Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    prefix length should be 64

    Scheduled Pinned Locked Moved IPv6
    53 Posts 6 Posters 9.3k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • Bob.DigB
      Bob.Dig LAYER 8 @gregeeh
      last edited by Bob.Dig

      @gregeeh I wonder how you manged to have a /56 on your LAN while you are using Track on it...

      gregeehG 1 Reply Last reply Reply Quote 0
      • gregeehG
        gregeeh @Bob.Dig
        last edited by

        @Bob-Dig said in prefix length should be 64:

        @gregeeh I wonder how you manged to have a /56 on your LAN while you are using Track on it...

        Would not a IPv6 Prefix Delegation Size being /64 do this?

        PfSense running on Qotom mini PC
        CPU N3150, 2 GB memory, 32 GB SSD & 2 Realtek Gb Ethernet ports.
        UniFi AC-Lite access point

        GertjanG 1 Reply Last reply Reply Quote 0
        • GertjanG
          Gertjan @gregeeh
          last edited by

          @gregeeh

          ef2d5848-1ed0-4a07-89bf-f39c53205b15-image.png

          Try without setting this option.
          Your ISP handles probably Ipv6 natively, so no need to do "IPv6 stuff over IPv4".

          This :

          0660ce97-f92e-4067-b311-095ce96186d0-image.png

          A IPv6 prefix is always (is this so : I'm just do y iown guessing) a /64.
          And not (like your LAN shows right now) /56.

          I have to set this one to /6 because my stupid ISP routers shows in its own GUI : I have a /56 for you.
          However, whatever I do, it only delegates one (1) /64 prefix to pfSense - so that is the one I'm tracking for on my LAN interface.
          My question : what happens if you set this to /56 instead of /64, because your ISP (router) really has a usable /56 for you.

          Also : if you have question, you want answers.
          Right ?

          So, help yourself : Go to System > Advanced > Networking and set :

          37b3c6ba-d65a-4e89-8f46-8dc45d1823bb-image.png

          and from now on, the Status > System Logs > DHCP will also contain the dhcp6c (that's the DHCP V6
          client) logs.

          No "help me" PM's please. Use the forum, the community will thank you.
          Edit : and where are the logs ??

          1 Reply Last reply Reply Quote 0
          • JKnottJ
            JKnott @gregeeh
            last edited by

            @gregeeh said in prefix length should be 64:

            EDIT: I read somewhere I should "set your WAN to request a /56 and pick a static /64 for LAN out of your /56 range - any of the 255 subnets in there". If so, I have no idea how to do this, so please help.

            You should set DHCPv6 Prefix Delegation size, on the WAN interface, to the size your ISP provides, which is likely 56.

            PfSense running on Qotom mini PC
            i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
            UniFi AC-Lite access point

            I haven't lost my mind. It's around here...somewhere...

            GertjanG RobbieTTR gregeehG 3 Replies Last reply Reply Quote 1
            • GertjanG
              Gertjan @JKnott
              last edited by

              @JKnott Ok, thanks, wasn't sure about that one.

              No "help me" PM's please. Use the forum, the community will thank you.
              Edit : and where are the logs ??

              1 Reply Last reply Reply Quote 0
              • RobbieTTR
                RobbieTT @JKnott
                last edited by

                @JKnott said in prefix length should be 64:

                You should set DHCPv6 Prefix Delegation size, on the WAN interface, to the size your ISP provides, which is likely 56.

                ... or 48, if your ISP is operating to the published guidance.

                ☕️

                1 Reply Last reply Reply Quote 0
                • gregeehG
                  gregeeh @JKnott
                  last edited by gregeeh

                  @JKnott said in prefix length should be 64:

                  @gregeeh said in prefix length should be 64:

                  EDIT: I read somewhere I should "set your WAN to request a /56 and pick a static /64 for LAN out of your /56 range - any of the 255 subnets in there". If so, I have no idea how to do this, so please help.

                  You should set DHCPv6 Prefix Delegation size, on the WAN interface, to the size your ISP provides, which is likely 56.

                  Done, this and no more "prefix length should be 64" messages. However, LAN clients now don't have access to IPv6 Addresses.

                  alt text

                  PfSense running on Qotom mini PC
                  CPU N3150, 2 GB memory, 32 GB SSD & 2 Realtek Gb Ethernet ports.
                  UniFi AC-Lite access point

                  JKnottJ 1 Reply Last reply Reply Quote 0
                  • JKnottJ
                    JKnott @gregeeh
                    last edited by

                    @gregeeh said in prefix length should be 64:

                    Done, this and no more "prefix length should be 64" messages. However, LAN clients now don't have access to IPv6 Addresses.

                    Run Packet Capture on your LAN, filtering on ICMP6, and post the capture file here.

                    PfSense running on Qotom mini PC
                    i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                    UniFi AC-Lite access point

                    I haven't lost my mind. It's around here...somewhere...

                    gregeehG 1 Reply Last reply Reply Quote 0
                    • gregeehG
                      gregeeh @JKnott
                      last edited by

                      @JKnott said in prefix length should be 64:

                      @gregeeh said in prefix length should be 64:

                      Done, this and no more "prefix length should be 64" messages. However, LAN clients now don't have access to IPv6 Addresses.

                      Run Packet Capture on your LAN, filtering on ICMP6, and post the capture file here.

                      packetcapture-re1-20230811093706.pcap

                      PfSense running on Qotom mini PC
                      CPU N3150, 2 GB memory, 32 GB SSD & 2 Realtek Gb Ethernet ports.
                      UniFi AC-Lite access point

                      JKnottJ 1 Reply Last reply Reply Quote 0
                      • JKnottJ
                        JKnott @gregeeh
                        last edited by

                        @gregeeh

                        The first thing that caught my eye is you have 2 prefix information blocks. That shouldn't be a problem except they're for different /64 GUAs. I have 2 here too, but one's GUA and the other is ULA.

                        dc1f672c-6f0c-4f6d-97b5-123d2c86e152-image.png

                        One ends in 2900 and the other 2903. According to the RDNSS line, the LAN is 2900.

                        Perhaps you can show us your RA page.

                        PfSense running on Qotom mini PC
                        i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                        UniFi AC-Lite access point

                        I haven't lost my mind. It's around here...somewhere...

                        gregeehG 1 Reply Last reply Reply Quote 0
                        • gregeehG
                          gregeeh @JKnott
                          last edited by gregeeh

                          @JKnott said in prefix length should be 64:

                          The first thing that caught my eye is you have 2 prefix information blocks.

                          First off, thanks for taking the time to help me with this, much appreciated.

                          Should one block be deleted and if so how?

                          This RA subnet has me confused, as does it not depend on what IPv6 my ISP gives me and if so what happens if the IPv6 changes. Just all confused about this.

                          Anyhow , here's the RA page:

                          alt text

                          I disabled Use IPv4 connectivity as parent interface in the WAN Interface and it looks like it's working at the moment. Will need to do some further testing.

                          Here's the Interface Status:

                          alt text

                          PfSense running on Qotom mini PC
                          CPU N3150, 2 GB memory, 32 GB SSD & 2 Realtek Gb Ethernet ports.
                          UniFi AC-Lite access point

                          JKnottJ RobbieTTR 2 Replies Last reply Reply Quote 0
                          • JKnottJ
                            JKnott @gregeeh
                            last edited by

                            @gregeeh said in prefix length should be 64:

                            I disabled Use IPv4 connectivity as parent interface in the WAN Interface and it looks like it's working at the moment. Will need to do some further testing.

                            Don't do that. By disabling that, you are turning off the prefix that's automatically assigned. You also have a prefix in the subnet box. This is causing 2 prefixes to be sent out, one based on the prefix ID from the /56 and the one you added. I use that box for adding a ULA prefix to my network. If you're not using ULA, don't put anything in that box.

                            PfSense running on Qotom mini PC
                            i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                            UniFi AC-Lite access point

                            I haven't lost my mind. It's around here...somewhere...

                            gregeehG 2 Replies Last reply Reply Quote 0
                            • gregeehG
                              gregeeh @JKnott
                              last edited by gregeeh

                              @JKnott said in prefix length should be 64:

                              Don't do that. By disabling that, you are turning off the prefix that's automatically assigned. You also have a prefix in the subnet box.

                              OK, have enabled Use IPv4 connectivity as parent interface again and removed the subnet.

                              Cannot access IPv6 sites from pfSense nor LAN Clients.

                              Here are the relevant screenshots, I think I included everything.

                              Have also included the latest Packet Capture.

                              packetcapture-re1-20230811135736.pcap

                              I'm not using ULA.

                              PfSense running on Qotom mini PC
                              CPU N3150, 2 GB memory, 32 GB SSD & 2 Realtek Gb Ethernet ports.
                              UniFi AC-Lite access point

                              Bob.DigB JKnottJ 2 Replies Last reply Reply Quote 0
                              • Bob.DigB
                                Bob.Dig LAYER 8 @gregeeh
                                last edited by Bob.Dig

                                @gregeeh With changes to IPv6 you sometimes have to reboot pfSense and the hosts. Do not wait for RA and Request ... through IPv4 connectivity are ISP specific. I don't think there is a general recommendation, you have to try.
                                fe80 for gateway is right and it is good, that your monitoring address is not the gateway address.

                                gregeehG 1 Reply Last reply Reply Quote 0
                                • gregeehG
                                  gregeeh @Bob.Dig
                                  last edited by

                                  @Bob-Dig said in prefix length should be 64:

                                  With changes to IPv6 you sometimes have to reboot pfSense

                                  Thanks for your reply.

                                  Yes, I have discovered this and alway reboot after making changes.

                                  I have tried all combinations of Use IPv4 connectivity as parent interface and Do not wait for a RA without luck.

                                  PfSense running on Qotom mini PC
                                  CPU N3150, 2 GB memory, 32 GB SSD & 2 Realtek Gb Ethernet ports.
                                  UniFi AC-Lite access point

                                  Bob.DigB 1 Reply Last reply Reply Quote 0
                                  • Bob.DigB
                                    Bob.Dig LAYER 8 @gregeeh
                                    last edited by Bob.Dig

                                    @gregeeh But you have said that it does work at least some of the time. The gateway check with googles dns should be enough for testing this, skip the "LANs" for now. Also the "modem" gives you almost all of the relevant informations, which is good.

                                    1 Reply Last reply Reply Quote 0
                                    • gregeehG
                                      gregeeh @JKnott
                                      last edited by

                                      @JKnott has previoiusly suggested I should not disable Use IPv4 connectivity as parent interface.

                                      @JKnott said in prefix length should be 64:

                                      Don't do that. By disabling that, you are turning off the prefix that's automatically assigned.

                                      PfSense running on Qotom mini PC
                                      CPU N3150, 2 GB memory, 32 GB SSD & 2 Realtek Gb Ethernet ports.
                                      UniFi AC-Lite access point

                                      Bob.DigB GertjanG 2 Replies Last reply Reply Quote 0
                                      • Bob.DigB
                                        Bob.Dig LAYER 8 @gregeeh
                                        last edited by

                                        @gregeeh Again it is ISP specific, @JKnott can't know everything, it is on you to try those options.

                                        JKnottJ 1 Reply Last reply Reply Quote 0
                                        • GertjanG
                                          Gertjan @gregeeh
                                          last edited by Gertjan

                                          @gregeeh said in prefix length should be 64:

                                          @JKnott has previously suggested I should not disable Use IPv4 connectivity as parent interface.

                                          Same thing for me.
                                          I have to disable = uncheck that option. If checked it : no more IPv6.

                                          (my) Long story short :

                                          My ISP router :

                                          685ac2b4-8146-4d6d-93dd-bba3d20be41b-image.png

                                          What I make of this : My ISP has a 2a01:cb19:907:a600::/56 for me.
                                          It uses the first '00' prefix for the ISP router LAN : 2a01:cb19:907:a600:46d4:54ff:fe2a:3600

                                          The 90:EC:77:29:39:2A is that MAC of my pfSense WAN :

                                          My pfSense IPv6 WAN interface :

                                          ee6b7840-c2dc-48e2-a816-8aea0c8ae82f-image.png

                                          The stupid thing is : whatever I do, my ISP router communicates just one prefix, the 'a6dc' for pfSense. Not the a601, or a6ff, only 'dc', so I can only use IPv6 on my pfsense LAN, and no Ipv6 on others LANs, as I need more prefixes for that.
                                          dhcp6c logs on pfSense show me that It asks for more (I've used a hand crafted dhcp6c config file to do so) but that was a no-go.
                                          And its gets way better : the IPv6 firewall on the ISP router does not permit me to create pass rules for IPv6 addresses or network using the prefix it handed over to pfSense.
                                          These issues are known on the french support forum ....

                                          No "help me" PM's please. Use the forum, the community will thank you.
                                          Edit : and where are the logs ??

                                          Bob.DigB 1 Reply Last reply Reply Quote 0
                                          • RobbieTTR
                                            RobbieTT @gregeeh
                                            last edited by RobbieTT

                                            @gregeeh said in prefix length should be 64:

                                            This RA submit has me confused, as does it not depend on what IPv6 my ISP gives me and if so what happens if the IPv6 changes. Just all confused about this.

                                            It is normal to use 'what IPv6 my ISP gives' in the land of IPv6. The ISP should provide a reserved /48 block for you and this should not change. Technically you could set this block without DHCPv6 but it would be unwise and not generally recommended.

                                            There is always a sideways look at an RFC 'should' statement and, as you have been already been exposed to, many ISPs assign a /56 (giving you a smaller block to work with) as this option was given some formal weight by the later RFC6177. Nobody likes a nibble.

                                            I also hear stories of some US ISPs providing a daft /64 block. There is no excuse for this as there are enough /48 for everything and everyone.

                                            ☕️

                                            GertjanG 1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.