OK, I think I figured it out looking at the tunnel interface MTU on the firewall. BY DEFAULT it sets to 1280 unless you set it to match the MTU on the other end of the tunnel - 1480 per HE. When I set to 1480, it no longer sent PMTU for 1280, but for 1480 like it's supposed to. Not at all intuitive... tracepath google.com 1?: [LOCALHOST] 0.029ms pmtu 1500 1: 2001:470:e073:101::2 0.392ms 1: 2001:470:e073:101::2 0.407ms 2: 2001:470:e073:101::2 0.425ms pmtu 1480 2: tunnel202636.tunnel.tserv13.ash1.ipv6.he.net 29.177ms 3: 10ge2-2.core1.ash1.he.net 13.809ms 4: pr61.iad07.net.google.com 12.468ms tracepath google.com 1?: [LOCALHOST] 0.033ms pmtu 1400 1: 2001:470:e5bf:1001:cafe:dead:beef:1 8.834ms 1: 2001:470:e5bf:1001:cafe:dead:beef:1 0.516ms 2: 2001:470:e5bf:3000::2 1.576ms 3: tunnel161881.tunnel.tserv13.ash1.ipv6.he.net 7.791ms 4: 10ge2-2.core1.ash1.he.net 7.385ms 5: pr61.iad07.net.google.com 7.862ms

@jknott I went back and looked things over for a couple of day. Looking at Wireshark, I wasn't seeing any ICMPv6 traffic at all coming over to the wired side of my network from the wireless side. So, I assumed it was something wrong with bridge mode on that Amplifi HD wireless router. I ordered a small netgear wireless access point to replace it with. But, today, as I was preparing for that WAP, I noted my prefix in the WAN interface wasn't what I thought it was. I used to have it set up for a /56. But, it was set for /64 and wasn't even set to send a hint. I changed that and now have IPv6 addresses on the phones. I made no other changes. Oh, well. Sorry for the trouble. Thanks for the help.

@kimble said in IPv6 Gateway monitoring broken in 2.6.0?: Maybe it's clever enough to bind to a LAN address in that instance? I've no idea. You have to specify a source address by using the -S option in ping. I just did it, using my LAN global address.

@jkmuk Do a packet capture on DHCPv6. To do this, shut down pfsense and disconnect the WAN cable. Reboot and start Packet Capture Plug in the WAN cable. After a couple of minutes, download the capture file and post it here.

This issue is reproduced by Netgate support and tracked as https://redmine.pfsense.org/issues/12790

@jknott as I said this setting work for me perfectly.

@gertjan I applied it to all interfaces in a floating rule. Why Not right? Yeah. Its an alias. Netflix was sort of sneaky by not blocking everything. Had me fooled for a minute there. I also handed out static IPV6 addresses to everything connected to the pfsense including my XMPP chat server and phone server. Interestingly, that totally fixed NAT issues like broken video and broken voice even when only one side of the conversation was on IPV6 and the other side was on IPV4. Thats the main reason I want everyone to transition to IPV6. No more NAT. No more buying a public IP for every server. No more need for STUN, ICE, Jingle, WebRTC, TURN servers or crap like that.

@wbond Ok, great. The dull thing about "ISP router in in router mode" is : it should work, as my he IPv6 tunnels are all up right now @work and also the one @home. I'm using the he.net POP in Paris. Note : he.net is supplying me with IPv6, as my ISP doesn't know what that is (@work) - or, @home, they just supply on /64. so none are available for the LAN's. Btw : always check the tunnel status. And if doubt, the forum on he.net.

Still an issue today

@pfsensation Yep, it's green and showing online.

Thank you all for your answers and discussion. Unfortunately it’s a “real problem”. There is a person who I trusted before but this person is now in suspicion for a bad deed. While changing my passwords (way too late I did that) I saw a log in to my personal account that was definitely not made by myself. It’s possible that that person had an auto login but I also had the hunch this person spied my personal mailbox (which is of great concern because I was in touch with official entities). Well I think the chance is quite low I forgot to logout somewhere and that that device has the same /56 prefix as that person. So I can just hope that was an auto login or that person did not found anything. Thank you all.

@jknott I'll try this out when I can find a time my flatmates are all asleep (not often!). Going on a long drive today, but thanks for the tip :)

@jknott I know you can use WAN and LAN, but that doesn't help if you want to allow a rule for a client inside the IPv6 pool. My address for WAN maybe 1111:2222:3333:4444:AAAA:BBBB:CCCC:DDDD, but my client maybe 1111:2222:3333:4444:AAAA:BBBB:CCCC:FFFF. So, I need my firewall to point to the FFFF address in the forward and if my IPv6 address changes, then I have to manually go into the firewall and update them.

@elscorcho Good. That setting allows you to choose whatever size prefix you want, up to whatever your ISP provides. So, if you choose 64, then you only get a single /64. I also have a /56, with a /64 assigned to my main LAN, guest WiFi, test LAN, a downstream Cisco router and I can then route another /64 to the Cisco router. With IPv6, you get gazillions of addresses, so no need to worry about how many you use.

@mrpete HEY!!! Get your priorities straight!!! BTW, isn't OPNsense based on pfsense? A friend of mine runs it and seems to like it.

@magikmark ???? If if was connected before, why is it now a "new" device? Regardless, one trick is to power down the modem for a minute or so and then try connecting.