Announcing /48 to BGP peer
-
I tested it, there must be an interface setting /48 to bgp broadcast. if LAN or other interface has no /48 or greater, pfsense 's frr can't normal broadcast. to upstream.
-
@yon-0 I can guarantee you that nobody who is successfully announcing an IPv6 /48 has that /48 on an interface.
Chattanooga, Tennessee, USA
A comprehensive network diagram is worth 10,000 words and 15 conference calls.
DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
Do Not Chat For Help! NO_WAN_EGRESS(TM) -
In addition, for larger IP segments, the shortest IP address can be used.
For example 2400:3200::1 2400:da00::6666 -
Anyone else?
Chattanooga, Tennessee, USA
A comprehensive network diagram is worth 10,000 words and 15 conference calls.
DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
Do Not Chat For Help! NO_WAN_EGRESS(TM) -
@derelict said in IPv6 broken beyond pfSense after 2.5 upgrade:
@yon-0 I can guarantee you that nobody who is successfully announcing an IPv6 /48 has that /48 on an interface.
i using /48 setup interface in ubuntu 20.10 system and runing frr 7.5
eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 9000 inet 185.154.1.130 netmask 255.255.254.0 broadcast 185.154.1.255 inet6 2a0d:2405:512::1 prefixlen 48 scopeid 0x0<global> inet6 fe80::278:34ff:fee6:2f3f prefixlen 64 scopeid 0x20<link> ether 00:70:30:e6:2f:3f txqueuelen 200000 (Ethernet) RX packets 35921977 bytes 19914818009 (19.9 GB) RX errors 0 dropped 8 overruns 0 frame 0 TX packets 24672157 bytes 19845868488 (19.8 GB) TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0 -
@derelict said in IPv6 broken beyond pfSense after 2.5 upgrade:
Anyone else?
240C::6666 240C::6644
DIG Output:
dig @240C::6666 yahoo.com SOA; <<>> DiG 9.11.4-P2-RedHat-9.11.4-26.P2.el7_9.3 <<>> @240C::6666 yahoo.com SOA
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 58824
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;yahoo.com. IN SOA;; ANSWER SECTION:
yahoo.com. 1800 IN SOA ns1.yahoo.com. hostmaster.yahoo-inc.com. 2021022619 3600 300 1814400 600;; Query time: 18 msec
;; SERVER: 240c::6666#53(240c::6666)
;; WHEN: Sat Feb 27 00:52:23 CET 2021
;; MSG SIZE rcvd: 99---- Finished ------
https://bgp.he.net/ip/240C::6666
it is using /28 ipv6 for interface and bgp
-
DIG Output:
dig @2001:da8::666 yahoo.com SOA; <<>> DiG 9.11.4-P2-RedHat-9.11.4-26.P2.el7_9.3 <<>> @2001:da8::666 yahoo.com SOA
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 41270
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;yahoo.com. IN SOA;; ANSWER SECTION:
yahoo.com. 1800 IN SOA ns1.yahoo.com. hostmaster.yahoo-inc.com. 2021022619 3600 300 1814400 600;; Query time: 418 msec
;; SERVER: 2001:da8::666#53(2001:da8::666)
;; WHEN: Sat Feb 27 01:00:26 CET 2021
;; MSG SIZE rcvd: 102---- Finished ------
-
@yon-0 Yet here you are with problems.
Instead of arguing with me about it, please argue with Douglas Comer instead.
Chattanooga, Tennessee, USA
A comprehensive network diagram is worth 10,000 words and 15 conference calls.
DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
Do Not Chat For Help! NO_WAN_EGRESS(TM) -
@yon-0 You are confusing routes and allocations with interface addressing. Please read up on the difference. Happy to help you but in this case you are wrong (and continue to belabor an incorrect position) and your IPv6 journey will be much more successful if you adhere to the established rules, standards, and protocols instead of making up your own.
Chattanooga, Tennessee, USA
A comprehensive network diagram is worth 10,000 words and 15 conference calls.
DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
Do Not Chat For Help! NO_WAN_EGRESS(TM) -
I tested it with a previous version of pfsense before, and /48 works. DHCP can work with /48 test in windows 10. /48 SLAAC maybe can't work for andriod system. This is the result of the previous test. But if you set static ip, there is no problem. for all system.
I have always used /48 on the LAN interface and BGP broadcasts, and it has been working. This time you adjusted the limit, so I found this change. I suggest that the decision is given to users to decide how large the IP segment to use.
You can prompt the recommended value and other information, but don't force the user to use what -
I used to set /48 on the LAN interface to work, but it pf2.5 doesn’t work anymore now. This is the actual change
-
@yon-0 said in IPv6 broken beyond pfSense after 2.5 upgrade:
it is using /28 ipv6 for interface and bgp
Just because AS45275 is a /28, where did you get that idea that address is 240C::6666 is using a /28 on some interface?? Sorry but that is just insane!
I used to set /48 on the LAN interface to work, but it pf2.5 doesn’t work anymore now. This is the actual change
Yeah because they prob put in logic to stop users from doing insane shit ;)
I suggest that the decision is given to users to decide how large the IP segment to use.
Not when they are going to BREAK all logic and think they could put a /48 on an interface..
-
These IP addresses run DNS servers, so the 240C::6666 IP must be set in the interface. if that ip has no setup in interface, how we can connect it? if your not allow /48 or other setup interface , how i do setup use /32 or /48 Shortest ip in LAN's servers?
No, I don’t think so, I think you force others what you think is impossible.
DIG Output: dig @2620:0:ccc::2 yahoo.com SOA ; <<>> DiG 9.11.4-P2-RedHat-9.11.4-26.P2.el7_9.3 <<>> @2620:0:ccc::2 yahoo.com SOA ; (1 server found) ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 38691 ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 4096 ;; QUESTION SECTION: ;yahoo.com. IN SOA ;; ANSWER SECTION: yahoo.com. 127 IN SOA ns1.yahoo.com. hostmaster.yahoo-inc.com. 2021022619 3600 300 1814400 600 ;; Query time: 7 msec ;; SERVER: 2620:0:ccc::2#53(2620:0:ccc::2) ;; WHEN: Sat Feb 27 01:24:57 CET 2021 ;; MSG SIZE rcvd: 99 ---- Finished ------ -
@yon-0 said in IPv6 broken beyond pfSense after 2.5 upgrade:
2620:0:ccc::2
That is 2620:0:ccc:0::2/64. Guaranteed. You do realize that zero compression can include bits from both the subnet and interface portion of the address, right?
-
Does this 240C::6666 ip use /64 or what?
My point of view is to leave it to users to decide what is right, and we can provide suggested values. -
@yon-0 The standards and RFCs dictate what's right.
-
@yon-0 said in IPv6 broken beyond pfSense after 2.5 upgrade:
Does this 240C::6666 ip use /64 or what?
Yes, if it is on an interface it is 240c:0:0:0::6666/64
You certainly cannot tell from afar based on the allocation or the route. I GUARANTEE they do not have a 240c::/16 on an interface though.
-
@yon-0 You are just flat out wrong. The largest subnet to be used on an interface is /64. To suggest anything else just means you do not understand or have not read the RFCs for IPv6.
-
https://www.ripe.net/publications/docs/ripe-690
-
Yeah so.. What does that have to do with anything?
The part where they say you should allocate a /48 to users? Completely agree - that has ZERO to do with putting a /48 on an interface.
I have a /48 from HE for example.. Putting a /48 on interface would make all 65k of those 64's useless!
