How to setup IPv6 for Comcast or similar ISP?

cFortC

I had Comcast and my Cisco RV34x router working fine with IPv6 there. The Cisco configuration, in brief, is: WAN DHCP connection, DHCP-PD on (64-bit prefix); LAN and RA set for that Prefix. Last year I did switch to my city's fibre network but the IPv6 configuration was unchanged (just unplugged the router from the Comcast modem and plugged it into the ONT).

So I've been trying to get pfSense (running on Mini-ITX box I had) working with IPv6. No joy at all. Per another post I did uncheck that Block Bogons option but it made no difference. No IPv6 prefix or addresses are received on the pfSense system at all. I have used the default WAN, LAN, and RA settings (which all looked like they should work) and a reasonable number of variations with no effect.

Any Comcast users succeed with pfSense IPv6? I'd love to know what set of pfSense settings (and possible System Tunables) will do the trick.

flatlander

Down and dirty:

Midwest Comcast on a non-business only will give you a /64 prefix now (not a /60 anymore). In my area, DHCPv6 was a bit unreliable until recently. If you have issues, flip on debugging. In my case, the server just didn't respond sometimes, the lease would expire eventually then bone routing on the clients. I don't know what the deal was there upstream from me, but it started working better all of the sudden a couple months ago.

So, pfsense 2.6.0. This is just for the WAN and LAN interfaces. I didn't use any system tunables. I did have the DNS resolver working on IPv4 before I started. I think I just used the defaults there.

system -> advanced ->networking:

check allow IPv6
Ipv6 DNS Entry, check Do not generate local ip DNS...
With an Intel nics I disable Hardware large Receive Offload

Interfaces -> Wan

IPv6 Config Type dhcp6
DHCPv6 Prefix Delegation size /64
Debug (if you want to)
check Do not wait for RA
check do not allow PD/Address release
check block private networks
check blockk bogon networks

Services --> DHCPv6 Server and RA

If you can't select it, you may have to reboot then select it

Dhcpv6 Server tab

enable DHCPv6 server
set the range ::1000 to ::2000
prefix delegation size 64
Put in some DNS ipv6 servers, I just tossed in cloudflares
check Prove DNS servers to DHCPv6 clients

Under Router Advertisements tab

Router mode Assisted - RA Flages [managed, other stateful]
priority normal
(use default lease times)
I put the ipv6 DNS servers in again
Check the Provide DNS configuration via radvd

Under Firewall-->Rules -->Lan
Add an IPv6 Lan Net entry to allow IPv6 traffic on your lan, just look at the IPv4 rule for a guide.

Make sure you saved everything while doing this and reboot (again). When it comes back up, you should have IPv6 on the WAN interface. If not, check the settings again and the DHCPv6 errors in the log.

Good Luck!

flatlander

Oh. Sorry, You might have to add an IPv6 gateway if it doesn't automagically, so:

System -> Routing -> Gateways
Add WAN_DHCP6 (it should be an Option you can select now)

You should see below on the same page:
Default gateway IPv4 and WAN_DHCP
Default gateway IPv6 and WAN_DHCP6

Last one:
Interfaces -> Lan

IPv6 Configuration type = track interface
Inder the Track IPv6 interface section select WAN as the IPv6 Interface

cFortC

I would like to thank flatlander for taking the time to help out with the configuration information.

pfSense is now fully operational IPv4/IPv6 on my recently acquired Barracuda F12 box.
It runs at Gigabit (ISP) speed both uplink and downlink.

coolyman

I have Sprectum. I had IPv6 working reliably on v2.5.2. Since upgrading to v2.6.0, rebooting pfSense would require various combinations of rebooting it and the MODEM, physically reconnecting the Ethernet cable or bouncing the WAN interface. It seemed random what combination of those things would restore LAN IPv6 Internet access. After upgrading to v2.7.0, no combination or amount of fudging with it would restore IPv6 Internet access. Upon the initial reboot IPv6 would work for a short while then eventually stop. It would work for anywere from 0 to maybe 30 seconds (PINGs) before breaking. I had given up on using v2.7.0 until I tried the settings you suggested.
TL;DR
Setting Do not wait for RA fixed it! Thank you! I can now reboot pfSense without worry and it just works!