Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    2.2.1: No IPv6 assigned to LAN anymore

    IPv6
    16
    64
    22.1k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • A
      azzido
      last edited by

      Did you try following configuration? In your case you can have up to 256 track interfaces, so I still don't understand what exactly is not working for you.

      • WAN Configuration

      • IPv6 Configuration Type: DHCP6

      • DHCPv6 Prefix Delegation size: 56

      • VLAN1 Configuration

      • IPv6 Configuration Type: Track Interface

      • IPv6 Interface: WAN

      • IPv6 Prefix ID: 1

      • VLAN2 Configuration

      • IPv6 Configuration Type: Track Interface

      • IPv6 Interface: WAN

      • IPv6 Prefix ID: 2

      • VLAN3 Configuration

      • IPv6 Configuration Type: Track Interface

      • IPv6 Interface: WAN

      • IPv6 Prefix ID: 3

      • VLAN4 Configuration

      • IPv6 Configuration Type: Track Interface

      • IPv6 Interface: WAN

      • IPv6 Prefix ID: 4

      • VLAN5 Configuration

      • IPv6 Configuration Type: Track Interface

      • IPv6 Interface: WAN

      • IPv6 Prefix ID: 5

      1 Reply Last reply Reply Quote 0
      • M
        maverick_slo
        last edited by

        Oh man….
        Sorry but you will have to learn to read what I posted.
        It is all working for me with advanced options or custom conf file.

        For the last time I DON`T WANT TO USE TRACK INTERFACE OPTION! :)

        1 Reply Last reply Reply Quote 0
        • K
          kejianshi
          last edited by

          Unless I'm confused, your setup will break eventually.

          1 Reply Last reply Reply Quote 0
          • M
            maverick_slo
            last edited by

            My setup?
            Why?

            1 Reply Last reply Reply Quote 0
            • H
              hda
              last edited by

              @kejianshi:

              Unless I'm confused, your setup will break eventually.

              Conclusion is the "Track Interface" is promoted to the default LAN config. Plus automated issuance of  LAN IP using SLAAC.
              The don't bother out-of-the-box solution for beginner.  ;)

              All other LAN config goes by using WAN "Advanced". Fine with me.

              1 Reply Last reply Reply Quote 0
              • M
                maverick_slo
                last edited by

                Couldn't agree more.
                My ipv6 setup works like this 3 years, last 2 years on pfsense…
                Autoconfig of lan seems bad idea for me and my both networks, home and work...

                1 Reply Last reply Reply Quote 0
                • H
                  hda
                  last edited by

                  @maverick_slo:

                  …
                  Autoconfig of lan seems bad idea for me and my both networks, home and work...

                  IF or WHEN my native (quasi-)static number of IPv6 prefix, by DHCP(PD), is changed (by ISP) I want to have my LAN dropped !. Security. No secret unnoticed changes from the far side allowed.  :)

                  1 Reply Last reply Reply Quote 0
                  • K
                    kejianshi
                    last edited by

                    IMHO its a bastardized solution and getting a tunnel would be better for what you guys are doing, but its cool.  Sounds like you are well aware it is not ideal.

                    1 Reply Last reply Reply Quote 0
                    • H
                      hda
                      last edited by

                      @kejianshi:

                      IMHO its a bastardized solution…

                      Yes, Track Interface is wizard-like, the easy way out. But, if one does IPv6, they should know the manual workings, in analogy with (experience of) multiple IPv4-no-NAT. So for me the full (overly) automation with Track Interface is a security flaw or allowing meddling with your site by ISP.

                      1 Reply Last reply Reply Quote 0
                      • K
                        kejianshi
                        last edited by

                        The things you talked about are not the problem for the average user as I see it.

                        Yes its good to understand the inner workings and all, but the problem as I see it is that you are assigning static IPs on the LAN from a /48 or /56 or /64 or whatever that is assigned dynamically by dhcp and could break in a day or a year.  Who knows?

                        Thats the part I'd never do, but if its working for you and you don't mind the possible breakage, then thats cool.

                        For me, its a show stopper if my internet breaks because my pfsense is far far away.

                        1 Reply Last reply Reply Quote 0
                        • H
                          hda
                          last edited by

                          @kejianshi:

                          The things you talked about are not the problem for the average user as I see it.
                          …

                          There is no such as an average user  8)

                          But. ISP WAN/LAN prefix changes AND the LAN SLAAC on boxes are without question a privacy security risk issue. pfSense should promote security. This comes with understanding what one is doing. Otherwise one may just get a consumer-router-FW. (duh) :)

                          1 Reply Last reply Reply Quote 0
                          • K
                            kejianshi
                            last edited by

                            I agree - Thats why I'd advise you to get a reliable /48 from HE.  Its actually static.

                            1 Reply Last reply Reply Quote 0
                            • H
                              hda
                              last edited by

                              @kejianshi:

                              …get a reliable /48 from HE....

                              Dependent on IPv4, that's funny.
                              I want local paid accountability, not SIXXS or not HE, and parallel functionality level like multiple-IPv4.

                              1 Reply Last reply Reply Quote 0
                              • A
                                azzido
                                last edited by

                                Well, I think we got down to the bottom of the original issue. You guys choose not to use track interfaces but assign static IP instead. You don't have to do that, but you choose to do that and it is ok if that works for you. Since you don't use functionality the way it was meant to be used, don't complain when fixes to that functionality break your setup.

                                1 Reply Last reply Reply Quote 0
                                • K
                                  kejianshi
                                  last edited by

                                  I also would prefer a static native IPV6 on the WAN when available.

                                  1 Reply Last reply Reply Quote 0
                                  • M
                                    maverick_slo
                                    last edited by

                                    Guys I have a static native /56 from provider for lan…
                                    It wont change I don't know from where u got ideas it will change :) Itz more reliable than track iface IMHO...

                                    1 Reply Last reply Reply Quote 0
                                    • L
                                      lobotiger
                                      last edited by

                                      Ok I thought I'd chime in here too just to add that I too ran into this same problem that others have had.

                                      I'm with a Canadian ISP called Teksavvy and they assign you a /64 for the WAN side of the PPPoE connection and a /56 for your LAN side.  I'm assuming that you have to use DHCPv6+PD in order to get the assignments but at least for the LAN side it's always the same static /56 assignment.  It's as close to Hurricane Electric's /48 assignment in terms of it practically being a static.  My LAN was configured with a static IPv6 address (no tracking) from that /56 (picked the first /64) and it's been working perfectly fine since December 2014 when I migrated from HE's tunnel.  I even followed this youtube video for how to set things up:  https://youtu.be/zdSI7Ez0Xhs?list=PL4T5Ac0HrL3PeGPoixe8RpHEeZuhf_hDD

                                      The upgrade to 2.2.1 definitely broke it for me and I'm not 100% sure that the way I and others were doing it was completely wrong.  There are many ISPs out there that will assign you a static LAN /48 or /56 but is only made routeable to you when you request the prefix delegation from a DHCPv6 setup.  Personally I had my LAN interface setup with ::1 as it made it easy to point my browser to it to get into the pfsense gui and I used it as the default gateway for some manually hard coded machines on my LAN.  The track option makes sense IMHO in situations like a residential setup where you just want IPv6 to work on the LAN and you don't care one way or the other what the assignments are to the hosts and the LAN interface.  If your ISP recycles your LAN assignment then you don't care so long as IPv6 still works.  That's fine for that scenario but on an enterprise network that would never fly.

                                      I've been playing with IPv6 for a number of years now and I actually deployed network wide when I worked for an ISP a few years ago.  We didn't do DHCPv6 assignments as we manually assigned them to our beta customers.  But from an Cisco IPv6 course that I took, I'm almost positive that one could have configured a LAN facing interface on a router to be automagically assigned via PD as well as having a hard coded IPv6 address on it.  Obviously that would only work if you knew the delegation but still.

                                      So, right now I've got things working again by doing the Advanced configuration but I've only added this "ia-pd 0" and ticked off prefix-delegation.  Should I do the rest of the stuff based on azzido's image?  Alternatively, should I just switch over to Tracked and use the link-local address of the LAN interface for accessing pfsense?  Would this second option break my SLAAC and DHCPv6 assignments I'm doing towards the LAN?

                                      LoboTiger

                                      1 Reply Last reply Reply Quote 0
                                      • H
                                        hda
                                        last edited by

                                        @lobotiger:

                                        …
                                        So, right now I've got things working again by doing the Advanced configuration but I've only added this "ia-pd 0" and ticked off prefix-delegation.  Should I do the rest of the stuff based on azzido's image?  Alternatively, should I just switch over to Tracked and use the link-local address of the LAN interface for accessing pfsense?  Would this second option break my SLAAC and DHCPv6 assignments I'm doing towards the LAN?

                                        You're doing fine is it not ?  :)
                                        In case of doubt, write up your functional specification for your premises and just build that configuration.  8)

                                        1 Reply Last reply Reply Quote 0
                                        • L
                                          lobotiger
                                          last edited by

                                          @hda:

                                          @lobotiger:

                                          …
                                          So, right now I've got things working again by doing the Advanced configuration but I've only added this "ia-pd 0" and ticked off prefix-delegation.  Should I do the rest of the stuff based on azzido's image?  Alternatively, should I just switch over to Tracked and use the link-local address of the LAN interface for accessing pfsense?  Would this second option break my SLAAC and DHCPv6 assignments I'm doing towards the LAN?

                                          You're doing fine is it not ?  :)
                                          In case of doubt, write up your functional specification for your premises and just build that configuration.  8)

                                          Yeah but if I'm going to go to the trouble of using the advanced configuration I figured I should populate as best as possible.  :)

                                          LoboTiger

                                          1 Reply Last reply Reply Quote 0
                                          • A
                                            azzido
                                            last edited by

                                            lobotiger, see notes on the image I posted if you want config file configured via advanced settings to look exactly like before.

                                            ia-pd you already configured because you obviously need that. If you did not have 'Request only an IPv6 prefix' flag checked before then add 'ia-na 0' + check 'Non-Temporary Address Allocation' flag. domain-name-servers and domain-name request options are always included when using basic settings.

                                            As far as switching to track interface, unfortunately there is currently a limitation that prevents you from using DHCPv6 server on interfaces configured as DHCP6 or Track. See this RM ticket: https://redmine.pfsense.org/issues/3029

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post