Unable to pass IPv6 Tests
-
I recently upgraded from a Ubnt EdgeRouter to pfSense 2.2. Since I wanted to take advantage of the platform's more developed features, I decided I would try a hand and enable IPv6 (I'm using Comcast and IPv6 is enabled in my area).
While I think I have everything configured correctly, I am still unable to pass the IPv6 test or connect to IPv6 sites. I'm hoping someone can assist.
What on earth am I missing? :-\
WAN:
IPv4 address 73.4.183.xxx
IPv6 address 2001:558:6017:ed:64a0:517c:958f:xxx
ISP DNS servers 75.75.75.75, 8.8.8.8, 2001:558:FEED::1 (this was set in System -> General Settings)
IPv4 Configuration Type DHCP
IPv6 Configuration Type DHCP6
Use IPv4 connectivity as parent interface Unchecked
Request only a IPv6 prefix Unchecked
DHCPv6 Prefix Delegation size 64
Send IPv6 prefix hint UncheckedLAN:
IPv4 Configuration Type Static IPv4
IPv6 Configuration Type Track Interface
IPv6 Interface WAN
IPv6 Prefix ID 0Client:
Win7
Ethernet adapter Home LAN:
Connection-specific DNS Suffix . : nato
Description . . . . . . . . . . . : Qualcomm Atheros AR8161/8165 PCI-E Gigabit Ethernet Controller (NDIS 6.20)
Physical Address. . . . . . . . . : 90-2B-34-D9-59-D9
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
IPv6 Address. . . . . . . . . . . : 2601:6:7780:581a:50ec:e9d4:7aae:xxxx(Preferred)
Temporary IPv6 Address. . . . . . : 2601:6:7780:581a:68eb:e38f:e369:xxxx(Preferred)
Link-local IPv6 Address . . . . . : fe80::50ec:e9d4:7aae:1e5f%11(Preferred)
IPv4 Address. . . . . . . . . . . : 192.168.10.100(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Lease Obtained. . . . . . . . . . : Thursday, February 19, 2015 12:52:47 PM
Lease Expires . . . . . . . . . . : Thursday, February 19, 2015 4:52:47 PM
Default Gateway . . . . . . . . . : fe80::1:1%11, 192.168.10.1
DHCP Server . . . . . . . . . . . : 192.168.10.1
DHCPv6 IAID . . . . . . . . . . . : 244329268
DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-18-E7-EB-49-90-2B-34-D9-59-D2
DNS Servers . . . . . . . . . . . : 192.168.10.1, 75.75.75.75
NetBIOS over Tcpip. . . . . . . . : EnabledClient can PING 2001:558:feed::1
Pinging 2001:558:feed::1 with 32 bytes of data:
Reply from 2001:558:feed::1: time=26ms
Reply from 2001:558:feed::1: time=11ms
Reply from 2001:558:feed::1: time=19msClient can PING ipv6.google.com
Pinging ipv6.l.google.com [2607:f8b0:4002:c01::71] with 32 bytes of data:
Reply from 2607:f8b0:4002:c01::71: time=49ms
Reply from 2607:f8b0:4002:c01::71: time=47msClient cannot pass test-ipv6.com
Test with IPv4 DNS record ok (0.058s) using ipv4
Test with IPv6 DNS record timeout (15.012s)
Test with Dual Stack DNS record ok (0.353s) using ipv4
Test for Dual Stack DNS and large packet ok (0.324s) using ipv4
Test IPv4 without DNS ok (0.056s) using ipv4
Test IPv6 without DNS timeout (15.013s)
Test IPv6 large packet timeout (15.009s)
Test if your ISP's DNS server uses IPv6 ok (0.345s) using ipv4
Find IPv4 Service Provider ok (0.144s) using ipv4 ASN 7015
Find IPv6 Service Provider timeout (15.040s) -
So out of the box lan has ipv4 enabled - but I am not sure there are any rules that allow ipv6 out.. What are you lan rules in pfsense? Seems you can ping out, so you must have that allowed..
-
So out of the box lan has ipv4 enabled - but I am not sure there are any rules that allow ipv6 out.. What are you lan rules in pfsense? Seems you can ping out, so you must have that allowed..
So that was a very good suggestion. Right now the rules I have is the following:
Floating:
IPv4+6 ICMP – Any <-> Any * *
IPv4+6 TCP/UDP -- !Guest_Network (Open WLAN) -> !Private_Networks * *Private_Networks is simply a list of private class A address spaces. These should allow access out.
On that specific LAN interface, I have one additional IPv4 rule that allows full access to the router.
-
You need to have a few things.
1st I recommend having DNS running that works with IPV6 also. What are you using for DNS?
Second, and this could be very important, what browser are you using?
-
I've run the tests in Chrome and IE.
As for DNS, please see attached.
-
Switch your IPV6 DNS to "none" and see what happens.
Chrome for sure should work out of the box with IPV6.also try these as your IPV6 DNS - just to test.
2001:4860:4860::8888
2001:4860:4860::8844I don't use those, but I know they work.
-
Should I also remove the DNS entry or just change the gateway to none?
The thing is, IPv6 lookups work in the current setup (eg. I can ping ipv6.google.com and receive a reply).
-
Try just setting gateway to none and try using the two IPV6 DNS I provided.
-
why do you have your rules in floating and not on the actual interface - out of curiosity?
-
The pfSense UI will not allow me to enter those DNS servers without configuring gateway interfaces.
As for the floating rules, there's a few other VLANs which they apply to, I'm just not concerned with IPv6 on those VLANs.
-
Thats strange to me…
I have 5 interfaces and, up till recently "none" was selected for all my dns server interfaces. IPV4 and IPV6.
Anyway - obviously whatever box you are on is getting IPV6 obviously. I assume you are not testing connectivity from pfsense, but rather are using the same machine you are attempting to browse the internet from?
-
Correction, I was able to implement these without specifying the gateway interface and I got the same result.
2001:4860:4860::8888
2001:4860:4860::8844I also disabled the firewall on my workstation for good measure. Still fails the IPv6 tests.
-
But your WORKSTATION is able to ping, for example, those two IPV6 addresses I gave you?
-
Yes, that is correct.
Pinging 2001:4860:4860::8888 with 32 bytes of data:
Reply from 2001:4860:4860::8888: time=29ms
Reply from 2001:4860:4860::8888: time=29ms
Reply from 2001:4860:4860::8888: time=30msPinging 2001:4860:4860::8844 with 32 bytes of data:
Reply from 2001:4860:4860::8844: time=29ms
Reply from 2001:4860:4860::8844: time=29ms
Reply from 2001:4860:4860::8844: time=29ms -
I've resolved this issue. The firewall rule IPv4+6 was not applying correctly. Listing an explicit IPv6 Any -> Any rule fixed the problem. I'll work to explore these rules in more detail.
-
Strange - Just to look into chrome, past this in your chrome browser:
chrome://net-internals/#dns
Then click "clear host cache"
Probably will make zero difference, but why not…
If that doesn't work, take a look to see if there is some strange rule in your firewall (or lack of a pass rule) that is letting ICMP pass but not allowing HTTP/HTTPS.
-
Ahh - so not passing IPV6 correctly (-;
Works now?
-
And again why do you have them in floating in the first place? Are they set to quick, rules in floating are for SPECIAL rules..
For example
" I'm just not concerned with IPv6 on those VLANs."But you had a rule that should allow ipv6 out, which would be applied to ALL interfaces.. I don't recommend putting anything in floating unless it really needs to go there.
