Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    prefix length should be 64

    Scheduled Pinned Locked Moved IPv6
    53 Posts 6 Posters 8.9k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • gregeehG
      gregeeh @Bob.Dig
      last edited by

      @Bob-Dig said in prefix length should be 64:

      With changes to IPv6 you sometimes have to reboot pfSense

      Thanks for your reply.

      Yes, I have discovered this and alway reboot after making changes.

      I have tried all combinations of Use IPv4 connectivity as parent interface and Do not wait for a RA without luck.

      PfSense running on Qotom mini PC
      CPU N3150, 2 GB memory, 32 GB SSD & 2 Realtek Gb Ethernet ports.
      UniFi AC-Lite access point

      Bob.DigB 1 Reply Last reply Reply Quote 0
      • Bob.DigB
        Bob.Dig LAYER 8 @gregeeh
        last edited by Bob.Dig

        @gregeeh But you have said that it does work at least some of the time. The gateway check with googles dns should be enough for testing this, skip the "LANs" for now. Also the "modem" gives you almost all of the relevant informations, which is good.

        1 Reply Last reply Reply Quote 0
        • gregeehG
          gregeeh @JKnott
          last edited by

          @JKnott has previoiusly suggested I should not disable Use IPv4 connectivity as parent interface.

          @JKnott said in prefix length should be 64:

          Don't do that. By disabling that, you are turning off the prefix that's automatically assigned.

          PfSense running on Qotom mini PC
          CPU N3150, 2 GB memory, 32 GB SSD & 2 Realtek Gb Ethernet ports.
          UniFi AC-Lite access point

          Bob.DigB GertjanG 2 Replies Last reply Reply Quote 0
          • Bob.DigB
            Bob.Dig LAYER 8 @gregeeh
            last edited by

            @gregeeh Again it is ISP specific, @JKnott can't know everything, it is on you to try those options.

            JKnottJ 1 Reply Last reply Reply Quote 0
            • GertjanG
              Gertjan @gregeeh
              last edited by Gertjan

              @gregeeh said in prefix length should be 64:

              @JKnott has previously suggested I should not disable Use IPv4 connectivity as parent interface.

              Same thing for me.
              I have to disable = uncheck that option. If checked it : no more IPv6.

              (my) Long story short :

              My ISP router :

              685ac2b4-8146-4d6d-93dd-bba3d20be41b-image.png

              What I make of this : My ISP has a 2a01:cb19:907:a600::/56 for me.
              It uses the first '00' prefix for the ISP router LAN : 2a01:cb19:907:a600:46d4:54ff:fe2a:3600

              The 90:EC:77:29:39:2A is that MAC of my pfSense WAN :

              My pfSense IPv6 WAN interface :

              ee6b7840-c2dc-48e2-a816-8aea0c8ae82f-image.png

              The stupid thing is : whatever I do, my ISP router communicates just one prefix, the 'a6dc' for pfSense. Not the a601, or a6ff, only 'dc', so I can only use IPv6 on my pfsense LAN, and no Ipv6 on others LANs, as I need more prefixes for that.
              dhcp6c logs on pfSense show me that It asks for more (I've used a hand crafted dhcp6c config file to do so) but that was a no-go.
              And its gets way better : the IPv6 firewall on the ISP router does not permit me to create pass rules for IPv6 addresses or network using the prefix it handed over to pfSense.
              These issues are known on the french support forum ....

              No "help me" PM's please. Use the forum, the community will thank you.
              Edit : and where are the logs ??

              Bob.DigB 1 Reply Last reply Reply Quote 0
              • RobbieTTR
                RobbieTT @gregeeh
                last edited by RobbieTT

                @gregeeh said in prefix length should be 64:

                This RA submit has me confused, as does it not depend on what IPv6 my ISP gives me and if so what happens if the IPv6 changes. Just all confused about this.

                It is normal to use 'what IPv6 my ISP gives' in the land of IPv6. The ISP should provide a reserved /48 block for you and this should not change. Technically you could set this block without DHCPv6 but it would be unwise and not generally recommended.

                There is always a sideways look at an RFC 'should' statement and, as you have been already been exposed to, many ISPs assign a /56 (giving you a smaller block to work with) as this option was given some formal weight by the later RFC6177. Nobody likes a nibble.

                I also hear stories of some US ISPs providing a daft /64 block. There is no excuse for this as there are enough /48 for everything and everyone.

                โ˜•๏ธ

                GertjanG 1 Reply Last reply Reply Quote 0
                • GertjanG
                  Gertjan @RobbieTT
                  last edited by

                  @RobbieTT

                  A /48 is 65535 prefixes, or 65535 LANs using 2^64 IPs for every LAN, right ?
                  A /56 is 'just' 255 LANs for the end user.

                  The typical SOHO Internet connection : I wonder what needs to be invented so that 255*(2^^64) isn't enough anymore ๐Ÿ˜Š

                  No "help me" PM's please. Use the forum, the community will thank you.
                  Edit : and where are the logs ??

                  RobbieTTR JKnottJ 2 Replies Last reply Reply Quote 0
                  • Bob.DigB
                    Bob.Dig LAYER 8 @Gertjan
                    last edited by

                    @Gertjan said in prefix length should be 64:

                    my ISP router communicates just one prefix

                    Technically you could use that for NPt.

                    1 Reply Last reply Reply Quote 0
                    • RobbieTTR
                      RobbieTT @Gertjan
                      last edited by

                      @Gertjan said in prefix length should be 64:

                      @RobbieTT
                      A /56 is 'just' 255 LANs for the end user.

                      The typical SOHO Internet connection : I wonder what needs to be invented so that 255*(2^^64) isn't enough anymore ๐Ÿ˜Š

                      It's that kind of presumption that brought about the folly of the revised RFC that made an unsupported leap of 'IPv6 address exhaustion' and worked backwards to the idea that a new measure of IPv4-esq address conservation was needed that the original IPv6 designers must have missed with their /48 per site recommendation.

                      This turned the original logic of the IPv6 design on its head. The underlying maths even managed to forget that almost all the GUA beyond the (then) original 2001: block was held in reserve!

                      This is an old article on the subject but it encapsulates my thoughts to this day:

                      Bad IPv6 Address Management

                      More importantly it leads to this situation:

                      @Gertjan said in prefix length should be 64:

                      What I make of this : My ISP has a 2a01:cb19:907:a600::/56 for me.

                      It uses the first '00' prefix for the ISP router LAN : 2a01:cb19:907:a600:46d4:54ff:fe2a:3600

                      The stupid thing is : whatever I do, my ISP router communicates just one prefix, the 'a6dc' for pfSense. Not the a601, or a6ff, only 'dc', so I can only use IPv6 on my pfsense LAN, and no Ipv6 on others LANs, as I need more prefixes for that.

                      Which is you struggling to get beyond a single subnet with the slightly more confusing /56 block and the less distinct nibble boundaries, in the more readable hex format, that is representing a long binary address.

                      So you may think a /56 is more than adequate for the decades to come, yet you yourself are struggling to get beyond a single subnet. You are not exactly a good advert for the merits of a /56 or the perils of the nibble boundaries. This IPv6 stuff is supposed to be understandable by every connected household, a limitation that the original IPv6 designers did understand.

                      ipv6 boundaries.jpeg

                      (Hint: 2a01:cb19:907:a6 is the bounded nibble for your /56 prefix)

                      โ˜•๏ธ

                      JKnottJ GertjanG 2 Replies Last reply Reply Quote 0
                      • JKnottJ
                        JKnott @gregeeh
                        last edited by

                        @gregeeh

                        I see you have the MTU set on the WAN. It won't hurt anything unless you're on ADSL or other connection that requires a less than 1500 MTU, but it's not needed.
                        I also see you're using prefix ID 3, which explains why the packet capture shows :2903 for the LAN prefix. That's fine.
                        Why do you have question marks next to the gateway? Using link local addresses for routing is entirely normal.
                        On RA, why do you have stateless? That implies you're using DHCP6, but you don't have it enabled. I use unmanaged here.

                        PfSense running on Qotom mini PC
                        i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                        UniFi AC-Lite access point

                        I haven't lost my mind. It's around here...somewhere...

                        gregeehG 1 Reply Last reply Reply Quote 0
                        • JKnottJ
                          JKnott @Bob.Dig
                          last edited by

                          @Bob-Dig said in prefix length should be 64:

                          @gregeeh Again it is ISP specific, @JKnott can't know everything, it is on you to try those options.

                          If his ISP is using DHCPv6-PD, and it appears they are, that parent interface is required. DHCPv6-PD won't work properly without it.

                          PfSense running on Qotom mini PC
                          i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                          UniFi AC-Lite access point

                          I haven't lost my mind. It's around here...somewhere...

                          1 Reply Last reply Reply Quote 0
                          • JKnottJ
                            JKnott @Gertjan
                            last edited by

                            @Gertjan said in prefix length should be 64:

                            A /56 is 'just' 255 LANs for the end user.

                            256, not 255.

                            PfSense running on Qotom mini PC
                            i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                            UniFi AC-Lite access point

                            I haven't lost my mind. It's around here...somewhere...

                            1 Reply Last reply Reply Quote 0
                            • JKnottJ
                              JKnott @RobbieTT
                              last edited by

                              @RobbieTT said in prefix length should be 64:

                              It's that kind of presumption that brought about the folly of the revised RFC that made an unsupported leap of 'IPv6 address exhaustion' and worked backwards to the idea that a new measure of IPv4-esq address conservation was needed that the original IPv6 designers must have missed with their /48 per site recommendation.

                              There are only enough /48s to give a bit over 4000 to every single person on the planet. We'd better not waste them. ๐Ÿ˜‰

                              PfSense running on Qotom mini PC
                              i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                              UniFi AC-Lite access point

                              I haven't lost my mind. It's around here...somewhere...

                              RobbieTTR 1 Reply Last reply Reply Quote 0
                              • RobbieTTR
                                RobbieTT @JKnott
                                last edited by RobbieTT

                                @JKnott said in prefix length should be 64:

                                There are only enough /48s to give a bit over 4000 to every single person on the planet. We'd better not waste them. ๐Ÿ˜‰

                                But that may impinge of the plan to give each grain of sand on the planet 45 quintillion unique IPv6 addresses.

                                Tough choices ahead, so I need to get the kettle on, which has its own /64 already!

                                ๐Ÿซ–

                                1 Reply Last reply Reply Quote 0
                                • GertjanG
                                  Gertjan @RobbieTT
                                  last edited by

                                  @RobbieTT said in prefix length should be 64:

                                  It's that kind of presumption ....

                                  Humm, no, didn't want to presuming anything - I was just mentioning what I have - and what I see.
                                  And of course /56 won't be enough. But I'll sign for it

                                  @RobbieTT said in prefix length should be 64:

                                  Bad IPv6 Address Management

                                  ๐Ÿ‘ Nice, that was written 11 years ago, and still very valid today.

                                  Btw : I'm not a IPv6 designer, just a guy using pFsense and I can tap into the "IPv6 resource" made available by my ISP. Learning while doing, of course.

                                  No "help me" PM's please. Use the forum, the community will thank you.
                                  Edit : and where are the logs ??

                                  1 Reply Last reply Reply Quote 0
                                  • the otherT
                                    the other
                                    last edited by the other

                                    Sorry @all for hijacking this thread with a short question...
                                    My German provider gives me a /56 prefix. It is no /48 but reading here regularly, I guess my /56 is close to heaven. ;)

                                    I set WAN on pfsense (which is behind a Fritzbox handing out everything) as DHCPv6 with a /57 prefix delegation size.
                                    Why I did that? For once, cause both tutorials I found for a setting like that told me to :D and cause Fritzbox is using own /64s for its LAN and guest LAN out of the ISPs /56.
                                    Everything works, all seems to be fine. VLANs get their own /64 with their own subnet part and SLAAC, clients get ULA, GUA, even changing GUAs (by ISP) don't bother me much...although..no, it does bother me, but it works for now...

                                    So, just a theoretical question (I hope since everything works and I haven't noticed any flaws): is that the way to do it or is it bogus and I could go with /56 on pfsense's WAN delegation size?

                                    the other

                                    pure amateur home user, no business or professional background
                                    please excuse poor english skills and typpoz :)

                                    1 Reply Last reply Reply Quote 0
                                    • gregeehG
                                      gregeeh @JKnott
                                      last edited by

                                      @JKnott said in prefix length should be 64:

                                      On RA, why do you have stateless? That implies you're using DHCP6, but you don't have it enabled. I use unmanaged here.

                                      Changed to unmanaged and now all seems good.

                                      Only issue is DHCP6 Gateway is pending.

                                      alt text

                                      alt text

                                      alt text

                                      PfSense running on Qotom mini PC
                                      CPU N3150, 2 GB memory, 32 GB SSD & 2 Realtek Gb Ethernet ports.
                                      UniFi AC-Lite access point

                                      JKnottJ 1 Reply Last reply Reply Quote 0
                                      • JKnottJ
                                        JKnott @gregeeh
                                        last edited by

                                        @gregeeh said in prefix length should be 64:

                                        Only issue is DHCP6 Gateway is pending.

                                        That could be due to what you're pinging. While you can ping a link local address, your ISP might not have configured it to respond. That's the case with my ISP. What I did was run a traceroute to Google and picked the first global address to use for the monitor.

                                        PfSense running on Qotom mini PC
                                        i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                                        UniFi AC-Lite access point

                                        I haven't lost my mind. It's around here...somewhere...

                                        gregeehG Bob.DigB 2 Replies Last reply Reply Quote 0
                                        • gregeehG
                                          gregeeh @JKnott
                                          last edited by

                                          @JKnott said in prefix length should be 64:

                                          That could be due to what you're pinging.

                                          I can ping the same addess from the pfSense CLI, so should it not also work in the Gateway Monitoring.

                                          PfSense running on Qotom mini PC
                                          CPU N3150, 2 GB memory, 32 GB SSD & 2 Realtek Gb Ethernet ports.
                                          UniFi AC-Lite access point

                                          JKnottJ 1 Reply Last reply Reply Quote 0
                                          • JKnottJ
                                            JKnott @gregeeh
                                            last edited by

                                            @gregeeh

                                            You'd think so. Did you enter the address for the gateway? Or just leave the box blank. It will default to the gateway address, so you don't have to enter anything. You could try putting some working GUA, that you can ping, in that box.

                                            PfSense running on Qotom mini PC
                                            i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                                            UniFi AC-Lite access point

                                            I haven't lost my mind. It's around here...somewhere...

                                            gregeehG 1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.