PfSense - Hurricane Electric - Tunnel Broker Setup
-
In System: Gateways: Edit gateway > gateway, I have no IP. Its set to dynamic
In my HE IPV6 interface, I have none and none for my IPv4 and IPV6 configuration.
I'm still interested to know… Is the client IP at the HE website the same as your current WAN IP?
-
In System: Gateways: Edit gateway > gateway, I have no IP. Its set to dynamic
In my HE IPV6 interface, I have none and none for my IPv4 and IPV6 configuration.
I'm still interested to know… Is the client IP at the HE website the same as your current WAN IP?
Yes, the HE client ipv4 address is my WAN ipv4 address.
-
Reboot and see if things change/
-
-
Mine is also a /48 - Never did a /64
I also have RADVD configured.
-
You still can't set the gateway to 2001:470:1f0e:d8e::1 ?
If not something is confused. Maybe delete the IPv6 interface and reconfig it or maybe restart.
-
Mine is also a /48 - Never did a /64
I also have RADVD configured.
I think it's automatic. I have a /64 I'm not using and can't give back. I figure he might as well config a /48 from the get-go. It don't cost nothin'.
-
Hmm. I can't create a gateway for my ::3. Same error. Time to do a little github diffing. The only address the gui will take is ::2, which is my interface address.
-
You still can't set the gateway to 2001:470:1f0e:d8e::1 ?
If not something is confused. Maybe delete the IPv6 interface and reconfig it or maybe restart.
no same error as before…
-
Hmm. I can't create a gateway for my ::3. Same error. Time to do a little github diffing. The only address the gui will take is ::2, which is my interface address.
ok, I have to get some sleep now. if you have some new ideas, shoot them over and I will try in the morning.
thanks for everyones time!
-
Roger that. If I had more public IPs I'd get another tunnel. I think there might be something wrong with that IPv6 gateway config page and its logic in determining the subnet of the interface. Not sure yet.
-
There are a few possibilities. Who is your ISP?
I am looking this over.
-
My IPv6 interface is 2001:470:x:67::2/64
My IPv6 Gateway is 2001:470:x:67::1
If I try to define another gateway of 2001:470:x:67::3 I get:
The following input errors were detected:
The gateway address 2001:470:x:67::3 does not lie within one of the chosen interface's subnets.
-
I think that his initial setup was 100% completely correct…
I think I had to click "disable this gateway" on the HEIPV6TUNNELV4 before mine would work though.
I didn't need to configure static IPV6 on the interface you talked about earlier
Also leaving the HEIPV6TUNNELV6 gateway set to dynamic works great for me.
I'm also pretty sure you get only 1 gateway per 1 GIF interface and only 1 GIF interface per 1 IPV4 public IP. (perhaps its different if you pay, but I doubt it)
The only other difference between mine and his is that mine is a /48
I have 3 set up like this. All working.
-
If I try to define another gateway of 2001:470:x:67::3 I get:
Why? Really, follow the docs, that works: https://doc.pfsense.org/index.php/Using_IPv6_with_a_Tunnel_Broker#Set_Gateway
-
Yeah - Thats works for me. The only thing extra I had to do is disable that IPV4 gateway that appeared then all was well.
I have alot of additional settings to make this available to openvpn clients also, but nothing extra was required to get it working for the LAN interface.
-
Why? Really, follow the docs, that works: https://doc.pfsense.org/index.php/Using_IPv6_with_a_Tunnel_Broker#Set_Gateway
Dude. My tunnel's up and working fine. Why should defining another gateway on the subnet be rejected?
-
Uh? As said above, as far as the WAN is concerned, you get only 1 gateway per 1 GIF interface and only 1 GIF interface per 1 IPv4 public IP. The working setup is described at the link I posted and works no matter how many /64 subnets out of the /48 you are using on your pfSense box. If you insist on inventing broken setups, feel free, but that's not something I'm going to waste my time with.
If you are trying to set up static routes in order to route some /64 from another box, then apparently you are doing it wrong.
Again - why are you doing this and what are you trying to achieve?
-
The error:
The gateway address 2001:470:x:67::3 does not lie within one of the chosen interface's subnets.
Would have probably made more sense if it had said "Only 1 Gateway per Gif interface allowed" or something
Your local access (gateway) is defined in the gif interface. Your gateway has to match it. (::2)
-
Fuck you, dude.
Wonderful. May I ask why are you suggesting completely broken things to the OP here - such as messing with the dynamic GW, creating useless additional GWs or assigning static config to the OPT iface that has the GIF tunnnel on it - without actually being able to provide any reason for suggesting them in the first place? This is load of bollocks and it goes downhill from there on. No such nonsense is needed, and much more importantly is not wanted. It won't fix anything and will only results in completely broken setup.
