Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Multiple IPv6 Prefix Delegation over AT&T Residential Gateway for pfSense 2.4.5

    Scheduled Pinned Locked Moved IPv6
    147 Posts 30 Posters 74.5k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • styxlS
      styxl @SirSilentBob
      last edited by

      @sirsilentbob

      This is how i did it (on an SG-5100)

      interface igb0 {
              send ia-na 0;
              send ia-pd 0;
              send ia-pd 1;
              send ia-pd 2;
              send ia-pd 3;
              send ia-pd 4;
              send ia-pd 5;
              send ia-pd 6;
              request domain-name-servers;
              request domain-name;
              script "/var/etc/dhcp6c_wan_script.sh";
      };
      id-assoc na 0 { };
      id-assoc pd 0 {
              prefix-interface ix0 {
                      sla-id 0;
                      sla-len 0;
              };
      };
      id-assoc pd 1 {
              prefix-interface ix1.101 {
                      sla-id 0;
                      sla-len 0;
              };
      };
      id-assoc pd 2 { };
      id-assoc pd 3 { };
      id-assoc pd 4 { };
      id-assoc pd 5 { };
      id-assoc pd 6 { };
      id-assoc pd 7 { };
      

      Then my LAN interfaces as setup as such;

      For LAN:
      Capture1.PNG
      Capture4.PNG

      For LAN2:
      Capture3.PNG

      S 1 Reply Last reply Reply Quote 1
      • S
        SirSilentBob @styxl
        last edited by

        @styxl Thanks! It turns out there was another configuration oddity that was the culprit. I've been able to get it going fine on FIOS without this script. I'll keep it in mind if anything ends up changing though.

        1 Reply Last reply Reply Quote 0
        • A
          AiC0315
          last edited by

          I am able to get an IPV6 address on WAN and LAN But when I go to a site to test IPV6 it fails. When I plug directly into the RG it passes the test. Am I missing something?

          TIA

          JKnottJ 1 Reply Last reply Reply Quote 0
          • JKnottJ
            JKnott @AiC0315
            last edited by

            @aic0315

            What failure do you see at the test site?
            Which test site are you using?

            PfSense running on Qotom mini PC
            i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
            UniFi AC-Lite access point

            I haven't lost my mind. It's around here...somewhere...

            A 1 Reply Last reply Reply Quote 0
            • A
              AiC0315 @JKnott
              last edited by

              @jknott
              Test-ipv6 gives no results for IPV6
              and IPVG-test says not supported

              JKnottJ 1 Reply Last reply Reply Quote 0
              • JKnottJ
                JKnott @AiC0315
                last edited by

                @aic0315

                Are you sure you have an IPv6 address, other than link local?

                PfSense running on Qotom mini PC
                i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                UniFi AC-Lite access point

                I haven't lost my mind. It's around here...somewhere...

                A 1 Reply Last reply Reply Quote 0
                • A
                  AiC0315 @JKnott
                  last edited by

                  @jknott
                  On the interface status page it is showing the link local and an IPV6 address. So, I am assuming so.

                  JKnottJ 1 Reply Last reply Reply Quote 0
                  • JKnottJ
                    JKnott @AiC0315
                    last edited by

                    @aic0315

                    What do you get when you run netstat -r?
                    You should see something like this:

                    Internet6:
                    Destination Gateway Flags Netif Expire
                    default fe80::217:10ff:fe9 UG igb0

                    Try a packet capture when you try to access test-ipv6.

                    PfSense running on Qotom mini PC
                    i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                    UniFi AC-Lite access point

                    I haven't lost my mind. It's around here...somewhere...

                    1 Reply Last reply Reply Quote 0
                    • P
                      paul_s
                      last edited by

                      I am getting prefix delegation to my two LAN interfaces. It is working great. However, sometimes the prefixes swap interfaces. Is there a way to configure dhcp6c to prevent that?

                      I have an ATT BGW320 and am using a UniFi USG router. Sorry I don't have a PFsense router. I think I just don't know what the dhcp6c configuration should be to prevent the swapping.

                      JKnottJ 1 Reply Last reply Reply Quote 0
                      • JKnottJ
                        JKnott @paul_s
                        last edited by

                        @paul_s

                        What do you mean swap prefixes? Normally, you assign a prefix ID to each interface.

                        PfSense running on Qotom mini PC
                        i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                        UniFi AC-Lite access point

                        I haven't lost my mind. It's around here...somewhere...

                        P 1 Reply Last reply Reply Quote 0
                        • P
                          paul_s @JKnott
                          last edited by

                          @jknott
                          For instance the prefixes and address might be assigned this way
                          2600:1700:2b60:df9e::1 assigned to eth0
                          2600:1700:2b60:df9f::1 assigned to eth1

                          Then a few days later or after a reboot they might be reversed
                          2600:1700:2b60:df9f::1 assigned to eth0
                          2600:1700:2b60:df9e::1 assigned to eth1

                          Is there a way to keep the assignments consistent? What part of the configuration assigned a particular prefix to an interface?

                          Bob.DigB JKnottJ T 3 Replies Last reply Reply Quote 0
                          • Bob.DigB
                            Bob.Dig LAYER 8 @paul_s
                            last edited by

                            @paul_s Something in the pfSense WebGUI. You can set it up for free...

                            1 Reply Last reply Reply Quote 0
                            • JKnottJ
                              JKnott @paul_s
                              last edited by

                              @paul_s

                              That sounds like a hardware issue. Any chance you're using USB Ethernet ports.

                              PfSense running on Qotom mini PC
                              i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                              UniFi AC-Lite access point

                              I haven't lost my mind. It's around here...somewhere...

                              1 Reply Last reply Reply Quote 0
                              • P
                                paul_s
                                last edited by

                                Not using USB. The interfaces are integrated in the router.

                                JKnottJ 1 Reply Last reply Reply Quote 0
                                • JKnottJ
                                  JKnott @paul_s
                                  last edited by

                                  @paul_s

                                  I have never seen anything like that.

                                  I just noticed this:

                                  I have an ATT BGW320 and am using a UniFi USG router. Sorry I don't have a PFsense router.

                                  So, you're not running pfSense? If not, maybe you should be asking in a UniFi forum.

                                  My router is the one described in my sig, which I have been using with pfSense for over 1.5 years and before that, I had a HP compact desktop computer. Before that, I had a Linux based firewall on that HP computer and other computers before that. I have never, ever seen interfaces move. Are eth0 and eth1 associated with the same interface (same MAC) when the prefixes move?

                                  PfSense running on Qotom mini PC
                                  i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                                  UniFi AC-Lite access point

                                  I haven't lost my mind. It's around here...somewhere...

                                  1 Reply Last reply Reply Quote 0
                                  • P
                                    paul_s
                                    last edited by paul_s

                                    @JKnott
                                    I have a lot of respect for the members of this forum and have been unable to find the answer at UniFi. I was hoping that someone with experience like you might know the mechanism that assigns the delegated prefixes to a particular interface. Is it dhcp6c or is it radvd or something else? Then I hoped there might be a configuration parameter that might anchor the prefix to an interface.

                                    The interfaces are not moving, they retain the same MAC address. The IPv6 prefix changes.

                                    thanks for your time.

                                    JKnottJ 1 Reply Last reply Reply Quote 0
                                    • JKnottJ
                                      JKnott @paul_s
                                      last edited by

                                      @paul_s

                                      Are you running pfSense or not? If not, you're not likely to find a lot of support here. As I mentioned, I have never seen your situation on multiple computers, with either pfSense or Linux firewalls over twenty years or so. My sole Unifi experience is with my AC-Lite access point.

                                      With pfSense, the prefix will change if you don't select that setting I mentioned. Also, some ISPs mess things up to. But neither of those would cause the problem you're mentioning where the same prefix moves to another port.

                                      PfSense running on Qotom mini PC
                                      i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                                      UniFi AC-Lite access point

                                      I haven't lost my mind. It's around here...somewhere...

                                      1 Reply Last reply Reply Quote 0
                                      • P
                                        paul_s
                                        last edited by

                                        @JKnott
                                        As I stated in my first post "I don't have a PFsense router."
                                        As I stated in my last post "thanks for your time"

                                        1 Reply Last reply Reply Quote 0
                                        • T
                                          ttmcmurry @paul_s
                                          last edited by

                                          @paul_s

                                          Have no experience with Unifi - my guess would be there's something being incorrectly set on non-wan interfaces. If your ISP is giving you a /60, then you should be specifying on each internal interface the prefix delegate hint so that internal interfaces assign themselves correctly each time.

                                          What I originally posted in post 1 has a step that refers to this process where the prefix delegation is associated "id-assoc" "pd 1" with the correct interface "hn1" (etc).

                                          The only assumption made with AT&T is they reserve a certain number of networks in their /60 for AT&T use, and the rest are available for delegation.

                                          If UniFi doesn't have a way to associate interfaces to prefix delegation, then you'll get the variability that you're experiencing. Even on PFSense, this has to be done by hand, there's nothing in the GUI that allows admins to configure prefix delegation.

                                          The answer to your other question is the documented method in post #1 is using DHCPv6 (no Router Advertisements) to pull the PD.

                                          1 Reply Last reply Reply Quote 0
                                          • P
                                            paul_s
                                            last edited by

                                            @ttmcmurry

                                            The UniFi router uses the same dhcp6c configuration pfSense uses. My config is below. I have not been able to find out what the "ifid" number is in the id-assoc but the rest of it looks like yours. Perhaps the IPv6 Track Interface Prefix ID you reference is the key. I will try to figure out what that does in pfSense and see if I can translate it to UniFi.

                                            Thanks for the help.

                                            interface eth3 {
                                            send ia-na 0;
                                            request domain-name-servers, domain-name;
                                            send rapid-commit;
                                            send ia-pd 0;
                                            send ia-pd 1;
                                            script "/opt/vyatta/sbin/ubnt-dhcp6c-script";
                                            };

                                            id-assoc na 0 {};

                                            id-assoc pd 0 {
                                            prefix ::/64 infinity;
                                            prefix-interface eth0 {
                                            sla-id 0;
                                            sla-len 0;
                                            ifid 1;
                                            };
                                            };

                                            id-assoc pd 1 {
                                            prefix ::/64 infinity;
                                            prefix-interface eth1 {
                                            sla-id 0;
                                            sla-len 0;
                                            ifid 1;
                                            };
                                            };

                                            T 1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.