IPv6 doubts

[cmpsalvestrini]

@johnpoz: As per your request, the router has in its web interface the following information: The prefix is 2001:818:d9d9.ba00/56, the gateway IP is 2001:818:d9d9:ba00::1. When I called the ISP complaining that I did not get Internet connectivity for any device behind my pfSense and asking how did I have to set up the prefix subdelegation, they told me that IP address distribution from the ISP's router is not made through DHCPv6 but through SLAAC. Using the ISP's own suggestion I assigned the WAN port on the pfSense box a static address, which works. Given that I can't break up the /56 and slice it and dice it to my heart's content -- I have tried, to frustrating failure.

[johnpoz]

@cmpsalvestrini

If your isp is giving you a /56 via slaac that is utterly borked!!! There are 2 legit prefixes /64 and /128

How about you just let your wan be slaac and setup that /56 broken up behind you and see if that works... How is that isp try and rollout ipv6 and just do not have clue one.. Did nobody at this isp read any of the rfcs?

[Derelict]

Post the output for your WAN interface from Status > Interfaces.

[johnpoz]

@derelict

Off topic sorry - tried sending you a chat.. But you have them blocked.. Your link to the use this diagram is not working. Would guess since the change to nodebb vs smf

[Derelict]

OK yeah chat should be fixed. Waiting for the attachments from the old forum to be sussed out before I hassle that diagram.

[cmpsalvestrini]

@Derelict : Of course, as soon as I get home I'll post the relevant info.

[cmpsalvestrini]

@johnpoz apparently not, I have exactly zero clue as to why they'd give me a whole /56, only to deny it to me by giving me /64 addresses through SLAAC from their router, smh...

[cmpsalvestrini]

@derelict as per your request here's the requested snapshot

[Derelict]

OK that's a /64 on WAN so that is what I would expect.

Is that statically-configured or is that what is on the interface when WAN is configured for SLAAC?

LAN looks good as well. I would:

(At least temporarily) Pass ICMPv6 (any) traffic on WAN from source any to destination 2001:818:d9d9:ba00::/56

ping6 2001:818:d9d9:ba01::fffe from the outside someplace.

See if you get a response. If so, you can start looking at why LAN isn't working. If not, verify you can ping6 to 2001:818:d9d9:ba00::fffe. If not your pings are probably not working. if so, packet capture on WAN for IPv6 traffic for 2001:818:d9d9:ba01::fffe and test the ping6 to that again. Stop the capture and see if you can see the echo requests coming in from the ISP. If so, you can proceed to figure out why there is no response. If not, you need to nail down the ISP as to exactly how they are provisioning this /56.

[NogBadTheBad]

You've got a bridge interface set up with IP addresses on each interface and the bridge, thought you should only have IP addresses on the bridge interface.

https://doc.pfsense.org/index.php/Interface_Bridges

[cmpsalvestrini]

@derelict this is statically configured. I haven't tried using SLAAC, will attempt to do so now.

[Derelict]

Not at all what I recommended you do but OK.

[Derelict]

@nogbadthebad Yeah I haven't even started with the bridge yet. First thing is to see if this ISP is even sending the traffic.

@cmpsalvestrini Why are you complicating things that aren't working yet with things like interface bridges? Why do you feel the need to do that?

[NogBadTheBad]

Pings to the WAN interface work.

mac-pro:~ andy$ ping6 2001:818:d9d9:ba00::fffe
PING6(56=40+8+8 bytes) 2a02:8010:XXXX:X::14 --> 2001:818:d9d9:ba00::fffe
16 bytes from 2001:818:d9d9:ba00::fffe, icmp_seq=0 hlim=252 time=50.847 ms
16 bytes from 2001:818:d9d9:ba00::fffe, icmp_seq=1 hlim=252 time=51.265 ms
16 bytes from 2001:818:d9d9:ba00::fffe, icmp_seq=2 hlim=252 time=50.797 ms
16 bytes from 2001:818:d9d9:ba00::fffe, icmp_seq=3 hlim=252 time=50.751 ms
16 bytes from 2001:818:d9d9:ba00::fffe, icmp_seq=4 hlim=252 time=51.085 ms

[cmpsalvestrini]

@derelict I-m still on the static, I fiddled with the LAN side a bit and I have as follows:
Interfaces status:

Firewall:

I know I was complicating things, I removed the bridge and I am trying to be a good boy and use a ULA and the (famous? infamous? nefarious?) NPt service. I get as follows in my client:

All dandy, until:

[Derelict]

Right. the other doesn't but that could be rules.

[NogBadTheBad]

You have a invert match rule on your wan interface.

[Derelict]

OK now everything is completely different. I would request that you stop making wholesale changes and perform the requested steps.

It is not up to you to be good and use ULA. It is up to the ISP not to be bad to give you something usable.

[Derelict]

And the destination is WAN net not the entire /56 so you won't be able to ping anything on the inside /64s. Please re-read my suggested actions above.

[cmpsalvestrini]

@derelict That's what happens when one starts thinking and having weird ideas. Let me fix that and I'll get back to you.