Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    How To: Setup IPv6 with Comcast - Full Internet connectivity

    Scheduled Pinned Locked Moved IPv6
    15 Posts 9 Posters 58.4k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • P
      priller
      last edited by

      @pfSense2User:

      9. Go to Firewall > Rules and create a new rule by clicking the + button to make a rule for the WAN interface

      The following must be entered:

      
      Proto    Src Prt Dst Prt GW Queue
      IPv6/UDP * 547 * 546 * none
      
      

      No need to manually enter that rule, it's already a built-in default rule.

      /etc/inc/filter.inc

      pass in quick on \${$oc['descr']} proto udp from any port = 547 to any port = 546 label "{$fix_rule_label("allow dhcpv6 client in {$oc['descr']}")}"
      

      pfctl -sr

      pass in quick on igb3 proto udp from any port = dhcpv6-server to any port = dhcpv6-client keep state label "allow dhcpv6 client in WAN"
      pass out quick on igb3 proto udp from any port = dhcpv6-client to any port = dhcpv6-server keep state label "allow dhcpv6 client out WAN"
      

      If been running Comcast IPv6 for about a year now without any special fw rules defined.

      1 Reply Last reply Reply Quote 0
      • D
        Doktor Jones
        last edited by

        Comcast apparently just rolled out IPv6 in my area, as I discovered that my pfSense box had picked up an IPv6 address on its WAN that it hadn't had last week. I followed the steps here to make sure everything was configured right; I see IPv6 addresses on my WAN and LAN interfaces, as well as on my laptop, yet my devices don't seem to have IPv6 connectivity.

        My WAN shows an address beginning with 2001:, my LAN and devices show addresses beginning with 2601:, and I have DNS servers of 2001:558:feed::1 and 2001:558:feed::2. From my laptop, an ifconfig en1 | grep inet6 yields the following:
        inet6 2601:AAAA:BBBB:CCCC:XXXX:XXXX:XXXX:XXXX prefixlen 64 autoconf
        inet6 2601:AAAA:BBBB:CCCC:YYYY:YYYY:YYYY:YYYY prefixlen 64 autoconf temporary
        (in addition to the link-local address) where the "AAAA:BBBB:CCCC" parts are the same across the two (but not those literal hexadecimal digits) and the rest differs between them.

        When I try to ping the DNS servers (i.e. ping6 2001:558:feed::1) from my laptop it just times out. If I run the ping from pfsense I get replies. I also can't ping the WAN's 2001: address or the WLAN's 2601: address, so it seems the problem is that my laptop can't talk to the router over IPv6. Strangely, if I do "ping6 ipv6.google.com", it resolves:
        PING6(56=40+8+8 bytes) 2601:AAAA:BBBB:CCCC:YYYY:YYYY:YYYY:YYYY –> 2607:f8b0:4006:802::1002
        (yes, it seems to be using the "temporary" address – is that normal?) but still times out.

        Here are screenshots of my configuration. I entirely disabled and re-enabled the WAN interface after making changes, as well as releasing/renewing in Status>Interfaces, but can't get my laptop to connect. I also made sure "Allow IPv6" was enabled under "System>Advanced>Networking". What am I missing?

        (P.S.: I'm running 2.1.2-RELEASE (amd64) / nanobsd (1g) if it makes a difference)

        pfsense_config.jpg_thumb
        pfsense_config.jpg

        1 Reply Last reply Reply Quote 0
        • K
          kpa
          last edited by

          Sounds like you're only getting the stateless autoconfig (SLAAC) addresses for the pfSense WAN.  If you want IPv6 connectivity for your LAN you'll also need a routed /64 prefix from your ISP that is a distinct subnet from this 2601:AAAA:BBBB:CCCC::/64 subnet that is now on the WAN side of your pfSense system. You then use addresses from the routed /64 prefix on your LAN.

          1 Reply Last reply Reply Quote 0
          • R
            razzfazz
            last edited by

            He was saying that he has a 2601:: address on the LAN side (both pfSense and devices), so clearly address assignment works.

            1 Reply Last reply Reply Quote 0
            • R
              razzfazz
              last edited by

              @Doktor:

              My WAN shows an address beginning with 2001:, my LAN and devices show addresses beginning with 2601:, and I have DNS servers of 2001:558:feed::1 and 2001:558:feed::2. From my laptop, an ifconfig en1 | grep inet6 yields the following:
              inet6 2601:AAAA:BBBB:CCCC:XXXX:XXXX:XXXX:XXXX prefixlen 64 autoconf
              inet6 2601:AAAA:BBBB:CCCC:YYYY:YYYY:YYYY:YYYY prefixlen 64 autoconf temporary
              (in addition to the link-local address) where the "AAAA:BBBB:CCCC" parts are the same across the two (but not those literal hexadecimal digits) and the rest differs between them.

              All of that looks correct. What do your LAN clients show as gateway? (Should be fe80::1:1 on the respective interface.) Anything in the firewall logs on the pfSense box?

              1 Reply Last reply Reply Quote 0
              • K
                kpa
                last edited by

                Ok I re-read the question and it should work with those addresses. However, how are your LAN rules for IPv6 traffic?

                1 Reply Last reply Reply Quote 0
                • D
                  Doktor Jones
                  last edited by

                  The only block activity I'm seeing w/r/t IPv6 is the following:

                  WLANINT / [fe80::5e96:9dff:fe95:8781]:5353 / [ff02::fb]:5353 / UDP

                  which appears to be multicast DNS, and this is right after attempting a ping6. Of note, that does seem to be my laptop's link-local IPv6 address, but I'm not seeing any other IPv6 traffic getting blocked.

                  As far as rules go, I have a "IPv6 from WLANINT to any" rule set up; do I need anything beyond this?

                  1 Reply Last reply Reply Quote 0
                  • P
                    priller
                    last edited by

                    For IPv6 connectivity with Comcast DHCP-PD, this no need to add any rules whatsoever.  It will work "out of the box".

                    You do NOT need that udp 546/547 rule.  (see:  https://forum.pfsense.org/index.php?topic=75795.msg413493#msg413493 )

                    I would recommend getting ride of that rule and any other IPv6 rule you have configured and get back to a basic "plain vanilla" configuration.

                    ![base rules.jpg](/public/imported_attachments/1/base rules.jpg)
                    ![base rules.jpg_thumb](/public/imported_attachments/1/base rules.jpg_thumb)

                    1 Reply Last reply Reply Quote 0
                    • D
                      Doktor Jones
                      last edited by

                      Okay, I don't know if removing the UDP 546/547 rule fixed it, or if the problem is specifically with my wireless interface and/or Macbook; right now I'm at work and tunneled into my home network, and my Windows desktop (which is on a wired connection) has full IPv6 connectivity. I will report back tonight when I get home with more results. Specifically, I'll test with my Macbook on wireless, then on wired, and see if I get different results.

                      If it matters, my pfSense box has an Atheros ar9280 wireless card in it.

                      1 Reply Last reply Reply Quote 0
                      • D
                        Doktor Jones
                        last edited by

                        It looks like my Macbook has full IPv6 connectivity now :)

                        I've also changed my "DHCPv6 Prefix Delegation size" on the WAN interface to a /60 and enabled "Send IPv6 prefix hint", and set each of my three internal networks to a separate "IPv6 Prefix ID". Now my private WiFi systems are getting IPv6 addresses in one /64, LAN systems are getting IPv6 addresses in another, and my public WiFi systems are getting IPv6 addresses in a third.

                        Thanks!

                        1 Reply Last reply Reply Quote 0
                        • G
                          gmx048 Banned
                          last edited by

                          This post is deleted!
                          1 Reply Last reply Reply Quote 0
                          • GatewayofIPG
                            GatewayofIP Banned
                            last edited by

                            This post is deleted!
                            1 Reply Last reply Reply Quote 0
                            • JKnottJ
                              JKnott @pfSense2User
                              last edited by

                              This post is deleted!
                              1 Reply Last reply Reply Quote 0
                              • W
                                Waytorouterlogin Banned
                                last edited by

                                This post is deleted!
                                1 Reply Last reply Reply Quote 0
                                • First post
                                  Last post
                                Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.