IPv6

• J

  Set dynamic static ip on LAN interface?
  • james2432  

  4
  0
  Votes
  4
  Posts
  123
  Views

  P

  @jimp Thanks for your comment, may be there are some misstakes in wording at my site, it's not my mothers speech :-) My last stand was, that you don't see the nessessarity, nice to see we are some steps forward :-) At me it looks not that complicated, prefix as variable to call everywhere and thats it . Ok I have no idea how coding works so I can only hope someone do it ;-)
• S

  CISCO and PFsense IPv6 Prefix Delegation
  • sparkplug3522  

  13
  0
  Votes
  13
  Posts
  220
  Views

  

  My point is it is not assigned to him via DHCP. And there is zero reason to use DHCP to assign it to pfSense. Just route it.
• H

  he.net tunnel up, but General Failure when pinging from Hosts within the network
  • hazenvs01234  

  25
  0
  Votes
  25
  Posts
  432
  Views

  H

  @Derelict I stated previously it was a PEBKAC error (as in the problem lies between the Keyboard and Chair). Again thanks everyone for your help and time on this. I have multiple clients and many of them run multiple VPN's. Putting a mention in the document to remind troglodytes like myself to disable VPN's when testing might deserve a mention?
• M

  Pings ok but nothing else
  • mark-b  

  12
  0
  Votes
  12
  Posts
  494
  Views

  B

  @mark-b Have you ended up figuring this one out? I’m having similar issues.
• S

  IPv6 LAN with Tracking interface problem
  • ssjoco85  

  4
  0
  Votes
  4
  Posts
  127
  Views

  

  They are not responding.
• J

  Track interface not working for ipv6 on pfsense
  • jsargent7089  

  5
  0
  Votes
  5
  Posts
  282
  Views

  

  One other thing you may want to try. Put your modem into gateway mode and see if it works properly. If it does, then the problem is with pfSense. If it doesn't it's with your ISP. My experience shows the tech support will not work on a problem if a customer firewall/router is used. So, use the gateway mode to determine where the problem is.
• J

  Track interface not working for ipv6 on pfsense
  • jsargent7089  

  1
  0
  Votes
  1
  Posts
  57
  Views

  No one has replied

• T

  ipv6 prefix delegation to second pfsense
  • tyn  

  3
  0
  Votes
  3
  Posts
  332
  Views

  T

  Thanks @Derelict I think I have it working now. I had a couple of problems with the way I was trying to do it. I ended up having edge-pf delegate /60 subnets so that internal-pf could use /64 subnets on its lans. The biggest catch, that had me scratching my head for ages, is the dhcpd service seems to need to be restarted; or a reboot. I'm not exactly sure which situation requires which but just saving a new configuration or restarting an interface isn't enough. After I have all this working I'll post my config to help the next novice like me.
• T

  Best way to confirm ipv6 setup?
  • tyn  

  4
  0
  Votes
  4
  Posts
  264
  Views

  T

  Thanks for the help @Derelict and @JKnott. I now have my WAN and LAN interfaces looking like they are working as they should. I can also successfully ping and traceroute to the public ipv6 address I found. For others who may have similar problems I found this post useful to understand a little more about how track interface works. My next hurdle is to get prefix delegation working from the pfsense that connects to the internet to the pfsense that does internal routing and services. I'm having some trouble with that but I'll create a new post for it since it's outside of this topic.
• 

  Rogers pfSense configuration
  • JKnott  

  44
  0
  Votes
  44
  Posts
  7566
  Views

  J

  @JKnott said in Rogers pfSense configuration: I was just reviewing the earlier posts. I don't ever recall using that setting and I've had IPv6 via Rogers for 3 years. Yeah Rogers can dhcp request over native ipv6 now, probably at the time of writing the guide the network engineer was correct as ipv6 wasnt wildly adopted
• W

  Comcast IPv6 woes
  • wwwdrich  

  7
  0
  Votes
  7
  Posts
  339
  Views

  W

  Well, I got it working last night... oddly enough the problem was actually due to the bug I mentioned in my original post - https://redmine.pfsense.org/issues/5999. Because IP aliases break tracking I had removed my IPv6 interface from CARP. That meant that my secondary was picking up some percentage of the IPv6 traffic on the LAN. It still had routes to my old ISP over the v6 tunnel, so it was sending some of the traffic out that way. The solution for the moment was to turn the secondary off, I'm going to do some more config tweaking tonight and see if I can get to a state (probably with no IPv6 on the secondary) where I can leave it on-line so I have at least some level of failover.
• B

  Native IPv6 from Telekom using GPON and PPPoe [solved]
  • bbusa  

  22
  0
  Votes
  22
  Posts
  408
  Views

  

  @bbusa said in Native IPv6 from Telekom using GPON and PPPoe [solved]: They had misinformation on the phone, and that created the confusion. Misinformation from an ISP? WOW, that's a first!!! Yeah, right. IPv6 from my ISP worked well from the start, three years ago, until I ran into a problem around New Years. With my own testing, I had determined the problem was at the ISPs office and later was even able to identify the failing system. It took me 3 months to get the problem resolve and I often found myself having to teach the support people how IPv6 worked. Hopefully, the support will improve, as ISPs get more experience with IPv6.
• S

  IPv6 ULA Router Advertisement not working on GUESTS interface with VLAN
  ipv6 vlan unifi ula • • stb  

  22
  0
  Votes
  22
  Posts
  555
  Views

  

  So looking at the new 5.11.10 release, looks like they have added ipv6? from 5.11.5 in the release notes? Add subnet for IPv6 networks in Networks Table. I am currently running 5.10.21 which is not viable direct upgrade.. So can not test for sure until I get on 5.11.10, but you might want to try 5.11.10 if you want ipv6 with guest policy enable. But not captive portal.
• 

  Prefix stuck
  • JKnott  

  18
  0
  Votes
  18
  Posts
  260
  Views

  

  Having multiple GUAs on a host puts a lot of the burden on that host for choosing the desired source address for a particular connection. The pfSense routing role could be handled right now using existing policy routing rules based on the source IPv6 address. This source, out this WAN, that source, out the other WAN. But the decision moved to the host as to which source address is used for a particular connection.
• M

  IPv6 Address to choose for Domain Controllers
  • mikael-ljung-mikeonline-se.  

  3
  0
  Votes
  3
  Posts
  257
  Views

  

  @mikael-ljung-mikeonline-se I think best practice is to use GUA for everything. If you have a broken ISP that changes the prefix then ULA is a way to work around that.
• P

  IPV6 with Windows 10 DNS and Link-Local Address used for Global Address
  • PabloAbonia  

  10
  0
  Votes
  10
  Posts
  475
  Views

  

  @PabloAbonia said in IPV6 with Windows 10 DNS and Link-Local Address used for Global Address: Address #2 is the preferred address which is not assigned from pfSense via DHCPv6, and is generated by Windows 10. It is derived from the prefix, and the fe80 address in address found under #4 This is entirely normal. With IPv6, you have a 64 bit prefix and 64 bit suffix. With the consistent address (MAC or random) it will have exactly the same suffix as the link local. You will see this even more, if you also use Unique Local Addresses. Then you will see the same suffix for link local, Unique Local Addresses and Global Unique addresses. With the privacy addresses, you will also have GUA and ULA with matching suffixes. Entirely normal.
• C

  Assign Subnets from IPv6 /60 Delegated Prefix to Two Interfaces
  • chrisarm  

  3
  0
  Votes
  3
  Posts
  121
  Views

  C

  Yeah, I had the PrefixID set but was calling it a NetID. Sorry for the confusion. Got IPv6 working by changing the LAN DHCPv6 Server + RA setting called "Delegation Prefix Size" to a 64 on the DHCPv6 Server + RA settings for the LAN interface and unchecking "Use DHCPv6 Server Settings" in the DNS Configuration at the bottom. Still not sure why that fixed it. But got a 10/10 with no warnings at https://test-ipv6.com. Settings from here were helpful getting it to the point I had it before: https://forum.netgate.com/post/619372 Now time to make sure I have policies set properly...Routable IPs in an internal network are a new level of fun. The VPN issue in particular. https://docs.netgate.com/pfsense/en/latest/vpn/ipv6-and-vpns.html Cheers.
• P

  A looped back NS message is detected during DAD
  • pfsensier  

  21
  0
  Votes
  21
  Posts
  9079
  Views

  V

  @kmo12345 So interestingly, I was playing around with SR-IOV and saw it was "Enabled" but not "Active" on my FreeBSD VM nor my pfSense VM. It was showing active on my Windows 2019 VM (after I had installed the correct supporting driver for support of the X520 Intel NIC) and Ubuntu LTS 18.04 VM. After examining it further and reading a bunch of posts in forums, I haven't had success in getting SR-IOV to be active, so I just disabled it. It seems the ix driver won't attach to the passed through PCI device for some reason. Anyway, when I did that on my FreeBSD 12 VM, the duplicate DAD issue came back after reboot. VMQ was left enabled. On the pfSense VM with the same configuration it wasn't showing the kernel warnings, but it seems SLAAC wasn't functioning with pfSense from my MacBook Pro. I honestly didn't verify this as I don't have a ton of time to mess with it at the moment. I just disabled VMQ and rebooted it again and all was happy. So, I'm not totally sure of what to make of this, but it seems SR-IOV being enabled, even if it's not active, seems to fix the VMQ issue. It might be that SR-IOV effectively disables VMQ even though it's still selected in the VM configuration. I don't know where the issue lies and I'm not skilled enough in that area to really determine that, but I wanted to pass along my own personal findings for the community based on my own experiences. FreeBSD bug in hn driver maybe? Again, Linux and Windows seem fine in the same setup. I wanted to correct my earlier statement that the updated driver on Windows Server 2019 appeared to fix the problem with VMQ, as that doesn't appear to be the case now. If I get time, I'd like to run disable SR-IOV on my other VM's and run Wireshark on Windows and tcpdump on my Linux VM just to verify that they also don't see the duplicate DAD issue and are just being silent about it. That would lead me to believe it's more of a Hyper-V and/or Intel driver problem on the host. If not, I'm back to supposing it's the hn driver in FreeBSD at fault with VMQ enabled.
• L

  ipv6 disable on Pfsense
  • lucas1  

  35
  0
  Votes
  35
  Posts
  1332
  Views

  

  @bimmerdriver said in ipv6 disable on Pfsense: Microsoft, as much as everyone likes to bash them, has embraced IPv6 since the Windows 7 Actually, XP SP3 almost fully supported it. There was some minor thing that didn't work, but it didn't have much effect overall. I know it worked fine for me. My first Android phone, a Google Nexus 1 also supported IPv6 and my current Pixel 2 even has IPv6 tethering, with a full /64 prefix.
• X

  IPv6 unable to access internet on LAN interface
  • xayumi  

  25
  0
  Votes
  25
  Posts
  717
  Views

  

  We're not talking about point-to-point links, bro. I don't have time to make every forum response cover every possible caveat.
• 

  FIOS users waiting for IPv6... script to let you know when it's ready
  • luckman212  

  6
  2
  Votes
  6
  Posts
  1344
  Views

  P

  Any dhcp6-pd packet captures from the G1100? I am having trouble determining the correct advanced DHCP6 settings for pfSense
• H

  [Solved] Static IPv6 setup, State issue when traffic comes from pfSense itself
  • hege  

  1
  0
  Votes
  1
  Posts
  64
  Views

  No one has replied

• 4

  PPPoE IPv6 + Hurricane Electrics IPv6 - Assymmetric routing / no ping from External to pppoe assigned IPv6 Adddress possibile, despite that, everything is working...?
  • 4920441 0  

  11
  0
  Votes
  11
  Posts
  303
  Views

  4

  Simple: because its a pppoe related bug. I got another IPv6 network on another interface propagated via SLAAC and it is also routet, this one is pingable without any problems. Only pppoe Connections via DHCP over pppoe behave strange... Cheers,
• E

  IPv6 default route disappears
  • entrader  

  19
  0
  Votes
  19
  Posts
  582
  Views

  

  @derelict said in IPv6 default route disappears: Vote with your deutchemarks, people. They are called Euros for years, ya' know? Problem is, that those small little pearls are mostly local ISPs in specific regions or cities. Even if I'd wanted to go all out and "shut up and take my money", it won't get me far. In most non-crowded places you're happy if you can get DSL with PPPoE or Cable from the same few companies. There are only some like e.g. DG / Deutsche Glasfaser / "german fiber" that will get you FTTH or FTTB. So more often then not, voting with ones wallet isn't possible as no other/better service is available.
• 

  FYI: Ipv6 users should use 2.pool.ntp.org as their NTP server
  • IsaacFL  

  1
  3
  Votes
  1
  Posts
  206
  Views

  No one has replied

• W

  Setting up Comcast Business Class IPv6 & IPv4 with Static Allocations to PFsense
  • WB3FFV  

  9
  0
  Votes
  9
  Posts
  1609
  Views

  K

  With the exception of the DHCP setup, the following works for me for a little while, but I suspect the issue on my end is something else. https://techielibrarians.com/index.php/2017/06/08/native-ipv6-with-comcast-business-and-pfsense-2-3/ Those instructions are for the old gateway modem type, but I'm on the Cisco and it seems to work.
• P

  Help me with IPv6 SLAAC on Android
  ipv6 android slaac • • pixielark  

  29
  0
  Votes
  29
  Posts
  1463
  Views

  P

  Ok, so the final update, I have everything fixed now (at least till now) So the final trick is to set my switch to tag port 5-8 which connect to my 4 APs apparently the tp-link APs will receice packages on it's selected wirelss VLAN + anything that's untagged (without vlan header) after change my switch to tag vlan1 on port 5-8 it ensures all the vlan1 tag won't be removed when outbound the port, which fixes the RA flood issue. Thanks everyone for the help
• S

  Using IPv6 on LAN without IPv6 on WAN?
  ipv6 lan • • stb  

  13
  0
  Votes
  13
  Posts
  593
  Views

  B

  Even if your ISP doesn't provide IPv6, you can still have it, using a tunnel from hurricane electric. They are free, they perform well, they are very reliable and they work. I used one for years before my ISP implemented IPv6. There are lots people here who can help you set it up.
• M

  tunnel over slash 48
  • msf2000  

  3
  0
  Votes
  3
  Posts
  110
  Views

  M

  Thanks for the sanity check. I got a few IPv6 digits reversed. Fixing the typo fixed the routing. :)
• L

  IPv6 Native with Telstra, Australia
  • Larrikin  

  165
  0
  Votes
  165
  Posts
  5389
  Views

  L

  @Derelict I am certain I have come across some sort of bug in pfsense that when IPv6 is enabled, IPv4 performance decreases by about 2mb/s both up and down. I have done lots of testing tonight and Telstra's router does not suffer this issue, only pfsense. The moment I turn off IPv6, I get my full speeds back. The moment I turn on IPv6, I lose 2mb/s down and up on IPv4. I cannot replicate that on Telstra's router. I maintain full speeds on IPv4 with IPv6 enabled on Telstra's router. What additional information would you need to help isolate what this bug would be?
• Q

  IPv4 over IPv6
  • QED  

  4
  0
  Votes
  4
  Posts
  253
  Views

  Q

  I guess this feature is not available on pfSense. It is a sad news as the situation will become worse over time. IPv6 over IPv4 was the 1st phase of IPv6 implementation. Now we are on the second phase were we are moving to IPV4 over IPv6, as ISP started increasing their IPv6 capable gear. We will see this increasing and this phase will last years IPv4 will eventually go away. However, looking at the trend, I wont be surprised if it takes over 30 years to get there.
• L

  Commercial opportunity for Netgate - IPv6
  • Larrikin  

  1
  0
  Votes
  1
  Posts
  153
  Views

  No one has replied

• L

  rapid-commit support
  • Larrikin  

  3
  0
  Votes
  3
  Posts
  220
  Views

  L

  Thanks. I realised I could put the rapid commit command via the GUI using https://imgur.com/a/IdxTJAr The problem I have is that I just cannot get IPv6 working at all with Australia's largest ISP Telstra. They only issue PD's (/56), but they don't respond to solicit commands at all. I think they only broadcast initially an IPv6 Neighbourhood advertisement which pfsense doesn't initially pick up. I've tried everything. All my config files are found here: https://forums.whirlpool.net.au/thread/2784659
• N

  Dynamic IPv6 Prefix assignment issue in xDSL users
  ipv6 • • niloofar  

  44
  0
  Votes
  44
  Posts
  1984
  Views

  

  See if using a scheme like this using both ULA and GUA-PD on the inside interfaces helps with that sort of problem. That is the recommended way to operate when an ISP insists on changing the PD. https://forum.netgate.com/post/825770 If that doesn't help you'll need to post specific details as to exactly what the ISP is doing and exactly what is causing your problems. Not a description, but screen shots and real, actual troubleshooting output. https://www.ripe.net/publications/docs/ripe-690#5--end-user-ipv6-prefix-assignment--persistent-vs-non-persistent Note that's RIPE - as in Europe. So it's their own RIR telling them they're doing it wrong, too. RFC7368 is about as close as we have to a controlling document here. https://tools.ietf.org/html/rfc7368 ULAs should be used within the scope of a homenet to support stable routing and connectivity between subnets and hosts regardless of whether a globally unique ISP-provided prefix is available. In the case of a prolonged external connectivity outage, ULAs allow internal operations across routed subnets to continue. ULA addresses also allow constrained devices to create permanent relationships between IPv6 addresses, e.g., from a wall controller to a lamp, where symbolic host names would require additional non-volatile memory, and updating global prefixes in sleeping devices might also be problematic.
• 

  Getting new IPv6 prefix
  • JKnott  

  28
  0
  Votes
  28
  Posts
  930
  Views

  

  While there is no doubt this problem is occurring at the ISP, I've continued investigating. I'm examining the DHCPv6 XID advertise packet. What I've found it this: Status Message: No prefix available on Link 'CMTS89.WLFDLE-BNDL1-GRP3' I assume this means the ISP is not providing the prefix to my network. The full packet is listed below. Any ideas? Frame 66: 214 bytes on wire (1712 bits), 214 bytes captured (1712 bits) on interface 0 Ethernet II, Src: Casa_9a:a1:99 (00:17:10:9a:a1:99), Dst: Trendnet_2b:ed:ea (00:14:d1:2b:ed:ea) Internet Protocol Version 6, Src: fe80::217:10ff:fe9a:a199, Dst: fe80::214:d1ff:fe2b:edea User Datagram Protocol, Src Port: 547, Dst Port: 546 DHCPv6 Message type: Advertise (2) Transaction ID: 0x557257 Client Identifier Option: Client Identifier (1) Length: 14 Value: 0001000123eb5e12001617a7f2d3 DUID: 0001000123eb5e12001617a7f2d3 DUID Type: link-layer address plus time (1) Hardware type: Ethernet (1) DUID Time: Feb 4, 2019 15:33:22.000000000 EST Link-layer address: 00:16:17:a7:f2:d3 Server Identifier Option: Server Identifier (2) Length: 14 Value: 00010001159bb6e50021285fd2b7 DUID: 00010001159bb6e50021285fd2b7 DUID Type: link-layer address plus time (1) Hardware type: Ethernet (1) DUID Time: Jun 27, 2011 17:47:17.000000000 EDT Link-layer address: 00:21:28:5f:d2:b7 Identity Association for Prefix Delegation Option: Identity Association for Prefix Delegation (25) Length: 72 Value: 000000000000000000000000000d003800064e6f20707265... IAID: 00000000 T1: 0 T2: 0 Status code Option: Status code (13) Length: 56 Value: 00064e6f2070726566697820617661696c61626c65206f6e... Status Code: NoPrefixAvail (6) Status Message: No prefix available on Link 'CMTS89.WLFDLE-BNDL1-GRP3' DNS recursive name server Option: DNS recursive name server (23) Length: 32 Value: 2607f7980018001000000640712552042607f79800180010... 1 DNS server address: 2607:f798:18:10:0:640:7125:5204 2 DNS server address: 2607:f798:18:10:0:640:7125:5198
• C

  Ipv6 Comcast
  • clifford64  

  2
  0
  Votes
  2
  Posts
  204
  Views

  C

  Ok, so it appears I was getting a PD, but I wasn't seeing it in the logs because the DHCP6c debugging wasn't turned on. After turning it on, it was showing me the full PD of /60 being given to me and then the router handling the tracking. So, what I have done is enabled tracking only on one of my 3 vlan interfaces (the guest). Then after receiving the prefix, I can set statics on the other interfaces that I care about.
• G

  Prevent logging of a specific IPv6 blocked address
  • ghostnet  

  4
  0
  Votes
  4
  Posts
  164
  Views

  

  The default deny rule logs by default. There is a checkbox to stop this logging but it will affect ALL traffic hitting default deny not just the traffic you are specifically asking about. A specific rule higher in the list can block the traffic, not log, and processing will stop. The default deny rule (and the logging) will never be hit/processed.
• X

  IPv6 no longer working after updating to 2.4.4
  • xero9  

  20
  0
  Votes
  20
  Posts
  1941
  Views

  D

  I have exactly the same issue. SLAAC on the PPPoE WAN interface seems to work, but I can't ping6 any host on the internet. Also, clients seem to not getting RA's. But before 2.4.4 I was able to ping6 google.com when I logged in to pfSense via SSH. Don't have a solution unfortunately.
• E

  IPv6 WAN interface not getting prefix, only single IPv6 address
  • earlish  

  12
  0
  Votes
  12
  Posts
  1919
  Views

  G

  @earlish Hi, Do you still use pfsense? I'm facing the same problem as you using AsashiNET provider. Only the WAN gets the prefix, LAN It is not getting anything. Please let me know if you found a solution because my provider doesn't support PPPoE for IPv6. Thanks in advance.
• M

  IPv6 and Ip renumbering
  • maybeageek  

  3
  0
  Votes
  3
  Posts
  194
  Views

  M

  Hi, thanks for the quick response! actually, I don't need IPv6, but, as we in Germany say, it is sort of a chicken - egg problem. If nobody uses it, then no services will be made available. If no services are available, no one will use it. Anyhow, the German Telekom started DualStack quite some time ago, and I want to use, if only for the reason of it being the future, and no immediate need. I expect current devices to use it where possible. But you are right, no necessary need has arisen, yet. To solve my problem: A guy in the german telekom forum asked the same questions, to which somebody else posted screenshots. They work perfectly for my setup. So I will leave the link here for documentation purposes: German Telekom Forum This setup does exactly what I want and it works without further config need. All the best, Thomas