Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Configure IPv6

    Scheduled Pinned Locked Moved
    IPv6
    3
    20
    1.6k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • D
      Danil 0 @JKnott
      last edited by

      @JKnott Finally, my ISP provide me PD that is /64. Is it even possible to setup with PD /64?

      JKnottJ 1 Reply Last reply Reply Quote 0
      • JKnottJ
        JKnott @Danil 0
        last edited by

        @Danil-0

        A /64 will work fine. However, that's only enough for a single network. I get a /56 from my ISP, which provides 256 /64s. Currently, I use one each for my main LAN, guest WiFi, test LAN, a Cisco router and my VPN. What does your ISP say they provide?

        PfSense running on Qotom mini PC
        i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
        UniFi AC-Lite access point

        I haven't lost my mind. It's around here...somewhere...

        D 1 Reply Last reply Reply Quote 0
        • D
          Danil 0 @JKnott
          last edited by

          @JKnott They provide /64. Tried to set up. Traceroute6 google.com is ok but not on LAN side.

          GertjanG JKnottJ 2 Replies Last reply Reply Quote 0
          • GertjanG
            Gertjan @Danil 0
            last edited by

            @Danil-0

            @JKnott said in Configure IPv6:

            Try capturing the DHCPv6 sequence to see what's happening. Post the capture file here.

            Here : https://forum.netgate.com/topic/172514/capture-full-dhcp-or-dhcpv6-sequence?_=1702908820445

            ?

            Or can you show what the dhcp6c process (DHCP IPv6 WAN client) showed you :
            ( First goto System > Advanced > Networking and check DHCP6 Debug )
            Read from bottom to top :

            2024-05-06 09:39:33.996883+02:00 	dhcp6c 	36936 	got an expected reply, sleeping.
2024-05-06 09:39:33.996859+02:00 	dhcp6c 	36936 	removing an event on ix3, state=RENEW
2024-05-06 09:39:33.996822+02:00 	dhcp6c 	36936 	script "/var/etc/dhcp6c_wan_dhcp6withoutra_script.sh" terminated
2024-05-06 09:39:33.996094+02:00 	dhcp6c 	24565 	dhcp6c renew, no change - bypassing update on ix3
2024-05-06 09:39:33.991236+02:00 	dhcp6c 	36936 	executes /var/etc/dhcp6c_wan_dhcp6withoutra_script.sh
2024-05-06 09:39:33.991226+02:00 	dhcp6c 	36936 	update a prefix 2a01:cb19:907:beef::/64 pltime=600, vltime=1800
2024-05-06 09:39:33.991213+02:00 	dhcp6c 	36936 	update an IA: PD-0
2024-05-06 09:39:33.991202+02:00 	dhcp6c 	36936 	Domain search list[0] home.
2024-05-06 09:39:33.991192+02:00 	dhcp6c 	36936 	nameserver[0] 2a01:cb19:907:befe:46d4:54ff:fe2a:3600
2024-05-06 09:39:33.991175+02:00 	dhcp6c 	36936 	dhcp6c Received INFO
2024-05-06 09:39:33.991164+02:00 	dhcp6c 	36936 	get DHCP option domain search list, len 6
2024-05-06 09:39:33.991153+02:00 	dhcp6c 	36936 	get DHCP option DNS, len 16
2024-05-06 09:39:33.991145+02:00 	dhcp6c 	36936 	preference: 255
2024-05-06 09:39:33.991136+02:00 	dhcp6c 	36936 	get DHCP option preference, len 1
2024-05-06 09:39:33.991125+02:00 	dhcp6c 	36936 	IA_PD prefix: 2a01:cb19:907:beef::/64 pltime=600 vltime=7039080927149950728
2024-05-06 09:39:33.991113+02:00 	dhcp6c 	36936 	get DHCP option IA_PD prefix, len 25
2024-05-06 09:39:33.991104+02:00 	dhcp6c 	36936 	IA_PD: ID=0, T1=300, T2=480
2024-05-06 09:39:33.991095+02:00 	dhcp6c 	36936 	get DHCP option IA_PD, len 41
2024-05-06 09:39:33.991086+02:00 	dhcp6c 	36936 	DUID: 00:03:00:01:44:d4:54:2a:36:00
2024-05-06 09:39:33.991075+02:00 	dhcp6c 	36936 	get DHCP option server ID, len 10
2024-05-06 09:39:33.991065+02:00 	dhcp6c 	36936 	DUID: 00:01:00:01:2c:ec:aa:20:90:ec:77:29:39:2c
2024-05-06 09:39:33.991051+02:00 	dhcp6c 	36936 	get DHCP option client ID, len 14
2024-05-06 09:39:33.991036+02:00 	dhcp6c 	36936 	receive reply from fe80::46d4:54ff:fe2a:3600%ix3 on ix3
2024-05-06 09:39:33.978715+02:00 	dhcp6c 	36936 	send renew to ff02::1:2%ix3
2024-05-06 09:39:33.978546+02:00 	dhcp6c 	36936 	set IA_PD
2024-05-06 09:39:33.978536+02:00 	dhcp6c 	36936 	set IA_PD prefix
2024-05-06 09:39:33.978522+02:00 	dhcp6c 	36936 	set option request (len 4)
2024-05-06 09:39:33.978511+02:00 	dhcp6c 	36936 	set elapsed time (len 2)
2024-05-06 09:39:33.978503+02:00 	dhcp6c 	36936 	set server ID (len 10)
2024-05-06 09:39:33.978494+02:00 	dhcp6c 	36936 	set client ID (len 14)
2024-05-06 09:39:33.978482+02:00 	dhcp6c 	36936 	a new XID (19bb2e) is generated
2024-05-06 09:39:33.978471+02:00 	dhcp6c 	36936 	Sending Renew
2024-05-06 09:39:33.978459+02:00 	dhcp6c 	36936 	reset a timer on ix3, state=RENEW, timeo=0, retrans=9677
2024-05-06 09:39:33.978407+02:00 	dhcp6c 	36936 	IA timeout for PD-0, state=ACTIVE

            You can see that dhp6c received a PD :

            IA_PD prefix: 2a01:cb19:907:beef::/64 pltime=600 vltime=7039080927149950728

            Your ISP should have an IPv6 for you, which could be an entire /64, so your WAN interface gets one, a /128), and it should also give you another /64, the PD (see logs above).
            That's the one you can use for your LAN, which has been set up with IPv6 tracking

            My ISP announces IPv6 capabilities like this :

            74ee34aa-08c5-4423-a388-8eded56e000a-image.png

            The first line is the IPv6 address my WAN obtained.
            The second line is the range of prefixes variables : 256 PD's, each one is a /64.

            No "help me" PM's please. Use the forum, the community will thank you.
            Edit : and where are the logs ??

            D 1 Reply Last reply Reply Quote 0
            • JKnottJ
              JKnott @Danil 0
              last edited by

              @Danil-0 said in Configure IPv6:

              @JKnott They provide /64. Tried to set up. Traceroute6 google.com is ok but not on LAN side.

              Do you get a valid IPv6 address on the LAN side?

              As @Gertjan mentioned, you may have a /128 on the WAN interface, though it's not necessary.

              I'd beyond belief that some ISPs provide only a single /64. As I mentioned, mine provides a /56 and some a /48. The IPv6 address space is so huge that there are over 4000 /48s available for every person on earth.

              PfSense running on Qotom mini PC
              i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
              UniFi AC-Lite access point

              I haven't lost my mind. It's around here...somewhere...

              D 1 Reply Last reply Reply Quote 0
              • D
                Danil 0 @Gertjan
                last edited by

                @Gertjan said in Configure IPv6:

                script

                You can find log below.

                May  7 09:50:02 dhcp6c[4062]: extracted an existing DUID from /var/db/dhcp6c_duid: 00:01:00:01:2c:b2:88:01:90:ec:77:88:d7:a1
May  7 09:50:02 dhcp6c[4062]: failed to open /usr/local/etc/dhcp6cctlkey: No such file or directory
May  7 09:50:02 dhcp6c[4062]: failed initialize control message authentication
May  7 09:50:02 dhcp6c[4062]: skip opening control port
May  7 09:50:02 dhcp6c[4062]: <3>[interface] (9)
May  7 09:50:02 dhcp6c[4062]: <5>[mvneta0] (7)
May  7 09:50:02 dhcp6c[4062]: <3>begin of closure [{] (1)
May  7 09:50:02 dhcp6c[4062]: <3>[send] (4)
May  7 09:50:02 dhcp6c[4062]: <3>[ia-na] (5)
May  7 09:50:02 dhcp6c[4062]: <3>[0] (1)
May  7 09:50:02 dhcp6c[4062]: <3>end of sentence [;] (1)
May  7 09:50:02 dhcp6c[4062]: <3>comment [# request stateful address] (26)
May  7 09:50:02 dhcp6c[4062]: <3>[send] (4)
May  7 09:50:02 dhcp6c[4062]: <3>[ia-pd] (5)
May  7 09:50:02 dhcp6c[4062]: <3>[0] (1)
May  7 09:50:02 dhcp6c[4062]: <3>end of sentence [;] (1)
May  7 09:50:02 dhcp6c[4062]: <3>comment [# request prefix delegation] (27)
May  7 09:50:02 dhcp6c[4062]: <3>[request] (7)
May  7 09:50:02 dhcp6c[4062]: <3>[domain-name-servers] (19)
May  7 09:50:02 dhcp6c[4062]: <3>end of sentence [;] (1)
May  7 09:50:02 dhcp6c[4062]: <3>[request] (7)
May  7 09:50:02 dhcp6c[4062]: <3>[domain-name] (11)
May  7 09:50:02 dhcp6c[4062]: <3>end of sentence [;] (1)
May  7 09:50:02 dhcp6c[4062]: <3>[script] (6)
May  7 09:50:02 dhcp6c[4062]: <3>["/var/etc/dhcp6c_wan_script.sh"] (31)
May  7 09:50:02 dhcp6c[4062]: <3>end of sentence [;] (1)
May  7 09:50:02 dhcp6c[4062]: <3>comment [# we'd like some nameservers please] (35)
May  7 09:50:02 dhcp6c[4062]: <3>end of closure [}] (1)
May  7 09:50:02 dhcp6c[4062]: <3>end of sentence [;] (1)
May  7 09:50:02 dhcp6c[4062]: <3>[id-assoc] (8)
May  7 09:50:02 dhcp6c[4062]: <13>[na] (2)
May  7 09:50:02 dhcp6c[4062]: <13>[0] (1)
May  7 09:50:02 dhcp6c[4062]: <13>begin of closure [{] (1)
May  7 09:50:02 dhcp6c[4062]: <3>end of closure [}] (1)
May  7 09:50:02 dhcp6c[4062]: <3>end of sentence [;] (1)
May  7 09:50:02 dhcp6c[4062]: <3>[id-assoc] (8)
May  7 09:50:02 dhcp6c[4062]: <13>[pd] (2)
May  7 09:50:02 dhcp6c[4062]: <13>[0] (1)
May  7 09:50:02 dhcp6c[4062]: <13>begin of closure [{] (1)
May  7 09:50:02 dhcp6c[4062]: <3>[prefix-interface] (16)
May  7 09:50:02 dhcp6c[4062]: <5>[mvneta1] (7)
May  7 09:50:02 dhcp6c[4062]: <3>begin of closure [{] (1)
May  7 09:50:02 dhcp6c[4062]: <3>[sla-id] (6)
May  7 09:50:02 dhcp6c[4062]: <3>[0] (1)
May  7 09:50:02 dhcp6c[4062]: <3>end of sentence [;] (1)
May  7 09:50:02 dhcp6c[4062]: <3>[sla-len] (7)
May  7 09:50:02 dhcp6c[4062]: <3>[0] (1)
May  7 09:50:02 dhcp6c[4062]: <3>end of sentence [;] (1)
May  7 09:50:02 dhcp6c[4062]: <3>end of closure [}] (1)
May  7 09:50:02 dhcp6c[4062]: <3>end of sentence [;] (1)
May  7 09:50:02 dhcp6c[4062]: <3>end of closure [}] (1)
May  7 09:50:02 dhcp6c[4062]: <3>end of sentence [;] (1)
May  7 09:50:02 dhcp6c[4062]: called
May  7 09:50:02 dhcp6c[4062]: called

                May  7 10:01:45 kea-dhcp6[42450]: WARN  [kea-dhcp6.dhcpsrv.0x11e7c2612000] DHCPSRV_MT_DISABLED_QUEUE_CONTROL disabling dhcp queue control when multi-threading is enabled.
May  7 10:01:45 kea-dhcp6[42450]: WARN  [kea-dhcp6.dhcp6.0x11e7c2612000] DHCP6_RESERVATIONS_LOOKUP_FIRST_ENABLED Multi-threading is enabled and host reservations lookup is always performed first.
May  7 10:01:45 kea-dhcp6[42450]: WARN  [kea-dhcp6.dhcpsrv.0x11e7c2612000] DHCPSRV_NO_SOCKETS_OPEN no interface configured to listen to DHCP traffic
May  7 10:01:45 kea-dhcp6[42450]: WARN  [kea-dhcp6.dhcp6.0x11e7c2612000] DHCP6_MULTI_THREADING_INFO enabled: yes, number of threads: 2, queue size: 64

                My ISP told me that i have only /64 and it is not possible to provide /56.

                1 Reply Last reply Reply Quote 0
                • D
                  Danil 0 @JKnott
                  last edited by

                  @JKnott No. I do not have IPV6 on LAN :) and I have /64 on WAN. Please, check interface pics.

                  Interface.png

                  JKnottJ 1 Reply Last reply Reply Quote 0
                  • JKnottJ
                    JKnott @Danil 0
                    last edited by

                    @Danil-0 said in Configure IPv6:

                    @JKnott
                    about 5 hours ago

                    @JKnott No. I do not have IPV6 on LAN :) and I have /64 on WAN. Please, check interface pics.

                    That explains why you can't traceroute to Google. You do not have global IPv6 addresses on your LAN. Your ISP is giving you a single /64, which goes to pfSense, leaving nothing for the LAN side. While my WAN port has an address, it's from a completely different prefix than what I'm assigned via DHCPv6-PD.

                    Complain to your ISP for them being so damn cheap with addresses.

                    PfSense running on Qotom mini PC
                    i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                    UniFi AC-Lite access point

                    I haven't lost my mind. It's around here...somewhere...

                    D 1 Reply Last reply Reply Quote 0
                    • D
                      Danil 0 @JKnott
                      last edited by Danil 0

                      @JKnott I asked him about /56 prefix so they told me that it is not possible to provide. My discount will be off till 2 months so it will be better to change ISP. I found some good. Any way, thanks a lot for help!!!

                      GertjanG 1 Reply Last reply Reply Quote 0
                      • GertjanG
                        Gertjan @Danil 0
                        last edited by Gertjan

                        @Danil-0 said in Configure IPv6:

                        I asked him about /56 prefix so they told me that it is not possible to provide.

                        and

                        @JKnott said in Configure IPv6:

                        Complain to your ISP for them being so damn cheap with addresses.

                        One simple call to 'whoever' allocates / distributes these /32 IPv6 networks (or even smaller) and your ISP has them avaible.
                        Bit this isn't the issue. I'm pretty sure they already 'have them'.

                        The thing is : they have to invest. Their equipment is probably a collection of 'works fine for IPv4' but can not deal with allocating IPv6 stuff, as they can do right now with the IPv4.
                        So they have to invest. But shareholders come first, then the CEOs, then the .... and etc etc.

                        There is only one thing you can do as a client : add the criteria "is this ISP doing the ISP job correctly ?" to your "how to select an ISP" list, and use it you while go out shopping for an ISP. If most clients would do this, all ISPs would be "IPv6 ready", or broke. Suddenly shareholder have lot of decision power ^^

                        Keep in mind the vast majority of all ISP clients don't kw sht about IPv6, or, understandably, don't care. Yet.
                        So up to you to chose wisely.

                        No "help me" PM's please. Use the forum, the community will thank you.
                        Edit : and where are the logs ??

                        D JKnottJ 2 Replies Last reply Reply Quote 0
                        • D
                          Danil 0 @Gertjan
                          last edited by

                          @Gertjan said in Configure IPv6:

                          One simple call to 'whoever' allocates / distributes these /32 IPv6 networks (or even smaller) and your ISP has them avaible.
                          Bit this isn't the issue. I'm pretty sure they already 'have them'.

                          The thing is : they have to invest. Their equipment is probably a collection of 'works fine for IPv4' but can not deal with allocating IPv6 stuff, as they can do right now with the IPv4.
                          So they have to invest. But shareholders come first, then the CEOs, then the .... and etc etc.

                          There is only one thing you can do as a client : add the criteria "is this ISP doing the ISP job correctly ?" to your "how to select an ISP" list, and use it you while go out shopping for an ISP. If most clients would do this, all ISPs would be "IPv6 ready", or broke. Suddenly shareholder have lot of decision power ^^

                          Keep in mind the vast majority of all ISP clients don't kw sht about IPv6, or, understandably, don't care. Yet.
                          So up to you to chose wisely.

                          I understand it that you mean but i receive answer that we can provide only /64 at the moment. I think, they do not have client like me or it is cca 5% from total.

                          JKnottJ 1 Reply Last reply Reply Quote 0
                          • JKnottJ
                            JKnott @Danil 0
                            last edited by

                            @Danil-0 said in Configure IPv6:

                            I understand it that you mean but i receive answer that we can provide only /64 at the moment. I think, they do not have client like me or it is cca 5% from total.

                            Initially, my ISP provided only a single /64, but that was temporary and now they provide a /56. However, they still properly used DHCPv6-PD, so that my WAN address was not part of that prefix. It sounds like yours isn't even doing that. In fact, your ISP should be able to provide your prefix via DHCPv6-PD, without having to provide a global address on the WAN. That would at least give you a single /64 to work with. Another possibility is to configure pfSense to be a firewall only and not a router. However, I have no experience with that. Maybe someone else here can advise.

                            PfSense running on Qotom mini PC
                            i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                            UniFi AC-Lite access point

                            I haven't lost my mind. It's around here...somewhere...

                            1 Reply Last reply Reply Quote 0
                            • JKnottJ
                              JKnott @Gertjan
                              last edited by

                              @Gertjan said in Configure IPv6:

                              The thing is : they have to invest. Their equipment is probably a collection of 'works fine for IPv4' but can not deal with allocating IPv6 stuff

                              That's likely a software issue, not hardware.

                              PfSense running on Qotom mini PC
                              i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                              UniFi AC-Lite access point

                              I haven't lost my mind. It's around here...somewhere...

                              1 Reply Last reply Reply Quote 0
                              • First post
                                Last post