Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    WAN and LAN IPv6

    Scheduled Pinned Locked Moved IPv6
    36 Posts 2 Posters 7.4k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • ?
      Guest
      last edited by

      Look in the System Menu, there's an option called Gateways, make sure you have a Gateway for your IPV6 there.

      I run statics on WAN and LAN, admitted I have a /48 I can play with but I have /64 on my WAN  and I pick a /64 on my LAN, the same as you.

      Trick is to find your gateway, it's usually the link local address of your ISP's router, the next hop. When you are setting the WAN Static address you had to add an IPv6 Upstream gateway, if you did not have one defined in System->Routing then you need to set the Gateway first, then set it in the WAN Static IPv6 Configuration.

      1 Reply Last reply Reply Quote 0
      • P
        pvexed
        last edited by

        Thanks for your help so far - so in my Gateways section I have a WAN_DHCP6 gateway set as a default, with an fe80 address set as the gateway itself.

        I'm a little confused about what exactly I need to add for the static route.  My WAN is automatically assigned some address in the AAAA:XXXX:1:YYY::/64 when it connects, and I can see that in Status -> Interfaces.

        For LAN I am trying to statically assign AAAA:XXXX:1:ZZZ::1 to that interface.  When I do that in Interfaces -> LAN, I have an option to set the "Upstream Gateway", but WAN_DHCP6 is not an option here.  I can't add another gateway with the same fe80 address as it complains that gateway IP already exists.

        1 Reply Last reply Reply Quote 0
        • ?
          Guest
          last edited by

          You should not need it, I have no static route defined. Did you not say that you can ping an ipv6 like google.com from pfsense
          ?

          1 Reply Last reply Reply Quote 0
          • P
            pvexed
            last edited by

            I think the problem is that the /64 blocks are distinct maybe?  I don't have a /48 or a /56 or anything I just have two /64 blocks, and apparently one is routed via the other.

            So in block 1 which is the non-routed block, I get assigned a random address from it on WAN via DHCP6.

            In block 2 which is the routed block, I assign the first IP as static on the LAN and the rest given out to LAN clients via DHCPv6 or whatever.

            In Diagnostics -> Ping I can choose WAN or LAN as the source address and try to ping an IPv6.  When doing this, it correctly pings from block 1 (WAN) or block 2 (LAN) as the source and I get a response.  The problem is that absolutely no IPv6 works on the LAN.  The LAN clients all have addresses from block 2 but they can't ping the static IPv6 on the LAN or anything, there's no v6 connectivity at all.

            1 Reply Last reply Reply Quote 0
            • ?
              Guest
              last edited by

              Have you set up target?

              1 Reply Last reply Reply Quote 0
              • ?
                Guest
                last edited by

                That should read RADVD damn autocorrect!

                1 Reply Last reply Reply Quote 0
                • P
                  pvexed
                  last edited by

                  I have it set to Assisted with no further configuration options.  Do I need to make an addition to "RA Subnets" or anything?

                  1 Reply Last reply Reply Quote 0
                  • ?
                    Guest
                    last edited by

                    @pvexed:

                    Thanks for your help so far - so in my Gateways section I have a WAN_DHCP6 gateway set as a default, with an fe80 address set as the gateway itself.

                    I'm a little confused about what exactly I need to add for the static route.  My WAN is automatically assigned some address in the AAAA:XXXX:1:YYY::/64 when it connects, and I can see that in Status -> Interfaces.

                    For LAN I am trying to statically assign AAAA:XXXX:1:ZZZ::1 to that interface.  When I do that in Interfaces -> LAN, I have an option to set the "Upstream Gateway", but WAN_DHCP6 is not an option here.  I can't add another gateway with the same fe80 address as it complains that gateway IP already exists.

                    There is no upstream gateway on the LAN, but it should be set on the WAN, is that the case?

                    1 Reply Last reply Reply Quote 0
                    • P
                      pvexed
                      last edited by

                      @marjohn56:

                      @pvexed:

                      Thanks for your help so far - so in my Gateways section I have a WAN_DHCP6 gateway set as a default, with an fe80 address set as the gateway itself.

                      I'm a little confused about what exactly I need to add for the static route.  My WAN is automatically assigned some address in the AAAA:XXXX:1:YYY::/64 when it connects, and I can see that in Status -> Interfaces.

                      For LAN I am trying to statically assign AAAA:XXXX:1:ZZZ::1 to that interface.  When I do that in Interfaces -> LAN, I have an option to set the "Upstream Gateway", but WAN_DHCP6 is not an option here.  I can't add another gateway with the same fe80 address as it complains that gateway IP already exists.

                      There is no upstream gateway on the LAN, but it should be set on the WAN, is that the case?

                      So there's no specific gateway set on the WAN because it's assigned via DHCP6 from ISP rather than statically on my end, but a gateway is defined by DHCP6 and it does work for connectivity from pfSense to the internet - it's an fe80 address.  For the static assignment on the LAN the gateway is set to "None" in the dropdown as it's the only option I have.

                      1 Reply Last reply Reply Quote 0
                      • ?
                        Guest
                        last edited by

                        If you look in Routing/Gateways, there should be two entries, one for ipv4, one for ipv6, both are created automatically, are they there?

                        1 Reply Last reply Reply Quote 0
                        • ?
                          Guest
                          last edited by

                          I want you to try something else. I suspect you can set your LAN to track your WAN interface. In WAN settings, you have it set to dhcp6. I think you should find that the LAN side will work if you set it track the WAN, so in LAN, set the IPV6 config type to "Track Interface", then  further down the page set the Track IPv6 interface to WAN, leave the prefix ID at 0.

                          Try that and then tell me what you see on the dashboard for addresses on the LAN interface.

                          1 Reply Last reply Reply Quote 0
                          • P
                            pvexed
                            last edited by

                            @marjohn56:

                            If you look in Routing/Gateways, there should be two entries, one for ipv4, one for ipv6, both are created automatically, are they there?

                            Yes they are both there, auto-named WAN_PPPOE and WAN_DHCP6.  Both are set as default and both have "external" addresses set as the Monitor IP and are responding etc. how I'd expect in that regard.

                            I will try the track interface now.

                            1 Reply Last reply Reply Quote 0
                            • P
                              pvexed
                              last edited by

                              Ok with Track Interface my WAN gets an IP in block 1 and my LAN gets no IPv6 address at all.  It also causes my WAN to flap and constantly disconnect/reconnect until I remove the track interface.

                              1 Reply Last reply Reply Quote 0
                              • ?
                                Guest
                                last edited by

                                Ok, put it back as was and do a ping from a device on the LAN side and see if you can ping pfsense's wan  ipv6 address.

                                1 Reply Last reply Reply Quote 0
                                • P
                                  pvexed
                                  last edited by

                                  @marjohn56:

                                  Ok, put it back as was and do a ping from a device on the LAN side and see if you can ping pfsense's wan  ipv6 address.

                                  Doesn't work unfortunately, same deal.

                                  Here's the output of ip -6 route show on a client:

                                  AAAA:XXXX:1:ZZZ:IPV6:IPV6:IPV6:IPV6:IPV6 dev wlp2s0 proto kernel metric 600 pref medium
AAAA:XXXX:1:ZZZ::/64 dev wlp2s0 proto ra metric 600 pref medium
fe80::/64 dev wlp2s0 proto kernel metric 256 pref medium
fe80::/64 dev wlp2s0 proto kernel metric 600 pref medium
default via fe80::1:1 dev wlp2s0 proto ra metric 600 pref medium

                                  And ip -6 nei:

                                  fe80::1:1 dev wlp2s0 lladdr 00:08:a2:no:no:no router STALE
AAAA:XXXX:1:ZZZ::1 dev wlp2s0 FAILED
                                  1 Reply Last reply Reply Quote 0
                                  • P
                                    pvexed
                                    last edited by

                                    Also, if I do a packet capture on pFsense, Interface = LAN, Address Family = IPv6 Only, and run a ping from a LAN client to WAN address, I see the packets coming in to pfSense:
                                    22:08:57.887259 IP6 LAN_CLIENT_V6 > WAN_V6: ICMP6, echo request, seq 1, length 64

                                    Seems they don't go any further than that though.

                                    EDIT: Also did a packet capture on WAN and did a ping from a LAN client.  I think I see the replies trying to get back to the LAN client and failing:
                                    22:13:02.741919 IP6 WAN_V6 > LAN_CLIENT_V6: ICMP6, echo reply, seq 1, length 64
                                    22:13:02.749090 IP6 fe80::V6_GATEWAY > LAN_CLIENT_V6: ICMP6, destination unreachable, unreachable address LAN_CLIENT_V6, length 112

                                    1 Reply Last reply Reply Quote 0
                                    • ?
                                      Guest
                                      last edited by

                                      Can you take a look at your firewall logs and see what's happening there? You do have a default PASS on the LAN side for IPv6 I assume?

                                      1 Reply Last reply Reply Quote 0
                                      • P
                                        pvexed
                                        last edited by

                                        @marjohn56:

                                        Can you take a look at your firewall logs and see what's happening there? You do have a default PASS on the LAN side for IPv6 I assume?

                                        Yes I have the "Default allow LAN IPv6 to any rule" enabled, and in fact this is a fairly new pfSense install, all the firewall rules are stock.  I don't see any results under Firewall -> Normal View or Firewall -> Dynamic View for any of the v6 addresses involved while trying to ping.

                                        1 Reply Last reply Reply Quote 0
                                        • ?
                                          Guest
                                          last edited by

                                          Hmm, hate to say it, but I'm baffled :(

                                          Let's hope someone else comes in with a fresh mind.

                                          1 Reply Last reply Reply Quote 0
                                          • P
                                            pvexed
                                            last edited by

                                            Just looking at what my ISP said again, or at least part of it:

                                            Just need to configure static route at WAN device for AAAA:XXXX:1:ZZZ::/64 pointing towards your LAN

                                            Could there be anything to do that given I see when I packet cap on the WAN I see this:
                                            22:13:02.749090 IP6 fe80::V6_GATEWAY > LAN_CLIENT_V6: ICMP6, destination unreachable, unreachable address LAN_CLIENT_V6, length 112

                                            Which seems to be my ISP's gateway (at least its link-local) saying that it can't reach the addresses on my LAN?

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.