Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    PfSense - Hurricane Electric - Tunnel Broker Setup

    Scheduled Pinned Locked Moved IPv6
    62 Posts 5 Posters 24.8k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • D
      doktornotor Banned
      last edited by

      @Derelict:

      If I try to define another gateway of 2001:470:x:67::3 I get:

      Why? Really, follow the docs, that works: https://doc.pfsense.org/index.php/Using_IPv6_with_a_Tunnel_Broker#Set_Gateway

      1 Reply Last reply Reply Quote 0
      • K
        kejianshi
        last edited by

        Yeah  - Thats works for me.  The only thing extra I had to do is disable that IPV4 gateway that appeared then all was well.

        I have alot of additional settings to make this available to openvpn clients also, but nothing extra was required to get it working for the LAN interface.

        1 Reply Last reply Reply Quote 0
        • DerelictD
          Derelict LAYER 8 Netgate
          last edited by

          Why? Really, follow the docs, that works: https://doc.pfsense.org/index.php/Using_IPv6_with_a_Tunnel_Broker#Set_Gateway

          Dude.  My tunnel's up and working fine.  Why should defining another gateway on the subnet be rejected?

          Chattanooga, Tennessee, USA
          A comprehensive network diagram is worth 10,000 words and 15 conference calls.
          DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
          Do Not Chat For Help! NO_WAN_EGRESS(TM)

          1 Reply Last reply Reply Quote 0
          • D
            doktornotor Banned
            last edited by

            Uh? As said above, as far as the WAN is concerned, you get only 1 gateway per 1 GIF interface and only 1 GIF interface per 1 IPv4 public IP. The working setup is described at the link I posted and works no matter how many /64 subnets out of the /48 you are using on your pfSense box. If you insist on inventing broken setups, feel free, but that's not something I'm going to waste my time with.

            If you are trying to set up static routes in order to route some /64 from another box, then apparently you are doing it wrong.

            Again - why are you doing this and what are you trying to achieve?

            1 Reply Last reply Reply Quote 0
            • K
              kejianshi
              last edited by

              The error:

              The gateway address 2001:470:x:67::3 does not lie within one of the chosen interface's subnets.

              Would have probably made more sense if it had said "Only 1 Gateway per Gif interface allowed" or something

              Your local access (gateway) is defined in the gif interface.  Your gateway has to match it.  (::2)

              1 Reply Last reply Reply Quote 0
              • D
                doktornotor Banned
                last edited by

                @Derelict:

                Fuck you, dude.

                Wonderful. May I ask why are you suggesting completely broken things to the OP here - such as messing with the dynamic GW, creating useless additional GWs or assigning static config to the OPT iface that has the GIF tunnnel on it - without actually being able to provide any reason for suggesting them in the first place? This is load of bollocks and it goes downhill from there on. No such nonsense is needed, and much more importantly is not wanted. It won't fix anything and will only results in completely broken setup.

                1 Reply Last reply Reply Quote 0
                • DerelictD
                  Derelict LAYER 8 Netgate
                  last edited by

                  Okay, OP.  Delete everything.  Do it again.  The docs are perfect.

                  Chattanooga, Tennessee, USA
                  A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                  DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                  Do Not Chat For Help! NO_WAN_EGRESS(TM)

                  1 Reply Last reply Reply Quote 0
                  • K
                    kejianshi
                    last edited by

                    Not perfect - I think he has to disable that auto-appearing useless IPV4 interface for this to work…

                    Other than that, yes.  That guide does work.

                    Doesn't mean the ISP isn't breaking GIF or blocking HEIPV6 or that the HE server wasn't having issues at the IPV4 address for HE he is using though.

                    There is still room for error beyond OPs control.

                    1 Reply Last reply Reply Quote 0
                    • D
                      doktornotor Banned
                      last edited by

                      The docs work. Both on 2.1.5 and 2.2. (The only thing they are missing on 2.2 is making the bogus additional IPv4 dynamic GW created no-op, but that does not affect the tunnel functionality at all.)

                      @OP: If you get "Offline" on the TunnelV6 GW when you goto Status > Gateways after you have edited the dynamic GW to make it default per the docs, simply reboot the pfSense box. This is the only thing needed and only needed once when you complete the initial tunnel set up.

                      If that still does not work, post relevant configuration screenshots here (OPT, GIF, GWs) and ifconfig output for the GIF tunnel interface.

                      P.S. And yes - delete everything and reboot before trying to follow the docs again.

                      1 Reply Last reply Reply Quote 0
                      • I
                        icemanncsu
                        last edited by

                        @kejianshi:

                        There are a few possibilities.  Who is your ISP?

                        I am looking this over.

                        AT&T Gigapower 1Gbps Symmetrical - Residential Service - NVG589 for the Gateway, not using their supplied IPv6 6rd services, they are all disabled in the residential gateway device (I disabled them).

                        I am using IP Passthrough to pfSense, no IPv6 is being pushed to pfSense since I disabled it.  I would highly doubt this would cause any trouble on pfSense trying to make a tunnel over IPv4 for IPv6 functionality.

                        1 Reply Last reply Reply Quote 0
                        • johnpozJ
                          johnpoz LAYER 8 Global Moderator
                          last edited by

                          "they are all disabled in the residential gateway device"

                          So your behind a nat?  Are you allowing ping to your ipv4 IP?  I can tell you for fact that guide in the docs work.  I don't recall any issues with it..

                          I have the /64 working on 1 segment and some of the /64s out of the /48 working on other segments without any problem.  They recently fixed gateway stuff so could disable the nonsense ipv4 that kept getting added.  But that was before the release of 2.2

                          he-elec-tunnel.png
                          he-elec-tunnel.png_thumb

                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                          If you get confused: Listen to the Music Play
                          Please don't Chat/PM me for help, unless mod related
                          SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                          1 Reply Last reply Reply Quote 0
                          • K
                            kejianshi
                            last edited by

                            IP Passthrough I hope is a non-technical term for bridged?

                            See - Thing is you CAN NAT a connection if it will pass Protocol 41

                            I have even enabled ICMP on a pfsense in the USA, use my USA pfsense IP and set up IPV6 on a second pfsense in manila because pfsense does pass that protocol.

                            However, thats the only way I've ever been able to get it to work behind NAT.  When pfsense was the 1st layer.

                            If you are using a NAT (Network Address Translation) appliance, please make sure it allows and forwards IP protocol 41.

                            What is IP Protocol 41?
                                IP Protocol 41 is one of the Internet Protocol numbers. Within the IPv4 header, the IPv4 Protocol field is set to 41 to indicate an encapsulated IPv6 packet.

                            So, my guess is your modem/router/ont whatever thingy might be killing protocol 41 or at minimum not passing it along.

                            That said, I'd do a fresh install and fresh config and try abit more before giving up.  Or check 1st device and see if its got setting relevant to protocol 41.

                            1 Reply Last reply Reply Quote 0
                            • I
                              icemanncsu
                              last edited by

                              So here is confirmation that AT&T has fucked me again!

                              http://forums.att.com/t5/Residential-Wi-Fi-Gateway/IPv6-Tunnels-broken-yet-again-this-time-on-the-NVG589-modem/td-p/3896665

                              Post number 9 in that thread. FUCK!

                              Thanks for all the help guys!

                              1 Reply Last reply Reply Quote 0
                              • johnpozJ
                                johnpoz LAYER 8 Global Moderator
                                last edited by

                                With the protocol 41, yeah some gateways will pass it if you put the box behind in the DMZ..  But yeah if your behind nat you can have issues.  What is the IP on pfsense wan - is it rfc1918??

                                An intelligent man is sometimes forced to be drunk to spend time with his fools
                                If you get confused: Listen to the Music Play
                                Please don't Chat/PM me for help, unless mod related
                                SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                                1 Reply Last reply Reply Quote 0
                                • K
                                  kejianshi
                                  last edited by

                                  Well - This sucks…

                                  Read em and weep  (Seriously - Start weeping)

                                  https://forums.he.net/index.php?topic=3110.0

                                  1 Reply Last reply Reply Quote 0
                                  • K
                                    kejianshi
                                    last edited by

                                    Yeah - You weren't doing anything wrong…  Sorry.

                                    1 Reply Last reply Reply Quote 0
                                    • I
                                      icemanncsu
                                      last edited by

                                      @kejianshi:

                                      Yeah - You weren't doing anything wrong…  Sorry.

                                      This might be the result of AT&T wanting all data to go through their routing endpoints (IPv4 and IPv6).  So that they can DPI all that traffic too.  If only we could encrypt the connection to HE for this tunnel. :(

                                      1 Reply Last reply Reply Quote 0
                                      • I
                                        icemanncsu
                                        last edited by

                                        I am going to try setting this up over my private OpenVPN connection to Atlanta and see if it works, screw AT&T.

                                        1 Reply Last reply Reply Quote 0
                                        • K
                                          kejianshi
                                          last edited by

                                          Could be…

                                          Could also be that they are holding you hostage and that if you buy their "business package" for the mere price of 3x as much or something they will stop blocking common ports and protocols like 6 in 4 and smtp...

                                          1 Reply Last reply Reply Quote 0
                                          • I
                                            icemanncsu
                                            last edited by

                                            @kejianshi:

                                            Could be…

                                            Could also be that they are holding you hostage and that if you buy their "business package" for the mere price of 3x as much or something they will stop blocking common ports and protocols like 6 in 4 and smtp...

                                            Possibly if I paid them the $30 more for non-Deep packet inspection (DPI) service, I wouldnt have this trouble.  But it seems to be Uverse wide :(

                                            But really I cant complain too loud since I pay $120 now for 1Gbps symmetrical and do get every 'bit' of it.

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.