OK this issue can be close, its fixed with the upgrade today to 24.03.

@syn4ck https://redmine.pfsense.org/

@JKnott @Gertjan I used to have cable (Xfinity), but got rid of it as it was a potential surge path (nothing is properly grounded here), I am able to get AT&T fiber, but their insistence on you using their gateway put me off. Maybe if I find a way to use my own fiber modem (if that is the proper term) fiber would be the way to go. As for now, it seems like I am out of luck, though : ) Thank you, appreciate the input!

@jhg said in pfSense static ipv6 address on LAN tracking delegated prefix?: Is there a way to give the firewall's LAN interface a static IPv6 address within the delegated prefix? I know of one 'official' way : you have to do this if you are really get an /64 (probably way bigger) to assign to your LAN(s). Normally, ISP don't do this, you need to have the dhcp6c on WAN asking for at least one 'prefix', and have that assigned to your LAN using Tracking mode. Create a free account here : https://tunnelbroker.net [image: 1713772665724-bfa252a7-0d69-4be4-ac0b-64c115ece417-image.png] From here on, it's easy : Assign statically the xxx:5c0:2 to you WAN IPv6. Because they give you a /48, don't even bother with the announced /64 = xxx:5c0::/64 Assign statically the first 2001:471:c8xx:0::/64 (from the /48 pool) to your first LAN. Assign statically the first 2001:471:c8xx:1::/64 (from the /48 pool) to your second LAN. Etc, continue like that 65533 times for 65535 LAN's ^^ I've been using this 'setup' for nearly a decade, and it was just perfect. Well, close to perfect, as a IPv6 over Ipv4 tunnel is used to the closest he;net access point, Paris for me (216.66.84.42). My IPv4 WAN speed was about 25 Mbits/sec back then, and I'm not sure they will follow my current speed, > 1 Gbits right now. But again : it worked flawlessly.

@Derelict the URL is not working

@Imesh_ Hello did you manage to get the ipv6 on the lan?

@KluthR said in Show dhcp6c status for ISP prefix: If this was the right way to test it. I suspect it might take another reboot. However, the way I found out about the problem was just disconnecting & reconnecting the Ethernet cable to the cable modem was enough to cause the prefix to change.

Issue resolved. The MTU needed to be 1500 not 1492. Thanks for the help, guys.

BTW the Redmine mentioned PR (https://redmine.pfsense.org/issues/6626) is also available at github at https://github.com/pfsense/pfsense/commit/7c4b3d3c8d2d15b1e59d1d262cc295a848434355 So, the :: feature expands the $rule['interface']'s prefix to the host portion. Useless in my case. Okay, lets make my target v6 a complete one: it works! Assuming the Do not allow PD/Address release is being ignored and I get a new prefix, then all my rules are dead. Correct me if Iam wrong, but pfSense misses a dropdown for that :: case, allowing me to select the target interface for auto-prefix-determination at https://github.com/pfsense/pfsense/blob/9fd4cb962ad28b0e03c8c755a80b20ad7c867d9e/src/etc/inc/filter.inc#L3247

Our data center set up a /125 IIRC for our IPv6 WAN and routes our LAN subnet to a specific IP. (We have a HA setup so two IPs plus the shared IP) Like this but IPv6: https://docs.netgate.com/pfsense/en/latest/recipes/route-public-ip-addresses.html#ip-assignments

@SteveITS If I leave it blank, my devices don't get IPs. I followed the @JKnott procedure and now it's running well.

I was able to locate the device using: netsh int ipv6 show neighbors This gave me the MAC address for the link local ipv6 addresses.

@Gertjan So if it's disabled by default then why does it work if I don't change that setting and it shows a green tick in the services. All clients pass the IPv6 tests and if I ping google.co.uk it uses the google IPv6 address.

@Sevi said in Delegated prefix in firewall rules?: patch should also be included in upcoming releases ref: https://docs.netgate.com/pfsense/en/latest/releases/24-03.html#aliases-tables @Sevi said in Delegated prefix in firewall rules?: address ::123 Hmm, thanks, will try that. Our IPv6 prefix at home changed recently and my main client (wife) was annoyed for a while without telling me. @johnpoz said in Delegated prefix in firewall rules?: free Hurricane Electric tunnel We did that once because of a specific setup...it functions, but the throughput is throttled, about 35 Mbps as I recall. And there are sites that consider HE IPs like a VPN and block access, for instance sites that can only show video or sports content to certain regions due to licensing.

@Bob-Dig I will definitely take a peek at that, thank you bringing it to my attention

@Bob-Dig said in Interface groups and IPv6 GUA subnets: Interesting that it does work for you without problems. A difference might be that I'm only testing VLANs right now, no physical interfaces? I can try it later on the 4100, but for now I was testing on an 1100 with the switched ports. (I did have to use the ol' Save&Apply on the WAN interface to trigger the prefix delegation for any new interface though... but I also had to do that before the patch.)

For years instead of the comcast router for gateway up detection I use their v6 DNS server. 2001:558:feed::2 or 2001:558:feed::1 As I had to set IPv6 to DNS server for monitoring...I also use their IPv4 DNS servers for the same. System - Routing - Gateways - Edit ... 75.75.76.76 and the 2001:558:feed::2 have worked swimingly. I don't use those servers for actual DNS...but it proves that my local routers and equipment are up and that I can reach the core of their public services ok. (edited for clarity)

SOLVED: The issue has been solved by checking "Do not wait for a RA" option in WAN interface.

To close this out... Apparently a firewall rule has to be manually added to allow IPv6 traffic to pass between the LAN and the WAN. And I completely missed that requirement in my "research". Having added said rule, things are working swimmingly. Thanks for your patience and sorry for the noise.