Use of both dhcp and slaac, advanced configuration

JKnott

It makes no difference whether you use MAC or random number for the suffix. The only thing is the MAC can be tied to a piece of hardware, but the random number can't.

My IPv4 addresses are within the 172.16 block. I match the 3rd octet to the IPv6 prefix ID, to keep things straight. I even did the same for the VLAN ID for my guest WiFi. Since you only have a /56 prefix from your ISP, you might as well use the same prefix IDs for ULA, just to help keep things straight.

One thing you may have noticed, with IPv6, is you have a LOT more addresses than with IPv4. A single /64 contains 18.4 billion, billion addresses.

crc_error_79

@JKnott

Hello, I think I did something wrong because following your guide I can't get any ipv6 addresses..

I have tried with all the RA combination, also with enable dhcpv6 but nothing works.. on pc side I always have the auto-generated local link

Where am I going wrong?

[EDIT] there was an error on the firewall rules on screenshot (the rule is for ipv4 instead ipv6). Anyway even with the right setting it doesn't work..

This is the vlan 219 (test) configuration

crc_error_79

@crc_error_79
@JKnott

[EDIT 2] i am an idiot, it is official..
It wasn't working because I did some hw modifications (I removed the nic where the vlan was assigned) but I didn't change the assignment.. So the network was up on a nic that doesn't exist..

I don't know if leave the upper post of my post or remove it.. anyway..

now I get the address end :1451 that is the temporary address used for internet, the 63c7 (i don't know) and the ULA.

now I have 2 questions:

how can I assign statically the ULA's if it is generated from the client?
If I set 7200 seconds on "Default valid lifetime" and "Default preferred lifetime", after 2 hours should I get another temporary address? right?

JKnott

@crc_error_79 said in Use of both dhcp and slaac, advanced configuration:

I don't know if leave the upper post of my post or remove it.. anyway..
now I get the address end :1451 that is the temporary address used for internet, the 63c7 (i don't know) and the ULA.
now I have 2 questions:

how can I assign statically the ULA's if it is generated from the client?

If I set 7200 seconds on "Default valid lifetime" and "Default preferred lifetime", after 2 hours should I get another temporary address? right?

One thing I noticed is you were assigning a static IPv6 address on a VLAN. You should use track interface and SLAAC to assign addresses. Also, what are you still doing with DHCP? Unless you have a specific need for it, don't use it.

As for the static ULA, it works exactly the same as global addresses. You get one consistent address and one or more dynamic addresses. Just create your prefix, as described, and then do the same as with your global addresses.

I have never found a need to change the lifetime. I get a new address every day and that's good enough for me.

crc_error_79

@JKnott

@JKnott said in Use of both dhcp and slaac, advanced configuration:

One thing I noticed is you were assigning a static IPv6 address on a VLAN. You should use track interface and SLAAC to assign addresses. Also, what are you still doing with DHCP? Unless you have a specific need for it, don't use it.

Ciao
I can't because the isp gives me a local link address on the wan, and a prefix /56 to use on the lans
I must to set it in that way in order to get it work..
The only way is set that /56 and create a gateway address on a /64 lan
Also dhcpv6 is disabled and RA is set to "assisted"

@JKnott said in Use of both dhcp and slaac, advanced configuration:

As for the static ULA, it works exactly the same as global addresses. You get one consistent address and one or more dynamic addresses. Just create your prefix, as described, and then do the same as with your global addresses.

I am a little bit lost.. Do I have to do it on the client side or in pfSense?
Because the only way I found is on the dhcpv6 (also requires a DUID [i don't know what it is and how get it])

About your guide: may I ask what the virtual ip on the same lan specified on the RA subnet is used for?

@JKnott said in Use of both dhcp and slaac, advanced configuration:

I have never found a need to change the lifetime. I get a new address every day and that's good enough for me.

Yes after many reboot of the mac the address remain, even the temporary.. maybe 7200 second is a too short time?

JKnott

@crc_error_79 said in Use of both dhcp and slaac, advanced configuration:

I can't because the isp gives me a local link address on the wan, and a prefix /56 to use on the lans

Does your ISP not use DHCPv6-PD? If so, you should be able to get the proper prefix for each interface. Have you set a unique prefix ID for each interface? With a /56 your choices are 0 - ff. Also, link local addresses are often used for routing, as a router only has to know how to reach the next hop. My ISP provides a global address for the WAN, but it's not used for routing. It can be used for things like a VPN or connecting directly to pfSense with SSH, etc., but it's not necessary even for that.

Also dhcpv6 is disabled and RA is set to "assisted"

I use unmanaged.

I am a little bit lost.. Do I have to do it on the client side or in pfSense?
Because the only way I found is on the dhcpv6 (also requires a DUID [i don't know what it is and how get it])

You don't do anything on the client. It all happens automagically there. The DUID just happens on it's own.

About your guide: may I ask what the virtual ip on the same lan specified on the RA subnet is used for?

It's used to provide an address for the interface. It will not assign one for itself with SLAAC.

Yes after many reboot of the mac the address remain, even the temporary.. maybe 7200 second is a too short time?

As I said, I've had no reason to change it.

crc_error_79

@JKnott

@JKnott said in Use of both dhcp and slaac, advanced configuration:

It's used to provide an address for the interface. It will not assign one for itself with SLAAC.

Thank you, this was the key to do what I want to do.
I found this video about the ipv6
Youtube: pfsense Setting Multiple Static WAN IP Addresses / Using Virtual IP's NAT Firewall Rules

Below how I set the dhcpv6 and slaac

interface

dhcpv6

RA and slaac

virtual IP

firewall (temporary rules, I have to set the correct ones)

and finally

Bob.Dig

@crc_error_79 This will not work for long if your IPv6 is dynamic... unless it never changes like JKnott's.

crc_error_79

@Bob-Dig
what do you mean?
If my isp changes the prefix I can still have the dhcpv6 with the ULAs addresses defined by me.
The only thing I have to do is to change the virtual IP prefix as well as the slaac with the new one
Also, for the some devices I can set a static address like I did with my mac mini ::500

Bob.Dig

@crc_error_79 said in Use of both dhcp and slaac, advanced configuration:

what do you mean?

This, kinda:

The only thing I have to do is to change the virtual IP prefix as well as the slaac with the new one

crc_error_79

@Bob-Dig
ah ok..
to me it is not a big deal, better change 2 parameters than at least 20 dhcpv6 static assigments..
Also I think that in this way I could have a public network and private one, I don't know if for security it is better..

but as I said before maybe am I still too ipv4 focused

Bob.Dig

@crc_error_79 You could do it the other way around, use track interface for GUA and ULA in RA.
Or try NPt.

crc_error_79

@Bob-Dig
I can't use track interface because my isp assigns to the wan a local link.. Also I don't want to use nat..

I think that this way or the one @JKnott suggested are the better, but maybe I am wrong (am an home user not an network engineer )

My goal is to have a single point where to control all the devices connected to the lan so I can set to each device a name and network information.
I can do it with dhcp (+dns) but not with slaac (or at least I think, I need some examples or try it)

Bob.Dig

@crc_error_79 said in Use of both dhcp and slaac, advanced configuration:

I can't use track interface because my isp assigns to the wan a local link..

Does this defeat track interface?

crc_error_79

@Bob-Dig
I don't know, as said am not an expert..

but if I set track interface on the lan the only option is WAN and it has a local link, not routable.. see? I am using pppoe for the ipv4 connection

Bob.Dig

@crc_error_79 said in Use of both dhcp and slaac, advanced configuration:

but if I set track interface on the lan the only option is WAN and it has a local link, not routable.. see? I am using pppoe for the ipv4 connection

Just try it, ping an IPv6 address from an interface which "tracks". Do a reboot to be sure.

crc_error_79

@Bob-Dig
Ok but I need a IPv6 Prefix ID, I never use track interface, where I can get it?

Bob.Dig

@crc_error_79 Just use 0 on your first LAN. But on WAN you have to put in the delegation size to you. If you are uncertain, use 60.

crc_error_79

@Bob-Dig
I tried but it is not work because (I think) the slaac can't autoassign an ipv6 if the gateway is a local link

JKnott

@crc_error_79

You seem to be creating your own problems. Use SLAAC to get the prefix for each interface for global addresses. Use my instructions for ULA and forget about DHCPv6, you don't need it.