prefix length should be 64

[gregeeh]

@Bob-Dig said in prefix length should be 64:

@gregeeh said in prefix length should be 64:

IPv4 Configuration Type is Static and IPv6 Configuration Type is Tracking.

Tracking on WAN? It should be something different, try DHCP6 for WAN.

Tracking type is on the LAN. Edited post to make it clearer. Thank you for picking that up.

[Gertjan]

@gregeeh

This one :

should be "64"; not "56".

This one :

same thing ( I guess ? - i've a /64 IPv6 on my WAN interface).

What is your WAN IPv6 setting ?

@gregeeh said in prefix length should be 64:

and pick a static /64 for LAN out of your /56 range

You do this by setting the LAN IPv6 to tracking and you select from 0 to 255 - sorry from 0 to FF hex.
0 to 255 : that's eight (bits), or the difference between /64 and /56, as there are 255 prefixes of /64 in a /56

Example : I have :

[gregeeh]

@Gertjan said in prefix length should be 64:

What is your WAN IPv6 setting ?

[Bob.Dig]

@gregeeh I wonder how you manged to have a /56 on your LAN while you are using Track on it...

[gregeeh]

@Bob-Dig said in prefix length should be 64:

@gregeeh I wonder how you manged to have a /56 on your LAN while you are using Track on it...

Would not a IPv6 Prefix Delegation Size being /64 do this?

[Gertjan]

@gregeeh

Try without setting this option.
Your ISP handles probably Ipv6 natively, so no need to do "IPv6 stuff over IPv4".

This :

A IPv6 prefix is always (is this so : I'm just do y iown guessing) a /64.
And not (like your LAN shows right now) /56.

I have to set this one to /6 because my stupid ISP routers shows in its own GUI : I have a /56 for you.
However, whatever I do, it only delegates one (1) /64 prefix to pfSense - so that is the one I'm tracking for on my LAN interface.
My question : what happens if you set this to /56 instead of /64, because your ISP (router) really has a usable /56 for you.

Also : if you have question, you want answers.
Right ?

So, help yourself : Go to System > Advanced > Networking and set :

and from now on, the Status > System Logs > DHCP will also contain the dhcp6c (that's the DHCP V6
client) logs.

[JKnott]

@gregeeh said in prefix length should be 64:

EDIT: I read somewhere I should "set your WAN to request a /56 and pick a static /64 for LAN out of your /56 range - any of the 255 subnets in there". If so, I have no idea how to do this, so please help.

You should set DHCPv6 Prefix Delegation size, on the WAN interface, to the size your ISP provides, which is likely 56.

[Gertjan]

@JKnott Ok, thanks, wasn't sure about that one.

[RobbieTT]

@JKnott said in prefix length should be 64:

You should set DHCPv6 Prefix Delegation size, on the WAN interface, to the size your ISP provides, which is likely 56.

... or 48, if your ISP is operating to the published guidance.

️

[gregeeh]

@JKnott said in prefix length should be 64:

@gregeeh said in prefix length should be 64:

EDIT: I read somewhere I should "set your WAN to request a /56 and pick a static /64 for LAN out of your /56 range - any of the 255 subnets in there". If so, I have no idea how to do this, so please help.

You should set DHCPv6 Prefix Delegation size, on the WAN interface, to the size your ISP provides, which is likely 56.

Done, this and no more "prefix length should be 64" messages. However, LAN clients now don't have access to IPv6 Addresses.

[JKnott]

@gregeeh said in prefix length should be 64:

Done, this and no more "prefix length should be 64" messages. However, LAN clients now don't have access to IPv6 Addresses.

Run Packet Capture on your LAN, filtering on ICMP6, and post the capture file here.

[gregeeh]

@JKnott said in prefix length should be 64:

@gregeeh said in prefix length should be 64:

Done, this and no more "prefix length should be 64" messages. However, LAN clients now don't have access to IPv6 Addresses.

Run Packet Capture on your LAN, filtering on ICMP6, and post the capture file here.

packetcapture-re1-20230811093706.pcap

[JKnott]

@gregeeh

The first thing that caught my eye is you have 2 prefix information blocks. That shouldn't be a problem except they're for different /64 GUAs. I have 2 here too, but one's GUA and the other is ULA.

One ends in 2900 and the other 2903. According to the RDNSS line, the LAN is 2900.

Perhaps you can show us your RA page.

[gregeeh]

@JKnott said in prefix length should be 64:

The first thing that caught my eye is you have 2 prefix information blocks.

First off, thanks for taking the time to help me with this, much appreciated.

Should one block be deleted and if so how?

This RA subnet has me confused, as does it not depend on what IPv6 my ISP gives me and if so what happens if the IPv6 changes. Just all confused about this.

Anyhow , here's the RA page:

I disabled Use IPv4 connectivity as parent interface in the WAN Interface and it looks like it's working at the moment. Will need to do some further testing.

Here's the Interface Status:

[JKnott]

@gregeeh said in prefix length should be 64:

I disabled Use IPv4 connectivity as parent interface in the WAN Interface and it looks like it's working at the moment. Will need to do some further testing.

Don't do that. By disabling that, you are turning off the prefix that's automatically assigned. You also have a prefix in the subnet box. This is causing 2 prefixes to be sent out, one based on the prefix ID from the /56 and the one you added. I use that box for adding a ULA prefix to my network. If you're not using ULA, don't put anything in that box.

[gregeeh]

@JKnott said in prefix length should be 64:

Don't do that. By disabling that, you are turning off the prefix that's automatically assigned. You also have a prefix in the subnet box.

OK, have enabled Use IPv4 connectivity as parent interface again and removed the subnet.

Cannot access IPv6 sites from pfSense nor LAN Clients.

Here are the relevant screenshots, I think I included everything.

Have also included the latest Packet Capture.

packetcapture-re1-20230811135736.pcap

I'm not using ULA.

[Bob.Dig]

@gregeeh With changes to IPv6 you sometimes have to reboot pfSense and the hosts. Do not wait for RA and Request ... through IPv4 connectivity are ISP specific. I don't think there is a general recommendation, you have to try.
fe80 for gateway is right and it is good, that your monitoring address is not the gateway address.

[gregeeh]

@Bob-Dig said in prefix length should be 64:

With changes to IPv6 you sometimes have to reboot pfSense

Thanks for your reply.

Yes, I have discovered this and alway reboot after making changes.

I have tried all combinations of Use IPv4 connectivity as parent interface and Do not wait for a RA without luck.

[Bob.Dig]

@gregeeh But you have said that it does work at least some of the time. The gateway check with googles dns should be enough for testing this, skip the "LANs" for now. Also the "modem" gives you almost all of the relevant informations, which is good.

[gregeeh]

@JKnott has previoiusly suggested I should not disable Use IPv4 connectivity as parent interface.

@JKnott said in prefix length should be 64:

Don't do that. By disabling that, you are turning off the prefix that's automatically assigned.