Rogers pfSense configuration

JKnott

This info was provided by a Rogers Network Architect:

Rogers IPv6 Settings for pFSense firewall

In WAN Interface menu:

Use IPv4 connectivity as parent interface: yes
Request only a IPv6 prefix: no
DHCPv6 Prefix Delegation Size: 56
Send IPv6 prefix hint: yes

In LAN Interface menu:

IPv6 Configuration Type: track interface
IPv6 Interface: WAN
IPv6 Prefix ID: 0

Derelict

Thanks for the info. Did it work?

Only a /64 PD? That is unfortunate.

JKnott

Yes it does. I have been using that configuration for months. They plan to have /56s shortly. They still don't "officially" support IPv6, but it's been available since about April and was just rolled out to cell phones last week. The same network architect has provided other info on what they plan to do, such as 464XLAT support for smart phones.

Double K

Jknott, did he happen to give any info on the default gateway (which pfsense uses for monitoring). Mine comes up as an fe80 link local address and thus i set the google ipv6 dns servers for monitoring the link.

JKnott

That is all the info provided. The default gateway is normally provided by DHCPv6 and is typically a link local address. Why do you need something other than the link local address for monitoring?

pfcode

What about RA?

JKnott

What about RA? It's provided by pfSense.

pfcode

@JKnott:

What about RA? It's provided by pfSense.

You don't set it up, and Rogers IPv6 works with pfSense? What I was asking is your RA Configuration

Derelict

Probably assisted. That's not really dependent on the WAN provider though.

JKnott

You don't set it up, and Rogers IPv6 works with pfSense? What I was asking is your RA Configuration

I don't recall any special config fo RA. The info Rogers provided was for connecting to their network. How you connect to your LAN is not their concern. Normally, the router (pfSense) is configured to provide a prefix via Router Advertisements, but that's not the only way.

pfcode

@JKnott:

You don't set it up, and Rogers IPv6 works with pfSense? What I was asking is your RA Configuration

I don't recall any special config fo RA. The info Rogers provided was for connecting to their network. How you connect to your LAN is not their concern. Normally, the router (pfSense) is configured to provide a prefix via Router Advertisements, but that's not the only way.

Thanks.

coolspot

I have my modem in bridge mode, running firmware 4.5.8.22… and the settings above but my WAN interface is not picking up a IPV6 IP address.

Any suggestions?

JKnott

What modem do you have? Not all are suitable.

coolspot

@JKnott:

What modem do you have? Not all are suitable.

I have the Gigabit modem (Hitron CGNM-3552-ROG) - I rebooted pfSense and now I pick up an IPV6 address:

However, within pfSense, the WAN_DHCP6 gateway is down?

WAN_DHCP6 fe80::217:10ff:fe91:55b1 0ms 0ms 100% Offline

Is there any other configuration that is required to get WAN_DHCP6 gateway to work properly?

screenshot_26.png_thumb

screenshot_24.png_thumb

JKnott

Is it actually down? You can try ipv6.google.com to verify. I find that Gateway Monitoring to an address that didn't respond caused that situation. I just turn off monitoring, as you don't really need it, if you have only one route to the Internet. Turning it off also cuts down on traffic. That monitoring sends out a lot of pings.

coolspot

@JKnott:

Is it actually down? You can try ipv6.google.com to verify. I find that Gateway Monitoring to an address that didn't respond caused that situation. I just turn off monitoring, as you don't really need it, if you have only one route to the Internet. Turning it off also cuts down on traffic. That monitoring sends out a lot of pings.

Turns out that you can't ping Roger's gateway - I replaced the monitor IP with Google's IPV6 IP and now it is online.

But another question - how do clients obtain an IPV6 address. Does the DHCP6 Relay and/or DHCP6 Relay & RA need to be enabled?

Thanks.

bimmerdriver

@coolspot:

But another question - how do clients obtain an IPV6 address. Does the DHCP6 Relay and/or DHCP6 Relay & RA need to be enabled?

If a prefix has been delegated to your router, you should use the dhcpv6 server, not the relay. When you enable the service, you will set the minimum and maximum range, such as ::1000 and ::2000 or whatever. If you will have a stateful and stateless devices on your network, set the router mode to assisted. (Android phones only support SLAAC.)

coolspot

@bimmerdriver:

@coolspot:

But another question - how do clients obtain an IPV6 address. Does the DHCP6 Relay and/or DHCP6 Relay & RA need to be enabled?

If a prefix has been delegated to your router, you should use the dhcpv6 server, not the relay. When you enable the service, you will set the minimum and maximum range, such as ::1000 and ::2000 or whatever. If you will have a stateful and stateless devices on your network, set the router mode to assisted. (Android phones only support SLAAC.)

Thanks, I got that working as well.

Last question, I have multiple LAN subnets - one regular one and one WiFi LAN … since Rogers is /64 prefix delegation, is it possible to "split" the IPV6 addresses across two LANs or am I SOL until Rogers changes the prefix delegation?

Thanks.

JKnott

It may be possible to split a prefix, but it will break some things, including SLAAC.

JKnott

I replaced the monitor IP with Google's IPV6 IP and now it is online.

Why not just turn off monitoring?

But another question - how do clients obtain an IPV6 address. Does the DHCP6 Relay and/or DHCP6 Relay & RA need to be enabled?

Normally, the router uses Router Advertisements to provide the local prefix. Then the various devices add another 64 bits to the prefix. Those 64 bits can be derived from the MAC address or be a random number.