• Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login
Netgate Discussion Forum
  • Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login

Migrating to IPv6

Scheduled Pinned Locked Moved IPv6
28 Posts 7 Posters 4.6k Views
Loading More Posts
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • J
    johnpoz LAYER 8 Global Moderator
    last edited by Jun 7, 2017, 8:54 PM

    "2a01:ghgh:2000::1/48 - Uplink (Out of my control)
    2a01:ghgh:2000::2/48 - PFsense WAN ip"

    Wrong - that is not how you would do it..

    Your uplink would not be a /48..

    And you would create nothing but /64's behind pfsense..

    If they allocated you a /48 that was routed to your pfsense via a transit - most likely some other /64 or could be say the 1st /64 out of the /48…  you would then subnet down the /48 into /64's and use those on your segments behind pfsense.

    Once you got your /48 the only time you wouldn't slice that down into /64s if you were going to allocate say /56 from that /48 to downstream routers that would have parts of those /56 broken up behind it into /64's from those /56's

    An intelligent man is sometimes forced to be drunk to spend time with his fools
    If you get confused: Listen to the Music Play
    Please don't Chat/PM me for help, unless mod related
    SG-4860 24.11 | Lab VMs 2.8, 24.11

    1 Reply Last reply Reply Quote 0
    • C
      creiss
      last edited by Jun 7, 2017, 9:02 PM

      Hey John,

      thanks for answering. So I would go ahead and subnet 2a01:ghgh:2000::/48 into

      2a01:ghgh:2000::/64
      2a01:ghgh:2000:1::/64
      2a01:ghgh:2000:2::/64
      […]

      My Uplink would stay the same, I would just use a different cidr for it?

      2a01:ghgh:2000::1/64 - uplink
      2a01:ghgh:2000::2/64 - pfsense

      Then use

      2a01:ghgh:2000:1::1/64 - pfsense (LAN)
      2a01:ghgh:2000:1::2/64 - testserver

      for the remainder?

      Thanks for your support <3
      -Chris.

      1 Reply Last reply Reply Quote 0
      • J
        johnpoz LAYER 8 Global Moderator
        last edited by Jun 8, 2017, 12:03 AM

        you but you don't know what the transit network might be - it could be the first /64 out of the /48 they give you, or could be something completely different.

        An intelligent man is sometimes forced to be drunk to spend time with his fools
        If you get confused: Listen to the Music Play
        Please don't Chat/PM me for help, unless mod related
        SG-4860 24.11 | Lab VMs 2.8, 24.11

        1 Reply Last reply Reply Quote 0
        • C
          creiss
          last edited by Jun 8, 2017, 6:16 AM

          Hey,

          I am pretty sure there is no transit network at all. Pretty much that /47 is routed to my uplink port; pretty much any IP can be used as-is by onlining them to a server inside my (physical) network. Thats why I am puzzled on how all that subnetting is supposed to work and how pfsense is routing all that.  More like that /64 you get on your broadband, I guess.

          If I do assign the

          2a01:ghgh:2000::1/64 - uplink
          2a01:ghgh:2000::2/64 - pfsense

          I can ping6 any ipv6 server in the world.

          When I up all the ips like i said before and ping from somewhere else I can see icmp6 packets on the LAN interface with "neighbor solicitation".
          Tried "ServicesDHCPv6 Server & RAINTERNETRouter Advertisements", "Router Only / FA Mode",

          1 Reply Last reply Reply Quote 0
          • K
            kpa
            last edited by Jun 8, 2017, 7:26 AM Jun 8, 2017, 7:20 AM

            If that's really the case your ISP are morons. If you're given a /48 there must be transit network involved to make any use of the /48 in any practical way, usually this transit is a /64 from a prefix that is completely distinct from the routed /48 although it's possible to use the first /64 from the /48 as the transit.

            No, you don't subnet a flat /48 that is terminated at the ISP router without some serious hackery involving tools like NDP proxy (which is not included in pfSense to drive the point home) etc. The situation is completely analogous to IPv4 where routed subnets must have a transit network involved as well, you don't magically subnet a /24 down to smaller subnets just like that, you have to have transit networks in place.

            1 Reply Last reply Reply Quote 0
            • C
              creiss
              last edited by Jun 8, 2017, 7:42 AM

              Nono,

              It seems that would be me-  I never explicitly asked for a transfer network due to my lack of any skill with ipv6. Luckily this is not in production (thankfuly) so I can toy around with it until it works.

              I requested a transfer net for my ipv6 allocation.

              At least this makes a whole of a lot more sense now.
              Thanks for helping. I'll let you know when I run into the next pitfall.

              -Chris.

              1 Reply Last reply Reply Quote 0
              • C
                creiss
                last edited by Jun 8, 2017, 9:52 PM

                Jeesh,

                So I have my transfer net:

                2a01:xyxy:5000:3::1/64 Their End
                2a01:xyxy:5000:3::2/64 My End

                I upped 2a01:xyxy:5000:3::2/64 as the WAN ip for pfsense. Ping6 form somewhere on the planet to 2a01:xyxy:5000:3::2 yields success. I added the default route to 2a01:xyxy:5000:3::1. Beyond that I have no clue on how to proceed.

                If I take the first /64 of my /47 (2a01:xyxy:6000::1/47)

                Yields me with 2a01:xyxy:6000::1/64…

                Okay I admin I am at a total and utter loss here. My brain, after weeks of bashing against IPv6 can not connect the dots, or any dots here. In my 20 years in meddling with the Internet I never asked this: But can anyone tell me what IP goes hwere to get a single ping from a server to the outside? How to I do the transfer net pfsense style?

                Thanks,
                Christian.

                1 Reply Last reply Reply Quote 0
                • D
                  Derelict LAYER 8 Netgate
                  last edited by Jun 9, 2017, 12:01 AM

                  You keep saying /47. Is it really /47?

                  Chattanooga, Tennessee, USA
                  A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                  DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                  Do Not Chat For Help! NO_WAN_EGRESS(TM)

                  1 Reply Last reply Reply Quote 0
                  • C
                    creiss
                    last edited by Jun 9, 2017, 5:51 AM

                    Hey,

                    yes, confirmed: /47. It's either /64 or /47. /64 was too small for people here so I went for /47.

                    1 Reply Last reply Reply Quote 0
                    • J
                      JKnott
                      last edited by Jun 9, 2017, 5:49 PM

                      You keep saying /47. Is it really /47?

                      Nothing wrong with a /47.  While not common, it's twice the size of a /48.

                      PfSense running on Qotom mini PC
                      i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                      UniFi AC-Lite access point

                      I haven't lost my mind. It's around here...somewhere...

                      1 Reply Last reply Reply Quote 0
                      • J
                        johnpoz LAYER 8 Global Moderator
                        last edited by Jun 9, 2017, 6:04 PM

                        So you go from a /64 to a /47 which is 128K /64's - wtf is this DC thinking??

                        Well put ::1 on pfsense lan side interface - then on box on this lan use ::2 in your /64 set its gateway to ::1

                        Allow ipv6 on that interface and your ready to rock..  You can get fancy with auto handing out IPs, etc. etc. after you get your pinging working.

                        Then to allow internet to get to that box - just put the rules on your wan to allow the IPv6 to where you want to allow it an what protocol, etc.

                        An intelligent man is sometimes forced to be drunk to spend time with his fools
                        If you get confused: Listen to the Music Play
                        Please don't Chat/PM me for help, unless mod related
                        SG-4860 24.11 | Lab VMs 2.8, 24.11

                        1 Reply Last reply Reply Quote 0
                        • D
                          Derelict LAYER 8 Netgate
                          last edited by Jun 9, 2017, 7:28 PM

                          Zero reason to stray from the expected /48, which lies not only on a hex digit boundary but a : group boundary as well.

                          If it is going to be split into multiple /48s it should probably be a routed /40 or /44 instead.

                          But whatever. Like you said it's not against any rules. Just unexpected.

                          Chattanooga, Tennessee, USA
                          A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                          DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                          Do Not Chat For Help! NO_WAN_EGRESS(TM)

                          1 Reply Last reply Reply Quote 0
                          • C
                            creiss
                            last edited by Jun 9, 2017, 7:55 PM

                            @johnpoz:

                            Well put ::1 on pfsense lan side interface - then on box on this lan use ::2 in your /64 set its gateway to ::1

                            Hey,

                            Thanks <3
                            And 2a01:xyxy:5000:3::2/64 in WAN with 2a01:xyxy:5000:3::1/64 as default GW, right?

                            -Chris

                            1 Reply Last reply Reply Quote 0
                            • C
                              creiss
                              last edited by Jun 9, 2017, 9:41 PM

                              HOLY JEBUS!

                              After whacking my head against this and doubting my networking skills… I got it running. Turns out: A rogue IPMI from (older) testing times was also using the same IP used for the transfer net. This resulted in some kind of wierdness.

                              Deactivated ipv6 on said ipmi, everything is working.

                              Thanks all you rock!
                              I can rest easy tonight.

                              \o/
                              -Chris.

                              1 Reply Last reply Reply Quote 0
                              28 out of 28
                              • First post
                                28/28
                                Last post
                              Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.
                                This community forum collects and processes your personal information.
                                consent.not_received