Migrating to IPv6

creiss

Hey folks,

thanks for your replies! ;)
So far I understood this:

I need a larger assignment.
I will assign an IPv6 from one of the subnets to pfsense,
I will assign an IPv6 from any other subnet to the Servers,
Routing is done magically? No one said anything about pfsense subnet configuration/ routes.
As long as I do not add any allow rules my internal servers remain unreachable

Am I right? If so I shall request the larger subnet right now :)
-Chris.

creiss

Hey,

anyone can check up on this?

Let's say my allocation would be: 2a01:ghgh:2000::/48, here is what I would do:

2a01:ghgh:2000::1/48 - Uplink (Out of my control)
2a01:ghgh:2000::2/48 - PFsense WAN ip

with that I can ping6 random remote target from my pfsense with great joy :) What I don't get is how I can connect any Server behind the pfsense via IPv6. What I gathered from here I need to subnet that net, let's say:

2a01:ghgh:2000::/50 - directly connected servers (pfsense, uplink)
2a01:ghgh:2000:4000::/50 - Should be assigned to servers on LAN
2a01:ghgh:2000:8000::/50 - unused
2a01:ghgh:2000:c000::/50 - unused

So I need to configure the LAN interface on pfsense. So I drag my IPv4 memories in here:

2a01:ghgh:2000:4000::1/50 - pfsense LAN
2a01:ghgh:2000:4000::2/50 - first server (testserver)

My testserver would be configured as follows:

2a01:ghgh:2000:4000::2/50 - eth0
2a01:ghgh:2000:4000::1/50 - default gw

In my imagination, backed with IPv4 goodness the testserver will ping6 some remote host, will see that it's not in the /50, will forward/use the :1 router. Pfsense will accept incoming on LAN 2a01:ghgh:2000:4000::1 and route it to the remote host.

In addition/ as bonus: As ther is not a single mention anywhere in any bgp full table about the 2a01:ghgh:2000::/50 reachable via 2a01:ghgh:2000::2/48 this also means I created some sort of private LAN?

Now where did my IPv4 knowledge kick me in the nuts?

Cheers,
-Christian

johnpoz

"2a01:ghgh:2000::1/48 - Uplink (Out of my control)
2a01:ghgh:2000::2/48 - PFsense WAN ip"

Wrong - that is not how you would do it..

Your uplink would not be a /48..

And you would create nothing but /64's behind pfsense..

If they allocated you a /48 that was routed to your pfsense via a transit - most likely some other /64 or could be say the 1st /64 out of the /48… you would then subnet down the /48 into /64's and use those on your segments behind pfsense.

Once you got your /48 the only time you wouldn't slice that down into /64s if you were going to allocate say /56 from that /48 to downstream routers that would have parts of those /56 broken up behind it into /64's from those /56's

creiss

Hey John,

thanks for answering. So I would go ahead and subnet 2a01:ghgh:2000::/48 into

2a01:ghgh:2000::/64
2a01:ghgh:2000:1::/64
2a01:ghgh:2000:2::/64
[…]

My Uplink would stay the same, I would just use a different cidr for it?

2a01:ghgh:2000::1/64 - uplink
2a01:ghgh:2000::2/64 - pfsense

Then use

2a01:ghgh:2000:1::1/64 - pfsense (LAN)
2a01:ghgh:2000:1::2/64 - testserver

for the remainder?

Thanks for your support <3
-Chris.

johnpoz

you but you don't know what the transit network might be - it could be the first /64 out of the /48 they give you, or could be something completely different.

creiss

Hey,

I am pretty sure there is no transit network at all. Pretty much that /47 is routed to my uplink port; pretty much any IP can be used as-is by onlining them to a server inside my (physical) network. Thats why I am puzzled on how all that subnetting is supposed to work and how pfsense is routing all that. More like that /64 you get on your broadband, I guess.

If I do assign the

2a01:ghgh:2000::1/64 - uplink
2a01:ghgh:2000::2/64 - pfsense

I can ping6 any ipv6 server in the world.

When I up all the ips like i said before and ping from somewhere else I can see icmp6 packets on the LAN interface with "neighbor solicitation".
Tried "ServicesDHCPv6 Server & RAINTERNETRouter Advertisements", "Router Only / FA Mode",

kpa

If that's really the case your ISP are morons. If you're given a /48 there must be transit network involved to make any use of the /48 in any practical way, usually this transit is a /64 from a prefix that is completely distinct from the routed /48 although it's possible to use the first /64 from the /48 as the transit.

No, you don't subnet a flat /48 that is terminated at the ISP router without some serious hackery involving tools like NDP proxy (which is not included in pfSense to drive the point home) etc. The situation is completely analogous to IPv4 where routed subnets must have a transit network involved as well, you don't magically subnet a /24 down to smaller subnets just like that, you have to have transit networks in place.

creiss

Nono,

It seems that would be me- I never explicitly asked for a transfer network due to my lack of any skill with ipv6. Luckily this is not in production (thankfuly) so I can toy around with it until it works.

I requested a transfer net for my ipv6 allocation.

At least this makes a whole of a lot more sense now.
Thanks for helping. I'll let you know when I run into the next pitfall.

-Chris.

creiss

Jeesh,

So I have my transfer net:

2a01:xyxy:5000:3::1/64 Their End
2a01:xyxy:5000:3::2/64 My End

I upped 2a01:xyxy:5000:3::2/64 as the WAN ip for pfsense. Ping6 form somewhere on the planet to 2a01:xyxy:5000:3::2 yields success. I added the default route to 2a01:xyxy:5000:3::1. Beyond that I have no clue on how to proceed.

If I take the first /64 of my /47 (2a01:xyxy:6000::1/47)

Yields me with 2a01:xyxy:6000::1/64…

Okay I admin I am at a total and utter loss here. My brain, after weeks of bashing against IPv6 can not connect the dots, or any dots here. In my 20 years in meddling with the Internet I never asked this: But can anyone tell me what IP goes hwere to get a single ping from a server to the outside? How to I do the transfer net pfsense style?

Thanks,
Christian.

Derelict

You keep saying /47. Is it really /47?

creiss

Hey,

yes, confirmed: /47. It's either /64 or /47. /64 was too small for people here so I went for /47.

JKnott

You keep saying /47. Is it really /47?

Nothing wrong with a /47. While not common, it's twice the size of a /48.

johnpoz

So you go from a /64 to a /47 which is 128K /64's - wtf is this DC thinking??

Well put ::1 on pfsense lan side interface - then on box on this lan use ::2 in your /64 set its gateway to ::1

Allow ipv6 on that interface and your ready to rock.. You can get fancy with auto handing out IPs, etc. etc. after you get your pinging working.

Then to allow internet to get to that box - just put the rules on your wan to allow the IPv6 to where you want to allow it an what protocol, etc.

Derelict

Zero reason to stray from the expected /48, which lies not only on a hex digit boundary but a : group boundary as well.

If it is going to be split into multiple /48s it should probably be a routed /40 or /44 instead.

But whatever. Like you said it's not against any rules. Just unexpected.

creiss

@johnpoz:

Well put ::1 on pfsense lan side interface - then on box on this lan use ::2 in your /64 set its gateway to ::1

Hey,

Thanks <3
And 2a01:xyxy:5000:3::2/64 in WAN with 2a01:xyxy:5000:3::1/64 as default GW, right?

-Chris

creiss

HOLY JEBUS!

After whacking my head against this and doubting my networking skills… I got it running. Turns out: A rogue IPMI from (older) testing times was also using the same IP used for the transfer net. This resulted in some kind of wierdness.

Deactivated ipv6 on said ipmi, everything is working.

Thanks all you rock!
I can rest easy tonight.

\o/
-Chris.