PfSense - Hurricane Electric - Tunnel Broker Setup
-
Okay, OP. Delete everything. Do it again. The docs are perfect.
-
Not perfect - I think he has to disable that auto-appearing useless IPV4 interface for this to work…
Other than that, yes. That guide does work.
Doesn't mean the ISP isn't breaking GIF or blocking HEIPV6 or that the HE server wasn't having issues at the IPV4 address for HE he is using though.
There is still room for error beyond OPs control.
-
The docs work. Both on 2.1.5 and 2.2. (The only thing they are missing on 2.2 is making the bogus additional IPv4 dynamic GW created no-op, but that does not affect the tunnel functionality at all.)
@OP: If you get "Offline" on the TunnelV6 GW when you goto Status > Gateways after you have edited the dynamic GW to make it default per the docs, simply reboot the pfSense box. This is the only thing needed and only needed once when you complete the initial tunnel set up.
If that still does not work, post relevant configuration screenshots here (OPT, GIF, GWs) and ifconfig output for the GIF tunnel interface.
P.S. And yes - delete everything and reboot before trying to follow the docs again.
-
There are a few possibilities. Who is your ISP?
I am looking this over.
AT&T Gigapower 1Gbps Symmetrical - Residential Service - NVG589 for the Gateway, not using their supplied IPv6 6rd services, they are all disabled in the residential gateway device (I disabled them).
I am using IP Passthrough to pfSense, no IPv6 is being pushed to pfSense since I disabled it. I would highly doubt this would cause any trouble on pfSense trying to make a tunnel over IPv4 for IPv6 functionality.
-
"they are all disabled in the residential gateway device"
So your behind a nat? Are you allowing ping to your ipv4 IP? I can tell you for fact that guide in the docs work. I don't recall any issues with it..
I have the /64 working on 1 segment and some of the /64s out of the /48 working on other segments without any problem. They recently fixed gateway stuff so could disable the nonsense ipv4 that kept getting added. But that was before the release of 2.2
-
IP Passthrough I hope is a non-technical term for bridged?
See - Thing is you CAN NAT a connection if it will pass Protocol 41
I have even enabled ICMP on a pfsense in the USA, use my USA pfsense IP and set up IPV6 on a second pfsense in manila because pfsense does pass that protocol.
However, thats the only way I've ever been able to get it to work behind NAT. When pfsense was the 1st layer.
If you are using a NAT (Network Address Translation) appliance, please make sure it allows and forwards IP protocol 41.
What is IP Protocol 41?
IP Protocol 41 is one of the Internet Protocol numbers. Within the IPv4 header, the IPv4 Protocol field is set to 41 to indicate an encapsulated IPv6 packet.So, my guess is your modem/router/ont whatever thingy might be killing protocol 41 or at minimum not passing it along.
That said, I'd do a fresh install and fresh config and try abit more before giving up. Or check 1st device and see if its got setting relevant to protocol 41.
-
So here is confirmation that AT&T has fucked me again!
http://forums.att.com/t5/Residential-Wi-Fi-Gateway/IPv6-Tunnels-broken-yet-again-this-time-on-the-NVG589-modem/td-p/3896665
Post number 9 in that thread. FUCK!
Thanks for all the help guys!
-
With the protocol 41, yeah some gateways will pass it if you put the box behind in the DMZ.. But yeah if your behind nat you can have issues. What is the IP on pfsense wan - is it rfc1918??
-
Well - This sucks…
Read em and weep (Seriously - Start weeping)
https://forums.he.net/index.php?topic=3110.0
-
Yeah - You weren't doing anything wrong… Sorry.
-
Yeah - You weren't doing anything wrong… Sorry.
This might be the result of AT&T wanting all data to go through their routing endpoints (IPv4 and IPv6). So that they can DPI all that traffic too. If only we could encrypt the connection to HE for this tunnel. :(
-
I am going to try setting this up over my private OpenVPN connection to Atlanta and see if it works, screw AT&T.
-
Could be…
Could also be that they are holding you hostage and that if you buy their "business package" for the mere price of 3x as much or something they will stop blocking common ports and protocols like 6 in 4 and smtp...
-
Could be…
Could also be that they are holding you hostage and that if you buy their "business package" for the mere price of 3x as much or something they will stop blocking common ports and protocols like 6 in 4 and smtp...
Possibly if I paid them the $30 more for non-Deep packet inspection (DPI) service, I wouldnt have this trouble. But it seems to be Uverse wide :(
But really I cant complain too loud since I pay $120 now for 1Gbps symmetrical and do get every 'bit' of it.
-
"I am going to try setting this up over my private OpenVPN connection to Atlanta and see if it works, screw AT&T."
Is your site in atlanta a pfsense with a public IP and no NAT?
If so, yeah - You can ride HE through that over a IPV4 UDP vpn to your local pfsense and then just set up HE IPV6 just like you were doing EXCEPT you will need to use the ipv4 address of the atlanta box in the HE config.
-
"I am going to try setting this up over my private OpenVPN connection to Atlanta and see if it works, screw AT&T."
Is your site in atlanta a pfsense with a public IP and no NAT?
If so, yeah - You can ride HE through that over a IPV4 UDP vpn to your local pfsense and then just set up HE IPV6 just like you were doing EXCEPT you will need to use the ipv4 address of the atlanta box in the HE config.
I cant use any HE destination Tunnel? I understand I would be adding latency. Is there something else I am not considering?
-
It would add some latency - yes.
