Noob question - ipv6 only on wan side

marian78 · Jan 15, 2018, 9:43 AM

Hi,
i'm very new to ipv6. I need to change ISP. New ISP give me only these two choices:
1. non-public IP address IPv4 on WAN side :'(
2. IPv6 public IP address on WAN side ???

Today i use only public IPv4 on WAN and IPv4 on LAN (home network - public web server behind my pfsense andand vpn server on pfsense box).

I have some noob questions:

1. If I get from ISP only public IPv6 address, how do I configure my pfsense box for LAN in ipv4? Or i need to migrate / set all devices to ipv6? If i migrate to IPv6, will be functional these services on pfsense box: suricata, proxy server (transparent only for http + antivirus), proxy filter, pfblocker?
2. How do I access my web server from internet? Today i use free no-ip ddns.
3. In my work we use IPv4 (and public address is also IPv4), will I be able to connect home - vpn or web server (IPv6 on Wan side)?

JKnott · Jan 15, 2018, 2:54 PM

It appears you've misunderstood something. I've never heard of an ISP providing only IPv6 addresses, as IPv4 is still needed to access many sites. Many, such as my own, provide a single public IPv4 address, along with a public IPv6 prefix. Others, provide a NAT (private) IPv4 adress and a public IPv6 prefix. The usual way for them to provide IPv6 is via DHCPv6-PD, which not only provides an IPv6 address for the WAN side of your router, but a network prefix for the LAN side. The minimum LAN prefix is a /64, but often a larger prefix is provided that can be split into multiple /64s. I have a /56.

Most devices, including Windows since XP SP3 support IPv6, so any computer, tablet or phone you have will likely support IPv6.

The first thing to do is find out exactly what you're being provided. PfSense can then be configured appropriately.

marian78 · Jan 15, 2018, 1:51 PM

thx sir for your answer.

i think option "Others, provide a NAT (private) IPv4 adress and a public IPv6 prefix" will be provided by new ISP.
I will more examine this on their support. ::)

If this will be my situation, i will must set my web server (behind pfsense box) to IPv6?

JKnott · Jan 15, 2018, 2:57 PM

@marian78:

thx sir for your answer.

i think option "Others, provide a NAT (private) IPv4 adress and a public IPv6 prefix" will be provided by new ISP.
I will more examine this on their support. ::)

If this will be my situation, i will must set my web server (behind pfsense box) to IPv6?

You will certainly be able to directly access your web server via IPv6, but if your IPv4 is via NAT from the ISP, you will not be able to access your server with it. If you had a public IPv4 address, you could use port forwarding to get around your own local NAT.

marian78 · Jan 16, 2018, 8:30 AM

I will have NAT IPv4. Than, if i will wanting to access my IPv6 web server from internet, all internet clienst must have IPv6 Tunnel Broker like Hurricane Electric Free IPv6 Tunnel Broker?

JKnott · Jan 16, 2018, 12:07 PM

@marian78:

I will have NAT IPv4. Than, if i will wanting to access my IPv6 web server from internet, all internet clienst must have IPv6 Tunnel Broker like Hurricane Electric Free IPv6 Tunnel Broker?

If they don't have IPv6, then yes they'd need something like he.net. Your situation illustrates why the world must move to IPv6 ASAP. There are simply not enough IPv4 addresses and haven't been for years. As a result, many people, like you, are stuck behind ISP NAT, which greatly reduces what they can do, even more than your own NAT does.

marian78 · Jan 17, 2018, 7:31 AM

Thx for all answers.