pfsense / HE tunnel / client vm problem

Gertjan

@capt_scurrrvy said in psfense / HE tunnel / client vm problem:

Debian

I just created a HyperV instance from scratch, attached a Debian Buster ISO, mapped the VM instance to the "LAN" interface already used by my pfSense instance, and fired up debian, the installer started, I choose the minimum options (no graphics, just a SSH access).
I did not have to login, the debian VM got a IPv4 and a IPv6 from the 'dhcp server pfSense':

johnpoz

@capt_scurrrvy said in psfense / HE tunnel / client vm problem:

I am trying to go ipv6 only for this learning adventure.

That is going to be very problematic - since the VAST majority of stuff on the net is not IPv6.. Your going to be very limited to where you can actually go ;)

capt_scurrrvy

@johnpoz
As it is for learning, the number of available site does not bother me.

Frustratingly, I have now failed to get FreeBSD to work. So Linux and FreeBSD fail to browse the web.

Windows 8 still working with no issue. Browses the web no problem.

There is something I am not seeing. To have one VM that works and the others not is disappointing. I also don't understand how the linux machines can get an address but cannot browse.

Gertjan

@capt_scurrrvy said in psfense / HE tunnel / client vm problem:

.... cannot browse.

That's far to generic as a fault description.
These two words can be easily broke down into :
Gateway not known -no route to gateway.
DNS not set => resolving doesn't work.

When I installed the "Debian Buster 10.7 ISO", I had it's 'network interface' attached to the "virtual LAN switch", created by Hyper-V, the one that pfSense, also a VM, uses. It is also attached to a physical NIC called LAN, so I can use more physical devices on the LAN.
During the install, the Debian started to do a massive apt-get to update and install most needed packages.
I've added a

iface 
     iface eth0 inet6 dhcp

To the /etc/networking/interfaces to kick off IPv6 using the DHCP6 server on pfSense's LAN.

You have the single default firewall rule on your pfSense, right ?

capt_scurrrvy

@gertjan

Thank you for trying to solve this.

Promox is the host with a bridge vmbr2 configured. Pfsense vm LAN nic and the test vm's nic are connected to vmbr2.

I am currently trying Debian 10's live CD.

Shortening my full ipv6 address to just the last part.

ip address shows for ens18:
::fffa/128 (fffa being inside the range of ff00 to ffff I configured for dhcp6 server on pfsense)
fe80::a518/64

ip -6 route show
::fffa
::/64
fe80::/64
default via fe80::1:1

DNS and ping6 work. I ping6 -c 2 www.yahoo.com and get a successful dns lookup of an ipv6 address and two successful pings.

By browser, I mean web browser, specifically Firefox. Type www.google.com in address bar and eventually get error server not found or time out. I don't remember which error.

I then tried apt-get update. It displays the ipv6 address of where it is trying to go but eventually times out.

johnpoz

@capt_scurrrvy said in psfense / HE tunnel / client vm problem:

fe80::a518/64

You understand that is link-local, you would not be able to get past your local network with such an address. Ie while you could look up stuff via local dns, you wouldn't be able to get to the internet, just like you ca not get to the internet with a rfc1918 address. Or a 169.254.x.x address

capt_scurrrvy

@johnpoz
Understood. fe80 is local-link.
Why is pfsense not providing the GW?
Why does ping6 work? DNS works. The ipv6 address for DNS is the LAN interface on pfsense.

I don't like Windows (not wanting to start a comment war), but it works. I only turned off ipv4 in the properties. It is set to get ipv6 automatically.

Next is to try setting the default route manually. Would that be the address of the LAN nic on pfsense?

capt_scurrrvy

Side question:
Is there a way to edit the title of this thread? I noticed today I typed psfense instead of pfsense.

johnpoz

Um so windows got a global address? If all your linux has a link-local, still not going anywhere even if it uses a link-local gateway. Unless you natted your link-local ipv6 to a global ipv6. Which isn't how it works ;)

Lets see the output of windows ipconfig /all

edit: I edited your title for you.

Also show us the ifconfig for you linux.. Here is my linux box with working IPv6

See how it has a global address, along with its link local address.

capt_scurrrvy

@johnpoz
I believe what you are asking for is in the post above. Under Windows 8 config.
I don't remember if that was ipconfig or ipconfig /all. The routes are there too.

Thanks.

johnpoz

Sorry I missed that - yeah it has a global address.. Does your linux?

edit: Oh missed that too - it does.. But your routing table is not correct..

Here for example is my default route on actual interface

It can point to the link-local of your gateway. But not going to work on your lo interface.

capt_scurrrvy

@johnpoz
In that same post is my test Centos 8 vm. It did get assigned an address, but from the route list, doesn't look like the default route gets set.

johnpoz

Your default is set, but only for lo - which never going to work.

capt_scurrrvy

@johnpoz
So is that Centos failing to request a route from the pfsense DHCP6 server or similarly failing to get the pfsense router advertisement?

johnpoz

Clients do not get "routes" from dhcpv6.. Not how IPv6 works. RA is used..

capt_scurrrvy

@johnpoz
Does that mean pfsense's router advertisement is not sending the information?

capt_scurrrvy

I noticed the fe80 address of the LAN nic of pfsense is being set automatically as the default route on the linux box.

[root@localhost ~]# ip -6 route
unreachable ::/96 dev lo metric 1024 error -113 pref medium
unreachable ::ffff:0.0.0.0/96 dev lo metric 1024 error -113 pref medium
2001:470:1f1d:bc::ff04 dev eth1 proto kernel metric 100 pref medium
2001:470:1f1d:bc::/64 dev eth1 proto ra metric 100 pref medium
unreachable 2002:a00::/24 dev lo metric 1024 error -113 pref medium
unreachable 2002:7f00::/24 dev lo metric 1024 error -113 pref medium
unreachable 2002:a9fe::/32 dev lo metric 1024 error -113 pref medium
unreachable 2002:ac10::/28 dev lo metric 1024 error -113 pref medium
unreachable 2002:c0a8::/32 dev lo metric 1024 error -113 pref medium
unreachable 2002:e000::/19 dev lo metric 1024 error -113 pref medium
unreachable 3ffe:ffff::/32 dev lo metric 1024 error -113 pref medium
fe80::/64 dev eth1 proto kernel metric 100 pref medium
fe80::/64 dev eth0 proto kernel metric 256 pref medium
default via fe80::8802:71ff:fe34:93cb dev eth1 proto ra metric 100 pref medium

I don't understand why that would happen.

The ifcg_eth1 file

DEFROUTE=yes
IPV4_FAILURE_FATAL=no
IPV6INIT=yes
IPV6_AUTOCONF=yes
IPV6_DEFROUTE=yes
IPV6_FAILURE_FATAL=no
IPV6_ADDR_GEN_MODE=stable-privacy

capt_scurrrvy

Still trying to figure out why I can't get non Windows machines to communication via ipv6.

On pfsense, I have disabled DHCPv6 and Router Advertisements.

On the Centos vm, I statically set the ipv6 address and the gateway.

Just as previously, the VM can:
ping6
(this even does the correct DNS lookup)

traceroute6 and tracepath6 both show going out the Hurricane Electric tunnel.

Just as previously, the VM cannot:
Use a browser to view cnn, google, redhat.

I even put an allow any type rule on the pfsense WAN, LAN, and WANv6.
I disabled the firewall running on Centos.

It is as if TCP is not working. However, tcpdump shows traffic.

capt_scurrrvy

@johnpoz
Upgraded to 2.5.0. Had to manually add the default route for my ipv4 gateway on the WAN. See Default gateway can not be created with GUI

Surprise, Firefox on CentOS VM started to get to ipv6 web sites. This is with a manually assigned ipv6 for CentOS. Not sure what has changed between 2.4.5 and 2.5.

Gertjan

I upgraded this morning my main 'company' pfSense to 2.5.0.
I'm using he.net for my my IPv6 'needs'.

I had nothing to do.

Everything came up and was working fine.
( + captive portal using FreeRadius - OpenVPN server for my remote access).

Even a non-native package I installed many years ago was upgraded and kept on running.