IPv6

• R

  Sa6_recoverscope: embedded scope mismatch: sin6_scope_id was overridden
  • Rezin

  5
  0
  Votes
  5
  Posts
  1263
  Views

  M

  Anything new here? I also get those messages. What can I do to fix?
• 

  Routing question about unused ip6 subnets
  • IsaacFL

  4
  0
  Votes
  4
  Posts
  289
  Views

  

  I tried an online tool to traceroute to an address, and you are right about pfsense just dropping it, at least as far as I could tell. There shouldn't be any reason any internal device doing it, so it should be ok. I just wanted to make sure didn't get a nasty note from my ISP.
• N

  Static /56, /64s to LANs
  • nh5

  29
  0
  Votes
  29
  Posts
  1008
  Views

  

  What he said
• K

  DHCPv6 - How to troubleshoot Prefix Delegation
  • kme0801

  3
  0
  Votes
  3
  Posts
  397
  Views

  K

  Thanks.  That gave me the information I needed.  A few more searches later and I was able to adjust my configuration to resolve the issue.  I had been using IPv6 with Unique Local Addresses but didn't want to switch my configuration around until I was able to confirm everything was working.  Because none of my interfaces had "Track Interface" set, it wasn't actually requesting an address.  Once I set my LAN to track the WAN, I received an address and prefix.  Thanks!
• G

  Configure fixed IP with PPPoE and /56 assignment
  • GeekGoneOld

  17
  0
  Votes
  17
  Posts
  662
  Views

  G

  Well a followup to let others know the final outcome. First, many thanks to all who helped me.  I truly appreciate spending your time on my problems! As it turns out, all I could get from my ISP was 1. A (pseudo) static IPv4 which I get by PPPoE (same address guaranteed but always assigned through PPPoE negotiation. 2. A dynamic /128 assigned by DHCPv6 over the PPPoE connection 3. A (pseudo) static /56 assigned by DHCPv6-PD over the PPPoE connection Note that the IPv6 communication between the router and the ISP uses a link local address, NOT the /128.  In fact, the /128 is not needed at all (as you will see)! Here is how I configured: 1. Per the requirements of my ISP, I configured the WAN IPv4 as PPPoE and the WAN IPv6 as DHCP over the IP4 link with a /56 prefix.  From this I found out my /56. 2. I then chose a prefix ID of ff for WAN addresses, 00 for LAN and 01 for VoIP (another inside LAN). 3. I created a WAN virtual IP/IP alias from the WAN /64 I chose and the mac address of the WAN adapter. 4. I made the LAN and VoIP interface IPv6 assignment to be Track Interface tracking the WAN /56 using prefix IDs 00 and 01 respectively 5. I enabled DHCPv6 and RA on LAN and VoIP 6. "normal" firewall rules (especially adding ICMPv6 req on WAN) Kinda simple. The amazing thing is that the IPv6 "WAN address" as known by pfSense (e.g. for binding OpenVPN etc) IS THE ALIAS!!!  This, it turns out, is ideal for me.  The ONLY dynamic address (the DHCPv6 assigned global WAN address) is totally irrelevant as I now have a static IPv6 global address!!  In fact the dynamic WAN address doesn't even show up in the GUI Status|Interfaces though it does show in command line ifconfig. The only place I have hardcoded an address (which I don't particularly like to do) is the alias.  One place. Just one. Finally, I added other things I use such as OpenVPN servers, OpenVPN clients etc. etc. All told, I'm very happy with what you people helped me set up and I'm testing it extensively.
• T

  Ipv6 Webserver issues
  • Temido2222

  7
  0
  Votes
  7
  Posts
  378
  Views

  

  Ah going for your HE cert nice!!!  Love the T-Shirt… Been Sage Since Jan of 2011 ;)
• R

  DNS ipv6 with dynamic prefix
  • rsq

  3
  0
  Votes
  3
  Posts
  390
  Views

  R

  I enabled the setting. The prefix no longer changes when I reboot the pfsense box, but a power cycle of the cable modem still changes the prefix. I am considering sending the fe80:: address of the pihole as DNS ip since that won't change. Still does not solve the problem, but it is a possible workaround. Thanks for the input.
• 

  DHCPv6 Static Mappings doesn't add hostname to DNS
  • IsaacFL

  7
  0
  Votes
  7
  Posts
  447
  Views

  

  What I figured out, is that after adding a static ipv6 entry, until you restart the unbound service, it will not show in DNS Lookup. You can verify that the client got the lease, but no sign of it in DNS. So after adding entries, then I restarted unbound, then DNS lookup works. Seems to me like you shouldn't have to do that, but that is only thing that I could find that works.
• T

  Ipv6 split dns
  • trumee

  2
  0
  Votes
  2
  Posts
  206
  Views

  

  You do that by creating entries for both addresses, using the same host name.
• N

  Can't get IPV6 on LAN with two routers
  • NotAnAlias

  5
  0
  Votes
  5
  Posts
  728
  Views

  N

  I enabled these settings in OpenWRT's LAN interface and it seems to work. The LAN interface in pfsense gets an ipv6 address and the computers on LAN get an ipv6 address.
• M

  6rd tunnel and DHCP6
  • MaxPF

  2
  0
  Votes
  2
  Posts
  202
  Views

  

  Normally, IPv6 addresses are assigned via SLAAC, where the router provides the network prefix and the client device creates the suffix, using either the MAC address or a random number.  Those addresses will not change unless the prefix does.  You can filter on those addresses for incoming traffic.  However, you usually can't filter on the address for outgoing traffic, as something called privacy addresses are used, which will change daily. https://en.wikipedia.org/wiki/IPv6#Stateless_address_autoconfiguration_.28SLAAC.29
• T

  DHCPv6 client on FreeBSD
  • trumee

  1
  0
  Votes
  1
  Posts
  240
  Views

  No one has replied

• D

  NPt or NAT Outbound rules?
  • DerKlaus

  1
  0
  Votes
  1
  Posts
  245
  Views

  No one has replied

• G

  Syncing hostnames from dhcpv4
  • ghulands

  10
  0
  Votes
  10
  Posts
  401
  Views

  

  it doesn't use mac for dhcp statics.  But sure still using mac to talk on the wire.
• G

  What hidden rules are created for ICMPv6 and DHCPv6
  • GeekGoneOld

  20
  0
  Votes
  20
  Posts
  754
  Views

  

  There is NO default allow rules in the wan gui out of the box… Out of the box on the wan would be block rfc1918 and bogon.  There would no other rules there unless created by the user. There are hidden rules say for dhcp when you enable dhcp on the wan.  And there will be ipv6 rules for your wan link local if you have ipv6 enabled. You can always view the full rule set here. https://doc.pfsense.org/index.php/How_can_I_see_the_full_PF_ruleset If your box is using teredo then all bets are off on the firewall rules since you just tunneled through it..
• C

  IPv6 Wan rtsold premission denied
  • CoinTos

  12
  0
  Votes
  12
  Posts
  359
  Views

  

  So I am guessing something firewall related I screwed up on somewhere. One thing I've often found is it's better to start from scratch, as something might have been set that shouldn't have been.  Also, as I mentioned, keep things simple at first, to get it going, then go from there.
• R

  Trials, Tribulations and Confirmations
  • Ragen

  3
  0
  Votes
  3
  Posts
  212
  Views

  R

  UPDATE: The same exact steps were taking again this afternoon. This time I observed the CPU level and waited until it leveled from near a 100% spike, post save/applying the interface changes, then rebooted the box. All is good!!
• A

  IPv6 + Alias + Firewall Rules
  • attewell

  4
  0
  Votes
  4
  Posts
  334
  Views

  G

  It was very good for me to have a chance to read this great content. It is very useful.
• C

  ICMPv6 Router Advertisments
  • C698D6724A5C570C3151DF121

  6
  0
  Votes
  6
  Posts
  665
  Views

  

  I updated yesterday and it appears to be working OK, including IPv6.
• P

  How To: Setup IPv6 with Comcast - Full Internet connectivity
  • pfSense2User

  12
  0
  Votes
  12
  Posts
  41681
  Views

  G

  Step 1 Log in to the router’s web-based management page, and please click here if you don’t know how to log in. Step 2 Go to IPv6 Support at the left hand side men. In the drop-down menu of IPv6 Support, please choose IPv6 Setup. Step 3 Please make sure that Enable IPv6 has been checked. Select DHCPV6 as WAN Connection Type. Select “Get IPV6 prefix delegation”. For the IPV6 Address Assign Type, please choose SLAAC. Then click at Save. If you tried the above steps, and still no IPv6 internet, also contacted with TP-Link Support but nothing happened PS: Your mentioned steps didn't worked for my router PS: You can also try the solution given here: https://10-0-0-0-1.org
• M

  Dual WAN with only 1 IPv6
  • mrsunfire

  1
  0
  Votes
  1
  Posts
  198
  Views

  No one has replied

• A

  IPv6 delegating prefix not working after upgrade
  • Apothis

  5
  0
  Votes
  5
  Posts
  348
  Views

  A

  It was an upgrade. I'm still getting the same global address from my ISP, and the isp is still routing replies to traffic fro both /64s that I'm sending request from, to pf. pf is just not routing the replies to /64 tha it delegates downstream to the google wifi, on to it. They arrive at the WAN port, and go no further. No firewall logs of them being blocked. Its as if after the upgrade, it cant see the route back to the lan for that prefix. IPv6 Trafffic for th /64 that is directly trcked by the LAN interface is still working fine, its just replies to the delegated /64 that are not getting back to the LAN
• L

  PFsense 2.4 IPV6 witha domain controler
  • Linearburn

  1
  0
  Votes
  1
  Posts
  207
  Views

  No one has replied

• R

  Use Delegate IPv6 Prefix in LAN
  • rafael.seeck

  11
  0
  Votes
  11
  Posts
  757
  Views

  M

  I have the same problem. My LAN doesnt get an IPv6. My WAN interface receives one.
• M

  64share IPv6 with tethered iPhone
  • mrsunfire

  2
  0
  Votes
  2
  Posts
  240
  Views

  M

  Right now I see in the logs``` Apr 2 15:46:37 dhcp6c 35833 advertise contains NoPrefixAvail status Apr 2 15:46:37 dhcp6c 35833 Sending Solicit But why? Here's a short dump: 
• R

  [SOLVED] How to IPv6 on multiple LANS? Track interface only supports one.
  • router_wang

  6
  0
  Votes
  6
  Posts
  348
  Views

  

  Do not think of an IPv6 prefix in terms of the number of addresses on a subnet. That is always /64. Think of it in terms of the number of /64 networks you have available to use on interfaces. /48 = 65536 /64s or 256 /56s for routing, delegation. /56 = 256 /64s /60 = 16 /64s You can call it ridiculous all you want. It is the way IPv6 is designed. Embrace it knowing you never ever ever have to worry about subnet size again.
• B

  IPV6 Track Interface
  • bdubn

  14
  0
  Votes
  14
  Posts
  4022
  Views

  

  @router_wang: @JKnott: …is there some reason why you don't want your WiFi on the same network as your local LAN?  The last time I did that was back in the 802.11b days, when only the insecure WEP encryption was available.  Then I had the WiFi on the outside of my firewall and used a VPN to access my network.  Currently, I just have an access point, not router, connected directly to my LAN, using WPA2 for encryption. Guest WiFi access. Also "facebook" syndrome. Why let rogue cellphone apps inventory and probe your network. I don't think a guest Wifi was the intent of the OP.  There's no reason why you can't have both LAN and guests on their own prefix.  Regardless, my point was there isn't much need to keep WiFi devices off of the local LAN, as WPA2 is quite secure.  That was not the case with WEP.
• D

  Centurylink IPv6 issues
  • Dazdigo

  4
  0
  Votes
  4
  Posts
  1555
  Views

  G

  For anyone else reading this thread, I also had to configure my WAN interface for VLAN 201, set my WAN MTU to 1472 and MSS to 1448 then set my LAN interface MSS to 1448.
• B

  DHCPv6 with PD - WAN not allocated address
  • bjornbylander

  6
  0
  Votes
  6
  Posts
  327
  Views

  B

  It works now. :) I didn't change anything however so my ISP must've done something.
• J

  IPV6 Out range
  • jsargent7089

  6
  0
  Votes
  6
  Posts
  262
  Views

  

  Why do you think the WAN address should be within your /60?  With that /60, you can have up to 16 LANs with a /64 prefix within 2600:8801:1d00:DE50 - 2600:8801:1d00:DE5E.  Normally, with IPv6, the ISP will assign a WAN address that is outside of your prefix.  That is certainly the case here.  Also, you don't actually need a routeable address on the WAN port, as routing, in IPv6, is normally done over the link local addresses.  The routeable address on the WAN interface would only be used for management and diagnostics.
• P

  NDP proxy where are you
  • pra

  50
  0
  Votes
  50
  Posts
  7249
  Views

  

  Then lobby to your ISP to get it fixed. It we add workarounds for broken designs, then ISPs will have no incentive to fix their broken designs.
• X

  TLS handshake fails for some sites over IPv6?
  • xme

  3
  0
  Votes
  3
  Posts
  821
  Views

  X

  No, the problem disappeared by itself… Probably an issue with my ISP?
• P

  PfSense 2.4.2, dual WAN IPv4 and HE IPv6 trouble…
  • pethson

  2
  0
  Votes
  2
  Posts
  425
  Views

  P

  I can add that I use a Windows 2016 IPv6 DHCP server for address leasing My pfSense is set up for Unmanaged Router Advertisment And I attach my LAN interface config Thank in advance for any help ///Peter!
• R

  Netgate SG-4860 crashing when changing WAN IPv6 parameters?
  • Ryan0751

  5
  0
  Votes
  5
  Posts
  301
  Views

  R

  I think something might have been locking me out with the firewall rules when making interface changes. In my case, I basically have a DMZ router hop to an internal network.  In order to rule this out, I connected my laptop directly to the LAN port of the Netgate. I'm now able to make changes to the interfaces and not get locked out. I'm also on Comcast, I set a prefix delegation hint of /60 and they happily handed me back that prefix.  Something to keep in mind if you need more subnets :)
• H

  Logged, but not formatted
  • hendersonmc

  5
  0
  Votes
  5
  Posts
  251
  Views

  H

  @JKnott: The only LL packets that pfSense can see are those that pass through a pfSense interface.  I know about the multicast packets for things such as router advertisements etc..  However, MLD is used to discover which devices on a local LAN want to receive specific multicasts from elsewhere, not those originating on the local LAN.  For example, if your computer wants to listen to some multicast out on the net, the routers (and possibly switches) listens for the request and then arranges to get that multicast from the source and pass it on to the requesting device(es). Agreed; all the packets logged are from potential LAN clients of a multicast stream that the pfsense router has access to. If you execute "netstat -s -s" you can see that under icmp6: has reference to "MLDv2 listener report" which am guessing means the number of listeners observed since boot. @JKnott: There is no need to do this on the local network.  Also, multicasts are not received by every node on the network.  They are filtered by multicast MAC address in the NIC, so that if a node is not interested in a particular multicast, it doesn't hear it. Yes, I understand and agree that multicasts are not received by every node. My understanding that the higher level IP protocols configure the Ethernet interface according to their needs to take advantage of the NICs ability to ignore Ethernet multicast traffic in hardware. The packets coming from various LL addresses on my LAN are sending to an IPv6 multicast address (ff02::16) that must be enabled by the pfsense router based upon a reserved Ethernet multicast address for MLDv2. I know how the old mapping of IPv4 multicast addresses were handled, but have not come across the equivalent method that supports IPv6 multicast addresses. IPv6 has many multicast addresses defined for LL traffic (https://www.iana.org/assignments/ipv6-multicast-addresses/link-local.csv) @JKnott: This differs from IPv4 broadcasts that all devices receive.  The only thing that's comparable in IPv6 is the all nodes multicast, which is received by all nodes and used for things like router advertisements.  Also, that "2" in ff02 refers to the scope, in this case link local.  That means a router will ignore it, as it doesn't have anything to do. Both IPv4 and IPv6 use Ethernet multicast. IPv4 also uses Ethernet broadcast, which is not supported in IPv6, but, as you pointed out, however, if every IPv6 node enables the same Ethernet multicast address on a specific interface, then there is an effective link broadcast address. Routers will NOT repeat that traffic onto other links. @JKnott: BTW, RFC 3810 has been superseded by RFC 4604. RFC4604 is an update to RFCs 3376 and 3810 and clarifies how IGMPv3 is related to MLDPv2 And, I still am waiting to hear why there is selective filtering of logged traffic. I wonder what else is unformatted besides MLDv2 listener reports…
• P

  Deny access to other subnets, but allow access to services available on the wan
  • pox

  10
  0
  Votes
  10
  Posts
  400
  Views

  

  To the time it takes.. You understand you can copy a rule right, and then just need to change the interface and it moves over to that tab.. So creating your rule once and then copy to multiple vlans only takes a few seconds.  And if you used alias to list your ports for your dest and even your dest IPs.. You just need to modify those and all rules using those would auto get updated..
• D

  DHCPv6 not giving out working IP addresses - Wrong Subnet
  • dakoellis

  1
  0
  Votes
  1
  Posts
  254
  Views

  No one has replied

• P

  Does NPt make my internal network more secure?
  • pox

  27
  0
  Votes
  27
  Posts
  1011
  Views

  

  @johnpoz: Where do you read that?  That does not say anything of the sort… I can put rfc1918 and public on a box as well - doesn't mean you should... You seem to think its ok to run multiple layer 3 on the same layer 2, which is exactly what that is..  Which is not the case, be it you can do it or not.. Who says those are the same interface?  It could be a back lan, or a storage network.. If he wants to run ULA on a vlan interface, and Global on another vlan - sure ok... Pretty pointless but yeah you can do it.. I could for sure see it as storage network say..  This should be a different L2.. Well, here's what RFC 6724 says: 1.  Introduction The IPv6 addressing architecture [RFC4291] allows multiple unicast   addresses to be assigned to interfaces.  These addresses might have   different reachability scopes (link-local, site-local, or global).   These addresses might also be "preferred" or "deprecated" [RFC4862].   Privacy considerations have introduced the concepts of "public   addresses" and "temporary addresses" [RFC4941].  The mobility   architecture introduces "home addresses" and "care-of addresses"   [RFC6275].  In addition, multi-homing situations will result in more   addresses per node.  For example, a node might have multiple   interfaces, some of them tunnels or virtual interfaces, or a site   might have multiple ISP attachments with a global prefix per ISP. Notice it says "multiple unicast addresses".  That implies more than two, so we can rule out just a unicast & a link local.  It also mentions multiple scopes (unique local replaced site local).  Clearly the IETF intended there be multiple routable addresses on a single interface.  It also mentions multiple ISPs & prefixes.  These are things I've mentioned were possible with IPv6.  You may think it's "borked", but you're at odds with the IETF.  They seem to think there are valid reasons for these things.  I have also read pretty much the same in the Cisco book "IPv6 Fundamentals: A Straightforward Approach to Understanding IPv6" 2nd ed..
• M

  Dhcpv6 server unknown leases
  • MyMrRobot

  1
  0
  Votes
  1
  Posts
  251
  Views

  No one has replied

• B

  Packet loss on HE tunnel and IPv4 WAN
  • biosed

  2
  0
  Votes
  2
  Posts
  219
  Views

  B

  I have removed pfsense from the equation and there is still packet loss so seems to be a strange coincidence with an ISP issue.