Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    IPv6 cannot connect to Internet

    Scheduled Pinned Locked Moved IPv6
    28 Posts 6 Posters 1.1k Views 4 Watching
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • GertjanG Online
      Gertjan @crazypotato142
      last edited by Gertjan

      @crazypotato142

      How is your WAN IPv6 set up ?
      Like :

      282b3d49-4825-4ea9-a841-0a4c516ea3c8-image.png

      Check : Status > Interfaces
      Did you WAN got an IPv6/128 to work with ?
      and way more important : did you get a /64 "prefix" that you've assigned to LAN (using tracking) ?

      ad1ea978-1aba-460a-aa3f-9b4af85f1fff-image.png

      Did you set up the DHCPv6 server on LAN, and does it show this IPV6 prefix assigned to you by the upstream ISP router or ISP "upstream" ?
      Like :

      a1fd31f4-e23d-42d2-ae72-6602a73bb71e-image.png

      Another check : did you LAN device got an DHCPv6 lease ?
      Liken, example (a Windows device, type ipconfig /all) :

      3cede636-4b01-44ce-a790-71e3fe0a89dc-image.png

      No "help me" PM's please. Use the forum, the community will thank you.
      Edit : and where are the logs ??

      crazypotato142C 1 Reply Last reply Reply Quote 0
      • crazypotato142C Offline
        crazypotato142 @Gertjan
        last edited by crazypotato142

        That's my WAN:

        8e8a8dd1-b3d4-417c-9519-6d09e2ed3601-image.png

        Yes, i get IPv6. Here's the status page:

        05c78b9a-bebe-4bf3-9dda-6d536d995b43-image.png

        Yes, I set up DHCPv6. It shows the prefix.

        91cebf5a-ac4c-4777-a918-0972597a682d-image.png

        And yes, also my device gets an IP with that prefix:

        96fdb24e-ec74-4efc-8c3e-6d2ee73cfa82-image.png

        As I mentioned, I don't think there is a problem on my configuration of DHCP. It just blocks IPv6 traffic.

        GertjanG Bob.DigB 3 Replies Last reply Reply Quote 0
        • GertjanG Online
          Gertjan @crazypotato142
          last edited by

          @crazypotato142

          Humm, then I don't know what to think.
          Consider my first 3 LAN rules as "don't care", look at my 4 & 5 rules :

          92e26798-114d-444f-b6ed-e0e3eec97378-image.png

          The last rules is my own 'block all'.

          No "help me" PM's please. Use the forum, the community will thank you.
          Edit : and where are the logs ??

          crazypotato142C 1 Reply Last reply Reply Quote 0
          • crazypotato142C Offline
            crazypotato142 @Gertjan
            last edited by

            @Gertjan
            It's very interesting it started to do so out of nowhere.

            I have these 2 rules as well, you can see on the first post.

            On logs it says it is being blocked by a default deny rule but i have no clue what and where it is.

            1 Reply Last reply Reply Quote 0
            • Bob.DigB Offline
              Bob.Dig LAYER 8 @crazypotato142
              last edited by Bob.Dig

              @crazypotato142 said in All IPv6 traffic is being blocked:

              And yes, also my device gets an IP with that prefix:

              Show them completely or do you have static IPv6. That Windows is showing three preferred "IPv6-Addresses" alone shows that here is a problem. Often though the problem is with pfSense itself and you might not be able to fix it. There were already two prefix-changes from your ISP but your Windows doesn't know about those and that is most probably on pfSense.
              If the problem is persistent for you, you could deploy ULA on your LAN and then do NPt (tracked from an unused VLAN). That has the benefit that for Windows, the prefix never changes because it only knows about the ULA.

              Screenshot 2025-09-29 172125.png

              In my example, the ULA-prefix is from my LAN and the tracked prefix is from a VLAN named "TRACK1WAN1".

              crazypotato142C 1 Reply Last reply Reply Quote 0
              • crazypotato142C Offline
                crazypotato142 @Bob.Dig
                last edited by

                @Bob.Dig
                No, my IPv6 is not static. They came out when I restarted my WAN multiple times while tryna fix it today. And one seems "Deprecated" right now.

                Will NPt really fix it? Because I clearly can see that pfSense blocks whatever I do on my Firewall Logs.

                Bob.DigB 1 Reply Last reply Reply Quote 0
                • Bob.DigB Offline
                  Bob.Dig LAYER 8 @crazypotato142
                  last edited by Bob.Dig

                  @crazypotato142 said in All IPv6 traffic is being blocked:

                  Because I clearly can see that pfSense blocks whatever

                  It blocks is probably because it knows that those prefixes are not valid anymore but your Windows doesn't know and still uses those. So the answer is yes.
                  My prefix is changing daily so I know a thing about this. 😉

                  JKnottJ 1 Reply Last reply Reply Quote 0
                  • JKnottJ Offline
                    JKnott @Bob.Dig
                    last edited by

                    @Bob.Dig said in All IPv6 traffic is being blocked:

                    It blocks is probably because it knows that those prefixes are not valid anymore but your Windows doesn't know and still uses those. So the answer is yes.
                    My prefix is changing daily so I know a thing about this.

                    I had thought about that too. He could capture the DHCP6 sequence to see if the assigned prefix is what the Windows computers are using.

                    PfSense running on Qotom mini PC
                    i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel 1 Gb Ethernet ports.
                    UniFi AC-Lite access point

                    I haven't lost my mind. It's around here...somewhere...

                    S 1 Reply Last reply Reply Quote 0
                    • S Offline
                      SteveITS Rebel Alliance @JKnott
                      last edited by

                      "ipconfig /all" will show a list:

                      Ethernet adapter Connection Name:
                      (...)
                      IPv6 Address. . . . . . . . . . . : 2603:300a:***:34b(Preferred)
                        Temporary IPv6 Address. . . . . . : 2603:300a:***:8b18(Preferred)
                      

                      I've seen my PC have 10-15 or so, and yes if it changes the old ones have to die off or be removed so Windows will start using the newer ones.

                      netsh interface ipv6 delete address interface="Connection Name" IPV6HERE
                      

                      We have a semi-related issue where the prefix changes when Comcast updates our modem but ISC DHCP apparently won't honor "deny unknown clients" for IPv6 and I haven't had a chance to try Kea again after hours. So I've been updating our routers manually, and (my point is) we use a relatively short lease time. But I digress...

                      Only install packages for your version, or risk breaking it. Select your branch in System/Update/Update Settings.
                      When upgrading, allow 10-15 minutes to reboot, or more depending on packages, and device or disk speed.
                      Upvote 👍 helpful posts!

                      crazypotato142C 1 Reply Last reply Reply Quote 0
                      • crazypotato142C Offline
                        crazypotato142 @SteveITS
                        last edited by

                        When I checked again all IPv6 addressed were deprecated. I restarted the NIC and now it has a single IP matches with the prefix on pfSense. There is no blocking on logs but it still doesn't connect anywhere over IPv6.

                        I'm just asking to understand the process: Shouldn't it work this way if it's the thing you guys told about? @Bob.Dig @JKnott

                        Bob.DigB JKnottJ 2 Replies Last reply Reply Quote 0
                        • GertjanG Online
                          Gertjan @crazypotato142
                          last edited by Gertjan

                          @crazypotato142

                          If you use / stick with DHCPv6 (server) you can use this :

                          af98d4c3-da23-4ca4-b3bc-4e292ccda79d-image.png

                          to make a 'static DHCPv6 lease" :

                          760a7d8f-726c-4059-acce-8ada4965ee11-image.png

                          and from then on, that PC will only get the (one) ::cc IPv6, with the current prefix prepended.

                          Btw : my ISP IPV6 prefix, used for my LAN, rarely change.

                          @crazypotato142 said in All IPv6 traffic is being blocked:

                          again all IPv6 addressed were deprecated. I restarted the NIC

                          Not needed.
                          Type :

                          ipconfig /renew6
                          

                          @crazypotato142 said in All IPv6 traffic is being blocked:

                          Shouldn't it work this way if it's the thing you guys told about?

                          Sure. Just keep in mind : On paper, IPv6 is ready, well defined, and should work well.
                          The thing is, there are probably a couple of ISPs (the ISP, the upstream router etc) out there that do respect fully the IPv6 guide lines (RFCs). The other 99,9 % make a mess out of it - doing their own 'things'.
                          Even pfSense isn't probably 'perfect'.

                          The thing is : 99,+ % clients of all IPSs in the world have just one local LAN after their ISP router.
                          So pfSense as a LAN device of this ISP router like any other device in this ISP LAN, has to obtain a IPv6 in this ISP LAN. This part works pretty well.
                          What is fare more rare : pfSense isn't a 'normal' end device. It's a router, and has its own 'sub' LAN or LANs.
                          So it has to ask 'prefixes', these are blocks /64 or ::1 to ::fffff:ffff:ffff:ffff, for every LAN pfSense has. That part is less well tested, less well implemented. And it all starts with : less well understood.

                          No "help me" PM's please. Use the forum, the community will thank you.
                          Edit : and where are the logs ??

                          1 Reply Last reply Reply Quote 0
                          • Bob.DigB Offline
                            Bob.Dig LAYER 8 @crazypotato142
                            last edited by

                            @crazypotato142 said in All IPv6 traffic is being blocked:

                            Shouldn't it work this way

                            Yes. So you might (also) have different problems.

                            1 Reply Last reply Reply Quote 0
                            • JKnottJ Offline
                              JKnott @crazypotato142
                              last edited by

                              @crazypotato142 said in All IPv6 traffic is being blocked:

                              I'm just asking to understand the process: Shouldn't it work this way if it's the thing you guys told about?

                              My prefix hasn't changed in almost 7 years, so I don't have much experience to work from. However, I would expect the pfSense LAN interface to show the new prefix and the router advertisements should tell other devices on the LAN what the new prefix is.

                              PfSense running on Qotom mini PC
                              i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel 1 Gb Ethernet ports.
                              UniFi AC-Lite access point

                              I haven't lost my mind. It's around here...somewhere...

                              crazypotato142C 1 Reply Last reply Reply Quote 0
                              • crazypotato142C Offline
                                crazypotato142 @JKnott
                                last edited by

                                I don't know, I still don't think it's a prefix problem because I used it as it is for a long time without a single problem and now I simply can't connect to the internet with it.

                                But I can't see any problem on my settings and my ISP says there's nothing wrong on their side either. I'll just turn my IPv6 network completely off until I figured it out because it really causes my network go crazy.

                                Do you have any recommendations to check or solve?

                                Bob.DigB JKnottJ 2 Replies Last reply Reply Quote 0
                                • Bob.DigB Offline
                                  Bob.Dig LAYER 8 @crazypotato142
                                  last edited by

                                  @crazypotato142 Check the IPv6-addresses closely, are they really using the same prefix or do they differ. It must be the same prefix as pfSense LAN has.

                                  In Windows use ipconfig /release6 and then ipconfig /renew6 and watch out for problems.

                                  crazypotato142C 1 Reply Last reply Reply Quote 0
                                  • crazypotato142C Offline
                                    crazypotato142 @Bob.Dig
                                    last edited by crazypotato142

                                    @Bob.Dig They are like this right now:

                                    Photos deleted for privacy

                                    Note: I can't ping an IPv6 address over pFsense interface either.

                                    Bob.DigB 1 Reply Last reply Reply Quote 0
                                    • Bob.DigB Offline
                                      Bob.Dig LAYER 8 @crazypotato142
                                      last edited by

                                      @crazypotato142 The first address already looks wrong. At least the prefix is the same.

                                      crazypotato142C 1 Reply Last reply Reply Quote 0
                                      • crazypotato142C Offline
                                        crazypotato142 @Bob.Dig
                                        last edited by

                                        @Bob.Dig
                                        pFsense itself can't connect to anything over IPv6 either. I can't use IPv6 ping, not even get into the Update page cuz Netgate has IPv6 addresses for their website.

                                        Bob.DigB JKnottJ 2 Replies Last reply Reply Quote 0
                                        • Bob.DigB Offline
                                          Bob.Dig LAYER 8 @crazypotato142
                                          last edited by

                                          @crazypotato142 said in IPv6 cannot connect to Internet:

                                          pFsense itself can't connect to anything over IPv6 either.

                                          That screams for a big problem, might be your ISP at this point.

                                          crazypotato142C 1 Reply Last reply Reply Quote 0
                                          • crazypotato142C Offline
                                            crazypotato142 @Bob.Dig
                                            last edited by

                                            I'll test it with their default router and keep here updated. Thank everyone for the help.

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.