Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    HE tunnel broker

    Scheduled Pinned Locked Moved IPv6
    14 Posts 3 Posters 1.6k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • johnpozJ
      johnpoz LAYER 8 Global Moderator @Antibiotic
      last edited by

      @Antibiotic yup get yourself the /48 vs the /64 and then you can use up to 65k /64s - which I would assume is more than enough for how many networks you could possibly have ;)

      An intelligent man is sometimes forced to be drunk to spend time with his fools
      If you get confused: Listen to the Music Play
      Please don't Chat/PM me for help, unless mod related
      SG-4860 24.11 | Lab VMs 2.8, 24.11

      A 1 Reply Last reply Reply Quote 0
      • A
        Antibiotic @johnpoz
        last edited by

        @johnpoz Ah ok, insteed of use /64 should request /48 and can use a lot. But when use /48 have to setup on interface static ipv6 as well or something different (DCHP6 or 6 to 4 or SLAAC)?

        pfSense plus 24.11 on Topton mini PC
        CPU: Intel N100
        NIC: Intel i-226v 4 pcs
        RAM : 16 GB DDR5
        Disk: 128 GB NVMe
        Brgds, Archi

        johnpozJ 1 Reply Last reply Reply Quote 0
        • johnpozJ
          johnpoz LAYER 8 Global Moderator @Antibiotic
          last edited by johnpoz

          @Antibiotic yeah you would setup your interfaces as static with whatever /64 out of the 48 you want... I keep them inline with the network I have on that network IPv4

          Notice how numbers like up with the 3rd octet in my ipv4 /24s

          3ipv6.jpg

          I normally don't run IPv6 at all on any clients - but have it setup on a few networks, so if I want to test something I can by just enabling ipv6 on the client.

          the IPv6 on your different IPs on pfsense would be set static by you.

          An intelligent man is sometimes forced to be drunk to spend time with his fools
          If you get confused: Listen to the Music Play
          Please don't Chat/PM me for help, unless mod related
          SG-4860 24.11 | Lab VMs 2.8, 24.11

          A 1 Reply Last reply Reply Quote 0
          • A
            Antibiotic @johnpoz
            last edited by

            @johnpoz
            If have a openVPN client and VPN service support ipv6 will this work with tunnel?

            pfSense plus 24.11 on Topton mini PC
            CPU: Intel N100
            NIC: Intel i-226v 4 pcs
            RAM : 16 GB DDR5
            Disk: 128 GB NVMe
            Brgds, Archi

            johnpozJ 1 Reply Last reply Reply Quote 0
            • johnpozJ
              johnpoz LAYER 8 Global Moderator @Antibiotic
              last edited by

              @Antibiotic if you run a vpn server on pfsense and have a client connect to you then yeah you can give them an IPv6 out of /64 you have.. But no some vpn client you setup on pfsense that connects to some vpn service would use what the vpn service gives you.

              An intelligent man is sometimes forced to be drunk to spend time with his fools
              If you get confused: Listen to the Music Play
              Please don't Chat/PM me for help, unless mod related
              SG-4860 24.11 | Lab VMs 2.8, 24.11

              A 1 Reply Last reply Reply Quote 0
              • A
                Antibiotic @johnpoz
                last edited by

                @johnpoz No i mean in case will use on this interface tunnel broker, will openvpn pick up ipv6

                pfSense plus 24.11 on Topton mini PC
                CPU: Intel N100
                NIC: Intel i-226v 4 pcs
                RAM : 16 GB DDR5
                Disk: 128 GB NVMe
                Brgds, Archi

                johnpozJ GertjanG 2 Replies Last reply Reply Quote 0
                • johnpozJ
                  johnpoz LAYER 8 Global Moderator @Antibiotic
                  last edited by

                  @Antibiotic what are you asking, can you use IPv6 to talk to a vpn service as a client? Can you use use the ipv6 you have on your wan which is the tunnel IPv6 network which is different than the /64 or /48 you can get

                  Yes.. If you have an HE tunnel pfsense has an IPv6 on its wan that it can use to talk to anything out on the internet. Your devices behind pfsense will also have an IPv6 if once you assign an IPv6 /64 to your network(s)..

                  You can have pfsense listen for openvpn clients on its wan.

                  The pfsense wan IP would be different than both your /64 you have routed to this tunnel address or any /64 you route out of the /48 you get..

                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                  If you get confused: Listen to the Music Play
                  Please don't Chat/PM me for help, unless mod related
                  SG-4860 24.11 | Lab VMs 2.8, 24.11

                  1 Reply Last reply Reply Quote 0
                  • GertjanG
                    Gertjan @Antibiotic
                    last edited by Gertjan

                    @Antibiotic said in HE tunnel broker:

                    No i mean in case will use on this interface tunnel broker, will openvpn pick up ipv6

                    I've been using my Phone with a OpenVPNclient using the he.net tunnel IPv6 for years.

                    Point your OpenVPN client to the green :
                    2e19ec7a-6342-4564-9518-6b56d5710a31-image.png

                    and don't forget to open the OpenVPN port and protocol on the pfSense side of things.

                    @Antibiotic said in HE tunnel broker:

                    something different (DCHP6 or 6 to 4 or SLAAC)?

                    Oh boy. You missed something major.
                    HE.net is like Boeing and Airbus : you are not allowed to use their services and equipment if you didn't follow and terminated their training.
                    See this : Hurricane Electric IPv6 Certification as mandatory, as it permits you to work in the garden, or take care of the kids, because "IPv6" will not be a secret anymore for you. I really can advise that training. You get a TShirt for free when done 👍

                    The free IPv6 HE.net service doesn't use "DHCP" or "SLAAC".
                    The IPv6 networks you receive are static (will never change).
                    So the setup both for the tunnel, your WAN IP (the ...::2 IPv6) and all your 65535 LAN networks (each /64 in size) have to be set up statically, by picking one out of the /48.

                    Because every LAN network (prefix) is a /64, you can now, for every LAN interface, set up a DHCP6 server on that LAN, and define a IPv6 pool for it which you take out of the /64 of that network.

                    Actually quiet daunting if you have to do this for 65535 LANs 😰
                    Btw : not sure if pfSense can handle that many interfaces ^^

                    Anyway, I have been using it for years, and it was rock solid.

                    No "help me" PM's please. Use the forum, the community will thank you.
                    Edit : and where are the logs ??

                    johnpozJ A 2 Replies Last reply Reply Quote 0
                    • johnpozJ
                      johnpoz LAYER 8 Global Moderator @Gertjan
                      last edited by

                      @Gertjan said in HE tunnel broker:

                      been using it for years, and it was rock solid.

                      yup same here - since 2014, nice!!

                      nice.jpg

                      Mine got reset from the 2011 date because they were having an issue with specific pop, and I wanted to change the pop I was pointing too.. And I just ended up deleting the tunnel and bring up a new one..

                      But I have had a tunnel with them since January 14, 2011 07:40:14 UTC

                      While sure the tunnel might add a few ms to your latency.. Its well worth that vs dealing with the nonsense that is most isps ipv6 deployments.

                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                      If you get confused: Listen to the Music Play
                      Please don't Chat/PM me for help, unless mod related
                      SG-4860 24.11 | Lab VMs 2.8, 24.11

                      1 Reply Last reply Reply Quote 0
                      • A
                        Antibiotic @Gertjan
                        last edited by

                        @Gertjan I have a certificate, but did a long time ago this certification. But do not understanding any benefits from this This is not a native ipv6, its going over ipv4 as understood and increase only latency. Why you using ipv6 tunnel, for what?

                        pfSense plus 24.11 on Topton mini PC
                        CPU: Intel N100
                        NIC: Intel i-226v 4 pcs
                        RAM : 16 GB DDR5
                        Disk: 128 GB NVMe
                        Brgds, Archi

                        GertjanG 1 Reply Last reply Reply Quote 0
                        • GertjanG
                          Gertjan @Antibiotic
                          last edited by Gertjan

                          @Antibiotic said in HE tunnel broker:

                          This is not a native ipv6, its going over ipv4 as understood and increase only latency. Why you using ipv6 tunnel, for what?

                          The traffic is really IPv6.
                          The fact that it goes over pppoe or PPP or radio waves (Wifi or 4G) or VHF (to ISS) or whatever or whatver kind of VPN : it is IPv6.
                          he.net exists because there are ISPs out there that do only IPv4 and if you need IPv6, he.net is a very good plan B.

                          edit : you can se the tunnel as a VPN connection between two points, your pfSense and their POP. This tunnel can only use IPv4, so that is used to encapsulate IPv6.

                          No "help me" PM's please. Use the forum, the community will thank you.
                          Edit : and where are the logs ??

                          1 Reply Last reply Reply Quote 0
                          • First post
                            Last post
                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.