Need some instructions for getting started with IPv6

Ulysses_

Because the support for that modem/router by the ISP is not as good as pfsense's here and if anything goes wrong I will be stuck offline and unable to ask you guys or research, even the telephone might not work to call the ISP. What problems would NAT create in our context?

JKnott

@Ulysses_

Well, on IPv4, you just get another layer of it, so either way you have the same problems. For example, with NAT, VoIP and some games require use of an STUN server, just so that the app knows the real world IP address. With IPSec, NAT breaks authentication headers, which are used to verify the packet hasn't been tampered with. There are other issues. On IPv6, with that modem in gateway mode, you are guaranteeing pfSense cannot properly provide IPv6 to your LAN.

Also, pfSense is likely a much better firewall than what's in your modem. You don't need the one in the modem. As for your modem, call your ISP to ask how to enable bridge or pass through mode for the modem. Lots of other people have a similar setup and the ISP should be able to advise you. Also, the configuration for the Internet connection should have no effect on that modem providing phone or TV service. They are completely independent services that simply happen to share the same box.

People's minds have been poisoned by NAT, so they now no longer how to properly do things with the Internet. This is just one example.

Ulysses_

Once in bridged mode, can ordinary devices still connect to the modem directly without too much configuration?

JKnott

@Ulysses_

I assume you're referring to computers and such. Yes, you can connect one device directly to the modem (with mine, I can connect 2) and it will work. For more, on a LAN, you'd use pfSense in place of the router in the modem. It will still provide NAT for IPv4, nothing you can do about that, but on IPv6, you can have one or more (V)LANs, each providing a /64. Devices connected with then have one or more global addresses. With SLAAC and privacy addresses, each device will have 9 after a week.

Ulysses_

The wifi will not work, will it. I would miss accessing the internet from my smartphone using that. Also pfsense is used in a VM in my main computer so to use several devices at the same time some more hardware would be needed (nic's). STUN doesn't sound like I'd ever need it.

JKnott

@Ulysses_

The modem's WiFi probably won't work. If it did, it would be entirely outside of pfSense. However, there's nothing to stop you from having your own access point. You can get dedicated APs or just use an old router as an AP. I have a separate AP, which uses power over Ethernet. This means I can place it in the best place, rather than what's handy for installing the modem. As for the VM, you could use separate NICs or VLANs & a managed switch to separate things.

Ulysses_

Anyway, I know it's a bad practise and strongly discouraged everywhere, but let's pretend I need the wifi and don't have the $5 to buy nic's, how is NAT done? It is just a line or two of iptables rules in linux for IPv4, can't be too hard in pfsense and IPv6.

JKnott

@Ulysses_

I have never set up NAT on IPv6, so no help there. However, other than WiFi, there should be no difference between using the modem in gateway and bridge modes. You'd still connect the LAN side exactly the same way. Do you not have an old router kicking around that you can use as an AP?

Ulysses_

No but I have a wifi usb adapter than probably can act like an ap. Alternatively, how do we do the following in pfsense:

https://serverfault.com/questions/929044/ip6tables-is-not-masquerading-source-address

JKnott

@Ulysses_

I don't know how well that USB adapter would work. FreeBSD, which pfSense is built on is not that great with WiFi. As for that link, that's about iptables, not ipfilter, which FreeBSD uses.

Ulysses_

It boils down to the following rules, is the equivalent functionality available in the web interface somewhere? In a package somewhere? In ipfilter?

-A PREROUTING -d 2001:470:4a71:f170::/64 -i eth0 -j DNAT --to-destination fdde:ad00:beef:0:91f5:6dd4:e66f:cf5b
-A POSTROUTING -s fdde:ad00:beef::/64 -o eth0 -j MASQUERADE
-A POSTROUTING -s fd11:22::/64 -o eth0 -p udp -j MASQUERADE
-A POSTROUTING -s fd11:22::/64 -o eth0 -p tcp -j MASQUERADE
-A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

dotdash

@JKnott said in Need some instructions for getting started with IPv6:

As for that link, that's about iptables, not ipfilter, which FreeBSD uses.

It's also not for pf, which pfSense uses.

OP- I'd expect you could use NPT, which is covered in the Netgate docs.
What exactly is the reason for needing ipv6? Your setup seems complicated enough, what with the virtualized firewall on the workstation and the double nat.

JKnott

@dotdash said in Need some instructions for getting started with IPv6:

As for that link, that's about iptables, not ipfilter, which FreeBSD uses.

It's also not for pf, which pfSense uses.

Sorry my mistake. Either way, it doesn't use iptables. I used to use iptables, when I had a Linux based firewall and ipchains before that. However, I never really got into the rules for iptables, as the firewall configuration in SUSE Linux handled most of my needs.

Ulysses_

What exactly is the reason for needing ipv6? Your setup seems complicated enough, what with the virtualized firewall on the workstation and the double nat.

So far it is just that a Windows VM that had to be worked with a while ago required access to something by Microsoft that was IPv6-only, but sooner or later there will be more and more instances of such in ordinary use of a browser, so better get this sorted once and for all.

Actually it would be nicer if IPv6 was completely missing in all devices except the pfsense VM. And the modem. IPv6 in them is an unnecessary human-unfriendly complexity if STUN is not needed, NAT could be from IPv4 to IPv6 and should be one of the jobs of the pfsense firewall to keep the user's life simpler and a little more private. You'd visit ipv6.google.com and your browser would think it is an IPv4 site.

Gertjan

@Ulysses_ said in Need some instructions for getting started with IPv6:

IPv6 in them is an unnecessary human-unfriendly complexity

Strange.
That was very valid for IPv4, a couple of decades ago.
Stuff like NAT was invented, people are still having huge problems with that, just check out this forum alone.

Anyway.
There are no more IPv4 left. It's done.

Ulysses_

If IP's have run out it means support for more IP's is needed, it does not mean everyone with a browser needs them.

JKnott

@dotdash said in Need some instructions for getting started with IPv6:

What exactly is the reason for needing ipv6?

That's where the world is heading. There are nowhere near enough IPv4 addresses to meet the need. I recently posted a link to an article that tells about how there are no longer any IPv4 addresses available in Europe & Middle Easy, unless someone sells some surplus. Anyone who thinks we shouldn't be moving to IPv6 is head in sand stupid.

JKnott

@Ulysses_ said in Need some instructions for getting started with IPv6:

If IP's have run out it means support for more IP's is needed, it does not mean everyone with a browser needs them.

No, the world has to move to IPv6 and that means everyone. Otherwise we'll wind up in a situation where some people are on IPv4 and others on IPv6, with some means to translate between them. Sticking with IPv4 means sticking with NAT, STUN servers, trying to stretch IPv4 addresses more and more, with more things breaking. Even Vint Cerf, one of the developers of TCP/IP said 32 bits was only used for proof on concept and the plan was to go with much longer addresses. IPv4 is a dead end and it's long past time to move to IPv6. I've been using it for almost 10 years.

Ulysses_

It wouldn't be half the world sticking with IPv4 and NAT or NAT46, it would be guys in particular situations, such as wanting to keep that old wifi up and running while using pfsense as a firewall. If pfsense's job is to act in the middle, NAT or NAT46 or NAT64 or DNS46 or DNS64 are all legitimate pfsense functionalities for particular scenarios. And quoting someone from a link given above:

"And for the "IPv6 doesn't need NAT!" brigade - sometimes you DO need it, for example if you want to run Docker containers on AWS. It doesn't support DHCP PD so you're stuck with NAT."

JKnott

@Ulysses_

WiFi should be transparent to the protocol. You should be able to run IPv4, IPv6, Appletalk, IPX and DECNet without issue, as WiFi is a layer 2 transport, not layer 3 where IPv4 & 6 are.

Why is NAT needed with Docker on AWS? What would you do if NAT wasn't available?