Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    2.1 with IPv6 Tunnel, HELP?

    Scheduled Pinned Locked Moved IPv6
    37 Posts 4 Posters 11.8k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • M
      mevans336
      last edited by

      I upgraded to 2.1 today without issue and have decided to play around with IPV6.

      First, my pfSense has 3 interfaces - WAN, LAN, and a virtual interface to StrongVPN (OpenVPN). I use Manual Outbound NAT so I can route LAN traffic various ways.

      When I configure my Tunnelbroker account according to the 2.1 how-to (https://doc.pfsense.org/index.php/Using_IPv6_on_2.1_with_a_Tunnel_Broker) I receive the following error and the gateway never comes up:

      php: /interfaces.php: The command '/sbin/route change -inet6 default '2001:470:7:bfd::1'' returned exit code '1', the output was 'route: writing to routing socket: Network is unreachable route: writing to routing socket: Network is unreachable change net default: gateway 2001:470:7:bfd::1: Network is unreachable'

      php: /interfaces.php: The command '/sbin/route change -inet6 default '2001:470:7:bfd::1'' returned exit code '1', the output was 'route: writing to routing socket: Network is unreachable route: writing to routing socket: Network is unreachable change net default: gateway 2001:470:7:bfd::1: Network is unreachable'

      I've tried switching the mask from /128 to /64 without any luck. I've had this working in the past on pfSense 2.0 and it always required a reboot, but this didn't work that time either.

      I'm thinking my OpenVPN connection to StrongVPN is probably mucking this up.

      Does anyone have any ideas or any assistance that doesn't involve ripping the OpenVPN connection out?

      1 Reply Last reply Reply Quote 0
      • D
        doktornotor Banned
        last edited by

        You got it misconfigured. HE IPv6 works absolutely fine on tons of boxes here. (On that note, /128 is completely wrong.)

        1 Reply Last reply Reply Quote 0
        • M
          mevans336
          last edited by

          @doktornotor:

          You got it misconfigured. HE IPv6 works absolutely fine on tons of boxes here. (On that note, /128 is completely wrong.)

          As I said, I've had this working before. The how-to notes /128 should be correct and if that doesn't work, try /64 - I've also tried /64 without success.

          I believe my OpenVPN interface to StrongVPN may be messing this up. However stopping it doesn't make a difference.

          1 Reply Last reply Reply Quote 0
          • K
            kejianshi
            last edited by

            Maybe there are some IPV6 related setting that didn't survive an update to 2.1 (assuming you just updated)

            1 Reply Last reply Reply Quote 0
            • M
              mevans336
              last edited by

              @kejianshi:

              Maybe there are some IPV6 related setting that didn't survive an update to 2.1 (assuming you just updated)

              This is a new IPV6 configuration. I've had this tunnel working in the past, but not at the same time as my StrongVPN connection. I've deleted the entire IPv6 config and I'm going to re-do it. If that fails, I'm going to rip out the StrongVPN configuration and see if that fixes it.

              1 Reply Last reply Reply Quote 0
              • K
                kejianshi
                last edited by

                doktornotor knows what he is talking about with IPV6 on these boxes.  I think its his favorite thing to play with.

                1 Reply Last reply Reply Quote 0
                • D
                  doktornotor Banned
                  last edited by

                  As said, tons of people using this. Wipe and redo from scratch. As noted, do NOT use /128. Never seen this howto, if you look at the other one, here's what it says:

                  If you use a /128 it will completely break your IPv6 & for me to get it fixed I had to restore a backup & redo all my IPv6 setup. You have been warned.

                  (On that note, this one is rather suboptimal as well, no such bridging mess required at all.)

                  1 Reply Last reply Reply Quote 0
                  • M
                    mevans336
                    last edited by

                    As soon as I try to add the GIF interface, I receive this error:

                    php: /interfaces_gif_edit.php: The command '/sbin/ifconfig gif0 inet6 2001:470:7:bfd::2 2001:470:7:bfd::1 prefixlen 64 ' returned exit code '1', the output was 'ifconfig: ioctl (SIOCAIFADDR): Invalid argument'

                    Same error as this guy perhaps?

                    http://forum.pfsense.org/index.php?topic=40377.0

                    1 Reply Last reply Reply Quote 0
                    • D
                      doktornotor Banned
                      last edited by

                      1/ Wipe everything IPv6 related, incl. the  GIF interface
                      2/ Reboot
                      3/ Follow this howto. I believe its about the most clear one out there.

                      Note: Your IPv4 must be pingable for the tunnel to work.

                      1 Reply Last reply Reply Quote 0
                      • M
                        mevans336
                        last edited by

                        @doktornotor:

                        1/ Wipe everything IPv6 related, incl. the  GIF interface
                        2/ Reboot
                        3/ Follow this howto. I believe its about the most clear one out there.

                        Note: Your IPv4 must be pingable for the tunnel to work.

                        My IPv4 is pingable. I tested it at GRC.

                        I did exactly as you instructed and as soon as I add the GIF interface, I receive this error:

                        php: /interfaces_gif_edit.php: The command '/sbin/ifconfig gif0 inet6 2001:470:7:bfd::2 2001:470:7:bfd::1 prefixlen 64 ' returned exit code '1', the output was 'ifconfig: ioctl (SIOCAIFADDR): Invalid argument'

                        If I SSH in and type the failing command, I get the same error:

                        [2.1-RELEASE][admin@xxx.xxx.xxx]/root(1): /sbin/ifconfig gif0 inet6 2001:470:7:bfd::2 2001:470:7:bfd::1 prefixlen 64
                        ifconfig: ioctl (SIOCAIFADDR): Invalid argument

                        If I add a / as in the thread I linked, the command works:

                        [2.1-RELEASE][admin@xxx.xxx.xxx]/root(2): /sbin/ifconfig gif0 inet6 2001:470:7:bfd::2 2001:470:7:bfd::1 prefixlen /64
                        [2.1-RELEASE][admin@xxx.xxx.xxx]/root(3):

                        I think this is a problem in the 2.1 release.

                        1 Reply Last reply Reply Quote 0
                        • D
                          doktornotor Banned
                          last edited by

                          There is no such generic problem for sure. Don't think this is heading anywhere. Do a factory reset, don't think the box configuration is in a sane state.

                          1 Reply Last reply Reply Quote 0
                          • M
                            mevans336
                            last edited by

                            @doktornotor:

                            There is no such generic problem for sure. Don't think this is heading anywhere. Do a factory reset, don't think the box configuration is in a sane state.

                            The box is in a fine state. I'm looking through the PHP file now. If I can't figure out where the error is in the PHP file I'll just open a support case. We have 5 hours we haven't used.

                            1 Reply Last reply Reply Quote 0
                            • D
                              doktornotor Banned
                              last edited by

                              Well, as your wish. I have this working on about 10 boxes incl. /48 and multiple /64 subnets on multiple interfaces , I'd sure like hell notice if there was a generic bug making this to not work.

                              1 Reply Last reply Reply Quote 0
                              • M
                                mevans336
                                last edited by

                                @doktornotor:

                                Well, as your wish. I have this working on about 10 boxes incl. /48 and multiple /64 subnets on multiple interfaces , I'd sure like hell notice if there was a generic bug making this to not work.

                                I'm not doubting you have this working on 10 boxes. I've gotten it working multiple times in the past as well. But have you set this up from scratch on 10 new 2.1 boxes? 2.1 was just released 17 hours ago …

                                http://blog.pfsense.org/?p=718

                                1 Reply Last reply Reply Quote 0
                                • D
                                  doktornotor Banned
                                  last edited by

                                  All of them are running 2.1, and have been running the snapshots for quite some time.

                                  1 Reply Last reply Reply Quote 0
                                  • M
                                    mevans336
                                    last edited by

                                    @doktornotor:

                                    All of them are running 2.1, and have been running the snapshots for quite some time.

                                    The release candidates and the final could have had code changes. Regardless, I've opened a ticket. Hopefully this can be resolved. It seems eerily similar to the thread I linked, especially since if I type the command manually into an SSH shell, it works. If my overall box config were borked, the correct command should fail.

                                    EDIT:

                                    Thank you for your help however and also for the link to the how-to. That is a much clearer how-to, the arrows pointing from the HE fields to the pfSense fields make it very easy to follow. I've bookmarked it for future use.

                                    1 Reply Last reply Reply Quote 0
                                    • D
                                      doktornotor Banned
                                      last edited by

                                      On a final note here: have you enabled IPv6 at all? It's disabled by default on upgrade from 2.0.x to the 2.1 release.

                                      1 Reply Last reply Reply Quote 0
                                      • M
                                        mevans336
                                        last edited by

                                        @doktornotor:

                                        On a final note here: have you enabled IPv6 at all? It's disabled by default on upgrade from 2.0.x to the 2.1 release.

                                        Damn, I thought you were on to something. "Allow IPv6" was not checked and I did in fact upgrade from 2.0.3 to 2.1. I checked it and tried to add the GIF interface but was met with the same error.

                                        Should I enable it somewhere else?

                                        1 Reply Last reply Reply Quote 0
                                        • D
                                          doktornotor Banned
                                          last edited by

                                          Did you reboot before trying to do anything else? On another note, no idea what got (mis)saved/(mis)configured when you've been trying to add IPv6-related stuff with IPv6 disabled… Leaving this for support, for me reconfiguring the thing from scratch would be faster than messing with box in unknown state.

                                          1 Reply Last reply Reply Quote 0
                                          • M
                                            mevans336
                                            last edited by

                                            @doktornotor:

                                            Did you reboot before trying to do anything else? On another note, no idea what got (mis)saved/(mis)configured when you've been trying to add IPv6-related stuff with IPv6 disabled… Leaving this for support, for me reconfiguring the thing from scratch would be faster than messing with box in unknown state.

                                            Great news.

                                            Checking "Allow IPv6" has allowed me to figure out what the problem is.

                                            It's definitely a problem with the GIF GUI interface on 2.1.

                                            If I try to add a GIF interface via the web GUI, I'm met with that error and it's not actually added. (Even after checking "Allow IPv6")

                                            If I manually type the command:

                                            [2.1-RELEASE][admin@xxx.xxx.xxx]/root(1): /sbin/ifconfig gif0 inet6 2001:470:7:bfd::2 2001:470:7:bfd::1 prefixlen /64

                                            … I am able to add the OPT interface, gateway, and everything works.

                                            It seems like something in 2.1 is not prefixing a / to the subnet, like the previous thread I linked to.

                                            Thanks doktornotor, I can proceed and play around with IPv6 while awaiting an official response from support to see if it's something unique to my config, or an actual problem with the 2.1 release.

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.