Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Stuck midway through IPv6 implementation

    Scheduled Pinned Locked Moved IPv6
    12 Posts 4 Posters 927 Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • U
      Uglybrian
      last edited by

      Hi, Try checking ( Do not wait for a RA) see if that helps. Also, are you resolving or fowarding your DNS?
      Do you have any of these checked?
      Screenshot from 2024-07-26 07-41-05.png

      N 1 Reply Last reply Reply Quote 0
      • N
        NickyDoes @Uglybrian
        last edited by

        @Uglybrian Both options are checked.
        e6e6fafd-fc1c-45c6-a4e5-c4bea8418d20-image.png

        I'm getting a /PD already and I cannot even ping using the IPv6 address, where no DNS is involved.

        keyserK 1 Reply Last reply Reply Quote 0
        • keyserK
          keyser Rebel Alliance @NickyDoes
          last edited by

          @NickyDoes Since you are using SLAAC, you will not see any activity/leases in your DHCPv6 server service (if you have set that up).

          SLAAC is stateless and the client autoprovisions it’s own IPv6 address from the prefix announced by the Router Advertisements (which gets the prefix from the PD assigned by the ISP using DHCPv6-PD on your WAN interface)

          You do not necessarily need a public IPv6 address on your WAN side interface - traffic can easily be routed using link-local between the ISP and your pfSense. That all depends on the ISP preferred method of operation.

          Make sure to allow ICMPv6 on your WAN interface to WAN itself and any interface containing IPv6 clients.
          Make sure to have a allow all IPv6 rule on your experiments interface - if not you specifically need an allow ICMPv6 rule on that interface to allow ping amongst other

          Love the no fuss of using the official appliances :-)

          N 1 Reply Last reply Reply Quote 1
          • U
            Uglybrian
            last edited by

            You may want to change this setting
            Screenshot from 2024-07-26 10-59-25.png
            If i remember correctly when i was setting up ipv6 from my isp I also got a PD but no connections.
            It wasnt until I checked "do not wate for RA" . As soon as I did that ipv6 started working for me.
            Screenshot from 2024-07-26 11-00-10.png

            1 Reply Last reply Reply Quote 0
            • N
              NickyDoes @keyser
              last edited by

              @keyser

              🤦Of course SLAAC isn't DHCP. IPv6 concepts are slowly making their way into my thinking.

              WAN ruleset (I just added the ICMP6 allow rule)
              e4b2ab4d-4f4b-4b70-ba57-c3aee41774be-image.png

              Experimental Network ruleset
              820ad0b3-0158-44c6-bc2d-84e00fcd25fd-image.png

              Are there other rules I should be adding for this test?

              keyserK the otherT 2 Replies Last reply Reply Quote 0
              • keyserK
                keyser Rebel Alliance @NickyDoes
                last edited by

                @NickyDoes hmm should work.

                I would rethink allowing all IPv6 to the firewall on WAN - that will expose the web UI, ssh and what not to the world😊

                Other than that it seems Strange that you cannot even Ping the firewall interfaces. Can you Ping the link addresses of the Experimentarium interface?

                Love the no fuss of using the official appliances :-)

                N 1 Reply Last reply Reply Quote 1
                • the otherT
                  the other @NickyDoes
                  last edited by the other

                  @NickyDoes
                  as @keyser said...delete that "this firewall rule". :)
                  do you have your pfsense behind a modem or do you have another router in front of it?
                  here my internetrouter gets a /56 prefix. It delegates a /57 size chunk to pfsense. This is then used by pfsense for LAN and Vlans (each /64) as recommended with v6.
                  I do not even need that ICMPv6 rule on WAN for IPv6 to work. If I remember correct then by activating IPv6 those rules are set automatically...as said, could be wrong, still here no probs without THAT rule.

                  So, what is your experimental VLANs interface's IPv6? Does it get one? Can you ping ie google.com from that one (pfsense's experimental VLAN interface)?
                  Can you ping THAT IP from your ubuntu? Can you ping vice versa (ping from pfsense experimental interface to ubuntu machine)?

                  the other

                  pure amateur home user, no business or professional background
                  please excuse poor english skills and typpoz :)

                  N 1 Reply Last reply Reply Quote 0
                  • N
                    NickyDoes @the other
                    last edited by

                    @the-other Back at it, as you saw from [this](link url) post 🙏.

                    Some answers:

                    pfSense is behind a Google fiber jack 'modem'.
                    I get a /56 PD per the DHCP6 log.

                    The IPv6_experimental interface does get an IP, which fits within Google's PD.
                    Running a fresh Ubuntu, I cannot ping the interface IPv6 from Ubuntu. UFW is not active.

                    Confirming my command: ping6 <pfsense experiemental VLAN IPv6 address> responds with "Destination unreachable: Address unreachable"

                    Note: I triple checked the 128-bit address.

                    The machine gets the address properly, so VLAN is working.

                    1 Reply Last reply Reply Quote 0
                    • N
                      NickyDoes @keyser
                      last edited by

                      @keyser I removed that one, which I added in error, so thanks.
                      No, I cannot ping the Expermiental interface from the machine.

                      the otherT 1 Reply Last reply Reply Quote 0
                      • the otherT
                        the other @NickyDoes
                        last edited by

                        @NickyDoes well,
                        you DO have a rule to allow ping?
                        You would need one to test that:
                        Interface experimental_vlan, allow / source: this exp_vlan subnet / destination: pfsense / protocol: icmp

                        Set that, try again, post results...please. ;)

                        the other

                        pure amateur home user, no business or professional background
                        please excuse poor english skills and typpoz :)

                        N 1 Reply Last reply Reply Quote 0
                        • N
                          NickyDoes @the other
                          last edited by

                          @the-other

                          Success! This issue was a layer 2 issue: I hadn't configured one VLAN switch port's VLAN ID, a simple oversight. Return traffic wasn't reaching the pfSense interface.

                          Whittling away the unknowns.

                          1 Reply Last reply Reply Quote 0
                          • First post
                            Last post
                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.