IPv6 issues

JKnott

Yeah, I meant a /60, which provides 16 /64s. I haven't had my morning beer yet.

johnpoz

I haven't had my morning beer yet

Me and you both.. Which we all know is the breakfast of champions! ;)

HomerSimpson

I followed someones blog post because I am a n00b :-) I thought I got an /64 prefix but just checked again and it seems to be a /128 prefix

johnpoz

@homersimpson

You need to ask for, and your isp needs to support giving you a prefix other than 1 single /64 if you want to use IPv6 behind pfsense.

Or you could just give up on whatever crappy ipv6 support your isp has and setup a Hurricane electric tunnel and get a /48 to use however you want..

A /48 would give you 65K /64s to play with - that should be more than enough ;)

edit: a /128 is fine for the transit.. Did you setup pfsense to request a delegation of say a /60? You then can setup your lan side interfaces to track this and assign a specific /64 prefix from the /60 to use on your lan side interface..

But to be honest just getting a /48 from HE is much easier setup ;) And you can take that /48 with you if you change ISPs.. You can do whatever static setups you want - with no worry that your prefix from your isp might change, etc. etc. You can setup PTRs for any of the IPv6 address in your /48.. etc.

HomerSimpson

@johnpoz awesome thanks!

A Former User

@johnpoz Having just done exactly this I can say it was a painless setup. Takes a bit of time to get static ipv6 leases setup, but once done your done for good. Those will not change and you can create aliases to do what you require without fear of a prefix change.

johnpoz

Yeah dhcpv6 can be a bit of a learning curve ;)

HomerSimpson

Turns out the modems DHCPv6 server is using a /64 prefix

johnpoz

"modems" don't have dhcp servers neither v4 or v6.. You mean some gateway isp device you have? Ie a modem/router combo..

Some modems might hand out a 192.168.100 address when they don't have an internet connection.

But if your isp device is handing pfsense a /64 ipv6 address on its wan - there is prob zero chance of getting delegation to work..

HomerSimpson

@johnpoz /128 on the WAN and /64 on the LAN side

johnpoz

So you asked for a delegation in pfsense and then set track on lan side interface..

Where does "modem" dhcp come into play there?? What isp device do you have - what is the make and model?

JKnott

@homersimpson said in IPv6 issues:

I followed someones blog post because I am a n00b :-) I thought I got an /64 prefix but just checked again and it seems to be a /128 prefix

That /128 is only for your WAN interface and has nothing to do with whatever prefix you get. Your gateway will be a link local address, as that is commonly used with IPv6. You should have at least a /64.

JKnott

@johnpoz said in IPv6 issues:

edit: a /128 is fine for the transit..

It's not even used for transit. It's just an identifier for that interface and can be used for testing, VPNs etc. Given that a /128 allows for no other device, it can't even be directly used for traffic.

HomerSimpson

@jknott got it fixed, turns out the modem router had an issue thank you for all your help.

johnpoz

@jknott said in IPv6 issues:

it can't even be directly used for traffic.

Huh??

Here I did a ipv6 traceroute from the internet to one of my ntp server that is using an IPv6 from one of my /64s out of my /48

As you can see it hits my /128 address that is used for the transit network to my /48..

While yes /128 is full mask, just like /32 in ipv4 - and is used for loopback addressing, etc. It for sure can be used as address and mask you assign to the interface that is used for transit of networks routed via the transit network..

JKnott

@johnpoz said in IPv6 issues:

it can't even be directly used for traffic.

Huh??
Here I did a ipv6 traceroute from the internet to one of my ntp server that is using an IPv6 from one of my /64s out of my /48
As you can see it hits my /128 address that is used for the transit network to my /48..

With a /128, like a /32 on IPv4, how many possible addresses are there on the subnet? Only one in both cases. This means you cannot assign a /128 to an interface, plug it into a switch and then expect to communicate with another /128. You have to route through something else. So, the ISP will have a route to that /128 via the link local address, just as it would for any address within the customer's prefix.

johnpoz

What does that have to do with the price of tea in china?

My statement to the OP was an easy way to say to him that /128 is fine for the transit network - ie his connection to his isp..

Your getting way to deep into the weeds..

JKnott

@johnpoz said in IPv6 issues:

My statement to the OP was an easy way to say to him that /128 is fine for the transit network - ie his connection to his isp..
Your getting way to deep into the weeds..

With a /128, it can't possibly be the transit network as it can't communicate directly, that is without passing through a router, with any other device. That is what the link local address is used for. With a transit network, the addresses at each end must be able to communicate directly with the other end. That cannot happen with a /128. Think back to IPv4, where link local addresses weren't used. You would have some pipe, could be Ethernet, PPP or whatever. You would have an IP path, with addresses at each end that could communicate with each other. The only exception was point to point links, where the interface could be used, instead of an IP address.

Here's what netstat -r shows for my gateway:
Internet6:
Destination Gateway Flags Netif Expire
default fe80::217:10ff:fe9 UG em0

Notice that link local address? Coming the other way, my ISP would route to my network by the link local address of the WAN side of pfSense. At no point is my /128 WAN address used for routing. In fact, I don't even need that address for my IPv6 Internet connection to work.

Gertjan

@johnpoz
I know :

which matches :

but I set the subnet as /64 :

I know, this is not what instructions told me.
Like this "GIF tunnel subnet" setting is a "don't care" ??

The IPv6 he.net side of things :

which tells me that /64 should be used.

All this doesn't match up with what @JKnott tells me = "a /128 will be a no go for communication", and I know that is true.
This tunnel tunnels ??

So it is the local link

that matters ?

Btw : sorry for lossing the initial subject..

johnpoz

Guys... All I stated to the OP that is was ok to see a /128 on the wan interface.. There is zero reason to confuse him even more..

Yes /128 is a loopback - we all know that.. Doesn't have anything to do with his problem..

And yes you can talk to a loopback address.. And it can pass traffic - I prob made it worse by even having to point that out..