Multiple IPv6 Prefix Delegation over AT&T Residential Gateway for pfSense 2.4.5
-
@jknott Oh okay, I must of misunderstood here. I took what was said in the first post to heart, that AT&T DOES provide a /60, but it seems like they only provide me a /64. Why? I don't know. Seems like other people get /60 to work, but this works for me. /64 is plenty of IP addresses, why do people fuss about it?
-
@brswattt you can not split a /64 - it is designed to be the smallest prefix to use really. There is some special use of /128
But putting a prefix on a interface for say your lan or optX etc would be a /64
In the quick reading I did about the att issue, which might be dated and I don't have att to test with.. Is they will not issue anything other than a /64 vs say a /60 or /56 etc.. that you could break up and use /64s out of that for your different networks/vlans behind pfsense.
So again my quick read of this issue is this script/config allows you to request a delegation for each interface on pfsense. Seems like a horrible setup, why not just let you request a /60??
But which is very typical with many an ISP and IPv6 - they F it up!! ;)
What should/supposed to happen is you request a /60 for example, and then use say prefix 1 of that on lan, prefix 2 on your optX, and prefix 3 on your optY, etc..
-
@johnpoz Yep, god forbid they do it right so we can split it how we want. Also, with managed RA my android devices won't get IPv6 addresses. Can I just set it to Assisted so they can use SLAAC?
-
@brswattt if you want a dead simple solution to all your isp ipv6 issues.. I have 2 suggestions really, don't use ipv6 at this time. Do you have some actual reason to use IPv6 - other than learning/playing with it? I have yet to have anyone post 1 legit resource that actually requires IPv6..
So the easy thing is just not use it ;)
Yeah sure IPv6 is the future, but that future sure isn't today, nor tomorrow or prob even next few years to be honest. So unless you have some actual need or want for using it, other than learning curve? I have yet to even see or hear of a game that leverages it to be honest.
Other option, is forget your isp stupid deployment method, and just get a free Hurricane electric tunnel. Free - you can get a /48 that doesn't change, you can set your interfaces to use any prefix you want out of your /48.. And guess what you can run slaac all you want ;)
I have had a HE tunnel for like 12 some years.. I use it when I want to test/play with something in IPv6.. Takes all of few minutes to setup. It doesn't change, you can even set your own PTRs for any IP in the /48 etc. Good luck getting your isp to let you do that ;)
My current isp doesn't even offer IPv6, nor have I seen any mention of providing it any time in the near future.
edit:
Click I have ipv6
Click I do not...
-
I have a pfSense CE router now and find your guide to prefix delegation works great. Thank you. I discovered that any Save/Apply to the Interfaces / LAN tab must be followed by a Save on the Router Advertisements tab to correctly define the radvd.conf file. The pfSense system seems to default the radvd.conf file after a Save/Apply on the Interfaces tab ignoring the Router Advertisements configuration until a Save is done on that page. You might want to note that in Step Six of your guide.
-
G Gertjan referenced this topic on
-
M marcg referenced this topic on
-
M marcg referenced this topic on
-
M marcg referenced this topic on
-
M marcg referenced this topic on
-
Is this recipe still applicable to 23.01 with recent BGW320 releases (mine is on 4.22.5)?
When I use the recipe, both the BGW and the router say that no prefixes have been delegated, and the router generally refuses to pass IPv4 or v6 traffic to the WAN. The behavior is the same after swapping the
dhcp6c_wan_script.shscript into the .conf file and with "Managed" for RA settings.I'm able to get and use a single prefix when the Configuration Override isn't specified for the WAN interface. Thanks.
-
Still works for me on the same hardware and firmware. I suggest you pcap your link with the RG for dhcp6 traffic and see if you are sending and receiving PDs
-
@lolipoplo Interesting results.
The router solicits three prefixes, which is correct. The BGW advertises them. The router gets them, and then releases all of them ~3 seconds later. You can see that in the screenshot below.
The OP says to uncheck "Do not allow PD/Address release" in the WAN interface DHCP6 setup. I couldn't find that option anywhere. Wonder if it's part of the issue?
-
It's working now. This was a new pfSense install, with the WAN interface of my old router (UDM Base) plugged into a dedicated LAN-side interface on the pfSense. I had neglected to turn off prefix solicitation on the UDM. The UDM and pfSense were apparently "fighting" for prefixes from the BGW. Disabling prefix solicitation on the UDM fixed the issue. IPv6 was disabled on the pfSense interface for the UDM throughout; still puzzled as to why the BGW saw the UDM's DHCP6 requests at all.
-
@marcg do you feel that your IPv6 connections drop after a few days (>24hrs)
I believe this is caused by the latest firmware. the RG has to be rebooted every few days
-
@lolipoplo not yet, but I'll keep an eye on it. My pfSense has only been installed for a ~week.
I did notice an issue with the BGW's NAT table on 4.22.5. NAT table source and destination addresses are reversed for a subset of the entries, i.e., the BGW's NAT table incorrectly shows some traffic being initiated from external->internal when in actuality the flows are initiated internal->external. The pfSense NAT states correctly reflect that. I thought this was a display issue on the BGW only, but it may be deeper. More details here.
Someone responded on that thread saying that their v6 connections were dropping. Maybe the same thing you're observing.
-
Hey folks. pfSense+ 23.05 has been released which has a better GUI, specifically for AT&T residential gateway customers. They have documentation in the release notes on how to set up IPv6 as well as RG bypass (direct to ONT).
I would urge people to try out 23.05 as it appears this documentation/post won't be updated to align with built-in features.
OP
-
@ttmcmurry Thanks for the heads-up and for the original recipe.
I have a BGW320. It would be great to get around its NAT state table limitation. The only rub is that I have no separate ONT: the fiber terminates directly on an SFP in the BGW. Not clear to me that I could take advantage of this new 23.05 feature unless I install a separate ATT-compatible ONT? The "ONT IN" port on the back of the BGW has a plastic cover. I'm not even sure there's an ethernet port underneath.
I installed 23.05 yesterday. Your original recipe continues to work well.
-
Yeah, I heard that AT&T was offering new gateways that have a built-in ONT. IIRC, all lines of service > 1 gigabit require that particular gateway.
This may or may not be a solution for customers with the newer RG. It stands to reason there's a possibility a separate or aftermarket ONT can be acquired and used, but that goes well outside of what I can test/document. :)
And thank you for the compliment! It's great keeping a healthy discussion forum!
-
Thank you for making me aware of this. Everything is working great.
Here is a link to a DUID generator that I found. -
I thought everything was working great. The bridge mode is working perfectly.
IPv6 is another story. I get IPV6 address on WAN and LAN but when I go to test it at various sites it fails. I have everything configured per the Netgate guide that @ttmcmurry posted.
Do I need to enable the DHCPv6 server? The guide did not state anything about that. -
@AiC0315 The recipe here covers prefix acquisition from the ATT Gateway. It's not a full v6 configuration guide for pfSense.
For example, v6 traffic needs to be enabled via System > Advanced > Networking > AllowIPv6 and firewall rules that support v6 have to be created.
Try to figure out where the traffic is being blocked and whether DNS v6 name resolution is working, e.g.,
traceroute -6 www.google.com -
@marcg
Thanks, I was able to find the extra settings. All is working now. -
@ttmcmurry Thanks for the heads-up on this. But looking at the new advanced options I was not able to figure out how to translate the current script into input to the new settings. Would you or someone else be able to create a post on how to do it?
Thanks!
-
I still don't understand the dumbass state limit from att.
first they should migrate all of their RG communication to ipv6 and free the only ipv4 to user
second, they should use STATELESS rules for PD'd ipv6 + ipv4.
this 8k limit feels very much arbitrary, as if it's intended to limit the number of devices for residential users
(it's not an issue for the box to support >1 million states: https://johnleach.co.uk/posts/2009/06/17/netfilter-conntrack-memory-usage/)
