Multiple IPv6 Prefix Delegation over AT&T Residential Gateway for pfSense 2.4.5

marcg

It's working now. This was a new pfSense install, with the WAN interface of my old router (UDM Base) plugged into a dedicated LAN-side interface on the pfSense. I had neglected to turn off prefix solicitation on the UDM. The UDM and pfSense were apparently "fighting" for prefixes from the BGW. Disabling prefix solicitation on the UDM fixed the issue. IPv6 was disabled on the pfSense interface for the UDM throughout; still puzzled as to why the BGW saw the UDM's DHCP6 requests at all.

lolipoplo

@marcg do you feel that your IPv6 connections drop after a few days (>24hrs)

I believe this is caused by the latest firmware. the RG has to be rebooted every few days

marcg

@lolipoplo not yet, but I'll keep an eye on it. My pfSense has only been installed for a ~week.

I did notice an issue with the BGW's NAT table on 4.22.5. NAT table source and destination addresses are reversed for a subset of the entries, i.e., the BGW's NAT table incorrectly shows some traffic being initiated from external->internal when in actuality the flows are initiated internal->external. The pfSense NAT states correctly reflect that. I thought this was a display issue on the BGW only, but it may be deeper. More details here.

Someone responded on that thread saying that their v6 connections were dropping. Maybe the same thing you're observing.

ttmcmurry

@marcg @lolipoplo

Hey folks. pfSense+ 23.05 has been released which has a better GUI, specifically for AT&T residential gateway customers. They have documentation in the release notes on how to set up IPv6 as well as RG bypass (direct to ONT).

I would urge people to try out 23.05 as it appears this documentation/post won't be updated to align with built-in features.

OP

marcg

@ttmcmurry Thanks for the heads-up and for the original recipe.

I have a BGW320. It would be great to get around its NAT state table limitation. The only rub is that I have no separate ONT: the fiber terminates directly on an SFP in the BGW. Not clear to me that I could take advantage of this new 23.05 feature unless I install a separate ATT-compatible ONT? The "ONT IN" port on the back of the BGW has a plastic cover. I'm not even sure there's an ethernet port underneath.

I installed 23.05 yesterday. Your original recipe continues to work well.

ttmcmurry

@marcg

Yeah, I heard that AT&T was offering new gateways that have a built-in ONT. IIRC, all lines of service > 1 gigabit require that particular gateway.

This may or may not be a solution for customers with the newer RG. It stands to reason there's a possibility a separate or aftermarket ONT can be acquired and used, but that goes well outside of what I can test/document. :)

And thank you for the compliment! It's great keeping a healthy discussion forum!

AiC0315

@ttmcmurry

Thank you for making me aware of this. Everything is working great.
Here is a link to a DUID generator that I found.

DUID Generator

AiC0315

I thought everything was working great. The bridge mode is working perfectly.
IPv6 is another story. I get IPV6 address on WAN and LAN but when I go to test it at various sites it fails. I have everything configured per the Netgate guide that @ttmcmurry posted.
Do I need to enable the DHCPv6 server? The guide did not state anything about that.

marcg

@AiC0315 The recipe here covers prefix acquisition from the ATT Gateway. It's not a full v6 configuration guide for pfSense.

For example, v6 traffic needs to be enabled via System > Advanced > Networking > AllowIPv6 and firewall rules that support v6 have to be created.

Try to figure out where the traffic is being blocked and whether DNS v6 name resolution is working, e.g., traceroute -6 www.google.com

AiC0315

@marcg
Thanks, I was able to find the extra settings. All is working now.

SimpsomRJ

@ttmcmurry Thanks for the heads-up on this. But looking at the new advanced options I was not able to figure out how to translate the current script into input to the new settings. Would you or someone else be able to create a post on how to do it?

Thanks!

lolipoplo

I still don't understand the dumbass state limit from att.

first they should migrate all of their RG communication to ipv6 and free the only ipv4 to user

second, they should use STATELESS rules for PD'd ipv6 + ipv4.

this 8k limit feels very much arbitrary, as if it's intended to limit the number of devices for residential users
(it's not an issue for the box to support >1 million states: https://johnleach.co.uk/posts/2009/06/17/netfilter-conntrack-memory-usage/)

fox hound

This post is deleted!

ronv42

This post is deleted!

pokrifchakd

Great write-up and work!

I've got a question on how I'd implement this given my desired configuration. I currently have a Netgate 7100, which has a block of static IPs assigned to the LAN interface, which I'm using as a DMZ. One of the public IPs is assigned to my UniFi UDM SE, which handles the majority of my internal networks.

I'd like to be able to hand off multiple /64 networks from the Netgate 7100 to the UDM SE, so it can then assign them to the various private LANs I have. What would the configuration look like on the pfSense, and is this even possible?

Thanks!

johnpoz

@pokrifchakd

https://docs.netgate.com/pfsense/en/latest/services/dhcp/ipv6.html#dhcpv6-prefix-delegation

pokrifchakd

@johnpoz Thanks for the response. I'm familiar with that article, but the instructions put together by @ttmcmurry seem to indicate the only way to have pfSense request the additional PDs is to assign that request to each of the switch ports on the Netgate 7100. Currently, I've got the switch carved up into two WAN connections, a connection to the DMZ, and an Admin LAN. I don't want to assign anything on the Admin LAN, just the DMZ systems and the second router that is there. Would I just need to have each of the id-assoc pd stanzas all using DMZ as the port, and it would then hand those off to the downstream router?

interface lagg-0.4090 {
	send ia-na 0;
	send ia-pd 0;
	send ia-pd 1;
	send ia-pd 2;
	send ia-pd 3;
	send ia-pd 4;
	send ia-pd 5;
        send ia-pd 6;
	send ia-pd 7;
	request domain-name-servers;
	request domain-name;
	script "/var/etc/dhcp6c_wan_script.sh";
};
id-assoc na 0 { };
id-assoc pd 0 {
	prefix-interface lagg-0.4091 {
		sla-id 0;
		sla-len 0;
	};
};
id-assoc pd 1 { 
	prefix-interface lagg-0.4091 {
		sla-id 0;
		sla-len 0;
	};
};
...

fox hound

Having issues with CE 2.7.1. I am able to ping from WAN, but no device on LAN can ping out to internet IPv6 address.

LAN device can ping WAN and WAN can ping the LAN device's IPv6 address, but the LAN device can't ping an internet IPv6 address. The LAN interface from pfSense can't even ping the internet IPv6 address.

Also I am able to traceroute from the WAN. Traceroute from the pfSense LAN interface just shows:

 1  * * *
 2  * * *
 3  * * *

This was working on a prior pfSense+, but since I've lost all data on my server I have had to start from scratch.

Can someone please help? I'm pulling my hair out over this nonsense.

marcg

@fox-hound Does ifconfig -a inet6 -- via ssh or Diagnostics>CommandPrompt -- show v6 addresses on the expected interfaces? Do you have LAN-side firewall rules that permit outbound v6 traffic?

fox hound

@marcg Yes, both the WAN and LAN interfaces show IPv6 addresses. The LAN-side firewall has the default allow any for IPv6.

Traceroute from a LAN device with an IPv6 address shows the first hop being pfSense, but stops after that:

traceroute to 2001:4860:4860::8888 (2001:4860:4860::8888), 30 hops max, 80 byte packets
 1  pfsense.home.lan (2600:1700:1d42:X:X:X:X:3fd)  0.455 ms  0.401 ms  0.347 ms
 2  * * *
 3  * * *