Still an issue today

@pfsensation Yep, it's green and showing online.

@keyser said in IPv6 via IPSec: My understanding is that ULA is not 100% like RFC1918 - there is actually another range of IPv6 addresses for that. Not that I'm aware of. ULA is the same as RFC1918 in that it's routeable, but not allowed on the Internet. However, you can't have a VPN over the Internet that uses ULA on either end. VPNs can certainly carry ULA though, just as they can RFC1918.

Thank you all for your answers and discussion. Unfortunately it’s a “real problem”. There is a person who I trusted before but this person is now in suspicion for a bad deed. While changing my passwords (way too late I did that) I saw a log in to my personal account that was definitely not made by myself. It’s possible that that person had an auto login but I also had the hunch this person spied my personal mailbox (which is of great concern because I was in touch with official entities). Well I think the chance is quite low I forgot to logout somewhere and that that device has the same /56 prefix as that person. So I can just hope that was an auto login or that person did not found anything. Thank you all.

@jknott I'll try this out when I can find a time my flatmates are all asleep (not often!). Going on a long drive today, but thanks for the tip :)

@jknott I know you can use WAN and LAN, but that doesn't help if you want to allow a rule for a client inside the IPv6 pool. My address for WAN maybe 1111:2222:3333:4444:AAAA:BBBB:CCCC:DDDD, but my client maybe 1111:2222:3333:4444:AAAA:BBBB:CCCC:FFFF. So, I need my firewall to point to the FFFF address in the forward and if my IPv6 address changes, then I have to manually go into the firewall and update them.

@elscorcho Good. That setting allows you to choose whatever size prefix you want, up to whatever your ISP provides. So, if you choose 64, then you only get a single /64. I also have a /56, with a /64 assigned to my main LAN, guest WiFi, test LAN, a downstream Cisco router and I can then route another /64 to the Cisco router. With IPv6, you get gazillions of addresses, so no need to worry about how many you use.

@mrpete HEY!!! Get your priorities straight!!! BTW, isn't OPNsense based on pfsense? A friend of mine runs it and seems to like it.

@magikmark ???? If if was connected before, why is it now a "new" device? Regardless, one trick is to power down the modem for a minute or so and then try connecting.

@bmeeks I'm a lot luckier with my ISP. They've been providing native IPv6 for about 6 years and via 6to4 and 6rd tunnels for a while before that. They are also my cell phone carrier so not only does my phone get an IPv6 address, but so do devices I tether to it. Also, my IPv4 address is virtually static and the host name depends on my hardware MAC addresses, so I have no problems with connecting my VPN to my network.

@martywise My IPv4 address is virtually static, but my host name is based on modem and router MAC addresses. If I change hardware, the host name will change. If I change my router or it's NIC, my address will change. On IPv6, my prefix has survived modem and complete replacement of the box I run pfsense on. I suspect it might take a nuke or two, to change it.

@johnpoz said in Access my website from WAN IP: That would be a feature request or bounty.. I am going with feature request.

@johnpoz Done https://redmine.pfsense.org/issues/12600

@almodovaris DHCPv6 does not work with Android. You'll have to switch to SLAAC.

Ok i just gave up on getting pfSense to generate a working configuration... If something in my ISP's weird setup is causing it, a bug or the position of the moon i have no idea. But it works when writing the config file manually and adding the interfaces. The interface still shows nothing about the delegated prefix but everything is working. RA's set to unmanaged on the local interfaces. The config file that works with my setup (on Kviknet in denmark): interface xn3 { send ia-pd 1; send ia-na 1; script "/var/etc/dhcp6c_wan_script.sh"; }; id-assoc na 1 { }; id-assoc pd 1 { prefix ::/48 infinity; prefix-interface xn0 { sla-len 16; sla-id 1; }; prefix-interface xn1 { sla-len 16; sla-id 2; }; };

@abcdefabcdef were you able to resolve telmex's IPv6 connection in bridge mode?

@johnpoz i installed the cert and added it to the trust store so i'm assuming i did lol cool ill take a look

So my config was perfectly fine. rebooted the server and it just suddenly started working. guessing something getting cached