IPV6 Static IPV6 address
-
from https://docs.netgate.com/pfsense/en/latest/book/interfaces/ipv6-wan-types.html:
"The Track Interface choice works in concert with another IPv6 interface using DHCPv6 Prefix Delegation. When a delegation is received from the ISP, this option designates which interface will be assigned the IPv6 addresses delegated by the ISP and in cases where a larger delegation is obtained, which prefix inside the delegation is used." -
@axsense2 said in IPV6 Static IPV6 address:
My ISP has gave me 2a00:900:10:10::/64 network
GW is 2a00:900:10:10::1/64Your ISP's gateway is within your network? That will never work. Are you sure the info you posted is correct?
-
@JKnott said in IPV6 Static IPV6 address:
Your ISP's gateway is within your network?
Huh? Normally yes the gateway would be on the network your in..
I think the users problem is while the ISP gave him a /64, which other /64s are routed to that.. You need more than 1 network to route.. I take it they think your devices are directly attached vs behind a router.
-
Hi. Thanks for the answer. Yes that is the information I got from ISP. Values are changed of course, but anyway.
I could not understand how I can route /64 network both sides, but the answer is that it is not possible of course.
Ax.
-
If they gave you 1 /64 then no you can not route another ipv6.. Did they not also give you a /56 or /60 to use behind that?
-
@johnpoz said in IPV6 Static IPV6 address:
Huh? Normally yes the gateway would be on the network your in..
Then it appears they are just giving him a /64 range to work in. As you mention, in another note, he can't route to a local network beyond that point. This also means he needs a bridging firewall, instead of routing, as normally used.
With my ISP, my /56 is entirely my own and I use a link local address to route to the Internet. My firewall is assigned an address that is not within my /56. That address is also a /128, so it plays no part in routing.
-
Lets suppose I get wider net. Lets say it is /56.
2a00:900:10:0001::/56 network
GW is 2a00:900:10:0001::1/64I set WAN address of PFSense to GW is 2a00:900:10:0001::2.
So I should put something like 2a00:900:10:0101::1/64 to LAN nic address I suppose...Is this all needed (I also have Firewall rule for routing from LAN to WAN_IPV6)? Should SLAAC take care of broadcasting 0101-network addresses to LAN devices or should I use DHCP6 as a best practice?
Ax.
-
@JKnott said in IPV6 Static IPV6 address:
With my ISP, my /56 is entirely my own and I use a link local address to route to the Internet. My firewall is assigned an address that is not within my /56. That address is also a /128, so it plays no part in routing.
Could you give an practical example of this. Can I do that with my /64 network as well?
Ax.
-
@axsense2 said in IPV6 Static IPV6 address:
Could you give an practical example of this. Can I do that with my /64 network as well?
I can describe my setup. My ISP uses DHCPv6-PD to distribute addresses and prefixes. PfSense gets an address, but it's a /128, which means it's not used to carry traffic, but can be used as a target address for VPNs, servers, etc.. This address is not within my /56. The prefix is passed to pfSense, to set the range of addresses I can use on my network. Since I have a /56, I can have up to 256 /64 networks. Local networks are always /64. My ISP's gateway address is fe80::217:10ff:fe9a:a199.
It sounds like your ISP is just giving you a /64 to work with, just like my LAN uses one of my /64s. If so, you can't route it to your local LAN.
BTW, I could configure pfSense to request anything from a single /64 to the full /56. If I selected only a single /64, I'd still have a route out of my network, that doesn't use an address within my /64.
I don't understand why some ISPs are so cheap with addresses. Even with my cell phone, tethered devices connect to a full /64 and the phone's WAN address is not within that /64.
Incidentally, there are enough IPv6 addresses to give every single person on earth over 4000 /48s! No need to cheap out with them.
-
@JKnott said in IPV6 Static IPV6 address:
Incidentally, there are enough IPv6 addresses to give every single person on earth over 4000 /48s! No need to cheap out with them.
Yup.. and like the smallest block an ISP can get is a freaking /32 so even if all they had was that, they would still be able to hand out 65K /48s... So give the users freaking /56's for gosh sake.. They could have like 16M users all getting /56's If you want to be extra tight - make it /60s, what something over 268M they could hand out.. And that is just with a small /32, which again is like the min allocation arin will give you as an ISP..
I think comcast got what a /9?
edit: If you isp is going to be stupid with their ipv6, just head over to hurricane electric.. You can get a free /48 from them.. Which you can use on any isp you want, even if they don't support it.. I have the same /48 since like 2011.. And my current isp doesn't even support IPv6 - but doesn't matter since I have my /48 that I can just tunnel over any ipv4 network.
-
I am going to get wider network than /64 next week. So that problem is going to be solved. But how to continue using best practice?
Lets suppose I get wider net. Lets say it is /56.
2a00:900:10:0001::/56 network
GW is 2a00:900:10:0001::1/64I set WAN address of PFSense to GW is 2a00:900:10:0001::2.
So I should put something like 2a00:900:10:0101::1/64 to LAN nic address I suppose...Is this all needed (I also have Firewall rule for routing from LAN to WAN_IPV6)? Should SLAAC take care of broadcasting 0101-network addresses to LAN devices or should I use DHCP6 as a best practice?
Ax.
-
You would never set a /56 on an interface... They would give you a transit network to use for your wan, or just link local - but that is kind of hard to route to. Or you would use say the first /64 in that /56 as your transit (wan) and then put the other /64s behind it.
Your need to get with your ISP on how to set it up..
-
@johnpoz said in IPV6 Static IPV6 address:
I think comcast got what a /9?
That's a huge amount. Given that only 1/8th of the IPv6 addresses are GUA, that would be 1/64th of them. A few more of those and we'd be back in the same situation as IPv4, where a few organization had most of the addresses. IIRC, IBM had at least 2 /8s, which were in use in my office 20 years ago. The token ring LAN was 9., but we were moving to Ethernet on 8., IIRC. My own static address was 9.29.146.147. They had several /16 blocks too.
-
@axsense2 said in IPV6 Static IPV6 address:
Lets suppose I get wider net. Lets say it is /56.
You'd split that into /64s. In PfSense you do that by selecting the IPv6 Prefix ID, when you configure an interface. You might also get a different gateway address.
Gateway addresses can be "fun" in IPv6. While you can use a routeable address, link local addresses are also often used. Regardless, they all resolve down to the MAC address & interface, to actually move the traffic. In a situation, such as mine, where a /128 address is assigned, traffic doesn't move through that address, but the ISP could use it to determine the MAC address that they have to talk to. Then again, they could use the DHCPv6-PD requests to determine the link local address and get the MAC through it.
-
@johnpoz said in IPV6 Static IPV6 address:
but that is kind of hard to route to
All routing resolves down to interface and MAC address. The MAC isn't even needed on point to point links.
-
true - my point is I think it would be easier to just use a specific /64 as transit and give the users a /128 to set..
But yeah the isp could do it a bunch of different ways - which is why he needs to get with his isp for the specific instructions allowing him to use the /56 behind his router.
-
@johnpoz said in IPV6 Static IPV6 address:
You would never set a /56 on an interface...
In where do you see I am using /56 on an interface? There are /64 on interfaces in the example.
Your need to get with your ISP on how to set it up..
My ISP does not provide PFSense support.
So my setup can be (we assume that I will have /56 network)
WAN:
IP: 2a00:900:10:0001::2 / 64
Upstream GW: WAN 2a00:900:10:0001::1LAN:
IP: 2a00:900:10:0101::2 / 64
(there is no Prefix ID when LAN IPV6 configuration type is set to "Static IPv6")Should this work without setting DHCP6 on LAN side?
-
@axsense2 said in IPV6 Static IPV6 address:
My ISP does not provide PFSense support.
Has ZERO do with what your using.. It has to do with how your suppose to set it up.. What is your transit, do you set static - then what are the details. Are you suppose to use slacc, are you suppose to use dhcpv6-pd, etc. etc.
-
@axsense2 said in IPV6 Static IPV6 address:
My ISP does not provide PFSense support.
An ISP providing pfSense support would be the same as an ISP providing Cisco or D-Link support. The equipment is irrelevant. It's the protocols that matter.
-
I am only asking what is best practice from PFSense perspective using example IPs. I am not asking ISP how to set up PFSense, I am asking it here. I am not asking ISP information from you, that is provided by ISP.
Lets put it this way.
As an example ISP provides a customer following network:
Network: 2a00:900:10:1000:: / 56
GW: 2a00:900:10:1000::1 / 64What is suggested setup using static IP on WAN side?
Edit: Try&Error method started...
Edit2: I hope someone writes a tutorial how to setup static IP based configuration as good as they are WAN DHCP client ones... -
This post is deleted! -
Lets split this in easy questions. ISP provides /48 network a : b:c::
On WAN interface, static IP is being used. IP is a: b:c::1
What is length? /64 or /48? -
it would NEVER be /48... You would never set a mask/prefix on a interface to anything other than /64 or /128.
If your isp is giving you a /48 it needs to be routed.. It would never be on any interface, if they are directly attaching you to a /48 they are doing it WRONG!!
-
Ok. This is clear. So my setup is building up. Lets continue.
ISP network a: b:c:: /48
ISP GW a: b:c::1 /64
My WAN IP is now a: b:c::2 / 64Then LAN side. I have subnets behind PFSense, but also individual devices.
Lets use the next /64 for LAN.
Static LAN IP: a: b:c:1::1 / 64This must be correct, right?
-
Yes you can use any of the /64s out of the routed /48 on your lan.. But the 1st one might not be your transit.. They might give you something other than part of your /48 as your transit.
Or maybe they just use link-local.. Maybe they want you to use a /128 on your wan, maybe they want you to just let your wan get via slaac.. Have no idea - which is why get with them!
-
johnpoz, please forget ISP already. I am building up IPV6 reference setup of configuring PFSense for myself as a learning curve. I asked for best practices. And best practices for PFSense only. Something I can use later with ISP connection. It was clear after two posts that the network they provided will not work. I will get a new next week.
But thank you for the confirmation and the clarification of transit detail.So, lets move on into practice. There are quite many parameters needed to be correct in order everything to work.. I can assume. I tried following in PFSense.
Network setup:
PFSense LAN IPV6: 2001:1111:2222:3333::1 /64DHCPv6 server enabled using following parameters:
Range start: 2001:1111:2222:3333::100
Range end: 2001:1111:2222:3333::1ff
Prefix Delegation Range start: 2001:1111:2222:3334::
Prefix Delegation Range end: 2001:1111:2222:333f::
Prefix delegation size: 64
Router mode: ManagedSo my HW setup is:
PFSense [LAN] <--> [WAN] SubRouter1 [LAN] <--> PC [NIC]PFSense LAN IP: 2001:1111:2222:3333::1/64 -> OK (set manually)
SubRouter1 WAN IP: 2001:1111:2222:3333::1c7/128 (DHCP seems to work OK)
PC IP: 2001:1111:2222:333e:6d12:8c45:1b7a:6388/128 (DHCP subnet provisioning seems to work since PC gets an address from 333e subnet OK)Lets ping:
PC to SubRouter WAN: YES
PC to PFSense LAN: YES
Subrouter to PFSense LAN: YES
SubRouter to PC: YES
PFSense to SubRouter WAN: YES
PFSense to PC: YESSo this setup seems to work on IPV6 level. I don't know if that is best practice or even suggested setup, but maybe someone can comment on that (rather than asking me to contact ISP)... and sorry, I am not ungrateful or anything. Maybe there is language barrier and I can't express myself clear enough.
What surprises me a little bit is that I haven't configured anything like "Default gateway" in SubRouter nor PC. I can see that PC has default IPV6 gateway to SubRouter's fe80-address. So it works that way just fine. Because PFSense LAN IP is in the same subnet as SubRouter's WAN routing works between PC and PFSense. But I wonder what happens when I ping Internet from PC. That remains to be seen after I have working ISP IPV6 connection next week... (I would be surprised if Subrouter knows how to handle Internet traffic, but maybe IPV6/PFSense is smart enough for that too automatically...)
Ax.
-
And yes, I wrote a little bit length message but I hope my learning notes helps someone else. I found quite many posts of how to set IPV6 on PFSense, but almost none related to Static IPs or using DHCP the way I need to. Also old seniors like me whom have done everything with IPV4 past 30 years there are quite many details done differently.
-
@axsense2 said in IPV6 Static IPV6 address:
I asked for best practices.
How is that possible, when you don't know what the ISP is providing? The setup for DHCPv6-PD is quite different from assigned static addresses.
-
@axsense2 said in IPV6 Static IPV6 address:
but almost none related to Static IPs or using DHCP the way I need to. Also old seniors like me whom have done everything with IPV4 past 30 years there are quite many details done
I'd suspect most people get IPv6 from an ISP that uses DHCPv6-PD. Again, until we know what you're dealing with, it's hard to offer advise.
-
Please forget my ISP already.
I was building a reference setup using an initial requirement that IPV6 address from ISP is static.For those whom are able to comment my setup I would be appreciated. Thank you.
-
@JKnott I'd suspect most people get IPv6 from an ISP that uses DHCPv6-PD. Again, until we know what you're dealing with, it's hard to offer advise.
Yes I can imagine that too. After reading instructions and comments.
But one more time: I am dealing with the setup I have specified and trying to build up a reference setup using those prerequisites. Got it?
-
Well then sure if you want to use the first /64 out of /48 as your transit - then sure that is possible.
-
In this reference setup the first /64 is assumed to be a transit.
But what I would like to know if is this a correct way to publish subnets to subroutes (copied from a message above)?:
Prefix Delegation Range start: 2001:1111:2222:3334::
Prefix Delegation Range end: 2001:1111:2222:333f::
Prefix delegation size: 64Ax.
-
So your going to do downstream prefix delegation? The range is only use to use part of a larger prefix in your actual delegation. Say you want to delegate the 2nd half of larger prefix, or maybe you want to only delegate the middle of the prefix to downstream devices asking for delegation - ie downstream routers.
-
Let me clarify the idea.
Lets assume ISP gives /56 network. In this theoretical example it is then 2001:1111:2222:3300::
So, 2001:1111:2222:3333 was the LAN network of PFSense. I think it was stated that SubRouters need to have /64 subnets within that /56 network? Otherwise they are not able to route to ISPSo I assigned 3334:: to 333f to be delegated to subrouters using /64 delegation size. Which they got and pinging works inside of the internal network built by this example (between 3333 and 333e and over the SubRouter).
-
You don't have to actually delegate anything if this your own internal network.. And delegating a /64 would kind of pointless.. For the same reason your isp giving you only 1 /64 would be pointless.
If you have downstream routers, then you could just statically assign everything, using link local for the transit to the downstream..
Love to see this network where you need to delegate say /60s from your /56 down to other routers, who then have other /64 behind them, etc. Are you going to be an isp for a neighborhood? A DC with multiple clients?
-
@johnpoz said in IPV6 Static IPV6 address:
Are you going to be an isp for a neighborhood?
Yes, that is correct. Been like that for 10 years and now exploring if I can upgrade to IPV6 level. There aren't subrouters behind the first level after PFSense.
I was going to delegate /64s (see specs above)If you have downstream routers, then you could just statically assign everything, using link local for the transit to the downstream..
There are probably many ways to do this. If the DHCP approach works I would probably start a pilot using that. Setup may change later tho...
-
Well if your an ISP for your neighborhood your prob going to want something bigger than a /56 ;) How many clients are you going to have? How many networks will they have behind their routers, etc.
-
There are only up to 30 so basically any size will do.
Probably the reason why ISP was giving me a static IPV6 address instead of one by DHCP is probably that the connection is business product and not consumer product. For consumers ISPs probably "always" supply IPs by DHCP. At least in this part of the world business connections have static IPs without DHCP.
"My customers" have just couple of devices behind their routers. Absolutely none of them has anything but a consumer xDSL router. -
@axsense2 said in IPV6 Static IPV6 address:
Absolutely none of them has anything but a consumer xDSL router.
Well you prob be best off just doing static for them as well.. This should take out any sort of deployment issues, and allow for them to get more segments if they need them. And for others not have to deal with ipv6 if they don't want to, etc.
This way your sure differences in their routers will not be a problem - only issue is that static will be a bit more leg work, and could be problem if you have to scale up to like 300 or 3000 at some point ;)