HE tunnel broker

Antibiotic

@johnpoz I don't want to use more than one tunnel, I just to try understanding, possible or not to use one tunnel on a few pfsense interfaces?

johnpoz

@Antibiotic yup get yourself the /48 vs the /64 and then you can use up to 65k /64s - which I would assume is more than enough for how many networks you could possibly have ;)

Antibiotic

@johnpoz Ah ok, insteed of use /64 should request /48 and can use a lot. But when use /48 have to setup on interface static ipv6 as well or something different (DCHP6 or 6 to 4 or SLAAC)?

johnpoz

@Antibiotic yeah you would setup your interfaces as static with whatever /64 out of the 48 you want... I keep them inline with the network I have on that network IPv4

Notice how numbers like up with the 3rd octet in my ipv4 /24s

I normally don't run IPv6 at all on any clients - but have it setup on a few networks, so if I want to test something I can by just enabling ipv6 on the client.

the IPv6 on your different IPs on pfsense would be set static by you.

Antibiotic

@johnpoz
If have a openVPN client and VPN service support ipv6 will this work with tunnel?

johnpoz

@Antibiotic if you run a vpn server on pfsense and have a client connect to you then yeah you can give them an IPv6 out of /64 you have.. But no some vpn client you setup on pfsense that connects to some vpn service would use what the vpn service gives you.

Antibiotic

@johnpoz No i mean in case will use on this interface tunnel broker, will openvpn pick up ipv6

johnpoz

@Antibiotic what are you asking, can you use IPv6 to talk to a vpn service as a client? Can you use use the ipv6 you have on your wan which is the tunnel IPv6 network which is different than the /64 or /48 you can get

Yes.. If you have an HE tunnel pfsense has an IPv6 on its wan that it can use to talk to anything out on the internet. Your devices behind pfsense will also have an IPv6 if once you assign an IPv6 /64 to your network(s)..

You can have pfsense listen for openvpn clients on its wan.

The pfsense wan IP would be different than both your /64 you have routed to this tunnel address or any /64 you route out of the /48 you get..

Gertjan

@Antibiotic said in HE tunnel broker:

No i mean in case will use on this interface tunnel broker, will openvpn pick up ipv6

I've been using my Phone with a OpenVPNclient using the he.net tunnel IPv6 for years.

Point your OpenVPN client to the green :

and don't forget to open the OpenVPN port and protocol on the pfSense side of things.

@Antibiotic said in HE tunnel broker:

something different (DCHP6 or 6 to 4 or SLAAC)?

Oh boy. You missed something major.
HE.net is like Boeing and Airbus : you are not allowed to use their services and equipment if you didn't follow and terminated their training.
See this : Hurricane Electric IPv6 Certification as mandatory, as it permits you to work in the garden, or take care of the kids, because "IPv6" will not be a secret anymore for you. I really can advise that training. You get a TShirt for free when done

The free IPv6 HE.net service doesn't use "DHCP" or "SLAAC".
The IPv6 networks you receive are static (will never change).
So the setup both for the tunnel, your WAN IP (the ...::2 IPv6) and all your 65535 LAN networks (each /64 in size) have to be set up statically, by picking one out of the /48.

Because every LAN network (prefix) is a /64, you can now, for every LAN interface, set up a DHCP6 server on that LAN, and define a IPv6 pool for it which you take out of the /64 of that network.

Actually quiet daunting if you have to do this for 65535 LANs
Btw : not sure if pfSense can handle that many interfaces ^^

Anyway, I have been using it for years, and it was rock solid.

johnpoz

@Gertjan said in HE tunnel broker:

been using it for years, and it was rock solid.

yup same here - since 2014, nice!!

Mine got reset from the 2011 date because they were having an issue with specific pop, and I wanted to change the pop I was pointing too.. And I just ended up deleting the tunnel and bring up a new one..

But I have had a tunnel with them since January 14, 2011 07:40:14 UTC

While sure the tunnel might add a few ms to your latency.. Its well worth that vs dealing with the nonsense that is most isps ipv6 deployments.

Antibiotic

@Gertjan I have a certificate, but did a long time ago this certification. But do not understanding any benefits from this This is not a native ipv6, its going over ipv4 as understood and increase only latency. Why you using ipv6 tunnel, for what?

Gertjan

@Antibiotic said in HE tunnel broker:

This is not a native ipv6, its going over ipv4 as understood and increase only latency. Why you using ipv6 tunnel, for what?

The traffic is really IPv6.
The fact that it goes over pppoe or PPP or radio waves (Wifi or 4G) or VHF (to ISS) or whatever or whatver kind of VPN : it is IPv6.
he.net exists because there are ISPs out there that do only IPv4 and if you need IPv6, he.net is a very good plan B.

edit : you can se the tunnel as a VPN connection between two points, your pfSense and their POP. This tunnel can only use IPv4, so that is used to encapsulate IPv6.