Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Coming back to PFsense but IPv6 doesn't appear to work

    Scheduled Pinned Locked Moved
    IPv6
    4
    17
    1.0k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • F022YF
      F022Y
      last edited by

      That would help wouldn't it......

      04ef4026-a231-47a1-b0c6-6457f935f9fd-image.png

      ee209f34-e7d3-4c96-9e4e-48c7a1d83da5-image.png

      94c923de-4b7f-4a83-b5f7-cb6ec04fdc0f-image.png

      57ddf5c7-1519-4814-8b7a-9865f3904c57-image.png

      0aee48df-2aa9-4b27-916c-ba106b3b48dc-image.png

      Bob.DigB 1 Reply Last reply Reply Quote 0
      • Bob.DigB
        Bob.Dig LAYER 8 @F022Y
        last edited by Bob.Dig

        @F022Y That is looking good, what do your LAN rules look like?

        Bob.DigB 1 Reply Last reply Reply Quote 0
        • F022YF
          F022Y
          last edited by

          This might be where it's gone pear shaped.

          9a781b54-f5b4-4da7-b7fc-201ff5495509-image.png

          Bob.DigB 1 Reply Last reply Reply Quote 0
          • Bob.DigB
            Bob.Dig LAYER 8 @F022Y
            last edited by Bob.Dig

            @F022Y Have you tried Track Interface?
            Anyways you can not set the prefix to /128, it has to be /64.

            And your firewall rules on LAN look like what?

            1 Reply Last reply Reply Quote 0
            • Bob.DigB
              Bob.Dig LAYER 8 @Bob.Dig
              last edited by

              @Bob-Dig said in Coming back to PFsense but IPv6 doesn't appear to work:

              @F022Y That is looking good,

              I take this back, it looks like you did everything manually, which could be wrong entirely. 😉

              1 Reply Last reply Reply Quote 0
              • F022YF
                F022Y
                last edited by

                Just running back through the setup wizard again to "default" it and in doing so the IPv6 Gateway shows as down.

                04d0b2bb-e0a2-449a-a1af-86693dae7053-image.png

                From the LAN firewall point of view very vanilla at the moment just defaults.

                fcff086b-adf4-4086-914c-66b944bf8978-image.png

                Bob.DigB 1 Reply Last reply Reply Quote 0
                • Bob.DigB
                  Bob.Dig LAYER 8 @F022Y
                  last edited by

                  @F022Y Try DHCP on WAN and Track Interface on LAN. I see no reason why your WAN is "offline" now, "save" it again, to trigger it.

                  1 Reply Last reply Reply Quote 0
                  • F022YF
                    F022Y
                    last edited by

                    Tried I assume you mean this?

                    6ba4ebdb-1212-47f4-94b0-3cae2989b916-image.png

                    However track get the hump in LAN

                    fb099ebc-c878-41de-908b-275dabc543f5-image.png

                    Bob.DigB 1 Reply Last reply Reply Quote 0
                    • F022YF
                      F022Y
                      last edited by

                      So trying to get some help from ISP (LitFibre here in the UK), connection is fairly simple.

                      Fibre into the property, ONT with an RJ45 running to their router of my PFsense box.

                      Addressing is via DHCP and DHCPv6 according to what i got out of their router.

                      d0e95496-b2b0-441b-b2fb-011b24ad9994-image.png

                      ec9a99cf-c838-4294-9a8d-8adc6fe1a900-image.png

                      4810045d-a85f-40b3-8398-f71fb124666d-image.png

                      55631173-04f4-4458-9658-b64ae6db3584-image.png

                      If i don't spoof the WAN MAC in PFsense i don't get my static IP with i presume is down to DHCP reservation but i'm now stumped, i have reached out to ISP incase there is a setting i need which clearly i've missed or if PFsense can't be used with them.

                      1 Reply Last reply Reply Quote 0
                      • Bob.DigB
                        Bob.Dig LAYER 8 @F022Y
                        last edited by

                        @F022Y said in Coming back to PFsense but IPv6 doesn't appear to work:

                        However track get the hump in LAN

                        No, you have to scroll down a bit...

                        1 Reply Last reply Reply Quote 0
                        • F022YF
                          F022Y
                          last edited by F022Y

                          Sorry for the delay, work got in the way so couldn't down the connection then i think the little USFF pc i was using died so back to my good old ESXI host.

                          I tried the following configurations:-

                          WAN interface IPv4 DHCP (this stays the same throughout)
                          WAN interface IPv6 DHCP
                          LAN interface IPv4 Static IP (this stays the same throughout)
                          LAN interface IPv6 DHCP

                          WAN interface IPv4 DHCP (this stays the same throughout)
                          WAN interface IPv6 Track interface WAN
                          LAN interface IPv4 Static IP (this stays the same throughout)
                          LAN interface IPv6 None

                          WAN interface IPv4 DHCP (this stays the same throughout)
                          WAN interface IPv6 Track Interface LAN
                          LAN interface IPv4 Static IP (this stays the same throughout)
                          LAN interface IPv6 None

                          WAN interface IPv4 DHCP (this stays the same throughout)
                          WAN interface IPv6 WAN
                          LAN interface IPv4 Static IP (this stays the same throughout)
                          LAN interface IPv6 None

                          WAN interface IPv4 DHCP (this stays the same throughout)
                          WAN interface IPv6 DHCP
                          LAN interface IPv4 Static IP (this stays the same throughout)
                          LAN interface IPv6 Track Interface WAN

                          1b150af6-7560-4f11-9d87-ecca1871cb12-image.png

                          I'm afraid i'm not familar with DHCP from an ISP as i've always been a PPPoE user so still working it out.

                          I have left it in the following state:-

                          WAN interface IPv4 DHCP (this stays the same throughout)
                          WAN interface IPv6 DHCP
                          LAN interface IPv4 Static IP (this stays the same throughout)
                          LAN interface IPv6 Track Interface WAN

                          This isn't showing me a DHCPv6 address in the interfaces and IPv6 tests at thge likes of https://test-ipv6.com/ are still failing.

                          S GertjanG 2 Replies Last reply Reply Quote 0
                          • S
                            SteveITS Rebel Alliance @F022Y
                            last edited by

                            @F022Y There are, unfortunately, a bunch of ways to configure IPv6, instead of just one. You need to figure out what your ISP wants you to use. Your ISP will delegate you a /64 block to use on your LAN.

                            https://docs.netgate.com/pfsense/en/latest/interfaces/configure-ipv6.html
                            "The Track Interface choice works in concert with another IPv6 interface using DHCPv6 Prefix Delegation. When a delegation is received from the ISP, this option designates which interface will be assigned the IPv6 addresses delegated by the ISP and in cases where a larger delegation is obtained, which prefix inside the delegation is used."

                            Your recent photo above shows WAN tracking LAN which is backwards. (and the opposite of your text in the post)

                            Pre-2.7.2/23.09: Only install packages for your version, or risk breaking it. Select your branch in System/Update/Update Settings.
                            When upgrading, allow 10-15 minutes to restart, or more depending on packages and device speed.
                            Upvote 👍 helpful posts!

                            F022YF 1 Reply Last reply Reply Quote 0
                            • GertjanG
                              Gertjan @F022Y
                              last edited by Gertjan

                              @F022Y

                              358d8403-38db-4351-8294-c58925ad5942-image.png

                              You don't track LAN, but the WAN 😊

                              Also : tip of the day : never presume that things are working : check it.
                              The 'thing' that that get an 'IPv6' for the WAN interface is called "dhcp6c".
                              The same process also asks 'prefixe(s)' so your LAN (or more LAN's) can have their own dedicated /64.

                              First, goto System > Advanced > Networking and check

                              4bb0536a-c44d-441d-ba45-d2bf43b9d8a0-image.png

                              Next : goto Status > System Logs > DHCP
                              Your looking for a known process : dhcp6c (and not dhcpd which is the dhcp server process for your LAN interfaces).
                              You should see something like this (read from bottom to top) :

                              2023-10-03 18:54:04.265573+02:00 	dhcp6c 	6769 	got an expected reply, sleeping.
2023-10-03 18:54:04.265548+02:00 	dhcp6c 	6769 	removing an event on ix3, state=RENEW
2023-10-03 18:54:04.265503+02:00 	dhcp6c 	6769 	script "/var/etc/dhcp6c_wan_script.sh" terminated
2023-10-03 18:54:04.265076+02:00 	dhcp6c 	21146 	dhcp6c renew, no change - bypassing update on ix3
2023-10-03 18:54:04.261992+02:00 	dhcp6c 	6769 	executes /var/etc/dhcp6c_wan_script.sh
2023-10-03 18:54:04.261982+02:00 	dhcp6c 	6769 	update a prefix 2a01:cbbb:beef:a6dc::/64 pltime=600, vltime=1800
2023-10-03 18:54:04.261970+02:00 	dhcp6c 	6769 	update an IA: PD-0
2023-10-03 18:54:04.261957+02:00 	dhcp6c 	6769 	Domain search list[0] home.
2023-10-03 18:54:04.261947+02:00 	dhcp6c 	6769 	nameserver[0] 2a01:cbaa:dead:beef:46d4:54ff:fe2a:3600
2023-10-03 18:54:04.261930+02:00 	dhcp6c 	6769 	dhcp6c Received INFO
2023-10-03 18:54:04.261919+02:00 	dhcp6c 	6769 	get DHCP option domain search list, len 6
2023-10-03 18:54:04.261910+02:00 	dhcp6c 	6769 	get DHCP option DNS, len 16
2023-10-03 18:54:04.261902+02:00 	dhcp6c 	6769 	preference: 255
2023-10-03 18:54:04.261894+02:00 	dhcp6c 	6769 	get DHCP option preference, len 1
2023-10-03 18:54:04.261881+02:00 	dhcp6c 	6769 	IA_PD prefix: 2a01:cb19:907:a6dc::/64 pltime=600 vltime=1800
2023-10-03 18:54:04.261862+02:00 	dhcp6c 	6769 	get DHCP option IA_PD prefix, len 25
2023-10-03 18:54:04.261853+02:00 	dhcp6c 	6769 	IA_PD: ID=0, T1=300, T2=480
2023-10-03 18:54:04.261845+02:00 	dhcp6c 	6769 	get DHCP option IA_PD, len 41
2023-10-03 18:54:04.261836+02:00 	dhcp6c 	6769 	DUID: 00:03:00:01:44:d4:54:2a:36:00
2023-10-03 18:54:04.261825+02:00 	dhcp6c 	6769 	get DHCP option server ID, len 10
2023-10-03 18:54:04.261816+02:00 	dhcp6c 	6769 	DUID: 00:01:00:01:2b:5a:d7:6b:90:ec:77:29:39:2c
2023-10-03 18:54:04.261801+02:00 	dhcp6c 	6769 	get DHCP option client ID, len 14
2023-10-03 18:54:04.261776+02:00 	dhcp6c 	6769 	receive reply from fe80::46d4:54ff:fe2a:3600%ix3 on ix3
2023-10-03 18:54:04.250458+02:00 	dhcp6c 	6769 	send renew to ff02::1:2%ix3
2023-10-03 18:54:04.250277+02:00 	dhcp6c 	6769 	set IA_PD
2023-10-03 18:54:04.250269+02:00 	dhcp6c 	6769 	set IA_PD prefix
2023-10-03 18:54:04.250258+02:00 	dhcp6c 	6769 	set option request (len 4)
2023-10-03 18:54:04.250248+02:00 	dhcp6c 	6769 	set elapsed time (len 2)
2023-10-03 18:54:04.250240+02:00 	dhcp6c 	6769 	set server ID (len 10)
2023-10-03 18:54:04.250232+02:00 	dhcp6c 	6769 	set client ID (len 14)
2023-10-03 18:54:04.250219+02:00 	dhcp6c 	6769 	a new XID (ff0494) is generated
2023-10-03 18:54:04.250208+02:00 	dhcp6c 	6769 	Sending Renew
2023-10-03 18:54:04.250174+02:00 	dhcp6c 	6769 	reset a timer on ix3, state=RENEW, timeo=0, retrans=10439
2023-10-03 18:54:04.250064+02:00 	dhcp6c 	6769 	IA timeout for PD-0, state=ACTIVE

                              This pure rocket science langue shows that my upstream ISP router gave me one prefix :

                              IA_PD prefix: 2a01:cbaa:beef:a6dc::/64 and that one is 'mapped' (by the tracking) on my LAN interface as it's static IPv6
                              The rest of the 2a01:cbaa:beef:a6dc::/64 is used by the dhcp6 SERVER so t can hand out IPv6 out off this /64 pool :

                              My dhcp6 server setup on LAN :

                              6b38b183-9fde-445a-920d-fc5a4b0b2f44-image.png

                              and now my IPv6 capable devices on my LAN are all getting an IPv6.
                              Most of them have "DUID static" IPv6 leases, so my printers, NAS, servers etc always get the same IPV6.

                              My interfaces :

                              40488149-e12e-495c-aaab-6768c2987f46-image.png

                              as you can (can't see actually - I've barred it) see, the WAN IPv6 which is the 'range' of the LAN of my ISP router.

                              Btw : My ISP says in its GUI that it has a /56 for me, that is 256 prefixes of /64.
                              But it only gives me one !!

                              That's why I have this :

                              d14eb37b-694b-43c9-9f80-a81dd0d296c6-image.png

                              I can chose only 0 of 0 - actually 1 out of the 1 available prefixes obtained (see logs above).
                              But "0" is an hex index here. as these indexes go from 00 hex to FF hex = 255.
                              So "0" is the first valid one.

                              Also : the fe80:xxxxx adresses are like RFC1918 : so just like 192.168.1.1 - we all have the same addresses.
                              A 'real' rout-able IPv6 start with 2xxx:xx:xx:xx:xx:xx:xx:xx:x

                              No "help me" PM's please. Use the forum, the community will thank you.
                              Edit : and where are the logs ??

                              F022YF 1 Reply Last reply Reply Quote 0
                              • F022YF
                                F022Y @SteveITS
                                last edited by

                                @SteveITS Sorry i did notice that it was backwards but by that point i had clicked submit and the work phone rang so apologies for the wrong info.

                                1 Reply Last reply Reply Quote 0
                                • F022YF
                                  F022Y @Gertjan
                                  last edited by

                                  @Gertjan Yeah i clicked submit then noticed my screenshot error (took it while testing) and then had a server issue at work so had to stop "playing".

                                  Thats really helpful info and gives me something to work on, i'm a simple man of PPPoE so this is a new config type for me so it's all weird and wonderful.

                                  1 Reply Last reply Reply Quote 0
                                  • First post
                                    Last post