IPv6 connectivity NAT

JKnott

I doubt your carrier is using CGNAT for IPv6. At the very least you should be getting a /64 prefix, though generally you'll get more. What does your ISP offer? Mine gives me a /56, which is 256 /64s, each of which contains 18.4 billion, billion addresses.

Also, don't use DHCP6, if you don't have a specific need for it, as Android devices won't work with it. Use SLAAC instead. You should also mention the type of connection to your ISP, as that can affect configuration details.

artafinde

@JKnott said in IPv6 connectivity NAT:

@artafinde

I doubt your carrier is using CGNAT for IPv6. At the very least you should be getting a /64 prefix, though generally you'll get more. What does your ISP offer? Mine gives me a /56, which is 256 /64s, each of which contains 18.4 billion, billion addresses.

Thanks for the reply! That's a fair point - The IPv6 is provided with /56 prefix.

Also, don't use DHCP6, if you don't have a specific need for it, as Android devices won't work with it. Use SLAAC instead. You should also mention the type of connection to your ISP, as that can affect configuration details.

So in order to use SLAAC I need to disable Router Advertisement or one of the other fields ?

See my IPS router WAN connection status - blurred out the sensitive bits:

artafinde

@JKnott said in IPv6 connectivity NAT:

Also, don't use DHCP6, if you don't have a specific need for it, as Android devices won't work with it. Use SLAAC instead. You should also mention the type of connection to your ISP, as that can affect configuration details.

OK as soon as I switch from DHCPv6 on the WAN interface to SLAAC I lost IPv6 connectivity to the outside world from the pfsense. So clearly that's not working ok for me.

Bob.Dig

@artafinde said in IPv6 connectivity NAT:

as soon as I switch from DHCPv6 on the WAN interface to SLAAC I lost IPv6 connectivity

That is expected. On WAN you have to keep DHCPv6, not on LAN though. And does your first router do prefix delegation? Most can't do it.

artafinde

@Bob-Dig said in IPv6 connectivity NAT:

That is expected. On WAN you have to keep DHCPv6, not on LAN though.

OK WAN interface now with DHCPv6 works. This assigns a IPv6 on the WAN interface:

*** Welcome to pfSense 2.7.2-RELEASE (amd64) on pfSense ***

 WAN (wan)       -> igb0       -> v4/DHCP4: 10.0.0.2/24
                                  v6/DHCP6: 2a01:4b00:xxxx:xxxx:xxx:xxxx:xxxx:b024/128

Interesting the SLAAC you see it's saying:

MAN (lan)       -> igb1       -> v4: 10.120.10.1/24
                                 v6/SLAAC: ::10.10.10.1/128

@Bob-Dig said in IPv6 connectivity NAT:

And does your first router do prefix delegation? Most can't do it.

How can I find out? I don't think so to be honest it's ZTE H3600 V9 V9.0.24P14_HOP I think chinese made - didn't delve too much into.

JKnott

@artafinde said in IPv6 connectivity NAT:

OK as soon as I switch from DHCPv6 on the WAN interface to SLAAC I lost IPv6 connectivity to the outside world from the pfsense. So clearly that's not working ok for me.

Use SLAAC on the LAN side, so your devices get IPv6 addresses. You still have to use DHCP6 on the WAN.

Here's the info on my ISP, which may give you an idea of what to do. Their connection is via cable modem.

JKnott

@artafinde said in IPv6 connectivity NAT:

How can I find out? I don't think so to be honest

The usual procedure is to put the modem in bridge mode.

artafinde

@JKnott

Yeah bridge mode doesn't exist of course on these :)

I'll try setting the LAN to Track Interface instead of SLAAC since this doesn't work now as I see from your thread.

artafinde

@artafinde

Neither SLAAC nor Track Interface on LAN assigns a proper IPv6 on my linux workstation.

➜ ip a
[..]
3: enp6s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
    link/ether a8:5e:45:11:95:be brd ff:ff:ff:ff:ff:ff
    altname enxa85e451195be
    inet 10.120.10.20/24 metric 1024 brd 10.120.10.255 scope global dynamic enp6s0
       valid_lft 6506sec preferred_lft 6506sec
    inet6 fe80::aa5e:45ff:fe11:95be/64 scope link proto kernel_ll
       valid_lft forever preferred_lft forever
[..]

I'm thinking it has something to do with the systemd-networkd configuration:

That's Default config from Arch Linux systemd + the below:

# /etc/systemd/network/wired.network
[Match]
Name=enp*

[Network]
DHCP=yes

According to systemd man page DHCP=yes makes IPv4 and IPv6 configure with dhcp. Maybe I'm thinking I need to set something different for IPv6 from the systemd examples https://man.archlinux.org/man/systemd.network.5#EXAMPLES

JKnott

@artafinde said in IPv6 connectivity NAT:

Yeah bridge mode doesn't exist of course on these :)

Then pfSense will not be able to provide IPv6 to your LAN. It seems strange the ISP would provide a /56 without a way to use it.

artafinde

@JKnott
I don't need public IPv6 addresses to my LAN - i just need to be able to route IPv6 traffic outside to the internet.

Reading in the web the Hyperoptic router does prefix delegation as if i difectly connect to it with wifi (macos) i get a working ipv6 with a /64 range.

Gertjan

@artafinde said in IPv6 connectivity NAT:

I'll try setting the LAN to Track Interface

This should work.
Your WAN DHCPv6 client obtains a WAN IPv6 - and you've shown already above you have a 'valid' IPv6 for this interface.
Hook up another device, like a Windows PC, to your ISP router, and it will also obtain an IPv6.
pfSense is a router, so it will ask more from the upstream DHCP (ISP) DHCPv6 server : it ask for an IPv6, right - but also a prefix.
You told use that it has a /56 for you - like my ISP.
This means that it uses (probably) one of these /65, a /64, to be used on it's LAN network - and pfSense's WAN interface will obtain an IPv6 lying in this prefix. So one prefix is used, 255 are left for you to use /64-/56 = 8, and 2^8 = 256.
Your DHCPv6 WAN client will, if at least one pfSense LAN interface is set to 'tracking', try to obtain a prefix (a /64 block) so it can be sued for this LAN. because you have a /56 available, your pfSEbnse could offer 255 LAN interfaces, all with their own /64 prefix.

Example : my ISP router announces to me it has a /56 for me :

So I set my LAN to IPv6 tracking :

and below :

where I selct from the WAN interface prefix number "0 out 0" (actually 1 out 1 available).

I can see this /64 prefix "eb" or decimal 235 prefix being used on the DHCPv6 LAN server page :

where I declared a IPv6 DHCP pool from ::2 to ::86 - the other ::87 to ::fff:ffff:ffff:ffff are available for other devices ( a couple of zillion other devices ).

Now all my LAN devices are using an IPv6 out of this pool or prefix, as they all prefer IPv6 over IPv4.

edit : forget to add my personal thought about SLAAC : I don't have any.
Also : I never used or owned a android device, so I can stay with "DHCP", the IPv6 way.

Bob.Dig

@artafinde said in IPv6 connectivity NAT:

i just need to be able to route IPv6 traffic outside to the internet

Why is that? There is no IPv6-only-internet, as far as I know.

Technically, you could NAT IPv6 the same way as IPv4. But it doesn't make much sense.

Gertjan

@Bob-Dig said in IPv6 connectivity NAT:

Why is that? There is no IPv6 only internet, as far as I know.

Interesting.
After reading this IPv6 description - and if you accept that what's said over there as 'probably exact' you have a choice to make.
Edit that page.
Or accepts that

Internet Protocol version 6 (IPv6) is the most recent version of the Internet Protocol (IP)

thus one might sat that IPv6 is an important part (and still growing) of the Internet.

artafinde

@Bob-Dig said in IPv6 connectivity NAT:

Why is that? There is no IPv6-only-internet, as far as I know.

I need to be able to connect to servers which have only IPv6 ip through SSH.

Bob.Dig

@artafinde said in IPv6 connectivity NAT:

I need to be able to connect to servers which have only IPv6 ip through SSH

If everything else already mentioned here doesn't work for you, you could

switch Outbound NAT to hybrid
take a look, what pfSense is doing for Outbound NAT on IPv4 and then replicate that manually to IPv6. For that you will have to add ULA to your LAN.

JKnott

@artafinde said in IPv6 connectivity NAT:

I don't need public IPv6 addresses to my LAN - i just need to be able to route IPv6 traffic outside to the internet.

Why not find out how to put your modem into bridge mode and do things properly. NAT was created to get around the IPv4 address shortage. No need for it with IPv6.

artafinde

@Gertjan
Thanks for the details reply! I followed your steps but something is missing still. See below

First made sure the router gets an IPv6 on WAN interface with a proper prefix:
<snips from ssh>

 WAN (wan)       -> igb0       -> v4/DHCP4: 10.0.0.2/24
                                  v6/DHCP6: 2a01:4b00:xxxx:de00:20d:b9ff:fe4f:b024/64

Then as you suggested (lan) interface gets to track WAN IPv6

and

but this gets a /128 as you see below:

MAN (lan)       -> igb1       -> v4: 10.120.10.1/24
                                  v6/t6: ::10.10.10.1/128

Is that ok I wonder..

I've setup DHCPv6 for lan interface

And I've set the Router Advertisement as below

I see in the logs the below error:

/status_services.php: The command '/usr/local/sbin/radvd -p /var/run/radvd.pid -C /var/etc/radvd.conf -m syslog' returned exit code '1', the output was '/var/etc/radvd.conf:12 error: syntax error'

The radvd.conf is like below so it complains about prefix ::a0a:a01/128 ?

# Automatically Generated, do not edit
# Generated for DHCPv6 Server lan
interface igb1 {
        AdvSendAdvert on;
        MinRtrAdvInterval 200;
        MaxRtrAdvInterval 600;
        AdvDefaultLifetime 1800;
        AdvLinkMTU 1500;
        AdvDefaultPreference medium;
        AdvManagedFlag off;
        AdvOtherConfigFlag on;
        prefix ::a0a:a01/128 {
                DeprecatePrefix on;
                AdvOnLink on;
                AdvAutonomous on;
                AdvValidLifetime 86400;
                AdvPreferredLifetime 14400;
        };
        route ::/0 {
                AdvRoutePreference medium;
                RemoveRoute on;
        };
};

Not sure what's the error or where i messed up but workstation doesn't get an IP from pfsense.

PS:I've tried connected to the ISP router with laptop and IPv6 works 100%. (gets assigned a /64 IPv6).

Bob.Dig

@artafinde Your router doesn't delegate so you can't do what Gertjan has done.

Gertjan

@artafinde said in IPv6 connectivity NAT:

First made sure the router gets an IPv6 on WAN interface with a proper prefix

WAN (wan)     -> ix3    -> v4/DHCP4: 192.168.10.4/24
                           v6/DHCP6: 2a01:dead:beef:a600:92ec:77ff:fe29:392a/64
LAN (lan)     -> igc0   -> v4: 192.168.1.1/24
                           v6/t6: 2a01:cb19:dead:beef:a6eb:92ec:77ff:fe29:392c/64
......

The WAN IPv6 '2a01:dead:beef:a600:92ec:77ff:fe29:392a/64" looks like a prfix, but its just an IPv6 in the "00" range as "a600" is just the first prefix from my /56 from my upstream ISP router.

The "0/0" I selected for my LAN, is the "eb" or "a6eb"
Btw : 2a01:cb19:dead:beef:a6eb:92ec:77ff:fe29:392c/64 is my auto assigned / attributed IPv6 for the pfSense LAN interface.
( why can't I chose 2a01:cb19:dead:beef:a6eb::1/64 ?? )

@artafinde said in IPv6 connectivity NAT:

v6/t6: ::10.10.10.1/128

Dono what it is.
When I see 10.10.10.1 I think about pfBockerng as that is the default Ipv4 it used for the totally useless DNSBL web server. Its .. not sure ... converted into something that looks and smells as an IPv6 by addding :: in front of it. I'm not sure.

My advise : need answers ? Ask question !
With pfSense, to no surprise, you do this by activating this :
System > Advanced > Networking

so from now on the dhcp6c client, the process that gets an IPv6 for WAN, and prefixe(s).
The answers are shown in the DHCP log.

@artafinde said in IPv6 connectivity NAT:

The radvd.conf is like below so it complains about prefix ::a0a:a01/128 ?

of course. That line is wrong. radvd agrees with me. "::a0a:a01/128" is ::10.10.10.1 in hex.
Get a real prefix if possible, and everything starts working.

I have installed the system patches package and activated all the patches ?

Lets see what the dhpc6c client log tells us.

@artafinde said in IPv6 connectivity NAT:

Internally the workstation it getting IPv4 normally and everything works on that but tcan't figure out the IPv6 settings. Do i need to run DHCP6 or can relay that ? Has anyone a similar setup and got it working?

DHCP is for "IPv4" lease handling.
DHCP6C is for a WAN IPv6 'lease' handling, and, if need, it will also handle the request for a, one, or more prefix(s).

Some magic words :

Hyperoptic IPv6 pfSense

No AI here, just click on the link.

The very first link, you'll see this :

and there you go : it looks nice and all that, but there error or misconception there.

IMHO : there is no prefix id for the WAN interface.
pfSense has a WAN right ? This WAN interface is like every other device connected to your ISP equipment. So pfSense does what every other device (phone, pad, Windows PC, whatever) does : it ask for an IPv6/128 and bingo, connected. Done.

But pfSense, unlike all your other devices, is a router.
So it has one, ore more LAN's.
The new DHCP6 role now is : it should also ask for a so called "prefix". It will do so if you set at least one of the pfSense LANs to "IPv6 tracking"

As in my IPv6 settings, you might say that prefix "00" :

is used for the pfSense WAN - my "00" is the prefix used on the ISP equipment LAN (thus pfSense WAN IPv6)
My pfSense also asked for a (1) prefix, to be used on my LAN :

so under the LAN settings I had to set :

and I obtained prefix number "eb". ( Why not "01" ? )

and that part shows my big issue with Orange (ISP) in France : whatever I do, my ISP DHCP6 server in the Orange ISP box will only grant my pfSense with "1" one prefix, whatever I do. It's a know bug. It has a /56 or 256 prefixes, and it only gives me one.
When I set up a second pfSense LAN to tracking, so it will ask for a second prefix, my entire IPv6 setup breaks. I guess its time to go to Paris and burn thing down again.

Btw : I can see in my box that my one and only IPS Box LAN device = pfSEnse has asked for a prefix. Do you have the same info ? It tells me that the DHCP6c pfSense request for a prefix was received, understood, accepted, and granted.