Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Migrating to IPv6

    Scheduled Pinned Locked Moved IPv6
    28 Posts 7 Posters 4.6k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • MikeV7896M
      MikeV7896
      last edited by

      @JKnott:

      Indeed my ISP gave me a /48 for home use.

      <sniff!>Mine only gave me a /56</sniff!>     ;)

      Quit complaining… mine only lets me get a /60. Not that I'm using 16 /64's... I'm not even using 8... but I am using more than one.

      The S in IOT stands for Security

      1 Reply Last reply Reply Quote 0
      • johnpozJ
        johnpoz LAYER 8 Global Moderator
        last edited by

        "or /64 subnetted into many /whatever"

        Because that is not really a viable option - the smallest segment with ipv6 is designed to be a /64..  Even a transit network would be a /64 by design…

        I use to have a hard time trying to understand the waste it seems is being done here - and that we could do the same nonsense that used up all the ipv4 space.. Hey school you want to get on the internet, hey sure here is a /8 to use ;)

        You may feel this way until you truly grasp the size of the ipv6 address space.. I at one time thought - what the hell even if you have what seems like infinite space, if you waste it - you could fill it up.. Do the math though ;)  And how many grains of sand on the planet.. There are more /64's in the space than that...

        An intelligent man is sometimes forced to be drunk to spend time with his fools
        If you get confused: Listen to the Music Play
        Please don't Chat/PM me for help, unless mod related
        SG-4860 24.11 | Lab VMs 2.7.2, 24.11

        1 Reply Last reply Reply Quote 0
        • JKnottJ
          JKnott
          last edited by

          Because that is not really a viable option - the smallest segment with ipv6 is designed to be a /64..  Even a transit network would be a /64 by design…

          I believe a point to point link with a /126 or /127 is supported.  Of course, with IPv6, you don't even need a global address for routers.  Link local works fine.  With a point-point link, you don't even have to specify an IP address.  Just say the route it out that interface.  Of course, that works with IPv4 too.

          PfSense running on Qotom mini PC
          i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
          UniFi AC-Lite access point

          I haven't lost my mind. It's around here...somewhere...

          1 Reply Last reply Reply Quote 0
          • johnpozJ
            johnpoz LAYER 8 Global Moderator
            last edited by

            /127 would be point to point in IPv6 – point I was trying to make is the really the smallest network you would ever use which would be a transit network - they are not always point to point ;)

            If your creating static point to point IPs on a link - none of the normal fundamentals come to play..  It most likely some special hardware doing routing, or running a routing distro, etc.  For sake of discussion with migration to ipv6 for his network the smallest prefix you would use is /64..

            An intelligent man is sometimes forced to be drunk to spend time with his fools
            If you get confused: Listen to the Music Play
            Please don't Chat/PM me for help, unless mod related
            SG-4860 24.11 | Lab VMs 2.7.2, 24.11

            1 Reply Last reply Reply Quote 0
            • DerelictD
              Derelict LAYER 8 Netgate
              last edited by

              Yes they routed a /64 to me but as I am really located inside a datacenter it is more than easy to get a bigger allocation.

              Just get the /48 then. The 64 host bits of a /64 subnet do not exist in general IPv6 network planning/design. Every subnet/interface gets a /64.

              Chattanooga, Tennessee, USA
              A comprehensive network diagram is worth 10,000 words and 15 conference calls.
              DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
              Do Not Chat For Help! NO_WAN_EGRESS(TM)

              1 Reply Last reply Reply Quote 0
              • C
                creiss
                last edited by

                Hey folks,

                thanks for your replies! ;)
                So far I understood this:

                • I need a larger assignment.
                • I will assign an IPv6 from one of the subnets to pfsense,
                • I will assign an IPv6 from any other subnet to the Servers,
                • Routing is done magically? No one said anything about pfsense subnet configuration/ routes.
                • As long as I do not add any allow rules my internal servers remain unreachable

                Am I right? If so I shall request the larger subnet right now :)
                -Chris.

                1 Reply Last reply Reply Quote 0
                • C
                  creiss
                  last edited by

                  Hey,

                  anyone can check up on this?

                  Let's say my allocation would be: 2a01:ghgh:2000::/48, here  is what I would do:

                  2a01:ghgh:2000::1/48 - Uplink (Out of my control)
                  2a01:ghgh:2000::2/48 - PFsense WAN ip

                  with that I can ping6 random remote target from my pfsense with great joy :) What I don't get is how I can connect any Server behind the pfsense via IPv6. What I gathered from here I need to subnet that net, let's say:

                  2a01:ghgh:2000::/50 - directly connected servers (pfsense, uplink)
                  2a01:ghgh:2000:4000::/50 - Should be assigned to servers on LAN
                  2a01:ghgh:2000:8000::/50 - unused
                  2a01:ghgh:2000:c000::/50 - unused

                  So I need to configure the LAN interface on pfsense. So I drag my IPv4 memories in here:

                  2a01:ghgh:2000:4000::1/50 - pfsense LAN
                  2a01:ghgh:2000:4000::2/50 - first server (testserver)

                  My testserver would be configured as follows:

                  2a01:ghgh:2000:4000::2/50 - eth0
                  2a01:ghgh:2000:4000::1/50 - default gw

                  In my imagination, backed with IPv4 goodness the testserver will ping6 some remote host, will see that it's not in the /50, will forward/use the :1 router. Pfsense will accept incoming on LAN 2a01:ghgh:2000:4000::1 and route it to the remote host.

                  In addition/ as bonus: As ther is not a single mention anywhere in any bgp full table about the 2a01:ghgh:2000::/50 reachable via 2a01:ghgh:2000::2/48 this also means I created some sort of private LAN?

                  Now where did my  IPv4 knowledge kick me in the nuts?

                  Cheers,
                  -Christian

                  1 Reply Last reply Reply Quote 0
                  • johnpozJ
                    johnpoz LAYER 8 Global Moderator
                    last edited by

                    "2a01:ghgh:2000::1/48 - Uplink (Out of my control)
                    2a01:ghgh:2000::2/48 - PFsense WAN ip"

                    Wrong - that is not how you would do it..

                    Your uplink would not be a /48..

                    And you would create nothing but /64's behind pfsense..

                    If they allocated you a /48 that was routed to your pfsense via a transit - most likely some other /64 or could be say the 1st /64 out of the /48…  you would then subnet down the /48 into /64's and use those on your segments behind pfsense.

                    Once you got your /48 the only time you wouldn't slice that down into /64s if you were going to allocate say /56 from that /48 to downstream routers that would have parts of those /56 broken up behind it into /64's from those /56's

                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                    If you get confused: Listen to the Music Play
                    Please don't Chat/PM me for help, unless mod related
                    SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                    1 Reply Last reply Reply Quote 0
                    • C
                      creiss
                      last edited by

                      Hey John,

                      thanks for answering. So I would go ahead and subnet 2a01:ghgh:2000::/48 into

                      2a01:ghgh:2000::/64
                      2a01:ghgh:2000:1::/64
                      2a01:ghgh:2000:2::/64
                      […]

                      My Uplink would stay the same, I would just use a different cidr for it?

                      2a01:ghgh:2000::1/64 - uplink
                      2a01:ghgh:2000::2/64 - pfsense

                      Then use

                      2a01:ghgh:2000:1::1/64 - pfsense (LAN)
                      2a01:ghgh:2000:1::2/64 - testserver

                      for the remainder?

                      Thanks for your support <3
                      -Chris.

                      1 Reply Last reply Reply Quote 0
                      • johnpozJ
                        johnpoz LAYER 8 Global Moderator
                        last edited by

                        you but you don't know what the transit network might be - it could be the first /64 out of the /48 they give you, or could be something completely different.

                        An intelligent man is sometimes forced to be drunk to spend time with his fools
                        If you get confused: Listen to the Music Play
                        Please don't Chat/PM me for help, unless mod related
                        SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                        1 Reply Last reply Reply Quote 0
                        • C
                          creiss
                          last edited by

                          Hey,

                          I am pretty sure there is no transit network at all. Pretty much that /47 is routed to my uplink port; pretty much any IP can be used as-is by onlining them to a server inside my (physical) network. Thats why I am puzzled on how all that subnetting is supposed to work and how pfsense is routing all that.  More like that /64 you get on your broadband, I guess.

                          If I do assign the

                          2a01:ghgh:2000::1/64 - uplink
                          2a01:ghgh:2000::2/64 - pfsense

                          I can ping6 any ipv6 server in the world.

                          When I up all the ips like i said before and ping from somewhere else I can see icmp6 packets on the LAN interface with "neighbor solicitation".
                          Tried "ServicesDHCPv6 Server & RAINTERNETRouter Advertisements", "Router Only / FA Mode",

                          1 Reply Last reply Reply Quote 0
                          • K
                            kpa
                            last edited by

                            If that's really the case your ISP are morons. If you're given a /48 there must be transit network involved to make any use of the /48 in any practical way, usually this transit is a /64 from a prefix that is completely distinct from the routed /48 although it's possible to use the first /64 from the /48 as the transit.

                            No, you don't subnet a flat /48 that is terminated at the ISP router without some serious hackery involving tools like NDP proxy (which is not included in pfSense to drive the point home) etc. The situation is completely analogous to IPv4 where routed subnets must have a transit network involved as well, you don't magically subnet a /24 down to smaller subnets just like that, you have to have transit networks in place.

                            1 Reply Last reply Reply Quote 0
                            • C
                              creiss
                              last edited by

                              Nono,

                              It seems that would be me-  I never explicitly asked for a transfer network due to my lack of any skill with ipv6. Luckily this is not in production (thankfuly) so I can toy around with it until it works.

                              I requested a transfer net for my ipv6 allocation.

                              At least this makes a whole of a lot more sense now.
                              Thanks for helping. I'll let you know when I run into the next pitfall.

                              -Chris.

                              1 Reply Last reply Reply Quote 0
                              • C
                                creiss
                                last edited by

                                Jeesh,

                                So I have my transfer net:

                                2a01:xyxy:5000:3::1/64 Their End
                                2a01:xyxy:5000:3::2/64 My End

                                I upped 2a01:xyxy:5000:3::2/64 as the WAN ip for pfsense. Ping6 form somewhere on the planet to 2a01:xyxy:5000:3::2 yields success. I added the default route to 2a01:xyxy:5000:3::1. Beyond that I have no clue on how to proceed.

                                If I take the first /64 of my /47 (2a01:xyxy:6000::1/47)

                                Yields me with 2a01:xyxy:6000::1/64…

                                Okay I admin I am at a total and utter loss here. My brain, after weeks of bashing against IPv6 can not connect the dots, or any dots here. In my 20 years in meddling with the Internet I never asked this: But can anyone tell me what IP goes hwere to get a single ping from a server to the outside? How to I do the transfer net pfsense style?

                                Thanks,
                                Christian.

                                1 Reply Last reply Reply Quote 0
                                • DerelictD
                                  Derelict LAYER 8 Netgate
                                  last edited by

                                  You keep saying /47. Is it really /47?

                                  Chattanooga, Tennessee, USA
                                  A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                  DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                  Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                  1 Reply Last reply Reply Quote 0
                                  • C
                                    creiss
                                    last edited by

                                    Hey,

                                    yes, confirmed: /47. It's either /64 or /47. /64 was too small for people here so I went for /47.

                                    1 Reply Last reply Reply Quote 0
                                    • JKnottJ
                                      JKnott
                                      last edited by

                                      You keep saying /47. Is it really /47?

                                      Nothing wrong with a /47.  While not common, it's twice the size of a /48.

                                      PfSense running on Qotom mini PC
                                      i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                                      UniFi AC-Lite access point

                                      I haven't lost my mind. It's around here...somewhere...

                                      1 Reply Last reply Reply Quote 0
                                      • johnpozJ
                                        johnpoz LAYER 8 Global Moderator
                                        last edited by

                                        So you go from a /64 to a /47 which is 128K /64's - wtf is this DC thinking??

                                        Well put ::1 on pfsense lan side interface - then on box on this lan use ::2 in your /64 set its gateway to ::1

                                        Allow ipv6 on that interface and your ready to rock..  You can get fancy with auto handing out IPs, etc. etc. after you get your pinging working.

                                        Then to allow internet to get to that box - just put the rules on your wan to allow the IPv6 to where you want to allow it an what protocol, etc.

                                        An intelligent man is sometimes forced to be drunk to spend time with his fools
                                        If you get confused: Listen to the Music Play
                                        Please don't Chat/PM me for help, unless mod related
                                        SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                                        1 Reply Last reply Reply Quote 0
                                        • DerelictD
                                          Derelict LAYER 8 Netgate
                                          last edited by

                                          Zero reason to stray from the expected /48, which lies not only on a hex digit boundary but a : group boundary as well.

                                          If it is going to be split into multiple /48s it should probably be a routed /40 or /44 instead.

                                          But whatever. Like you said it's not against any rules. Just unexpected.

                                          Chattanooga, Tennessee, USA
                                          A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                          DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                          Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                          1 Reply Last reply Reply Quote 0
                                          • C
                                            creiss
                                            last edited by

                                            @johnpoz:

                                            Well put ::1 on pfsense lan side interface - then on box on this lan use ::2 in your /64 set its gateway to ::1

                                            Hey,

                                            Thanks <3
                                            And 2a01:xyxy:5000:3::2/64 in WAN with 2a01:xyxy:5000:3::1/64 as default GW, right?

                                            -Chris

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.