Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Static IPv6 "gateway does not lie within one the chosen interface's subnets"

    Scheduled Pinned Locked Moved IPv6
    27 Posts 3 Posters 1.4k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • johnpozJ
      johnpoz LAYER 8 Global Moderator @JKnott
      last edited by

      @JKnott true, no arp ;) I used the wrong term, shoot me ;)

      An intelligent man is sometimes forced to be drunk to spend time with his fools
      If you get confused: Listen to the Music Play
      Please don't Chat/PM me for help, unless mod related
      SG-4860 24.11 | Lab VMs 2.8, 24.11

      1 Reply Last reply Reply Quote 0
      • JKnottJ
        JKnott @lmat
        last edited by

        @lmat said in Static IPv6 "gateway does not lie within one the chosen interface's subnets":

        Why do you say the gateway is invalid?

        What address on pfSense will be used to reach it? You can't use the WAN address as it's a /128, which means there is no other device possible, within it's subnet. As I mentioned, link local is generally used for gateways.

        Try doing a packet capture on the WAN interface, filtering on ICMPv6, and post the capture file here. PfSense has a built in capture utility. If that fails, you can make a data tap from a cheap managed switch and put it ahead of the WAN interface. Leave the capture running for a few minutes so you can make sure you get a router advertisement.

        PfSense running on Qotom mini PC
        i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
        UniFi AC-Lite access point

        I haven't lost my mind. It's around here...somewhere...

        L 1 Reply Last reply Reply Quote 1
        • L
          lmat @johnpoz
          last edited by

          @johnpoz said in Static IPv6 "gateway does not lie within one the chosen interface's subnets":

          If that works, then create a lan side /64 out of the /56 they are routing to you.
          ...
          ...you could try creating your lan with a /64 out of that /56 they gave you...

          These two statements are interesting to me. It looks to me that they gave me one address (/128) in a network (subnet?) with a 56-bit network mask. (Although if that was the case, I'm not sure why they wouldn't say my assigned IPv6 was 2000:561:10:301::162/56.) But you're suggesting they have allocated all host IP addresses within that 56-bit network mask to me? Why do you think that?

          For example, they also gave me a public IPv4 address of 65.39.159.66/24, but I don't assume that I get 255 public IPv4 addresses. Why would I assume I get the whole 56-bit prefix in IPv6?

          JKnottJ johnpozJ 2 Replies Last reply Reply Quote 0
          • JKnottJ
            JKnott @lmat
            last edited by JKnott

            @lmat Working with IPv6 is in many ways different from IPv4. The only reason you get a single address on IPv4 is the shortage of addresses. There are nowhere enough to go around, to the point many ISPs now use CGNAT, which is even worse than 1 address & NAT. With IPv6, you get a block of addresses, to use as you chose. With a /56, which I also have, you can create 256 separate networks, each of which contains 18.4 billion, billion addresses. That said, your WAN address has absolutely nothing to do with your LAN addresses. They are completely independent. So, what you need is a link local address for the gateway, as you cannot use the assigned WAN address to talk to any gateway. If they'd given use a smaller prefix, even a /127, then you could use the WAN to reach the gateway. BTW, the link local address would likely have a /64 prefix, so a gateway can support 18.4 billion, billion devices (yeah, right), as that many are supported by the prefix.

            PfSense running on Qotom mini PC
            i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
            UniFi AC-Lite access point

            I haven't lost my mind. It's around here...somewhere...

            L 2 Replies Last reply Reply Quote 0
            • johnpozJ
              johnpoz LAYER 8 Global Moderator @lmat
              last edited by johnpoz

              @lmat said in Static IPv6 "gateway does not lie within one the chosen interface's subnets":

              I don't assume that I get 255 public IPv4 addresses.

              Because that is not a network address that /24 is a host address.. The ipv6 they gave you is prefix/network add not a host address. Also you would never assign a /56 to a single network.. That would be a routed network via the transit they assigned with the odd /128 setup, etc.

              You can look at any address and tell if its a host or a network.. If it lands on a network boundary then its a network, if it doesn't land a network boundary then its a host address. They clearly gave you a /56 network there.

              2000:561:10:301::/56

              which would run from.. 2000:561:10:300:: - 2000:561:10:3ff::

              Now that you mention it, that 301 isn't proper boundary..

              I would get with your isp - they are clearly doing their ipv6 deployment without having a clue.. Or they just typo'd what they sent you for info.. So yeah 2000:561:10:301:0:0:0:0/56 would be a host address - but that would be insane to assign a /56 to some interface... prefixes in ipv6 should be a /64 in almost all cases, other then delegation of a prefix, or a route statement or firewall rule, etc.

              Maybe they are not letting you use the 1st /64 in that /56?

              An intelligent man is sometimes forced to be drunk to spend time with his fools
              If you get confused: Listen to the Music Play
              Please don't Chat/PM me for help, unless mod related
              SG-4860 24.11 | Lab VMs 2.8, 24.11

              JKnottJ L 2 Replies Last reply Reply Quote 0
              • JKnottJ
                JKnott @johnpoz
                last edited by

                @johnpoz said in Static IPv6 "gateway does not lie within one the chosen interface's subnets":

                prefixes in ipv6 should be a /64 in almost all cases, other then delegation of a prefix, or a route statement or firewall rule, etc.

                Or a point to point link, which can be a /127/

                PfSense running on Qotom mini PC
                i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                UniFi AC-Lite access point

                I haven't lost my mind. It's around here...somewhere...

                1 Reply Last reply Reply Quote 0
                • L
                  lmat @JKnott
                  last edited by

                  Thank you again for your most helpful replies.

                  @JKnott said in Static IPv6 "gateway does not lie within one the chosen interface's subnets":

                  That said, your WAN address has absolutely nothing to do with your LAN addresses. They are completely independent.

                  I think I follow this: My WAN address is a way for the ISP to address the edge of my network. When you say "LAN addresses", though, those addresses aren't isolated to my LAN, but they're publicly addressible Internet addresses, right?

                  So, what you need is a link local address for the gateway, as you cannot use the assigned WAN address to talk to any gateway.

                  Okay, I drafted the following message to my ISP representative, does it look correct?

                  I'm not sure how I'm supposed to contact the gateway because the IP address you gave is /128. That means I can't communicate with anything from that address because it is isolated in its own prefix.

                  I'll also ask if they can provide a link-local IP address to their gateway instead.

                  JKnottJ 1 Reply Last reply Reply Quote 0
                  • L
                    lmat @johnpoz
                    last edited by

                    As always, thank you very much for your help!

                    @johnpoz said in Static IPv6 "gateway does not lie within one the chosen interface's subnets":

                    You can look at any address and tell if its a host or a network.. If it lands on a network boundary then its a network, if it doesn't land a network boundary then its a host address.

                    By "boundary", I assume you mean the lower boundary. (2000:561:10:300::/56 has a lower boundary of 2000:561:10:300:: and an upper boundary of 2000:561:10:30ff:ffff:ffff:ffff:ffff, right?)

                    They clearly gave you a /56 network there.

                    You say "They clearly gave" rather than "You're clearly on". I'll sleep on this some more until I get it through my mind that this is the way things work!

                    Now that you mention it, that 301 isn't proper boundary..

                    Yeah, looks like a typo. I'll clarify with them.

                    JKnottJ 1 Reply Last reply Reply Quote 0
                    • JKnottJ
                      JKnott @lmat
                      last edited by

                      @lmat said in Static IPv6 "gateway does not lie within one the chosen interface's subnets":

                      I think I follow this: My WAN address is a way for the ISP to address the edge of my network. When you say "LAN addresses", though, those addresses aren't isolated to my LAN, but they're publicly addressible Internet addresses, right?

                      Yep. All the addresses are reachable from outside if you allow it. However, by default, the firewall blocks them.

                      And yes, you probably need a link local address for the gateway. While you have a WAN address, you don't need it. It's generally used for things like a VPN, but you could also use any LAN side interface address for that.

                      PfSense running on Qotom mini PC
                      i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                      UniFi AC-Lite access point

                      I haven't lost my mind. It's around here...somewhere...

                      JKnottJ 1 Reply Last reply Reply Quote 1
                      • JKnottJ
                        JKnott @lmat
                        last edited by

                        @lmat said in Static IPv6 "gateway does not lie within one the chosen interface's subnets":

                        By "boundary", I assume you mean the lower boundary. (2000:561:10:300::/56 has a lower boundary of 2000:561:10:300:: and an upper boundary of 2000:561:10:30ff:ffff:ffff:ffff:ffff, right?)

                        In this respect, IPv6 works the same as IPv4, except with much larger numbers. The prefix, can be almost anything, but an ISP will typically assign a /64, /60, /56 or /48. A network address will always end in ::, which indicates a continuous string of 0.

                        BTW, that :: can be used anywhere within an address, but can only be used once. If it isn't used at the end, then you'd see the 0 specifically included. Here's an example, the IPv6 loopback address: ::1. This indicates 127 0 bits followed by a single 1. This method is better than writing out all those 0s.

                        PfSense running on Qotom mini PC
                        i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                        UniFi AC-Lite access point

                        I haven't lost my mind. It's around here...somewhere...

                        1 Reply Last reply Reply Quote 0
                        • JKnottJ
                          JKnott @JKnott
                          last edited by

                          @JKnott said in Static IPv6 "gateway does not lie within one the chosen interface's subnets":

                          Yep. All the addresses are reachable from outside if you allow it. However, by default, the firewall blocks them.

                          There's one other thing, the address space is so sparse it's hard for an attacker to find anything to attack. Your LAN will have 18.4 billion, billion addresses, of which only a few are in use. So, unless the attacker already knows a device address, it will be almost impossible for them to attack anything. This compares with IPv4 where it's hard to find an address that's not in use somewhere.

                          PfSense running on Qotom mini PC
                          i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                          UniFi AC-Lite access point

                          I haven't lost my mind. It's around here...somewhere...

                          1 Reply Last reply Reply Quote 0
                          • L
                            lmat @JKnott
                            last edited by

                            Thank you! Please be patient as I'm still having trouble sorting through everything.

                            @JKnott said in Static IPv6 "gateway does not lie within one the chosen interface's subnets":

                            ...you cannot use the assigned WAN address to talk to any gateway.

                            You said this because the assigned WAN address is /128 meaning it is the only host with that prefix. It can't talk to a gateway because that gateway doesn't share a prefix, right?

                            Earlier you said (and I've heard this several places)

                            ...link local is generally used for gateways.

                            but the WAN address certainly won't share a prefix with that link local address (fe80::/10). I guess in that case I won't be sending traffic from my WAN address, but from my own link local (fe80::1/10) which properly shares a prefix?

                            Later you said:

                            All the addresses are reachable from outside if you allow it.

                            This suggests it doesn't matter whether they share a prefix or not?

                            Thank you again for your patience!

                            JKnottJ 1 Reply Last reply Reply Quote 0
                            • L
                              lmat @JKnott
                              last edited by

                              @JKnott said in Static IPv6 "gateway does not lie within one the chosen interface's subnets":

                              Try doing a packet capture on the WAN interface, filtering on ICMPv6, and post the capture file here.

                              I ran the packet capture for several minutes: tcpdump -vvv -ttt -i igb0 icmp6; and got the following:

                              00:00:01.000026 IP6 (hlim 255, next-header ICMPv6 (58) payload length: 32) 2000:561:9:300::162 > ff02::1:ff00:6: [icmp6 sum ok] ICMP6, neighbor solicitation, length 32, who has 2000:561:9:3::7
                                        source link-address option (1), length 8 (1): 00:0a:cd:20:5d:97
                                          0x0000:  000a cd20 5d97
                              00:00:01.068027 IP6 (hlim 255, next-header ICMPv6 (58) payload length: 32) 2000:561:9:300::162 > ff02::1:ff00:6: [icmp6 sum ok] ICMP6, neighbor solicitation, length 32, who has 2000:561:9:3::7
                                        source link-address option (1), length 8 (1): 00:0a:cd:20:5d:97
                                          0x0000:  000a cd20 5d97
                              

                              and a BUNCH more just like it. It looks like my machine is issuing a solicitation every second, but getting nothing back?

                              JKnottJ 1 Reply Last reply Reply Quote 0
                              • JKnottJ
                                JKnott @lmat
                                last edited by

                                @lmat said in Static IPv6 "gateway does not lie within one the chosen interface's subnets":

                                You said this because the assigned WAN address is /128 meaning it is the only host with that prefix. It can't talk to a gateway because that gateway doesn't share a prefix, right?

                                Yes.

                                @lmat said in Static IPv6 "gateway does not lie within one the chosen interface's subnets":

                                but the WAN address certainly won't share a prefix with that link local address (fe80::/10). I guess in that case I won't be sending traffic from my WAN address, but from my own link local (fe80::1/10) which properly shares a prefix?

                                First off, the link local address will likely have a /64 prefix and a link local address starts with fe80 and then has 64 bits, often derived from the MAC address, so every link local address is in the same prefix, which starts with fe80::.

                                PfSense running on Qotom mini PC
                                i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                                UniFi AC-Lite access point

                                I haven't lost my mind. It's around here...somewhere...

                                1 Reply Last reply Reply Quote 0
                                • JKnottJ
                                  JKnott @lmat
                                  last edited by

                                  @lmat said in Static IPv6 "gateway does not lie within one the chosen interface's subnets":

                                  I ran the packet capture for several minutes: tcpdump -vvv -ttt -i igb0 icmp6; and got the following:

                                  Use the packet capture that's in pfSense. You may have to install it. Then post the capture file here. It's a lot easier to examine the capture with Wireshark that what packet capture displays.

                                  Here's what a router advertisement looks like in Wireshark:

                                  ae550191-613d-491b-bc38-83746130322c-image.png

                                  And when expanded, selecting IPv6 info:

                                  1f6587bd-bae2-4ff2-8f09-66e18495c283-image.png

                                  PfSense running on Qotom mini PC
                                  i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                                  UniFi AC-Lite access point

                                  I haven't lost my mind. It's around here...somewhere...

                                  1 Reply Last reply Reply Quote 1
                                  • First post
                                    Last post
                                  Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.