Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    OpenVPN and Deutsche Glasfaser - IPV6 and CGNAT blocking connection?

    Scheduled Pinned Locked Moved OpenVPN
    45 Posts 5 Posters 6.6k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • N
      netblues @charry2014
      last edited by

      @charry2014 Only a reflector site will tell you your ip.
      Status interfaces should have it
      can you ping ipv6.google.com from pfsense cli?

      1 Reply Last reply Reply Quote 0
      • JKnottJ
        JKnott @netblues
        last edited by

        @netblues

        The WAN address may often have a host name which can be used. Use host or nslookup command on the WAN address to see what turns up.

        PfSense running on Qotom mini PC
        i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
        UniFi AC-Lite access point

        I haven't lost my mind. It's around here...somewhere...

        1 Reply Last reply Reply Quote 0
        • JKnottJ
          JKnott @charry2014
          last edited by

          @charry2014 said in OpenVPN and Deutsche Glasfaser - IPV6 and CGNAT blocking connection?:

          6rd Prefix: 2A00:61E0::

          They're using a tunnel, rather than native IPv6. I used a tunnel for the first 6 years I had IPv6, but now I get a native IPv6 connection from my ISP. I'm surprised they're using a tunnel and CGNAT. How old is that info? My ISP also used a tunnel (though not the one I used) prior to providing native IPv6. If they're using a tunnel these days, I'd have to question their competence.

          PfSense running on Qotom mini PC
          i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
          UniFi AC-Lite access point

          I haven't lost my mind. It's around here...somewhere...

          1 Reply Last reply Reply Quote 0
          • Bob.DigB
            Bob.Dig LAYER 8
            last edited by Bob.Dig

            Does your (smartphone) service provider has IPv6? Than you can connect OVPN via IPv6 directly.

            Bob.DigB 1 Reply Last reply Reply Quote 0
            • C
              charry2014
              last edited by

              I could get my IPv6 address from https://ipv6-test.com/ easily enough but have drawn a blank trying to test OpenVPN connecting to it. Both running the OpenVPN client on my phone, and using the phone as wifi hotspot for my Mac result in no packets received at the PFSense WAN. Tunnelblick on Mac reports:
              2020-07-26 15:43:16.288025 write UDPv6: No route to host (code=65)

              1 Reply Last reply Reply Quote 0
              • Bob.DigB
                Bob.Dig LAYER 8 @Bob.Dig
                last edited by Bob.Dig

                Please answer the question:

                @Bob-Dig said in OpenVPN and Deutsche Glasfaser - IPV6 and CGNAT blocking connection?:

                Does your (smartphone) service provider has IPv6?

                1 Reply Last reply Reply Quote 0
                • C
                  charry2014
                  last edited by charry2014

                  Yes. My phone (Samsung S20) is on Vodafone in Germany and I have read that they have IPv6 nationwide.
                  Edit - I did some digging and it has an IPv6 address too.

                  Bob.DigB 1 Reply Last reply Reply Quote 0
                  • Bob.DigB
                    Bob.Dig LAYER 8 @charry2014
                    last edited by

                    @charry2014 That's great, you don't need any IPv4, at least not if you want to connect the phone to home via OVPN.

                    1 Reply Last reply Reply Quote 0
                    • C
                      charry2014
                      last edited by

                      The site https://ipv6-test.com/ reports that my firewall is filtering ICMP v6 messages. Could this be a problem for OpenVPN? I am suspecting it might. How do I enable this?

                      JKnottJ 1 Reply Last reply Reply Quote 0
                      • Bob.DigB
                        Bob.Dig LAYER 8
                        last edited by Bob.Dig

                        No. How is your IPv6 configured? I think your ISP is doing native IPv6.

                        1 Reply Last reply Reply Quote 0
                        • C
                          charry2014
                          last edited by

                          I think so too, but I am not sure of much from my ISP.

                          One thing I did notice is that when I connect to whatismyipaddress.com or similar from different computers in my LAN that the IPv6 address that is returned is different for each one. The IPv4 address is the same, as I would expect. Now I think I am stumbling into a noob difference between IPv4 and IPv6 addresses.

                          So the question - what actually is the IPv6 address of my PFSense WAN?

                          JKnottJ 1 Reply Last reply Reply Quote 0
                          • Bob.DigB
                            Bob.Dig LAYER 8
                            last edited by Bob.Dig

                            You can see it in the interfaces-gadget and other places. 😉 (Status - Interfaces)

                            1 Reply Last reply Reply Quote 0
                            • C
                              charry2014
                              last edited by

                              Alright - so it is something like 2a00:61e0:abcd🔢:?

                              It is not the much longer address 2a00:61e0:b00b5:34dd:6969:beef:babe:face?

                              Bob.DigB 1 Reply Last reply Reply Quote 0
                              • Bob.DigB
                                Bob.Dig LAYER 8 @charry2014
                                last edited by Bob.Dig

                                @charry2014 Can't say but maybe you did something wrong. Try this and go for DHCPv6 and not 6rd.

                                1 Reply Last reply Reply Quote 0
                                • C
                                  charry2014
                                  last edited by

                                  Boom - that did it - using the IPv6 address for the WAN as shown in the Interfaces widget on the dashboard packets are now flowing.

                                  I now get an authentication error, but the connection is there. Authentication errors are kinda the staple for getting OpenVPN working so somehow I am back on known territory now.

                                  1 Reply Last reply Reply Quote 0
                                  • JKnottJ
                                    JKnott @charry2014
                                    last edited by

                                    @charry2014

                                    No, OpenVPN uses UDP, not ICMPv6. However, ICMPv6 is used for a lot of things, so be careful about any rules blocking it.

                                    PfSense running on Qotom mini PC
                                    i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                                    UniFi AC-Lite access point

                                    I haven't lost my mind. It's around here...somewhere...

                                    1 Reply Last reply Reply Quote 0
                                    • JKnottJ
                                      JKnott @charry2014
                                      last edited by

                                      @charry2014

                                      One nice thing about IPv6 is there are plenty of addresses to go around. This means no longer having to share an address with NAT. Not only does each device get an address, it will often get several. With SLAAC, privacy addresses are often used. These are random number based addresses and you get a new one every day. They expire after a week. This is in addition to the consistent address, so you could have as many as 8 public addresses on each device.

                                      PfSense running on Qotom mini PC
                                      i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                                      UniFi AC-Lite access point

                                      I haven't lost my mind. It's around here...somewhere...

                                      1 Reply Last reply Reply Quote 0
                                      • C
                                        charry2014
                                        last edited by

                                        Thanks everyone for your help - it seems that a little background reading would be a good idea sometime soon. This may well change the settings in the firewall rules, then?

                                        JKnottJ 1 Reply Last reply Reply Quote 0
                                        • JKnottJ
                                          JKnott @charry2014
                                          last edited by

                                          @charry2014

                                          That depends on what the rules do. If filtering on protocol, then you can often create a single rule that handles both. If filtering on address, then you'd need separate rules.

                                          PfSense running on Qotom mini PC
                                          i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                                          UniFi AC-Lite access point

                                          I haven't lost my mind. It's around here...somewhere...

                                          1 Reply Last reply Reply Quote 0
                                          • C
                                            charry2014
                                            last edited by

                                            So here it is, best I can remember it. All the things I changed to get this working:

                                            System - Advanced - Networking
                                            a539b8e1-4fea-4842-a249-397b68fe9769-image.png

                                            Interfaces - WAN
                                            0f469929-d495-4ecc-918c-10c081001e7f-image.png
                                            d5ac4ad4-c53f-4b6c-b78b-d608e71c7687-image.png

                                            Interfaces - LAN:
                                            cb7eb2b6-7155-4731-8e0d-eeae16b2cae9-image.png
                                            6655c340-d9fb-4936-ae80-1b32133c45ef-image.png

                                            The PFSense WAN IPv6 address is then in the Dashboard.

                                            Finally I meant to link to beechy.de above but got the wrong link pasted in.

                                            JKnottJ 1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.