Finally I reinstall a new PF 2.1, restore the config and its works now

I have the same issue, same hardware and version, different ISP (Hughesnet Gen4).  I have native IPv6, I get a /64 on the WAN side, I can't get the right allocation on the LAN side because they hand out a /61 and that isn't a choice in the pull down menu, but if I pick /62 it all seems to look right.  none of my hosts on the LAN side (pretty much all apple devices at the moment) get an address. radvd is running in services, but because I have track interface for LAN, not a static, I can't set anything for the RA, and I don't know what the defaults are. I see the RAs in tcpdump from fe80::1:1, which is the LAN interface address, and they have a /63 prefix in 2001: that matches the LAN address on the pfsense box,  but the host never gets an autoconfig address.  I use autoconfig on the same laptop at work every day, and it's fine there. I'm new to pfsense, and I've only done IPv6 routing on enterprise-level gear, not home network stuff, but it's the only public address I can get out of Hughesnet, so any ideas are greatly appreciated.

Ah, ok… makes sense then.

I've had this problem for a while, since upgrading beyond 2.1-RC0. I have IPv6 working fine with Internode on an install from pfSense-LiveCD-2.1-RC0-i386-20130528-0427.iso but I can't get it working in 2.1-RELEASE-i386. I've even tried backing up and restoring the pfSense config from the old install to the new one (I run pfSense VMs). Everything works after restoring, except IPv6! The 2.1-RELEASE has more WAN IPV6 options than the 2.1-RC0. In RC0 I select "DHCP6", which then shows the "DHCP6 client configuration" options below it. The only option is the prefix delegation size which I set to /56 and when I apply the settings my WAN interface gets assigned my static IPv4 address from Internode and a global /64 Internode IPv6 address. In the final release 2.1-RELEASE there are three tickboxes in addition to the prefix delegation size drop down box. I'm sure I've tried every combination of these tickboxes to no avail. I'm confident the problem is something that has broken in pfSense since 2.1-RC0 due to the new options for DHCP6. I'm happy to post system logs from both the 2.1-RC0 and the 2.1-RELEASE installs if somebody is a good pfSense troubleshooter, although the only DHCP6 entries I can see in the logs are under the PPP tab. If there's a better log file to be looking at via command line please let me know. Cheers, BieRHeDD.

@razzfazz: Maybe I misunderstand what you're saying, but to do prefix delegation, you set only your WAN interface to DHCP6 and configure a prefix delegation size on it; the WAN interfaces are set to "track interface", each with a different "IPv6 prefix ID". for this setup type I found several howtos… "Problem" is, that we don't use DHCP/ DHCPv6 service from our ISP but we have static IPs which we announce ourself with BGP to our ISP ;) Additional "interesting" is that DHCPv6 service on pfsense have no CARP/replication modus? our Setup (each 2 servers with CARP failover):       ISP-line1                    ISP-line2         |    |                      |    |        (transfer-networks IPv4/IPv6 fixed)   gw1-jws1  gw2-jws1          gw1-zws1  gw2-zws2         |    |                      |    |       [DMZ ----------------------------- DMZ]      (public static IPv4 / IPv6 networks - here BGP announced)         |    |                      |    |   fw1-jws1  fw2-jws1          fw1-zws1  fw2-zws2         |    |                      |    |        (public NAT for IPv4 servers / public IPv6 networks wanted)       [LANs JWS1]                  [LANs ZWS8]

I try a ping to the gateway and a remote IPv6 address (from pfSense) every time I make a change to see if its up, and haven't been able to ping it yet.

Nevertheless, the proper way to set this up should be to set the "DHCPv6 prefix delegation size" on your WAN interface to whatever your provider actually gives you (apparently /48 in your case) and then set your LAN interface to "track interface" with "IPv6 prefix ID" set to a one of the possible sub-prefixes (0-ffff for a /48). Does that not work for you?

It may have… not sure since it happened overnight. Can't see any logs that would indicate link failure and the link is point to point Ethernet.

Yes, you'd either need either a second physical interface or a switch that supports VLANs (or at least passes VLAN tags through unmodified). Unless you actually want to allow all incoming IPv6 traffic from the WAN through to the LAN side (probably not a good idea), you'll have to create pass rules for the services that you want to expose. Because your LAN prefix is dynamically assigned by Comcast (and changes e.g. on every reconnect), you can't (easily) create a pass rule that only applies to your server and not to all the other machines on your LAN as well. An easy way around this problem is to put all your public machines on a separate interface (and prefix) and add a rule that allows the desired traffic to e.g. "OPT1 subnet" (which will just match whatever prefix is assigned to that interface at any given time).

The 192.168.100.x addresses handed out by DOCSIS modems prior to registration are very short leases, and a proper address provided by your ISP's DHCP server should have been assigned within 30 seconds of the modem completing registration. At this point pfSense should have updated the default route. If your modem is DOCSIS 3.0 it likely didn't need a firmware update at all. The reconfiguration for IPV6 happens at the CMTS end of the connection with your modem only needing a reset. For a modem to be certified for DOCSIS 3.0 it must support dual stack out of the box.

It's not avail as a visual option but it is enabled in the mpd config. I know it works cause I requested the option to be enabled over a year ago. Here is my log file from 2.1 Release with ipv6cp enabled. Sep 24 14:45:32 ppp: [wan] 894c:be78:d0b8:0407 -> 0090:1a00:0243:0fe0 Sep 24 14:45:32 ppp: [wan] IPV6CP: LayerUp Sep 24 14:45:32 ppp: [wan] IPV6CP: state change Ack-Sent –> Opened Sep 24 14:45:32 ppp: [wan] IPV6CP: rec'd Configure Ack #1 (Ack-Sent) Sep 24 14:45:32 ppp: [wan] IPV6CP: state change Req-Sent –> Ack-Sent Sep 24 14:45:32 ppp: [wan] IPV6CP: SendConfigAck #161 Sep 24 14:45:32 ppp: [wan] IPV6CP: rec'd Configure Request #161 (Req-Sent)

@razzfazz: That said, it would be very nice if the miniupnpd version included in pfSense supported WANIPv6Firewall / pinholes / PCP. Last time we tried to enable IPv6 for miniupnpd, it broke in various ways. Maybe a newer version would help there, but at the time we tried it, it was the most current version available. It has been a while though, we may revisit that for 2.2.

Since the anti-locking rules are applied to the LAN interface. You should unblock the webUI to be reachble from your WAN interface after that change.