Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    2.1 with IPv6 Tunnel, HELP?

    Scheduled Pinned Locked Moved IPv6
    37 Posts 4 Posters 11.8k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • D
      doktornotor Banned
      last edited by

      There is no such generic problem for sure. Don't think this is heading anywhere. Do a factory reset, don't think the box configuration is in a sane state.

      1 Reply Last reply Reply Quote 0
      • M
        mevans336
        last edited by

        @doktornotor:

        There is no such generic problem for sure. Don't think this is heading anywhere. Do a factory reset, don't think the box configuration is in a sane state.

        The box is in a fine state. I'm looking through the PHP file now. If I can't figure out where the error is in the PHP file I'll just open a support case. We have 5 hours we haven't used.

        1 Reply Last reply Reply Quote 0
        • D
          doktornotor Banned
          last edited by

          Well, as your wish. I have this working on about 10 boxes incl. /48 and multiple /64 subnets on multiple interfaces , I'd sure like hell notice if there was a generic bug making this to not work.

          1 Reply Last reply Reply Quote 0
          • M
            mevans336
            last edited by

            @doktornotor:

            Well, as your wish. I have this working on about 10 boxes incl. /48 and multiple /64 subnets on multiple interfaces , I'd sure like hell notice if there was a generic bug making this to not work.

            I'm not doubting you have this working on 10 boxes. I've gotten it working multiple times in the past as well. But have you set this up from scratch on 10 new 2.1 boxes? 2.1 was just released 17 hours ago …

            http://blog.pfsense.org/?p=718

            1 Reply Last reply Reply Quote 0
            • D
              doktornotor Banned
              last edited by

              All of them are running 2.1, and have been running the snapshots for quite some time.

              1 Reply Last reply Reply Quote 0
              • M
                mevans336
                last edited by

                @doktornotor:

                All of them are running 2.1, and have been running the snapshots for quite some time.

                The release candidates and the final could have had code changes. Regardless, I've opened a ticket. Hopefully this can be resolved. It seems eerily similar to the thread I linked, especially since if I type the command manually into an SSH shell, it works. If my overall box config were borked, the correct command should fail.

                EDIT:

                Thank you for your help however and also for the link to the how-to. That is a much clearer how-to, the arrows pointing from the HE fields to the pfSense fields make it very easy to follow. I've bookmarked it for future use.

                1 Reply Last reply Reply Quote 0
                • D
                  doktornotor Banned
                  last edited by

                  On a final note here: have you enabled IPv6 at all? It's disabled by default on upgrade from 2.0.x to the 2.1 release.

                  1 Reply Last reply Reply Quote 0
                  • M
                    mevans336
                    last edited by

                    @doktornotor:

                    On a final note here: have you enabled IPv6 at all? It's disabled by default on upgrade from 2.0.x to the 2.1 release.

                    Damn, I thought you were on to something. "Allow IPv6" was not checked and I did in fact upgrade from 2.0.3 to 2.1. I checked it and tried to add the GIF interface but was met with the same error.

                    Should I enable it somewhere else?

                    1 Reply Last reply Reply Quote 0
                    • D
                      doktornotor Banned
                      last edited by

                      Did you reboot before trying to do anything else? On another note, no idea what got (mis)saved/(mis)configured when you've been trying to add IPv6-related stuff with IPv6 disabled… Leaving this for support, for me reconfiguring the thing from scratch would be faster than messing with box in unknown state.

                      1 Reply Last reply Reply Quote 0
                      • M
                        mevans336
                        last edited by

                        @doktornotor:

                        Did you reboot before trying to do anything else? On another note, no idea what got (mis)saved/(mis)configured when you've been trying to add IPv6-related stuff with IPv6 disabled… Leaving this for support, for me reconfiguring the thing from scratch would be faster than messing with box in unknown state.

                        Great news.

                        Checking "Allow IPv6" has allowed me to figure out what the problem is.

                        It's definitely a problem with the GIF GUI interface on 2.1.

                        If I try to add a GIF interface via the web GUI, I'm met with that error and it's not actually added. (Even after checking "Allow IPv6")

                        If I manually type the command:

                        [2.1-RELEASE][admin@xxx.xxx.xxx]/root(1): /sbin/ifconfig gif0 inet6 2001:470:7:bfd::2 2001:470:7:bfd::1 prefixlen /64

                        … I am able to add the OPT interface, gateway, and everything works.

                        It seems like something in 2.1 is not prefixing a / to the subnet, like the previous thread I linked to.

                        Thanks doktornotor, I can proceed and play around with IPv6 while awaiting an official response from support to see if it's something unique to my config, or an actual problem with the 2.1 release.

                        1 Reply Last reply Reply Quote 0
                        • M
                          mevans336
                          last edited by

                          FYI, after typing the correct command into an SSH window, the IPv6 tunnel is up and I can ping ipv6.google.com via the WAN port successfully.

                          Ping output:
                          PING6(56=40+8+8 bytes) 2001:470:7:bfd::2 –> 2607:f8b0:4004:801::1011
                          16 bytes from 2607:f8b0:4004:801::1011, icmp_seq=0 hlim=59 time=10.487 ms
                          16 bytes from 2607:f8b0:4004:801::1011, icmp_seq=1 hlim=59 time=10.293 ms
                          16 bytes from 2607:f8b0:4004:801::1011, icmp_seq=2 hlim=59 time=14.126 ms

                          --- ipv6.l.google.com ping6 statistics ---
                          3 packets transmitted, 3 packets received, 0.0% packet loss
                          round-trip min/avg/max/std-dev = 10.293/11.635/14.126/1.763 ms

                          Doesn't look like there is IPv6 support for AON however, so ultimately I might be out of luck.

                          1 Reply Last reply Reply Quote 0
                          • K
                            kejianshi
                            last edited by

                            OK - I'll bite…  AON?

                            1 Reply Last reply Reply Quote 0
                            • K
                              kejianshi
                              last edited by

                              OHHHHHHHH - THAT AON!

                              ::)

                              Why?????

                              1 Reply Last reply Reply Quote 0
                              • M
                                mevans336
                                last edited by

                                For traffic to flow from my LAN clients to the Internet, an additional LAN rule needs to be created for IPv6, as noted in one of doktornotor's links.

                                However, his link leaves out a few steps that the official how-to doesn't, so I'm going to submit an update to the official how-to and hopefully combine the two.

                                So, in a nutshell, everything is now working - as long as I manually add the / via an SSH command so I'm going to keep my support ticket open.

                                Thanks for the help everyone.

                                ![9-15-2013 11-20-02 PM.jpg](/public/imported_attachments/1/9-15-2013 11-20-02 PM.jpg)
                                ![9-15-2013 11-20-02 PM.jpg_thumb](/public/imported_attachments/1/9-15-2013 11-20-02 PM.jpg_thumb)

                                1 Reply Last reply Reply Quote 0
                                • M
                                  mevans336
                                  last edited by

                                  @kejianshi:

                                  OHHHHHHHH - THAT AON!

                                  ::)

                                  Why?????

                                  I have my normal WAN connection, but I also keep a nailed-up OpenVPN connection to StrongVPN. I can dynamically route traffic either out via my ISP or via StrongVPN by simply manipulating a LAN firewall rule. For this to work you have to use AON.

                                  EDIT:

                                  Why would I do this? My ISP has issues with SIP, so I route my SIP phone over the StrongVPN connection. It's just a tunnel via OpenVPN to bypass my ISPs SIP issues.

                                  Of course, I can also use it when I'd rather have the StrongVPN IP appear as my source IP rather than my ISPs IP. ;)

                                  1 Reply Last reply Reply Quote 0
                                  • D
                                    doktornotor Banned
                                    last edited by

                                    Uhm… considering this is the only mention of IPv6 anywhere on their site, don't see what's the plan there.

                                    1 Reply Last reply Reply Quote 0
                                    • M
                                      mevans336
                                      last edited by

                                      @doktornotor:

                                      Uhm… considering this is the only mention of IPv6 anywhere on their site, don't see what's the plan there.

                                      I don't use them for IPv6, I only route IPv4 over them.

                                      Basically, they are another gateway, just like Tunnelbroker. So I have 3 gateways - my ISP, StrongVPN, and now HE.net (Tunnelbroker).

                                      1 Reply Last reply Reply Quote 0
                                      • D
                                        doktornotor Banned
                                        last edited by

                                        Yes… so what's the IPv6 NAT for?

                                        1 Reply Last reply Reply Quote 0
                                        • M
                                          mevans336
                                          last edited by

                                          @doktornotor:

                                          Yes… so what's the IPv6 NAT for?

                                          Do you mean my previous question about IPv6 and AON?

                                          1 Reply Last reply Reply Quote 0
                                          • D
                                            doktornotor Banned
                                            last edited by

                                            Well, you mentioned you need IPv6 NAT on this thread as well…

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.