(
• C

  IPv6 n00b: dhcpv6-client requests blocked on LAN
  • Chucko

  2
  0
  Votes
  2
  Posts
  147
  Views

  C

  Since no one is answering, I did a little research. This appears to be a valid DHCP server/relay solicitation. It doesn't go anywhere because there's no DHCP server/relay on the subnet, because in turn the subnet has been delegated to us from the ISP. radvd is running but we're using stateless autoconfiguration to allocate addresses. Should I be running a DHCPv6 relay in this situation? Or is stateless autoconfiguration enough? It seems to be working fine at the moment.
• B

  Survey of ISP support for Dual-Stack IPv4/IPv6 Networking
  • bimmerdriver

  8
  0
  Votes
  8
  Posts
  293
  Views

  

  @bimmerdriver said in Survey of ISP support for Dual-Stack IPv4/IPv6 Networking: They do not support IA_NA or IA_NT. So you meant to say IA_NA or IA_NA? Not really sure what you meant. IA_NA or IA_TA?
• 

  Windows Update failing using 6rd
  • Com DAC

  9
  0
  Votes
  9
  Posts
  1022
  Views

  S

  Just to let anyone with the same problem know, for a few days now, the problem suddenly occured again. 2a01:111:f307:1790::f001:7a5 and 2a01:111:f335:1792::f001:7a5 exist and both have an AAAA record but they seem to not react on IPv6 connections. I have 3 machines here which are not updating for a few days now except I disable IPv6 for a second, so that they can reach the update server by IPv4. I'm now trying suggested solutions above. Kind of a weird issue. Edit: Rejecting IPv6 packets to sls.update.microsoft.com servers seems to be a workaround.
• H

  IPV6 Setup and DHCPV6
  • Hurtz2P

  3
  0
  Votes
  3
  Posts
  253
  Views

  H

  Spoke too soon... It worked for a bit then stopped after I rebooted pfsense.
• M

  dhcp6c config not working?
  • misch

  6
  0
  Votes
  6
  Posts
  416
  Views

  M

  Changing the config again deletes the dhcp6_wan.conf entirely, so no dhcp6c is started at all.
• 

  Sanity check on my IPv6 settings (/56 PD + DHCP6 enabled)
  • luckman212

  12
  0
  Votes
  12
  Posts
  562
  Views

  

  The ISP is Spectrum/TimeWarner. I'll call them tomorrow, but you don't get to talk to engineers, just call center people. Most of them can't even spell IPv6, much less tell you anything about it. Another odd thing, I rebooted pfSense and then checked the DHCP logs to see if I could confirm the /56 that was being handed out. I didn't see anything in the log at all for dhcp6 (yes, there was stuff in there before...) : # clog /var/log/dhcpd.log | grep dhcp6 # <------ ¯\_(ツ)_/¯ radvdump shows that the /64s being offered there have valid lifetimes of infinity : prefix 2604:2000:ffc0:4::/64 { AdvValidLifetime infinity; # (0xffffffff) AdvPreferredLifetime infinity; # (0xffffffff) AdvOnLink on; AdvAutonomous off; AdvRouterAddr off; }; # End of prefix definition So maybe pfSense is caching this and just re-using it without triggering dhcp6c at all? I know it's not in config.xml so maybe on the filesystem somewhere? I have to look at the code to see if this is what's actually happening. I'll try to do some more packet captures as well.
• L

  IPv6 Network details from ISP
  • Lin4Fun

  31
  0
  Votes
  31
  Posts
  1034
  Views

  

  @gertjan said in IPv6 Network details from ISP: Ah, yeah ! Can we have FTP back ?? Please ? ^^ How about VoIP or some games, where you need to use an STUN server to tell the devices what the real world address is for something hidden behind NAT. There's also IPSec authentication headers, which are broken by NAT. What if you want to run two servers, running the same protocal, behind NAT? Then you need to do remap some port numbers.
• C

  IPv6 from ISP works, but WAN address is link local, not global
  • cra

  9
  0
  Votes
  9
  Posts
  476
  Views

  C

  Thanks everyone. I'm combining the last two posts from Derelict and JKnott and crossing my fingers to see if my ISP will do it right in the long term!
• D

  WAN IPv6 Address Not Acquiring
  • dxmaster

  6
  0
  Votes
  6
  Posts
  207
  Views

  D

  Ok so I rebooted after installing pfblockerng and now I can’t get my ipv6 address back again ‍️
• M

  Windows 7 Not Adding Default Route
  • msf2000

  4
  0
  Votes
  4
  Posts
  188
  Views

  

  @msf2000 : for what it's worth : my settings and yours (see your image) are the same. I have an only-win7 network (9 PC's) and a 2008R2 : never had anything to do so IPv6 work on LAN. for all my PC's and devices IPv6 DHCP settings : Btw : For most devices I set DHCPv6 Static Mappings : Btw : Using Win7 for a company. I ruled out Windows 8.x for a company, and, my opinion, Windows 10 isn't still ready yet, I guess I'll be using it in a year or so ... A "route print" on a Win7 PC : C:\Users\Réception-Gauche>route print =========================================================================== Liste d'Interfaces 10...b8 ac 6f 47 2c 77 ......Broadcom NetLink (TM) Gigabit Ethernet 1...........................Software Loopback Interface 1 =========================================================================== IPv4 Table de routage =========================================================================== Itinéraires actifs : Destination réseau Masque réseau Adr. passerelle Adr. interface Métrique 0.0.0.0 0.0.0.0 192.168.1.1 192.168.1.6 200 127.0.0.0 255.0.0.0 On-link 127.0.0.1 306 127.0.0.1 255.255.255.255 On-link 127.0.0.1 306 127.255.255.255 255.255.255.255 On-link 127.0.0.1 306 192.168.1.0 255.255.255.0 On-link 192.168.1.6 356 192.168.1.6 255.255.255.255 On-link 192.168.1.6 356 192.168.1.255 255.255.255.255 On-link 192.168.1.6 356 224.0.0.0 240.0.0.0 On-link 127.0.0.1 306 224.0.0.0 240.0.0.0 On-link 192.168.1.6 356 255.255.255.255 255.255.255.255 On-link 127.0.0.1 306 255.255.255.255 255.255.255.255 On-link 192.168.1.6 356 =========================================================================== Itinéraires persistants : Aucun IPv6 Table de routage =========================================================================== Itinéraires actifs : If Metric Network Destination Gateway 10 266 ::/0 fe80::212:3fff:feb3:5875 1 306 ::1/128 On-link 10 18 2001:470:1f13:5c0::/64 On-link 10 266 2001:470:1f13:5c0:2::c6/128 On-link 10 266 fe80::/64 On-link 10 266 fe80::75cd:7073:d0a4:bc7c/128 On-link 1 306 ff00::/8 On-link 10 266 ff00::/8 On-link =========================================================================== Itinéraires persistants : Aucun C:\Users\Réception-Gauche>
• M

  Certain OS cannot use IPv6 network
  • msf2000

  2
  0
  Votes
  2
  Posts
  120
  Views

  No one has replied

• J

  Cannot route IPv6 - Frustrated
  • johnnybinator

  38
  0
  Votes
  38
  Posts
  804
  Views

  J

  @isaacfl said in Cannot route IPv6 - Frustrated: LOCAL_SUBNETS_v6 HILARIOUS! That was is! The rule change fixed it. I used LAN NET because it was set up that way for the IPv4 rule. Thanks for walking through this mess with me. I Learned a lot.
• P

  http://test-ipv6.com/ works but httpS://test-ipv6.com/ doesn’t - TLS handshake stuck with IPv6
  • paulgreg

  15
  0
  Votes
  15
  Posts
  603
  Views

  P

  @johnpoz The maximum working MSS is 1440 in my LAN interface setup in pfSense. 1280 also works. (the tracepath result gave me the same result as for you) As I said, I used 1220 because I found that post https://forum.netgate.com/topic/73573/massive-http-ipv6-connectivity-issues/8 where the solution was to set the MSS to 1220. I’m setting IPv6 in my « home » LAN, to learn more about IPv6 but also to have a fully functional IPv6 connection. I hope that’s the only problem I’ll find about my IPv6 setup. Again, thanks for all the resource you shared.
• T

  A little help setting up a connection
  • Trendkill99

  33
  0
  Votes
  33
  Posts
  813
  Views

  T

  @derelict I will ask for the humax model. I have a friend using this model without problems.
• D

  2.4.2-Release-p1 Loses ipv6 every few hours bounce LAN/WAN comes backup same PD
  • Dudleydogg

  1
  0
  Votes
  1
  Posts
  117
  Views

  No one has replied

• F

  ADD RFC 6296 for futur version pfsense
  • fredlubrano

  14
  0
  Votes
  14
  Posts
  369
  Views

  

  The procedure to request features is in the documentation. No need to discuss a public topic privately.
• C

  Unable to obtain v6 address on WAN without having LAN enabled for tracking
  • coreybrett

  11
  0
  Votes
  11
  Posts
  385
  Views

  C

  I know this is an edge case (v6 on WAN only), but still seems like a bug to me.
• M

  Static IPv6 setup
  • MatthiasLohr

  21
  0
  Votes
  21
  Posts
  4040
  Views

  

  I cannot imagine that a bridge like that is necessary. That is really ugly. They should route the /56 to an address on the WAN interface. That address can be obtained in multiple different ways. It can even be link-local. It is really up to them to tell you, in general terms, how to provision your router interface. For anyone else it would just be a guessing game. This is an example of instructions for a static /48 from a popular IPv6 transit + colo provider: IPv6 2001:xx:x:xx::/64 ::1 is ISP ::2 is Customer They route 2001:xxx:xxx::/48 to 2001:xx:x:xx::2 It's as simple as that. Interface network + routed subnet. In that case you would set pfSense WAN to Static 2001:xx:x:xx::2/64 with a gateway of 2001:xx:x:xx::1 and use 2001:xxx:xxx::/48 on the inside however you want.
• W

  Setting up Comcast Business Class IPv6 & IPv4 with Static Allocations to PFsense
  • WB3FFV

  7
  0
  Votes
  7
  Posts
  1117
  Views

  J

  @wb3ffv Did you get this working? I'm stuck in the exact same place you were 9 m,onths ago. Some screen shots would be so awesome.
• T

  ipv6: can ping GUA address in different VLAN, but not ULA.
  • Tanya

  27
  0
  Votes
  27
  Posts
  1054
  Views

  U

  to the interfaces.inc file: The specific parts of the script just checks for link local and an interface ipv6, but since IPv6 knows more than one type of an interface IP (GUA and ULA handled by a single function and stops if an matching IP is found) This could be the reason for the behavior i ve seen for my problem and at the end for ur's too. For me an ifconfig in a console, i ll get all IPv6 IP's of an specific interface...if i do same in the gui i ll just only get two IP's So u get for example in GUI an LL+GUA or an LL+ULA, but NOT ULA+GUA+LL Since most configs generate from the pfsense scripts, the underlying "real" IP's are ignored in this case. At the end u have missing routes, cause the routes are build from only the half of informations needed But my programming skills are not so deep to evaluate my thinking, im an hardware guy. :/
• D

  Unable to Delete Unused Local Link ipv6 Gateway
  • Dudleydogg

  1
  0
  Votes
  1
  Posts
  150
  Views

  No one has replied

• M

  IPv6 - FRR OSPF6 keeps crashing
  • mplanquart

  7
  0
  Votes
  7
  Posts
  305
  Views

  M

  Status of 2.4.4... I still loose routes when combining 2.4.3 with 2.4.4 and Cisco. But the good news is that it's not the case anymore with the following configurations: 1-pfSense 2.4.4 (priority 0), pfSense 2.4.4 (priority 0), DR Cisco (priority 1) 2-pfSense 2.4.4 (priority 0), BDR pfSense 2.4.4 (priority 1), DR Cisco (priority 1) In addition, both pfSense devices have the following setting: redistribute connected route-map DNR6 New issues: 1-After the upgrade to 2.4.4, connected interfaces are not redistributed anymore. As a workaround, disabling/enabling the interface sometimes works! And when not, it has to be re-created! 2-In order to have pfSense act as the BDR (the way we typically need it), it has to redistribute a default route to other routers in the area. At a minimum, the option "default-information originate" should be available on the UI with ideally the possibility to also select "always". When configured this way for both the DR and BDR, 2 default routes will end up on all the routers.
• S

  ipv6 client routing issue
  • Slampman

  12
  0
  Votes
  12
  Posts
  302
  Views

  

  @slampman said in ipv6 client routing issue: It looks like it is doing RA's but I dont know enough about v6 to tell if they are correct? That looks like Packet Capture. I much prefer Wireshark, as it provides much more info. However, you can download the capture and open the file with Wireshark. There is a router advertisement there: 21:57:02.548979 IP6 fe80::250:56ff:fe9c:8801 > ff02::1: ICMP6, router advertisement, length 152 But since I can't see it in Wireshark, I can't tell you much about it, other than the router link local address and it's an unsolicited multicast, rather than a response to a request. If I could view it in Wireshark, I'd be able to determine the prefix used for the network and some other things.
• U

  BUG in IPv6: Adding ULA Virtual IP breakes RA at LAN interface
  • UlfMerbold

  4
  0
  Votes
  4
  Posts
  321
  Views

  T

  I have exactly the same problem. My setup is slightly different. My WAN is set to DHCP and DHCP6. My assigned prefix doesn't normally change that often, but from time to time it does. (For example after a power outage that take a while to solve; or after network maintenance by our ISP) Anyhow, I too have track interface on my LAN (and VLAN) interfaces, and had added Virtual IPs to those interfaces as well. Those Virtual IPs were ULA addresses, where the intention was that I could always reach the firewall by its virtual IP. In my case I do not have to wait for a ppoe reconnect or a DHCP renewal on the WAN interface, it is enough that I reboot my pfSense to reproduce it. When that happens the GUA address on the LAN or VLAN interface is replaced by the Virtual IP and the RA stops 'distributing' the GUA adresses to the clients. I too have no solution for that, so I have removed the Virtual IPs to get the GUA anouncements working again.
• M

  IPv6 - FRR BGP issue with Redistribute connected networks
  • mplanquart

  4
  0
  Votes
  4
  Posts
  154
  Views

  

  You could go for a completely manual config but the easiest workaround is what you did before, just add those networks to the manual list to distribute.
• M

  dhcp6c: Unsupported authentication protocol: 100
  • miceliux

  2
  0
  Votes
  2
  Posts
  169
  Views

  M

  Jul 30 21:41:11 dhcp6c 14743 Sending Solicit Jul 30 21:41:11 dhcp6c 14743 set client ID (len 14) Jul 30 21:41:11 dhcp6c 14743 set elapsed time (len 2) Jul 30 21:41:11 dhcp6c 14743 set option request (len 4) Jul 30 21:41:11 dhcp6c 14743 set IA_PD Jul 30 21:41:11 dhcp6c 14743 send solicit to ff02::1:2%vtnet1 Jul 30 21:41:11 dhcp6c 14743 reset a timer on vtnet1, state=SOLICIT, timeo=10, retrans=111000 Jul 30 21:41:11 dhcp6c 14743 receive advertise from fe80::12e8:78ff:fe4e:db51%vtnet1 on vtnet1 Jul 30 21:41:11 dhcp6c 14743 get DHCP option IA_PD, len 41 Jul 30 21:41:11 dhcp6c 14743 IA_PD: ID=0, T1=43200, T2=69120 Jul 30 21:41:11 dhcp6c 14743 get DHCP option IA_PD prefix, len 25 Jul 30 21:41:11 dhcp6c 14743 IA_PD prefix: 2a01:c50e:9101:fa00::/56 pltime=86400 vltime=140733193474432 Jul 30 21:41:11 dhcp6c 14743 get DHCP option server ID, len 23 Jul 30 21:41:11 dhcp6c 14743 DUID: 00:02:00:00:05:58:4f:53:50:20:49:6e:74:65:72:6e:65:74:20:50:72:6f:64 Jul 30 21:41:11 dhcp6c 14743 get DHCP option client ID, len 14 Jul 30 21:41:11 dhcp6c 14743 DUID: 00:01:00:01:22:f1:89:88:52:54:00:a7:d6:70 Jul 30 21:41:11 dhcp6c 14743 get DHCP option authentication, len 27 Jul 30 21:41:11 dhcp6c 14743 proto: unknown(0), alg: unknown(0), RDM: mono counter, RD: 0000 0000 0000 0000 Jul 30 21:41:11 dhcp6c 14743 unsupported authentication protocol: 100 Jul 30 21:41:11 dhcp6c 14743 failed to parse options
• T

  Prefix Delegation to subrouter requires hard-coding subnets when Track Interface enabled
  • tobiasm

  17
  0
  Votes
  17
  Posts
  464
  Views

  

  @derelict said in Prefix Delegation to subrouter requires hard-coding subnets when Track Interface enabled: Even better would be a static assignment from the ISP. That is common for larger businesses, but small business and home users generally don't get it. For them, the ISP generally wants something that's just plug 'n go. Assigning static addresses requires configuration on their part. Also, when I first started using pfSense, my prefix could change for something as minor as disconnecting/reconnecting the Ethernet cable.
• A

  How do I create a Static IPv6 address
  • attewell

  12
  0
  Votes
  12
  Posts
  371
  Views

  

  Right. If you use SLAAC the host should establish a "permanent" address based on the MAC address but randomly generate temporary addresses. In general the "permanent" address can be used for connections to the host, while the random address is used for connections from the host. This is all controlled by settings on the host itself, not the routers or firewalls.
• T

  How to properly configure HA pair with IPv6 and CARP for symmetric routing?
  • techstone

  1
  0
  Votes
  1
  Posts
  198
  Views

  No one has replied

• A

  Do I have IPv6 Setup right?
  • attewell

  2
  0
  Votes
  2
  Posts
  242
  Views

  

  Did the ISP mention a ND & PD prefix, I recieved the following from my ISP:- ND Prefix: 2a02:xxxx:xxxx:xx::/64 PD Prefix: 2a02:xxxx:xxxx::/48 The ND prefix is for the WAN interface and the PD prefix for the LAN, I split my PD into /64 chunks.
• A

  Static IPv6 configuration with gateway from router advertisement
  • andrin55

  1
  0
  Votes
  1
  Posts
  227
  Views

  No one has replied

• D

  NPt not working on 6RD tunnel delegated addresses?
  • dlasher

  13
  0
  Votes
  13
  Posts
  680
  Views

  D

  Any ideas @jimp ? Still broken. See post right above this one. I can submit an actual bug report if you'd like.
• G

  cellular ipv6 in USA, preferably AT&T?
  • gzorn

  29
  0
  Votes
  29
  Posts
  1356
  Views

  G

  I can confirm that it's possible to get IPV6 on the LB1120 in bridge mode with AT&T working in PFsense, but it's a VERY non-optimal configuration. It appears that I get a single /64 via SLAAC (as mentioned above). The default route for internet isn't fe80::1 It appears to be randomly generated and locally advertised. Here's where things get weird - although I can see the router adverts, the router won't actually pass the packets if I boot it connected to PFsense. Here's what did work: Hook the LB1120 (unpowered) up to a computer running windows. Turn on the LB1120 and let it boot Query the ethernet port in windows with 'ipconfig'. Record the IP address received by windows, the GW address assigned, and the ethernet address of the windows machine's ethernet port. Unplug the LB1120 from the win10 computer (don't power it off). Configure PFsense to spoof the win10 computer's HW address, set static IPV6 using the assigned address (though you can actually change it slightly, too). I'm also assigning it as a /126 (/128 might be possible), and set a static gw recorded above. The mac spoof is necessary to get both a DHCPv4 IP and working IPV6. Yes, this is incredibly hackish. Ideally, I'd like to figure out what magic is happening with windows that isn't happening with PFsense, so I can set this thing to autoconfig. So far, I see only 2 differences in the packet captures: Windows uses an AT&T-advertised nameserver on a private local address: fc00:a:a::300 I tried hard-coding that nameserver in the config, but it did not help. Windows sends a bunch of broadcasts on ff02::16. This is multicast listener discovery. I'm not sure how to make PFsense send these, and only a few search hits for mld with pfsense. Any ideas? Now, I'm having some trouble getting ipv6 packets to pass the wireless WAN link when the router is set to prefer the wired IPV6. But that's a multi-WAN issue, so I'll probably start a new thread on that.
• 

  IPv6 Router Advertisements - Router Mode - Stateless DHCP
  • IsaacFL

  3
  0
  Votes
  3
  Posts
  427
  Views

  N

  @isaacfl said in IPv6 Router Advertisements - Router Mode - Stateless DHCP: From my own testing today. "Stateless DHCP" seems to be the same as assisted but with the "Management" flag not set. My PC's seemed to not mind, but my Apple products work better with "Assisted". Which is exactly what the dropdown says?
• X

  IPv6 - No Address on WAN?
  • xero9

  2
  0
  Votes
  2
  Posts
  287
  Views

  G

  @xero9 I'm in a similar boat. In most cases, I've just applied the changes through the webGUI. Sometimes, I'll release and renew the DHCP through the webGUI. On occasion, I've taken disabled and re-enabled the interface in the GUI to ensure that I've forced a reset (though this is probably overkill). I haven't had to reboot the machine. Are you able to consistently get an address on your WAN? Something starting with 2600:, probably? It will always have an address starting with fe80:
• T

  IPv6 default route is lost
  • tungsten

  10
  0
  Votes
  10
  Posts
  642
  Views

  A

  Great defect report you have made: https://redmine.pfsense.org/issues/8611
• L

  Strange entries in the LAN f/w blocked log
  • lohphat

  27
  0
  Votes
  27
  Posts
  676
  Views

  

  @isaacfl actually, I just went and checked and my "cheat sheet" for multicast is obsolete See https://en.m.wikipedia.org/wiki/Multicast_address For updated multicast (go down to IPv6 )
• J

  ICMP filtered
  • jycai

  9
  0
  Votes
  9
  Posts
  499
  Views

  

  @jycai Here is my WAN rule for ICMP
• L

  6to4: monitoring gateway address needs to entered manually
  • lohphat

  3
  0
  Votes
  3
  Posts
  253
  Views

  L

  @theserverguy Only after I enter the ::1 address specifically in the monitoring field. Just enabling the 6to4 config isn't enough for the gateway monitoring. If I leave it blank IPv6 still works but the monitor says it's down. So it seems to be cosmetic but affects the uptime stats. So I suspect the 6to4 code simply missing a step when it creates the dynamic gateway for monitoring.