IPv6 issues

HomerSimpson

Hi all,

I have some issues with my IPv6 setup.

My WAN receives an IPv6 address from my modem by DHCPv6, I have set a static address for the LAN where my WAN is xxxx:xxxx:xxxx:xxxx:etc:etc:etc:etc my lan is xxxx:xxxx:xxxx:yyyy::1

Have enabled the DHCPv6 server for LAN and Router Advertisements set to Managed. All clients receives an IPv6 address and are able to ping the firewall.

The DNS server returns a valid IPv6 address, I have added a new IPv6 rule and with logging enabled and I see the requests, but the clients are not able to contact external addresses the connections are getting timed out.

When I do a port test from WAN I can contact external addresses but not from LAN

I have tried multiple things which I have read from this forum but no luck so far.

Thanks

johnpoz

@homersimpson said in IPv6 issues:

I have set a static address for the LAN where my WAN is xxxx:xxxx:xxxx:xxxx:etc:etc:etc:etc my lan is xxxx:xxxx:xxxx:yyyy::1

Where would you have gotten the idea that would work? Did you get a prefix delegation from your isp a /60, /56? And the range you put on your lan is within this delegation?

If you want to use IPv6 on lan side networks. You need a delegation from your ISP that gives you that range..

JKnott

@homersimpson

As mentioned by @johnpoz, you have to use addresses assigned by your ISP. The usual method is via DHCPv6-PD. The "PD" refers to prefix delegation, where they assign you a prefix, which you then use on your LAN. You should get at least 1 /64 and likely more. Many ISPs provide a /56 for 256 /64s. Others may provide a /16, /48 or other.

johnpoz

@jknott said in IPv6 issues:

Others may provide a /16

Clearly that is a typo ;) That sure and the hell would never be handed out PD hehehe

JKnott

@johnpoz

Yeah, I meant a /60, which provides 16 /64s. I haven't had my morning beer yet.

johnpoz

@jknott said in IPv6 issues:

I haven't had my morning beer yet

Me and you both.. Which we all know is the breakfast of champions! ;)

HomerSimpson

I followed someones blog post because I am a n00b :-) I thought I got an /64 prefix but just checked again and it seems to be a /128 prefix

johnpoz

@homersimpson

You need to ask for, and your isp needs to support giving you a prefix other than 1 single /64 if you want to use IPv6 behind pfsense.

Or you could just give up on whatever crappy ipv6 support your isp has and setup a Hurricane electric tunnel and get a /48 to use however you want..

A /48 would give you 65K /64s to play with - that should be more than enough ;)

edit: a /128 is fine for the transit.. Did you setup pfsense to request a delegation of say a /60? You then can setup your lan side interfaces to track this and assign a specific /64 prefix from the /60 to use on your lan side interface..

But to be honest just getting a /48 from HE is much easier setup ;) And you can take that /48 with you if you change ISPs.. You can do whatever static setups you want - with no worry that your prefix from your isp might change, etc. etc. You can setup PTRs for any of the IPv6 address in your /48.. etc.

HomerSimpson

@johnpoz awesome thanks!

A Former User

@johnpoz Having just done exactly this I can say it was a painless setup. Takes a bit of time to get static ipv6 leases setup, but once done your done for good. Those will not change and you can create aliases to do what you require without fear of a prefix change.

johnpoz

Yeah dhcpv6 can be a bit of a learning curve ;)

HomerSimpson

Turns out the modems DHCPv6 server is using a /64 prefix

johnpoz

"modems" don't have dhcp servers neither v4 or v6.. You mean some gateway isp device you have? Ie a modem/router combo..

Some modems might hand out a 192.168.100 address when they don't have an internet connection.

But if your isp device is handing pfsense a /64 ipv6 address on its wan - there is prob zero chance of getting delegation to work..

HomerSimpson

@johnpoz /128 on the WAN and /64 on the LAN side

johnpoz

So you asked for a delegation in pfsense and then set track on lan side interface..

Where does "modem" dhcp come into play there?? What isp device do you have - what is the make and model?

JKnott

@homersimpson said in IPv6 issues:

I followed someones blog post because I am a n00b :-) I thought I got an /64 prefix but just checked again and it seems to be a /128 prefix

That /128 is only for your WAN interface and has nothing to do with whatever prefix you get. Your gateway will be a link local address, as that is commonly used with IPv6. You should have at least a /64.

JKnott

@johnpoz said in IPv6 issues:

edit: a /128 is fine for the transit..

It's not even used for transit. It's just an identifier for that interface and can be used for testing, VPNs etc. Given that a /128 allows for no other device, it can't even be directly used for traffic.

HomerSimpson

@jknott got it fixed, turns out the modem router had an issue thank you for all your help.

johnpoz

@jknott said in IPv6 issues:

it can't even be directly used for traffic.

Huh??

Here I did a ipv6 traceroute from the internet to one of my ntp server that is using an IPv6 from one of my /64s out of my /48

As you can see it hits my /128 address that is used for the transit network to my /48..

While yes /128 is full mask, just like /32 in ipv4 - and is used for loopback addressing, etc. It for sure can be used as address and mask you assign to the interface that is used for transit of networks routed via the transit network..

JKnott

@johnpoz said in IPv6 issues:

it can't even be directly used for traffic.

Huh??
Here I did a ipv6 traceroute from the internet to one of my ntp server that is using an IPv6 from one of my /64s out of my /48
As you can see it hits my /128 address that is used for the transit network to my /48..

With a /128, like a /32 on IPv4, how many possible addresses are there on the subnet? Only one in both cases. This means you cannot assign a /128 to an interface, plug it into a switch and then expect to communicate with another /128. You have to route through something else. So, the ISP will have a route to that /128 via the link local address, just as it would for any address within the customer's prefix.