Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    No traffic gets past HE ipv6 tunnel

    Scheduled Pinned Locked Moved IPv6
    39 Posts 6 Posters 4.6k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • T
      toskium
      last edited by toskium

      Hello,

      I am trying to setup a HE ipv6 tunnel.
      GIF Interface works and comes up. Clients in LAN get proper ipv6 addresses but I can not ping anything on the far end of the tunnel.

      I do have a XG7100 with two WAN interfaces up. The tunnel is connected via the PPPoE interface, I already set the MTU size to 1452 on the Hurricane Electric advanced tab.

      The GW is up
      ec319b12-4ee5-4a67-b907-cc680478dbae-image.png

      The LAN interface is set up:
      290e08a1-82aa-4497-b3c8-92f4eeec127d-image.png

      DHCPv6 looks like so:
      eede6c7e-06ab-4e66-8c43-86fb95966f0a-image.png

      Clients do get an IPv6 Address:
      f78ad614-4e3d-4b7f-98be-1ab86a58ae85-image.png

      Firewall rule to allow IPv6 traffic from LAN to any is setup.

      However, nothing get's past the pfsense.
      Any ideas would be very welcome.

      Cheers,
      Markus

      JKnottJ 1 Reply Last reply Reply Quote 0
      • JKnottJ
        JKnott @toskium
        last edited by

        @toskium

        Two thoughts, firewall rules and routing. You need both to be properly configured. Without knowing more about what you've done, that's all I can offer.

        PfSense running on Qotom mini PC
        i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
        UniFi AC-Lite access point

        I haven't lost my mind. It's around here...somewhere...

        T 1 Reply Last reply Reply Quote 0
        • T
          toskium @JKnott
          last edited by

          @JKnott don't know if the following is sufficient, let me know if you need to know more.

          ipv6 Routes on the pfsense look like so:

          c0b966ad-3b1d-4ad7-8542-b301243fad07-image.png

          the only ipv6 rule on the LAN interface is that:

          c6cf3d62-2391-4f26-9f36-6d841b3a3f5f-image.png

          JKnottJ 1 Reply Last reply Reply Quote 0
          • JKnottJ
            JKnott @toskium
            last edited by

            @toskium

            Then you'll have to do some testing. For example you say you can't ping anything at the other end. Do you mean the tunnel end point? Or something on the LAN that the end point is connected to? The first is some hard error. The other is a routing issue. So, start with pinging end point to end point and if that's successful, go further. Also, is it a DNS issue, where pinging by host name fails? What about by IP address?

            PfSense running on Qotom mini PC
            i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
            UniFi AC-Lite access point

            I haven't lost my mind. It's around here...somewhere...

            1 Reply Last reply Reply Quote 0
            • GertjanG
              Gertjan
              last edited by Gertjan

              Probably not related, but this firewall rule won't introduce any issues :

              9675447f-0b28-4a0b-b059-22816407ce9e-image.png

              I'm using tunnel.he.net myself.

              I compared your routing table with mine.
              I found 3 differences :

              1 = I'm using pfBlockerNG(latest) : that' where my ::10.10.10.1 comes from.
              3 = I'm exposing a /64 out of the he.net's /46 for my VPN server, so I can use IPv4 and IPv6 for my road warriors.

              It sure 1 & 3 are actually not related.

              2=> Mine is attached to an interface 'em1'.
              Your is a lagg ?? Now where did that lagg came from ? ( and what is it ? ^^)
              I advise you to go by the books : use an (one unique) LAN interface and make IPv6 work. When done, go lagg ...

              53b3f877-503b-4f5f-bb11-232911fde714-image.png

              No "help me" PM's please. Use the forum, the community will thank you.
              Edit : and where are the logs ??

              T 1 Reply Last reply Reply Quote 0
              • T
                toskium @Gertjan
                last edited by

                @Gertjan Mine is on a lagg interface since the xg7100 does not have separate physical interfaces. The current config for the xg7100 is the result of a conversion from a SG3100. This was done by netgate support and they asked me in the process which switch port is supposed to be mapped on what interface, so that's the reason the interface looks as it does :-).

                1 Reply Last reply Reply Quote 0
                • GertjanG
                  Gertjan
                  last edited by Gertjan

                  I was kidding, I know what lagg is, but never used it - don't need it.

                  The thing is : for that small detail, everything look good.

                  Just to be sure :

                  The gateway tab :

                  1fc5fc1a-c1cf-4a99-8c94-253af2d00317-image.png

                  and

                  f53e866e-e7f3-4a3b-8dc8-73ff597818f7-image.png

                  edit : and because he;net is some kind of ISP for you and mle, always keep an eye on https://tunnelbroker.net/status.php
                  and the he.net users forum : the POP's stop working ones in a while.

                  No "help me" PM's please. Use the forum, the community will thank you.
                  Edit : and where are the logs ??

                  T 1 Reply Last reply Reply Quote 0
                  • T
                    toskium @Gertjan
                    last edited by

                    @Gertjan thanks for your input. Unfortunately it all looks correct.
                    The only major difference I seem to have is my multi-wan setup.

                    My gateways tab looks like so:
                    73bebbca-6e1b-4666-8cb9-1b29f56b27ae-image.png

                    You seem to be using a different monitoring IP though, but that shouldn't be an issue.

                    What I tried so far:

                    • ruled out name resolution, by directly pinging ipv6 address.
                    • ruled out wrong routes from client by pinging directly from pfsense to ipv6 address.

                    Since you mentioned the tunnelbroker.net status page, all tunnel servers are up and running at the time of my testing.

                    GertjanG 1 Reply Last reply Reply Quote 0
                    • GertjanG
                      Gertjan @toskium
                      last edited by

                      @toskium said in No traffic gets past HE ipv6 tunnel:

                      different monitoring IP though

                      I've use one of my own servers to ping-reply for dpinger.

                      25d92eb0-90cf-4a56-9aae-6d6402291fc5-image.png

                      Using the console / SSH access, option 8, you can ping6 to some host ?

                      No "help me" PM's please. Use the forum, the community will thank you.
                      Edit : and where are the logs ??

                      1 Reply Last reply Reply Quote 0
                      • kiokomanK
                        kiokoman LAYER 8
                        last edited by kiokoman

                        i have pppoe and he.net myself, to make it work for me I had to set mtu to 1472 and mss to 1440 on the gif interface
                        on tunnelbroker.net the mtu is set to 1472

                        ̿' ̿'\̵͇̿̿\з=(◕_◕)=ε/̵͇̿̿/'̿'̿ ̿
                        Please do not use chat/PM to ask for help
                        we must focus on silencing this @guest character. we must make up lies and alter the copyrights !
                        Don't forget to Upvote with the 👍 button for any post you find to be helpful.

                        1 Reply Last reply Reply Quote 0
                        • GertjanG
                          Gertjan
                          last edited by Gertjan

                          Same thing here :

                          ade87f5a-75c5-4719-8e66-7b822b075278-image.png

                          Although my WAN is connected to my ISP router, I know this routers is doing pppoe on the ADSL side.

                          edit : and yes, on the he.net side MTU is set to 1472.

                          No "help me" PM's please. Use the forum, the community will thank you.
                          Edit : and where are the logs ??

                          T 1 Reply Last reply Reply Quote 0
                          • T
                            toskium @Gertjan
                            last edited by toskium

                            @Gertjan @kiokoman
                            I tried what you just suggested, unfortunately no change in the behaviour.
                            I can't even ping the tunnel server ipv6 endpoint address even though the tunnel is up.
                            In theory I would need to be able to ping the ipv6 tunnel server address from my pfsense when selecting the HE tunnel interface.

                            1 Reply Last reply Reply Quote 0
                            • kiokomanK
                              kiokoman LAYER 8
                              last edited by kiokoman

                              but the tunnel show it's up, can you ping from pfsense that 2001:470:6c ::1 and ::2 ?

                              ̿' ̿'\̵͇̿̿\з=(◕_◕)=ε/̵͇̿̿/'̿'̿ ̿
                              Please do not use chat/PM to ask for help
                              we must focus on silencing this @guest character. we must make up lies and alter the copyrights !
                              Don't forget to Upvote with the 👍 button for any post you find to be helpful.

                              T 1 Reply Last reply Reply Quote 0
                              • T
                                toskium @kiokoman
                                last edited by toskium

                                @kiokoman I can ping myself -> ::2 but I can not ping the tunnel end at HE with -> ::1.
                                I am mystified :-)

                                1 Reply Last reply Reply Quote 0
                                • GertjanG
                                  Gertjan
                                  last edited by

                                  If you can't ping6 the remote part of the tunnel, the he.net POP, the one ending with ::1 then I advise you to use ping6 with some parameters, like :

                                  ping6 -I gif0 2001:470:1f12:5c0::1

                                  To force it to use the correct interface.

                                  You can get the interface name with

                                  ifconfig

                                  Btw : starts to looks like a routing issue.

                                  You have no IPv6 activated on your WAN_DHCP and WAN2_PPPOE as these are IPv4 only (are they ?).

                                  No "help me" PM's please. Use the forum, the community will thank you.
                                  Edit : and where are the logs ??

                                  T 1 Reply Last reply Reply Quote 0
                                  • T
                                    toskium @Gertjan
                                    last edited by

                                    @Gertjan

                                    ping6 -I gif0 -c 3 2001...

                                    works fine. So the tunnel by itself is working.

                                    what I do not yet understand is why that doesn't work from the GUI diagnostic ping when I specifically set the interface to the HE gif0 interface. In theory it should deliver the same result.

                                    WAN:
                                    0ebe47a9-0ed3-4287-944f-1db7d88c33e0-image.png

                                    WAN2:
                                    84b93276-8524-4a07-8f68-aa6fabf87cc4-image.png

                                    I do not see any other ipv6 related interfaces in the whole config.

                                    T 1 Reply Last reply Reply Quote 0
                                    • T
                                      toskium @toskium
                                      last edited by

                                      This post is deleted!
                                      1 Reply Last reply Reply Quote 0
                                      • T
                                        toskium
                                        last edited by toskium

                                        That's the current ipv6 routing table:

                                        Destination	Gateway	Flags	Use	Mtu	Netif	Expire
default	2001:470:6c:aaaa::1	UGS	151	1500	gif0	
::1	link#19	UH	1747	16384	lo0	
2001:470:20::2	2001:470:6c:aaaa::1	UGHS	0	1500	gif0	
2001:470:6c:aaaa::1	link#43	UH	23260	1280	gif0	
2001:470:6c:aaaa::2	link#43	UHS	6	16384	lo0	
2001:470:6d:aaaa::/64	link#32	U	6249	1500	lagg0.4088	
2001:470:6d:aaaa::1	link#32	UHS	0	16384	lo0	
2001:4860:4860::8888	2001:470:6c:aaaa::1	UGHS	0	1500	gif0	
fe80::%igb0/64	link#1	U	0	1500	igb0	
fe80::8261:5fff:fe04:ea3f%igb0	link#1	UHS	0	16384	lo0	
fe80::%lo0/64	link#19	U	0	16384	lo0	
fe80::1%lo0	link#19	UHS	0	16384	lo0	
fe80::%lagg0/64	link#23	U	0	1500	lagg0	
fe80::208:a2ff:fe11:5f66%lagg0	link#23	UHS	0	16384	lo0	
fe80::%igb0.7/64	link#24	U	0	1500	igb0.7	
fe80::8261:5fff:fe04:ea3f%igb0.7	link#24	UHS	0	16384	lo0	
fe80::%lagg0.4081/64	link#25	U	0	1500	lagg0.4081	
fe80::208:a2ff:fe11:5f66%lagg0.4081	link#25	UHS	0	16384	lo0	
fe80::%lagg0.4082/64	link#26	U	21	1500	lagg0.4082	
fe80::208:a2ff:fe11:5f66%lagg0.4082	link#26	UHS	0	16384	lo0	
fe80::%lagg0.4083/64	link#27	U	0	1500	lagg0.4083	
fe80::208:a2ff:fe11:5f66%lagg0.4083	link#27	UHS	0	16384	lo0	
fe80::%lagg0.4084/64	link#28	U	0	1500	lagg0.4084	
fe80::208:a2ff:fe11:5f66%lagg0.4084	link#28	UHS	0	16384	lo0	
fe80::%lagg0.4085/64	link#29	U	0	1500	lagg0.4085	
fe80::208:a2ff:fe11:5f66%lagg0.4085	link#29	UHS	0	16384	lo0	
fe80::%lagg0.4086/64	link#30	U	0	1500	lagg0.4086	
fe80::208:a2ff:fe11:5f66%lagg0.4086	link#30	UHS	0	16384	lo0	
fe80::%lagg0.4087/64	link#31	U	0	1500	lagg0.4087	
fe80::208:a2ff:fe11:5f66%lagg0.4087	link#31	UHS	0	16384	lo0	
fe80::%lagg0.4088/64	link#32	U	619	1500	lagg0.4088	
fe80::208:a2ff:fe11:5f66%lagg0.4088	link#32	UHS	0	16384	lo0	
fe80::%lagg0.4000/64	link#33	U	0	1500	lagg0.4000	
fe80::208:a2ff:fe11:5f66%lagg0.4000	link#33	UHS	0	16384	lo0	
fe80::%lagg0.20/64	link#34	U	0	1500	lagg0.20	
fe80::208:a2ff:fe11:5f66%lagg0.20	link#34	UHS	0	16384	lo0	
fe80::%lagg0.30/64	link#35	U	0	1500	lagg0.30	
fe80::208:a2ff:fe11:5f66%lagg0.30	link#35	UHS	0	16384	lo0	
fe80::%lagg0.40/64	link#36	U	0	1500	lagg0.40	
fe80::208:a2ff:fe11:5f66%lagg0.40	link#36	UHS	0	16384	lo0	
fe80::%lagg0.50/64	link#37	U	0	1500	lagg0.50	
fe80::208:a2ff:fe11:5f66%lagg0.50	link#37	UHS	0	16384	lo0	
fe80::%lagg0.60/64	link#38	U	0	1500	lagg0.60	
fe80::208:a2ff:fe11:5f66%lagg0.60	link#38	UHS	0	16384	lo0	
fe80::%lagg0.70/64	link#39	U	0	1500	lagg0.70	
fe80::208:a2ff:fe11:5f66%lagg0.70	link#39	UHS	0	16384	lo0	
fe80::%lagg0.80/64	link#40	U	0	1500	lagg0.80	
fe80::208:a2ff:fe11:5f66%lagg0.80	link#40	UHS	0	16384	lo0	
fe80::%lagg0.90/64	link#41	U	0	1500	lagg0.90	
fe80::208:a2ff:fe11:5f66%lagg0.90	link#41	UHS	0	16384	lo0	
fe80::%pppoe0/64	link#42	U	0	1492	pppoe0	
fe80::208:a2ff:fe11:5f66%pppoe0	link#42	UHS	0	16384	lo0	
fe80::%gif0/64	link#43	U	0	1500	gif0	
fe80::8261:5fff:fe04:ea3f%gif0	link#43	UHS	0	16384	lo0

                                        for better readability:
                                        e9f7ec0f-f645-4cac-afba-590cef7d8ff6-image.png

                                        1 Reply Last reply Reply Quote 0
                                        • kiokomanK
                                          kiokoman LAYER 8
                                          last edited by kiokoman

                                          @toskium said in No traffic gets past HE ipv6 tunnel:

                                          2001:470:20::2

                                          what is it? ^
                                          and why do you have google dns there ?

                                          ah i see it's he net dns

                                          ̿' ̿'\̵͇̿̿\з=(◕_◕)=ε/̵͇̿̿/'̿'̿ ̿
                                          Please do not use chat/PM to ask for help
                                          we must focus on silencing this @guest character. we must make up lies and alter the copyrights !
                                          Don't forget to Upvote with the 👍 button for any post you find to be helpful.

                                          T 1 Reply Last reply Reply Quote 0
                                          • T
                                            toskium @kiokoman
                                            last edited by

                                            @kiokoman this comes from my general DNS settings, the howto on docs.netgate.com stated to add google DNS servers in System > General Setup like so:

                                            b0cc0d12-6847-46cd-98b7-8350b8d61754-image.png

                                            GertjanG 1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.