Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    [Resolved] IPv6 /48 routed trough /64 interconnection

    Scheduled Pinned Locked Moved IPv6
    34 Posts 5 Posters 3.2k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • F
      fabienfs
      last edited by

      @Derelict:

      They should create a gateway with your IPv6 wan interface address on it then a static route for the /48 to that. Zero reason for any VIPs.

      Thanks! It's work with this solution! :-)

      1 Reply Last reply Reply Quote 0
      • JKnottJ
        JKnott
        last edited by

        @Derelict:

        an Virtual IPs > IP Alias linked with "Customer" interface, IP Adresses : 2A0A:xxxx:50::/48.

        No idea what they're doing there.

        They should create a gateway with your IPv6 wan interface address on it then a static route for the /48 to that. Zero reason for any VIPs.

        Yet Another Clueless ISP.

        That assigned WAN adress is likely not used for routing.  On IPv6, routing is normally done via the link local address.  Go to a command prompt and enter netstat -r.  You'll likely see the IPv6 default route is a link local address, not the WAN ULA.

        PfSense running on Qotom mini PC
        i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
        UniFi AC-Lite access point

        I haven't lost my mind. It's around here...somewhere...

        1 Reply Last reply Reply Quote 0
        • F
          fabienfs
          last edited by

          @JKnott:

          That assigned WAN adress is likely not used for routing.  On IPv6, routing is normally done via the link local address.  Go to a command prompt and enter netstat -r.  You'll likely see the IPv6 default route is a link local address, not the WAN ULA.

          Thanks JKnott,
          Indeed, before your message, I used a global address to do routing, instead of just using the link-local adress. I reconfigured my WAN interface by putting "IPv6 Configuration Type: None" and now when I'm doing a netstat -r, I see that the default GW for IPv6 is the link-local address. it saves a prefix /64 that was not useful!

          no risk that my link-local IPv6 address changes?
          Thanks

          1 Reply Last reply Reply Quote 0
          • JKnottJ
            JKnott
            last edited by

            @fabienfs:

            no risk that my link-local IPv6 address changes?
            Thanks

            Given that it's normally based on the MAC address, no chance unless you change the hardware.  In some instance, such as routers, the link local address can be locally assigned.  For example, with pfsense, on my local LAN, the default gateway is fe80::1:1.

            PfSense running on Qotom mini PC
            i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
            UniFi AC-Lite access point

            I haven't lost my mind. It's around here...somewhere...

            1 Reply Last reply Reply Quote 0
            • F
              fabienfs
              last edited by

              When you said
              @JKnott:

              the link local address can be locally assigned.  For example, with pfsense, on my local LAN, the default gateway is fe80::1:1.

              do you mean that you have manually chosen and set this link-local address?

              if yes, can it be a problem for the ISP if someone did like you and chose the same address?

              1 Reply Last reply Reply Quote 0
              • JKnottJ
                JKnott
                last edited by

                @fabienfs:

                When you said
                @JKnott:

                the link local address can be locally assigned.  For example, with pfsense, on my local LAN, the default gateway is fe80::1:1.

                do you mean that you have manually chosen and set this link-local address?

                if yes, can it be a problem for the ISP if someone did like you and chose the same address?

                No, I didn't choose it, pfsense did.  Also, that's on the LAN side, so the ISP wouldn't see it.  However, even on the WAN side it might not be a problem, as the link local address needs to be unique only on a given link.  There's no reason why it can't be used on another one.

                PfSense running on Qotom mini PC
                i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                UniFi AC-Lite access point

                I haven't lost my mind. It's around here...somewhere...

                1 Reply Last reply Reply Quote 0
                • F
                  fabienfs
                  last edited by

                  Yes… that’s right
                  Thanks :-)

                  1 Reply Last reply Reply Quote 0
                  • F
                    fabienfs
                    last edited by

                    One last question:
                    ISPs use one interface by customer then?

                    1 Reply Last reply Reply Quote 0
                    • DerelictD
                      Derelict LAYER 8 Netgate
                      last edited by

                      A Router Advertisement will likely results in a destination route to a link-local address, but an ISP static route probably should not since the link-local address for the route destination is un-knowable.

                      Happy to be educated to the contrary.

                      Chattanooga, Tennessee, USA
                      A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                      DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                      Do Not Chat For Help! NO_WAN_EGRESS(TM)

                      1 Reply Last reply Reply Quote 0
                      • DerelictD
                        Derelict LAYER 8 Netgate
                        last edited by

                        @fabienfs:

                        One last question:
                        ISPs use one interface by customer then?

                        Question for your ISP.

                        Chattanooga, Tennessee, USA
                        A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                        DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                        Do Not Chat For Help! NO_WAN_EGRESS(TM)

                        1 Reply Last reply Reply Quote 0
                        • JKnottJ
                          JKnott
                          last edited by

                          @fabienfs:

                          One last question:
                          ISPs use one interface by customer then?

                          That would depend on the ISP and connection type.  I have a cable modem and the segment is shared by others.  So, the link local address would have to be unique on the segment, but not elsewhere.

                          PfSense running on Qotom mini PC
                          i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                          UniFi AC-Lite access point

                          I haven't lost my mind. It's around here...somewhere...

                          1 Reply Last reply Reply Quote 0
                          • DerelictD
                            Derelict LAYER 8 Netgate
                            last edited by

                            Right but I'm talking static routing. Or a routing protocol. Not anything dynamic like DHCP/PDs.

                            Chattanooga, Tennessee, USA
                            A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                            DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                            Do Not Chat For Help! NO_WAN_EGRESS(TM)

                            1 Reply Last reply Reply Quote 0
                            • JKnottJ
                              JKnott
                              last edited by

                              @Derelict:

                              A Router Advertisement will likely results in a destination route to a link-local address, but an ISP static route probably should not since the link-local address for the route destination is un-knowable.

                              Happy to be educated to the contrary.

                              With routing, the task is to determine what interface to use to reach a destination.  This is done with routing tables that point to the appropriate interface.  It makes no difference whether static or routing protocol, such as OSPF is used.  A multipoint link requires the IP address of the next router and link local is fine for that.  A point to point link doesn't even need that, as there is only one possible destination.  When routing to a destination, only the end point IP address is relevant.  Any address in between is not, so long as the router knows which interface to use.

                              Bottom line, routing over the entire Internet, using only link local addresses is possible.  Global addresses are needed only for management and diagnostics.

                              Here is the default route for my pfsense firewall:
                              default            fe80::217:10ff:fe9 UGS        re0

                              It lists the link local address for my ISP's router and the interface it's found on.

                              PfSense running on Qotom mini PC
                              i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                              UniFi AC-Lite access point

                              I haven't lost my mind. It's around here...somewhere...

                              1 Reply Last reply Reply Quote 0
                              • JKnottJ
                                JKnott
                                last edited by

                                @Derelict:

                                Right but I'm talking static routing. Or a routing protocol. Not anything dynamic like DHCP/PDs.

                                It looks like we crossed in our posts.  However, a router only needs to know the interface to send the packets out of to reach the next hop.  This can be any valid IPv6 address or, in the case of point to point links, just the interface.  Every route in a routing table eventually works it way down to an exit interface.  The routes in a routing table can be entered manually or via routing protocol.  It makes no difference.  All that matters is the exit interface to the next hop.

                                PfSense running on Qotom mini PC
                                i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                                UniFi AC-Lite access point

                                I haven't lost my mind. It's around here...somewhere...

                                1 Reply Last reply Reply Quote 0
                                • DerelictD
                                  Derelict LAYER 8 Netgate
                                  last edited by

                                  I agree, but Q: How does upstream know the downstream link-local address for a static route? A: It doesn't and can't.

                                  Here is the default route for my pfsense firewall:
                                  default            fe80::217:10ff:fe9 UGS        re0

                                  It lists the link local address for my ISP's router and the interface it's found on.

                                  Right. But that is downstream-to-upstream which is discovered using an RA.

                                  Chattanooga, Tennessee, USA
                                  A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                  DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                  Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                  1 Reply Last reply Reply Quote 0
                                  • JKnottJ
                                    JKnott
                                    last edited by

                                    I agree, but Q: How does upstream know the downstream link-local address for a static route? A: It doesn't and can't.

                                    It doesn't need it.  All it needs to know is which direction takes a packet closer to the destination, that is the exit interface.  Then, at the next router, the same thing happens again, which exit interface to get the packet closer to the destination.  This can keep on happening for as many hops as necessary, until the packet reaches the destination network, where it's finally delivered.  None of the routers along the path needs to know the WAN address of the destination router, only the way to get to the destination network.

                                    Think about what happens on IPv4.  Do all the routers know the WAN address of the destination network?  Or do they just know the way to the next hop, according to routing tables?  If you assume that the WAN IP address must be known, then the IP address of all the routers must also be known and with complex networks, that's not likely to happen.

                                    Go to the command prompt and enter netstat -r and you'll see the routing table listing which interface is used for the known addresses and the default route for any unknown addresses.

                                    PfSense running on Qotom mini PC
                                    i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                                    UniFi AC-Lite access point

                                    I haven't lost my mind. It's around here...somewhere...

                                    1 Reply Last reply Reply Quote 0
                                    • DerelictD
                                      Derelict LAYER 8 Netgate
                                      last edited by

                                      It doesn't need it.  All it needs to know is which direction takes a packet closer to the destination, that is the exit interface.  Then, at the next router, the same thing happens again, which exit interface to get the packet closer to the destination.  This can keep on happening for as many hops as necessary, until the packet reaches the destination network, where it's finally delivered.  None of the routers along the path needs to know the WAN address of the destination router, only the way to get to the destination network.

                                      Right. but that requires interface routes. You are mixing things up. There needs to be a next hop address. There is no way to know the link-local address of the next hop in this case.

                                      Chattanooga, Tennessee, USA
                                      A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                      DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                      Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                      1 Reply Last reply Reply Quote 0
                                      • JKnottJ
                                        JKnott
                                        last edited by

                                        There needs to be a next hop interface.  Point to point links don't need an address at all and multipoint need the interface and next hop address.  That next hop address is usually link local on IPv6.  Any router address beyond the next hop is irrelevant.  As for the IPv6 address at the other end of a link, why is there any difference between GUA and link local?  If doing manual configuration, you'd need to know the address either way.  If using a routing protocol, such as OSPF, it's all worked out automatically.

                                        Here's something from the Cisco book IPv6 Fundamentals: A Straightforward Approach to Understanding IPv6, 2nd ed., page 425:

                                        ipv6-address: The IPv6 address of the next hop that can be used to reach the specified
                                        network. The IPv6 address of the next hop need not be directly connected;
                                        recursion is done to find the IPv6 address of the directly connected next hop. When
                                        an interface type and interface number are specified, you can optionally specify
                                        the IPv6 address of the next hop to which packets are output. Note that you must
                                        specify an interface type and an interface number when using a link-local address as
                                        the next hop. (The link-local next hop must also be an adjacent router.) This argument
                                        must be in the form documented in RFC 4291, where the address is specified
                                        in hexadecimal, using 16-bit values between colons.

                                        Notice they say a link local address can be used.

                                        PfSense running on Qotom mini PC
                                        i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                                        UniFi AC-Lite access point

                                        I haven't lost my mind. It's around here...somewhere...

                                        1 Reply Last reply Reply Quote 0
                                        • DerelictD
                                          Derelict LAYER 8 Netgate
                                          last edited by

                                          Of course it can. If you know it.

                                          Of course you can route to a link-local address.
                                          Of course you can route to a link-local address.
                                          Of course you can route to a link-local address.
                                          Of course you can route to a link-local address.
                                          Of course you can route to a link-local address.
                                          Of course you can route to a link-local address.
                                          Of course you can route to a link-local address.
                                          Of course you can route to a link-local address.
                                          Of course you can route to a link-local address.
                                          Of course you can route to a link-local address.
                                          Of course you can route to a link-local address.
                                          Of course you can route to a link-local address.
                                          Of course you can route to a link-local address.
                                          Of course you can route to a link-local address.
                                          Of course you can route to a link-local address.
                                          Of course you can route to a link-local address.

                                          We are talking about a specific case where the ISP needs to route a /48 to a WAN interface at the customer.

                                          The ISP does not know the WAN link-local address.

                                          See Also: HE.NET GIF interfaces. Same thing.

                                          Chattanooga, Tennessee, USA
                                          A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                          DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                          Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                          1 Reply Last reply Reply Quote 0
                                          • JKnottJ
                                            JKnott
                                            last edited by

                                            We are talking about a specific case where the ISP needs to route a /48 to a WAN interface at the customer.

                                            No matter what it's routing, it needs an IP address on a multipoint link.  That can be link local.  I provided my default gateway earlier, but here it is again:
                                            default            fe80::217:10ff:fe9 UGS        re0

                                            Notice that it's link local.  This is on a cable modem connection, with the modem in bridge mode.  Using Wireshark, I discovered that my IPv6 gateway has the same MAC as shown for IPv4 in the arp cache.  So, I am using a link local address for the gateway.  Don't forget, IPv6 can use things like neighbour advertisements to announce their IPv6 address and I can see those on the WAN link.  As mentioned, I am on a cable modem.  It uses DHCPv6 to get it's WAN global address.  But DHCPv6 uses ICMPv6, using the link local address to reach the server.  So, with that mechanism, the server has the MAC address and link local address.  It will also have the DUID, as provided by the DHCPv6 client.  The ISP now has the link local address to use to forward the /48.

                                            See Also: HE.NET GIF interfaces. Same thing.

                                            He.net uses a point to point tunnel to carry IPv6 and therefore does not need any IP address.  However, this is a bit different situation, where the link has to be configured over IPv4.  The configuration tells the he.net router which link to use for the /48.

                                            This is one of the areas where IPv6 is different from IPv4.  It has the link local address which is used for so much in configuring networks etc.  No need for ARP.  DHCP is often used to provide addresses other than for an interface, though that can happen too.  It also has things like router and neighbour advertisements and requests and so much more.  It makes some things a lot easier than IPv4.

                                            BTW, I just used Packet Capture to look at my WAN interface.  I see neighbour solicitations and advertisements using link local addresses, not global, even though that interface has a global address.

                                            Also, how do you display the neighbour MAC addresses for IPv6 addresses in pfsense.  With Linux, the command ip -6 neigh show does it and with FreeBSD it should be npd -a, but that command is not available with pfsense.

                                            PfSense running on Qotom mini PC
                                            i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                                            UniFi AC-Lite access point

                                            I haven't lost my mind. It's around here...somewhere...

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.