Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Migrating to IPv6

    Scheduled Pinned Locked Moved IPv6
    28 Posts 7 Posters 4.6k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • johnpozJ
      johnpoz LAYER 8 Global Moderator
      last edited by

      "2a01:ghgh:2000::1/48 - Uplink (Out of my control)
      2a01:ghgh:2000::2/48 - PFsense WAN ip"

      Wrong - that is not how you would do it..

      Your uplink would not be a /48..

      And you would create nothing but /64's behind pfsense..

      If they allocated you a /48 that was routed to your pfsense via a transit - most likely some other /64 or could be say the 1st /64 out of the /48…  you would then subnet down the /48 into /64's and use those on your segments behind pfsense.

      Once you got your /48 the only time you wouldn't slice that down into /64s if you were going to allocate say /56 from that /48 to downstream routers that would have parts of those /56 broken up behind it into /64's from those /56's

      An intelligent man is sometimes forced to be drunk to spend time with his fools
      If you get confused: Listen to the Music Play
      Please don't Chat/PM me for help, unless mod related
      SG-4860 24.11 | Lab VMs 2.8, 24.11

      1 Reply Last reply Reply Quote 0
      • C
        creiss
        last edited by

        Hey John,

        thanks for answering. So I would go ahead and subnet 2a01:ghgh:2000::/48 into

        2a01:ghgh:2000::/64
        2a01:ghgh:2000:1::/64
        2a01:ghgh:2000:2::/64
        […]

        My Uplink would stay the same, I would just use a different cidr for it?

        2a01:ghgh:2000::1/64 - uplink
        2a01:ghgh:2000::2/64 - pfsense

        Then use

        2a01:ghgh:2000:1::1/64 - pfsense (LAN)
        2a01:ghgh:2000:1::2/64 - testserver

        for the remainder?

        Thanks for your support <3
        -Chris.

        1 Reply Last reply Reply Quote 0
        • johnpozJ
          johnpoz LAYER 8 Global Moderator
          last edited by

          you but you don't know what the transit network might be - it could be the first /64 out of the /48 they give you, or could be something completely different.

          An intelligent man is sometimes forced to be drunk to spend time with his fools
          If you get confused: Listen to the Music Play
          Please don't Chat/PM me for help, unless mod related
          SG-4860 24.11 | Lab VMs 2.8, 24.11

          1 Reply Last reply Reply Quote 0
          • C
            creiss
            last edited by

            Hey,

            I am pretty sure there is no transit network at all. Pretty much that /47 is routed to my uplink port; pretty much any IP can be used as-is by onlining them to a server inside my (physical) network. Thats why I am puzzled on how all that subnetting is supposed to work and how pfsense is routing all that.  More like that /64 you get on your broadband, I guess.

            If I do assign the

            2a01:ghgh:2000::1/64 - uplink
            2a01:ghgh:2000::2/64 - pfsense

            I can ping6 any ipv6 server in the world.

            When I up all the ips like i said before and ping from somewhere else I can see icmp6 packets on the LAN interface with "neighbor solicitation".
            Tried "ServicesDHCPv6 Server & RAINTERNETRouter Advertisements", "Router Only / FA Mode",

            1 Reply Last reply Reply Quote 0
            • K
              kpa
              last edited by

              If that's really the case your ISP are morons. If you're given a /48 there must be transit network involved to make any use of the /48 in any practical way, usually this transit is a /64 from a prefix that is completely distinct from the routed /48 although it's possible to use the first /64 from the /48 as the transit.

              No, you don't subnet a flat /48 that is terminated at the ISP router without some serious hackery involving tools like NDP proxy (which is not included in pfSense to drive the point home) etc. The situation is completely analogous to IPv4 where routed subnets must have a transit network involved as well, you don't magically subnet a /24 down to smaller subnets just like that, you have to have transit networks in place.

              1 Reply Last reply Reply Quote 0
              • C
                creiss
                last edited by

                Nono,

                It seems that would be me-  I never explicitly asked for a transfer network due to my lack of any skill with ipv6. Luckily this is not in production (thankfuly) so I can toy around with it until it works.

                I requested a transfer net for my ipv6 allocation.

                At least this makes a whole of a lot more sense now.
                Thanks for helping. I'll let you know when I run into the next pitfall.

                -Chris.

                1 Reply Last reply Reply Quote 0
                • C
                  creiss
                  last edited by

                  Jeesh,

                  So I have my transfer net:

                  2a01:xyxy:5000:3::1/64 Their End
                  2a01:xyxy:5000:3::2/64 My End

                  I upped 2a01:xyxy:5000:3::2/64 as the WAN ip for pfsense. Ping6 form somewhere on the planet to 2a01:xyxy:5000:3::2 yields success. I added the default route to 2a01:xyxy:5000:3::1. Beyond that I have no clue on how to proceed.

                  If I take the first /64 of my /47 (2a01:xyxy:6000::1/47)

                  Yields me with 2a01:xyxy:6000::1/64…

                  Okay I admin I am at a total and utter loss here. My brain, after weeks of bashing against IPv6 can not connect the dots, or any dots here. In my 20 years in meddling with the Internet I never asked this: But can anyone tell me what IP goes hwere to get a single ping from a server to the outside? How to I do the transfer net pfsense style?

                  Thanks,
                  Christian.

                  1 Reply Last reply Reply Quote 0
                  • DerelictD
                    Derelict LAYER 8 Netgate
                    last edited by

                    You keep saying /47. Is it really /47?

                    Chattanooga, Tennessee, USA
                    A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                    DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                    Do Not Chat For Help! NO_WAN_EGRESS(TM)

                    1 Reply Last reply Reply Quote 0
                    • C
                      creiss
                      last edited by

                      Hey,

                      yes, confirmed: /47. It's either /64 or /47. /64 was too small for people here so I went for /47.

                      1 Reply Last reply Reply Quote 0
                      • JKnottJ
                        JKnott
                        last edited by

                        You keep saying /47. Is it really /47?

                        Nothing wrong with a /47.  While not common, it's twice the size of a /48.

                        PfSense running on Qotom mini PC
                        i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                        UniFi AC-Lite access point

                        I haven't lost my mind. It's around here...somewhere...

                        1 Reply Last reply Reply Quote 0
                        • johnpozJ
                          johnpoz LAYER 8 Global Moderator
                          last edited by

                          So you go from a /64 to a /47 which is 128K /64's - wtf is this DC thinking??

                          Well put ::1 on pfsense lan side interface - then on box on this lan use ::2 in your /64 set its gateway to ::1

                          Allow ipv6 on that interface and your ready to rock..  You can get fancy with auto handing out IPs, etc. etc. after you get your pinging working.

                          Then to allow internet to get to that box - just put the rules on your wan to allow the IPv6 to where you want to allow it an what protocol, etc.

                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                          If you get confused: Listen to the Music Play
                          Please don't Chat/PM me for help, unless mod related
                          SG-4860 24.11 | Lab VMs 2.8, 24.11

                          1 Reply Last reply Reply Quote 0
                          • DerelictD
                            Derelict LAYER 8 Netgate
                            last edited by

                            Zero reason to stray from the expected /48, which lies not only on a hex digit boundary but a : group boundary as well.

                            If it is going to be split into multiple /48s it should probably be a routed /40 or /44 instead.

                            But whatever. Like you said it's not against any rules. Just unexpected.

                            Chattanooga, Tennessee, USA
                            A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                            DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                            Do Not Chat For Help! NO_WAN_EGRESS(TM)

                            1 Reply Last reply Reply Quote 0
                            • C
                              creiss
                              last edited by

                              @johnpoz:

                              Well put ::1 on pfsense lan side interface - then on box on this lan use ::2 in your /64 set its gateway to ::1

                              Hey,

                              Thanks <3
                              And 2a01:xyxy:5000:3::2/64 in WAN with 2a01:xyxy:5000:3::1/64 as default GW, right?

                              -Chris

                              1 Reply Last reply Reply Quote 0
                              • C
                                creiss
                                last edited by

                                HOLY JEBUS!

                                After whacking my head against this and doubting my networking skills… I got it running. Turns out: A rogue IPMI from (older) testing times was also using the same IP used for the transfer net. This resulted in some kind of wierdness.

                                Deactivated ipv6 on said ipmi, everything is working.

                                Thanks all you rock!
                                I can rest easy tonight.

                                \o/
                                -Chris.

                                1 Reply Last reply Reply Quote 0
                                • First post
                                  Last post
                                Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.