Migrating to IPv6
-
But wouldn't I be able to subnet the /64 into even smaller fragments?
It may be technically possible, but it's a bad idea. An IPv6 address has 64 bits for the network and 64 for the host. Some things, such as SLAAC, depend on this.
https://en.wikipedia.org/wiki/IPv6#Stateless_address_autoconfiguration_.28SLAAC.29
-
That they would give you only 1 /64 is beyond stupid.. Min allocation should be a /56 or 256 /64's – better yet would be a /48... But if they really want to be stingy they could give you a /60 - but 1 single /64 is not something anything other than a home setup should get since in that sort of setup everything is just directly connected inside the /64..
Indeed my ISP gave me a /48 for home use.
-
Indeed my ISP gave me a /48 for home use.
<sniff!>Mine only gave me a /56</sniff!> ;)
-
Indeed my ISP gave me a /48 for home use.
<sniff!>Mine only gave me a /56</sniff!> ;)
Quit complaining… mine only lets me get a /60. Not that I'm using 16 /64's... I'm not even using 8... but I am using more than one.
-
"or /64 subnetted into many /whatever"
Because that is not really a viable option - the smallest segment with ipv6 is designed to be a /64.. Even a transit network would be a /64 by design…
I use to have a hard time trying to understand the waste it seems is being done here - and that we could do the same nonsense that used up all the ipv4 space.. Hey school you want to get on the internet, hey sure here is a /8 to use ;)
You may feel this way until you truly grasp the size of the ipv6 address space.. I at one time thought - what the hell even if you have what seems like infinite space, if you waste it - you could fill it up.. Do the math though ;) And how many grains of sand on the planet.. There are more /64's in the space than that...
-
Because that is not really a viable option - the smallest segment with ipv6 is designed to be a /64.. Even a transit network would be a /64 by design…
I believe a point to point link with a /126 or /127 is supported. Of course, with IPv6, you don't even need a global address for routers. Link local works fine. With a point-point link, you don't even have to specify an IP address. Just say the route it out that interface. Of course, that works with IPv4 too.
-
/127 would be point to point in IPv6 – point I was trying to make is the really the smallest network you would ever use which would be a transit network - they are not always point to point ;)
If your creating static point to point IPs on a link - none of the normal fundamentals come to play.. It most likely some special hardware doing routing, or running a routing distro, etc. For sake of discussion with migration to ipv6 for his network the smallest prefix you would use is /64..
-
Yes they routed a /64 to me but as I am really located inside a datacenter it is more than easy to get a bigger allocation.
Just get the /48 then. The 64 host bits of a /64 subnet do not exist in general IPv6 network planning/design. Every subnet/interface gets a /64.
-
Hey folks,
thanks for your replies! ;)
So far I understood this:- I need a larger assignment.
- I will assign an IPv6 from one of the subnets to pfsense,
- I will assign an IPv6 from any other subnet to the Servers,
- Routing is done magically? No one said anything about pfsense subnet configuration/ routes.
- As long as I do not add any allow rules my internal servers remain unreachable
Am I right? If so I shall request the larger subnet right now :)
-Chris. -
Hey,
anyone can check up on this?
Let's say my allocation would be: 2a01:ghgh:2000::/48, here is what I would do:
2a01:ghgh:2000::1/48 - Uplink (Out of my control)
2a01:ghgh:2000::2/48 - PFsense WAN ipwith that I can ping6 random remote target from my pfsense with great joy :) What I don't get is how I can connect any Server behind the pfsense via IPv6. What I gathered from here I need to subnet that net, let's say:
2a01:ghgh:2000::/50 - directly connected servers (pfsense, uplink)
2a01:ghgh:2000:4000::/50 - Should be assigned to servers on LAN
2a01:ghgh:2000:8000::/50 - unused
2a01:ghgh:2000:c000::/50 - unusedSo I need to configure the LAN interface on pfsense. So I drag my IPv4 memories in here:
2a01:ghgh:2000:4000::1/50 - pfsense LAN
2a01:ghgh:2000:4000::2/50 - first server (testserver)My testserver would be configured as follows:
2a01:ghgh:2000:4000::2/50 - eth0
2a01:ghgh:2000:4000::1/50 - default gwIn my imagination, backed with IPv4 goodness the testserver will ping6 some remote host, will see that it's not in the /50, will forward/use the :1 router. Pfsense will accept incoming on LAN 2a01:ghgh:2000:4000::1 and route it to the remote host.
In addition/ as bonus: As ther is not a single mention anywhere in any bgp full table about the 2a01:ghgh:2000::/50 reachable via 2a01:ghgh:2000::2/48 this also means I created some sort of private LAN?
Now where did my IPv4 knowledge kick me in the nuts?
Cheers,
-Christian -
"2a01:ghgh:2000::1/48 - Uplink (Out of my control)
2a01:ghgh:2000::2/48 - PFsense WAN ip"Wrong - that is not how you would do it..
Your uplink would not be a /48..
And you would create nothing but /64's behind pfsense..
If they allocated you a /48 that was routed to your pfsense via a transit - most likely some other /64 or could be say the 1st /64 out of the /48… you would then subnet down the /48 into /64's and use those on your segments behind pfsense.
Once you got your /48 the only time you wouldn't slice that down into /64s if you were going to allocate say /56 from that /48 to downstream routers that would have parts of those /56 broken up behind it into /64's from those /56's
-
Hey John,
thanks for answering. So I would go ahead and subnet 2a01:ghgh:2000::/48 into
2a01:ghgh:2000::/64
2a01:ghgh:2000:1::/64
2a01:ghgh:2000:2::/64
[…]My Uplink would stay the same, I would just use a different cidr for it?
2a01:ghgh:2000::1/64 - uplink
2a01:ghgh:2000::2/64 - pfsenseThen use
2a01:ghgh:2000:1::1/64 - pfsense (LAN)
2a01:ghgh:2000:1::2/64 - testserverfor the remainder?
Thanks for your support <3
-Chris. -
you but you don't know what the transit network might be - it could be the first /64 out of the /48 they give you, or could be something completely different.
-
Hey,
I am pretty sure there is no transit network at all. Pretty much that /47 is routed to my uplink port; pretty much any IP can be used as-is by onlining them to a server inside my (physical) network. Thats why I am puzzled on how all that subnetting is supposed to work and how pfsense is routing all that. More like that /64 you get on your broadband, I guess.
If I do assign the
2a01:ghgh:2000::1/64 - uplink
2a01:ghgh:2000::2/64 - pfsenseI can ping6 any ipv6 server in the world.
When I up all the ips like i said before and ping from somewhere else I can see icmp6 packets on the LAN interface with "neighbor solicitation".
Tried "ServicesDHCPv6 Server & RAINTERNETRouter Advertisements", "Router Only / FA Mode", -
If that's really the case your ISP are morons. If you're given a /48 there must be transit network involved to make any use of the /48 in any practical way, usually this transit is a /64 from a prefix that is completely distinct from the routed /48 although it's possible to use the first /64 from the /48 as the transit.
No, you don't subnet a flat /48 that is terminated at the ISP router without some serious hackery involving tools like NDP proxy (which is not included in pfSense to drive the point home) etc. The situation is completely analogous to IPv4 where routed subnets must have a transit network involved as well, you don't magically subnet a /24 down to smaller subnets just like that, you have to have transit networks in place.
-
Nono,
It seems that would be me- I never explicitly asked for a transfer network due to my lack of any skill with ipv6. Luckily this is not in production (thankfuly) so I can toy around with it until it works.
I requested a transfer net for my ipv6 allocation.
At least this makes a whole of a lot more sense now.
Thanks for helping. I'll let you know when I run into the next pitfall.-Chris.
-
Jeesh,
So I have my transfer net:
2a01:xyxy:5000:3::1/64 Their End
2a01:xyxy:5000:3::2/64 My EndI upped 2a01:xyxy:5000:3::2/64 as the WAN ip for pfsense. Ping6 form somewhere on the planet to 2a01:xyxy:5000:3::2 yields success. I added the default route to 2a01:xyxy:5000:3::1. Beyond that I have no clue on how to proceed.
If I take the first /64 of my /47 (2a01:xyxy:6000::1/47)
Yields me with 2a01:xyxy:6000::1/64…
Okay I admin I am at a total and utter loss here. My brain, after weeks of bashing against IPv6 can not connect the dots, or any dots here. In my 20 years in meddling with the Internet I never asked this: But can anyone tell me what IP goes hwere to get a single ping from a server to the outside? How to I do the transfer net pfsense style?
Thanks,
Christian. -
You keep saying /47. Is it really /47?
-
Hey,
yes, confirmed: /47. It's either /64 or /47. /64 was too small for people here so I went for /47.
-
You keep saying /47. Is it really /47?
Nothing wrong with a /47. While not common, it's twice the size of a /48.
