Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    PfSense - Hurricane Electric - Tunnel Broker Setup

    Scheduled Pinned Locked Moved IPv6
    62 Posts 5 Posters 26.9k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • johnpozJ
      johnpoz LAYER 8 Global Moderator
      last edited by

      "they are all disabled in the residential gateway device"

      So your behind a nat?  Are you allowing ping to your ipv4 IP?  I can tell you for fact that guide in the docs work.  I don't recall any issues with it..

      I have the /64 working on 1 segment and some of the /64s out of the /48 working on other segments without any problem.  They recently fixed gateway stuff so could disable the nonsense ipv4 that kept getting added.  But that was before the release of 2.2

      he-elec-tunnel.png
      he-elec-tunnel.png_thumb

      An intelligent man is sometimes forced to be drunk to spend time with his fools
      If you get confused: Listen to the Music Play
      Please don't Chat/PM me for help, unless mod related
      SG-4860 24.11 | Lab VMs 2.8, 24.11

      1 Reply Last reply Reply Quote 0
      • K
        kejianshi
        last edited by

        IP Passthrough I hope is a non-technical term for bridged?

        See - Thing is you CAN NAT a connection if it will pass Protocol 41

        I have even enabled ICMP on a pfsense in the USA, use my USA pfsense IP and set up IPV6 on a second pfsense in manila because pfsense does pass that protocol.

        However, thats the only way I've ever been able to get it to work behind NAT.  When pfsense was the 1st layer.

        If you are using a NAT (Network Address Translation) appliance, please make sure it allows and forwards IP protocol 41.

        What is IP Protocol 41?
            IP Protocol 41 is one of the Internet Protocol numbers. Within the IPv4 header, the IPv4 Protocol field is set to 41 to indicate an encapsulated IPv6 packet.

        So, my guess is your modem/router/ont whatever thingy might be killing protocol 41 or at minimum not passing it along.

        That said, I'd do a fresh install and fresh config and try abit more before giving up.  Or check 1st device and see if its got setting relevant to protocol 41.

        1 Reply Last reply Reply Quote 0
        • I
          icemanncsu
          last edited by

          So here is confirmation that AT&T has fucked me again!

          http://forums.att.com/t5/Residential-Wi-Fi-Gateway/IPv6-Tunnels-broken-yet-again-this-time-on-the-NVG589-modem/td-p/3896665

          Post number 9 in that thread. FUCK!

          Thanks for all the help guys!

          1 Reply Last reply Reply Quote 0
          • johnpozJ
            johnpoz LAYER 8 Global Moderator
            last edited by

            With the protocol 41, yeah some gateways will pass it if you put the box behind in the DMZ..  But yeah if your behind nat you can have issues.  What is the IP on pfsense wan - is it rfc1918??

            An intelligent man is sometimes forced to be drunk to spend time with his fools
            If you get confused: Listen to the Music Play
            Please don't Chat/PM me for help, unless mod related
            SG-4860 24.11 | Lab VMs 2.8, 24.11

            1 Reply Last reply Reply Quote 0
            • K
              kejianshi
              last edited by

              Well - This sucks…

              Read em and weep  (Seriously - Start weeping)

              https://forums.he.net/index.php?topic=3110.0

              1 Reply Last reply Reply Quote 0
              • K
                kejianshi
                last edited by

                Yeah - You weren't doing anything wrong…  Sorry.

                1 Reply Last reply Reply Quote 0
                • I
                  icemanncsu
                  last edited by

                  @kejianshi:

                  Yeah - You weren't doing anything wrong…  Sorry.

                  This might be the result of AT&T wanting all data to go through their routing endpoints (IPv4 and IPv6).  So that they can DPI all that traffic too.  If only we could encrypt the connection to HE for this tunnel. :(

                  1 Reply Last reply Reply Quote 0
                  • I
                    icemanncsu
                    last edited by

                    I am going to try setting this up over my private OpenVPN connection to Atlanta and see if it works, screw AT&T.

                    1 Reply Last reply Reply Quote 0
                    • K
                      kejianshi
                      last edited by

                      Could be…

                      Could also be that they are holding you hostage and that if you buy their "business package" for the mere price of 3x as much or something they will stop blocking common ports and protocols like 6 in 4 and smtp...

                      1 Reply Last reply Reply Quote 0
                      • I
                        icemanncsu
                        last edited by

                        @kejianshi:

                        Could be…

                        Could also be that they are holding you hostage and that if you buy their "business package" for the mere price of 3x as much or something they will stop blocking common ports and protocols like 6 in 4 and smtp...

                        Possibly if I paid them the $30 more for non-Deep packet inspection (DPI) service, I wouldnt have this trouble.  But it seems to be Uverse wide :(

                        But really I cant complain too loud since I pay $120 now for 1Gbps symmetrical and do get every 'bit' of it.

                        1 Reply Last reply Reply Quote 0
                        • K
                          kejianshi
                          last edited by

                          "I am going to try setting this up over my private OpenVPN connection to Atlanta and see if it works, screw AT&T."

                          Is your site in atlanta a pfsense with a public IP and no NAT?

                          If so, yeah - You can ride HE through that over a IPV4 UDP vpn to your local pfsense and then just set up HE IPV6 just like you were doing EXCEPT you will need to use the ipv4 address of the atlanta box in the HE config.

                          1 Reply Last reply Reply Quote 0
                          • I
                            icemanncsu
                            last edited by

                            @kejianshi:

                            "I am going to try setting this up over my private OpenVPN connection to Atlanta and see if it works, screw AT&T."

                            Is your site in atlanta a pfsense with a public IP and no NAT?

                            If so, yeah - You can ride HE through that over a IPV4 UDP vpn to your local pfsense and then just set up HE IPV6 just like you were doing EXCEPT you will need to use the ipv4 address of the atlanta box in the HE config.

                            I cant use any HE destination Tunnel?  I understand I would be adding latency.  Is there something else I am not considering?

                            1 Reply Last reply Reply Quote 0
                            • K
                              kejianshi
                              last edited by

                              It would add some latency - yes.

                              1 Reply Last reply Reply Quote 0
                              • First post
                                Last post
                              Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.