Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Rogers pfSense configuration

    IPv6
    11
    60
    117.0k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • JKnottJ
      JKnott
      last edited by

      I replaced the monitor IP with Google's IPV6 IP and now it is online.

      Why not just turn off monitoring?

      But another question - how do clients obtain an IPV6 address. Does the DHCP6 Relay and/or DHCP6 Relay & RA need to be enabled?

      Normally, the router uses Router Advertisements to provide the local prefix.  Then the various devices add another 64 bits to the prefix.  Those 64 bits can be derived from the MAC address or be a random number.

      PfSense running on Qotom mini PC
      i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
      UniFi AC-Lite access point

      I haven't lost my mind. It's around here...somewhere...

      1 Reply Last reply Reply Quote 0
      • JKnottJ
        JKnott
        last edited by

        If a prefix has been delegated to your router, you should use the dhcpv6 server, not the relay.

        No need for DHCPv6 on the local LAN.  Router Advertisements and SLAAC provide the addresses.

        PfSense running on Qotom mini PC
        i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
        UniFi AC-Lite access point

        I haven't lost my mind. It's around here...somewhere...

        1 Reply Last reply Reply Quote 0
        • C
          coolspot
          last edited by

          @JKnott:

          If a prefix has been delegated to your router, you should use the dhcpv6 server, not the relay.

          No need for DHCPv6 on the local LAN.  Router Advertisements and SLAAC provide the addresses.

          However, if I run a server on a network, DHCP6 would allow me to set a static address correct - this would make it easier to setup firewall rules?

          1 Reply Last reply Reply Quote 0
          • DerelictD
            Derelict LAYER 8 Netgate
            last edited by

            Yes. Though it is arguable that a static config on the server is no more work than setting up a static assignment. At least it's centralized in the DHCP server.

            And I believe there is no way to turn off DHCP6 on an inside interface set to track.

            "Assisted" is generally what you want on the RA settings since some devices (android) are SLAAC-only.

            Chattanooga, Tennessee, USA
            A comprehensive network diagram is worth 10,000 words and 15 conference calls.
            DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
            Do Not Chat For Help! NO_WAN_EGRESS(TM)

            1 Reply Last reply Reply Quote 0
            • C
              coolspot
              last edited by

              @Derelict:

              Yes. Though it is arguable that a static config on the server is no more work than setting up a static assignment. At least it's centralized in the DHCP server.

              And I believe there is no way to turn off DHCP6 on an inside interface set to track.

              "Assisted" is generally what you want on the RA settings since some devices (android) are SLAAC-only.

              I'm still getting ramped up on IPv6, but it seems that support for DHCP-PD is still weak in pfSense - without the ability for static mappings to track the WAN PD, the entries will become nullified if the ISP updates the modem address assignment.

              I guess I got the basics setup - for hosting a server seems like I'll still be on IPv4.

              1 Reply Last reply Reply Quote 0
              • DerelictD
                Derelict LAYER 8 Netgate
                last edited by

                In my opinion support for DHCP-PD is weak on the ISP side.

                They're the ones changing what should be static IP addresses.

                Use tunnelbroker.net. They manage to issue static /48s. And they don't charge $90+/month.

                Chattanooga, Tennessee, USA
                A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                Do Not Chat For Help! NO_WAN_EGRESS(TM)

                1 Reply Last reply Reply Quote 0
                • MikeV7896M
                  MikeV7896
                  last edited by

                  @coolspot:

                  I'm still getting ramped up on IPv6, but it seems that support for DHCP-PD is still weak in pfSense - without the ability for static mappings to track the WAN PD, the entries will become nullified if the ISP updates the modem address assignment.

                  I guess I got the basics setup - for hosting a server seems like I'll still be on IPv4.

                  Static mappings CAN track the WAN PD. When you create a static DHCPv6 mapping and the interface is set up to track another (i.e. LAN tracking WAN), then the only part of the IPv6 address you're entering is the host portion of the address. I've posted elsewhere that I've set up two hosts on my LAN with ::4001 and ::4002 as the static DHCPv6 addresses. That way if the prefix changes, the DHCPv6 server will adjust and on renewal a valid address will be provided to the host with the new prefix.

                  The area that still falls short is the firewall, which has no way to create a rule for an address with a dynamic prefix. I suppose you could create an alias with the hostname of your server(s)… but I'd prefer not to have to do that. That's just another piece in a puzzle where if one part fails, you get to figure out what isn't working.

                  The S in IOT stands for Security

                  1 Reply Last reply Reply Quote 0
                  • JKnottJ
                    JKnott
                    last edited by

                    However, if I run a server on a network, DHCP6 would allow me to set a static address correct - this would make it easier to setup firewall rules?

                    With SLAAC, you can have 2 types of address, MAC based and random number "privacy" addresses.  For a server, you'd configure the firewall and DNS for the MAC based address, as it's static.  You may have to configure the server to have a MAC address.  It's usually available in Linux, but with Windows you have to specifically enable it.

                    PfSense running on Qotom mini PC
                    i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                    UniFi AC-Lite access point

                    I haven't lost my mind. It's around here...somewhere...

                    1 Reply Last reply Reply Quote 0
                    • JKnottJ
                      JKnott
                      last edited by

                      Yes. Though it is arguable that a static config on the server is no more work than setting up a static assignment. At least it's centralized in the DHCP server.

                      With SLAAC and MAC based addresses, there's no setup at all.  It just works.

                      PfSense running on Qotom mini PC
                      i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                      UniFi AC-Lite access point

                      I haven't lost my mind. It's around here...somewhere...

                      1 Reply Last reply Reply Quote 0
                      • MikeV7896M
                        MikeV7896
                        last edited by

                        @JKnott:

                        Yes. Though it is arguable that a static config on the server is no more work than setting up a static assignment. At least it's centralized in the DHCP server.

                        With SLAAC and MAC based addresses, there's no setup at all.  It just works.

                        Except that static DHCP/DHCPv6 also includes hostname resolution in DNS forwarder/resolver, while SLAAC would require a DNS Entry that would need to be changed every time the prefix changes.

                        The S in IOT stands for Security

                        1 Reply Last reply Reply Quote 0
                        • B
                          bimmerdriver
                          last edited by

                          @virgiliomi:

                          @JKnott:

                          Yes. Though it is arguable that a static config on the server is no more work than setting up a static assignment. At least it's centralized in the DHCP server.

                          With SLAAC and MAC based addresses, there's no setup at all.  It just works.

                          Except that static DHCP/DHCPv6 also includes hostname resolution in DNS forwarder/resolver, while SLAAC would require a DNS Entry that would need to be changed every time the prefix changes.

                          Agreed about the hostnames. Also, it's not like it's difficult to enable dhcpv6. Since it's being used for dhcpv4, you may as well also use it for dhcpv6.

                          1 Reply Last reply Reply Quote 0
                          • DerelictD
                            Derelict LAYER 8 Netgate
                            last edited by

                            @JKnott:

                            Yes. Though it is arguable that a static config on the server is no more work than setting up a static assignment. At least it's centralized in the DHCP server.

                            With SLAAC and MAC based addresses, there's no setup at all.  It just works.

                            I know that. But change a NIC and you have to change all of that. Setting a static IP address on the server is probably easier over the long run. Or a push, like I said. It is pretty common practice to set static IP addresses in IPv4 for servers. Not really any need to change that.

                            Chattanooga, Tennessee, USA
                            A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                            DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                            Do Not Chat For Help! NO_WAN_EGRESS(TM)

                            1 Reply Last reply Reply Quote 0
                            • JKnottJ
                              JKnott
                              last edited by

                              If you're using DHCP, changing a NIC will require updating the server too, as the MAC address, which the server maps the address to, will change.

                              PfSense running on Qotom mini PC
                              i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                              UniFi AC-Lite access point

                              I haven't lost my mind. It's around here...somewhere...

                              1 Reply Last reply Reply Quote 0
                              • DerelictD
                                Derelict LAYER 8 Netgate
                                last edited by

                                Not talking about using DHCP.

                                Chattanooga, Tennessee, USA
                                A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                1 Reply Last reply Reply Quote 0
                                • JKnottJ
                                  JKnott
                                  last edited by

                                  A bit of an update.  When I started this thread, Rogers provided only a /64, but has been providing a /56 for quite some time.  It appears they might now be offering a /48, as the DHCPv6 Prefix Delegation size on the WAN page now goes to /48, whereas it used to be /56.  I haven't tried it yet, but someone else may be interested in trying a /48.

                                  PfSense running on Qotom mini PC
                                  i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                                  UniFi AC-Lite access point

                                  I haven't lost my mind. It's around here...somewhere...

                                  1 Reply Last reply Reply Quote 0
                                  • DerelictD
                                    Derelict LAYER 8 Netgate
                                    last edited by

                                    What you can select on the WAN page has nothing to do with what the ISP will or will not do.

                                    You can set it to anything from /48 on down.

                                    If you want to change it you probably need to copy out the DUID file to a safe place like /root so you can put it back if you need to, delete it, then change the prefix hint and save. Otherwise the ISP might ignore the prefix hint and give you your old delegation based on the DUID.

                                    The DUID file is: /var/db/dhcp6c_duid

                                    You might also need to clear it out of System > Advanced, Networking if you have saved it there (or change it there if you know what you are doing).

                                    Chattanooga, Tennessee, USA
                                    A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                    DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                    Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                    1 Reply Last reply Reply Quote 0
                                    • JKnottJ
                                      JKnott
                                      last edited by

                                      What you can select on the WAN page has nothing to do with what the ISP will or will not do.

                                      You can set it to anything from /48 on down.

                                      I don't recall ever seeing /48 before, though I could be mistaken.  I'll give it a try later and see what happens.

                                      PfSense running on Qotom mini PC
                                      i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                                      UniFi AC-Lite access point

                                      I haven't lost my mind. It's around here...somewhere...

                                      1 Reply Last reply Reply Quote 0
                                      • JKnottJ
                                        JKnott
                                        last edited by

                                        What you can select on the WAN page has nothing to do with what the ISP will or will not do.

                                        You can set it to anything from /48 on down.

                                        My mistake.  It appears you're right.  I guess I'll just have to make do with a /56.  ;)

                                        PfSense running on Qotom mini PC
                                        i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                                        UniFi AC-Lite access point

                                        I haven't lost my mind. It's around here...somewhere...

                                        1 Reply Last reply Reply Quote 0
                                        • M
                                          mjnr
                                          last edited by

                                          Can anyone validate these settings still work? Trying to get IPV6 running on an XB6 Gateway in bridge mode running on PFSense 2.4 and no joy on getting the WAN interface to draw an IP. I've tried the settings above and various other combinations with no success.

                                          JKnottJ C 2 Replies Last reply Reply Quote 0
                                          • JKnottJ
                                            JKnott @mjnr
                                            last edited by

                                            @mjnr said in Rogers pfSense configuration:

                                            Can anyone validate these settings still work? Trying to get IPV6 running on an XB6 Gateway in bridge mode running on PFSense 2.4 and no joy on getting the WAN interface to draw an IP. I've tried the settings above and various other combinations with no success.

                                            Those settings are still good. Try connecting a computer directly to the modem, to see if that works. You should get an IPv6 address.

                                            PfSense running on Qotom mini PC
                                            i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                                            UniFi AC-Lite access point

                                            I haven't lost my mind. It's around here...somewhere...

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.