IPV6 and firewall rules - My newb is showing
-
This post is deleted! -
-
make sure Do not allow PD/Address release on the WAN page is selected.
-This setting does not exist for me -
If that doesn't do the trick, you can set up Unique Local Addresses
-I am unable to complete this as i do not understand the below step
"This is exactly the same as the prefix for the GUA, except that the GUA prefix has been replaced with the ULA prefix"
What is the GUA prefix? Is that what is assigned by the ISP? Where do i find the GUA prefix? -
You end the post with "Once the ULA addresses have been enabled, the DNS can be configured to use those addresses"
Ok, how do i configure dns to use those address's?
-
-
@cr8tor said in IPV6 and firewall rules - My newb is showing:
make sure Do not allow PD/Address release on the WAN page is selected.
-This setting does not exist for meDo you not see this?
You end the post with "Once the ULA addresses have been enabled, the DNS can be configured to use those addresses"
Ok, how do i configure dns to use those address's?On the DNS resolver (or forwarder if you're using that) page there's a section called Host Overrides. You add the DNS entries in there. You create the host name and provide the consistent IPv6 address. You can also add another entry with the same name, but with the IPv4 address.
As for creating the ULA, just follow the instructions on the link I provided. To start, you have to create a 48 bit number starting with fc or fd and then fill out the remaining bits. I provided a couple of ways to generate random numbers. The idea behind the random numbers is to avoid the address collisions that are common on IPv4 when RFC1918 addresses are used. The length of the random number makes that extremely unlikely. ULA stands for Unique Local Address, which is the IPv6 equivalent of the IPv4 RFC1918 address. GUA means Global Unique Address, which is a public address, so if you want to reach devices on your network from elsewhere, you use GUA. These are the addresses you get from your ISP. Also, what size prefix do you get from your ISP? I get a /56 from mine, which provides 2^72 addresses, which can be split into 256 /64s, each of which contains 18.4 billion, billion addresses.
Perhaps you can do a screen capture of your WAN and LAN pages, so I can see what you've done.
-
@jknott
First, thank you for taking the time to respond again. I really wish i had the background and time to learn this in depth my self. Guidance from people like you is very much appreciated. Apologies for my jumbles mess of replies to your first post. :-)
Anyway, I do not see the PD/Address release option. I figured out why though.
I am using a IPv6 Configuration Type: 6rd Tunnel, where you use IPv6 Configuration Type: DHCP6
So i have different options. I'm not sure if i can get DHCP6 working with CenturyLink. The only thing that i have found to get it working is the 6rd tunnel.
I'm also not an expert, do you know enough to recommend settings that should work with CenturyLink? If so id be grateful for more of your time.Below are WAN, LAN, and Dashboard screenshots to give you more info on existing config.
As mentioned, right now ipv6 works, but i have to set a rule up that allows all ipv6 traffic destination/source as any. I can not limit access to certain PC's using an alias as source.
-
@jknott said in IPV6 and firewall rules - My newb is showing:
so if you want to reach devices on your network from elsewhere, you use GUA.
Also, i do want to be able to reach devices from elsewhere.
Is the GUA the address i receive from the ISP, shown in the screenshot below?
-
6rd tunnel is a method of providing IPv6 over an IPv4 network. It does that by encapsulating the IPv6 packet in IPv4. I had used something similar called 6in4 before my ISP provided native IPv6. However, this leaves you completely at the mercy of your ISP with regards to IPv6 addresses. So, you will have to use ULA for local addresses to get DNS to work. As for public addresses, you'll have to use a dynamic DNS service, which I have no experience with. And yes, that address is the global unique address. Only 1/8th of the entire IPv6 address space is assigned to GUA and the addresses start with 2 or 3.
You have to set up ULA on the RA page, as I have done here:
As I mentioned in that article, start the prefix with fc or fd and fill out the remainder with a random number. The right most character, 0 in my example, is used to select the prefix ID for each network you have on the LAN side. 0 is the first, then 1, etc., all the way up as far as you want to go. Also, note the ":" between groups of digits. Each group is 16 bits and :: is a string of continuous 0. So, if you set up yours in a way that looks like mine, then you should be OK.
-
I am not quite following your example. I am a very visual person and i cant see how you are getting things as your examples dont match.
I go to GRC.com
These are the 64 random hexadecimal characters (0-9 and A-F):
181B87B34BED6866F487958F98ECBEEDCCF0E5EE6BC6EEB9FA737F20835FD6F1I take 14 characters and precede them with fd.
fd181B87B34BED68
How do i turn these 16 characters fd181B87B34BED68 into the 12 character subnet and 29 character VIP?I'm guessing the 12 character would be: fd18:1B87:B34B::0
And my virtual IP's would start as below.
fd18:1B87:B34B:0:
fd18:1B87:B34B:1:
fd18:1B87:B34B:2:
But i'm not sure where to get the rest of the VIP from?Again, many thanks. Where can i send a donation to you?
-
Here's how IPv6 addresses work. They are 128 bits long, with 64 used by the prefix and 64 by the device. There are a couple of tricks to reducing the number of digits. In each group of 4 hex digits, with the groups separated by :. Leading 0s don't have to be included. So, :0abc: is the same as
. As I mentioned :: represents a string of 0s. You can only do that once. In my ULA prefix, I started with fd. I now need to fill out the remainder of the prefix 64 bits. In the last group, I have 0. The other groups I filled with a random number. On my guest LAN, I have 3 for the last group, but the rest of the prefix is identical. The :: reserves 64 bits for the host portion of the address. So, your examples appear correct. One other trick. I try to keep the prefix ID matching throughout. For example, my guest LAN would have 3 for the prefix ID with both ULA and GUA prefixes. In addition, on IPv4, I use 172.16.0.0 /16 and match the 3rd octet with the prefix ID, so my guest LAN would be 172.16.3.0 /24 and main LAN 172.16.0.0 /24. In addition, I use VLAN3 to connect to the guest SSID on my access point. In this way I can tell, at a glance, which network I'm working with. This is just a convenience however, and not required.I don't know what size prefix you get from your ISP, /56 is typical, some provide a /48, but your ULA prefix is absolutely huge. It's a /7. By picking random numbers, a collision with some other network is extremely unlikely to cause problems with a VPN.
-
@jknott said in IPV6 and firewall rules - My newb is showing:
So, your examples appear correct.
Correct how when the VIP's are incomplete?
I stated i dont know how to complete the VIP address? :-)If this is the 64 characters from GRC
181B87B34BED6866F487958F98ECBEEDCCF0E5EE6BC6EEB9FA737F20835FD6F1Then fd18:1B87:B34B:0:: works for the subnet.
Total of 13 characters, starts with fd and then 10 more random from the generated line above.But for the VIP's?
LAN - fd18:1B87:B34B:0:????:????:????:????
WIRELESS - fd18:1B87:B34B:1:????:????:????:????What do i use from that 64 character string to complete this correctly? Do i just add more random characters like so?
LAN - fd18:1B87:B34B:0:ED68:66F4:8795:8F98
WIRELESS - fd18:1B87:B34B:1:ED68:66F4:8795:8F98 -
@cr8tor said in IPV6 and firewall rules - My newb is showing:
I stated i dont know how to complete the VIP address? :-)
It happens automagically.
With SLAAC, the device provides it's own suffix to go with the prefix. This can be based on the MAC or a random number. Also, with SLAAC, there are privacy addresses, with a new one every day for up to 7. These are used for outgoing connections and the consistent address is used for incoming. Here's how my ULA look on this computer. The computer has been up for over a week, so I have 1 consistent address, the first one ending in f5fa, and the rest are privacy addresses. I have similar with GUA.inet6 fd48:1a37:2160:0:76d4:35ff:fe5b:f5fa prefixlen 64 scopeid 0x0<global> inet6 fd48:1a37:2160:0:58e2:3166:6e0:2b26 prefixlen 64 scopeid 0x0<global> inet6 fd48:1a37:2160:0:695d:b446:442d:a1f6 prefixlen 64 scopeid 0x0<global> inet6 fd48:1a37:2160:0:358f:4c9c:a6a5:cfce prefixlen 64 scopeid 0x0<global> inet6 fd48:1a37:2160:0:21ff:5569:891d:b317 prefixlen 64 scopeid 0x0<global> inet6 fd48:1a37:2160:0:fd33:fb34:5207:5bfe prefixlen 64 scopeid 0x0<global> inet6 fd48:1a37:2160:0:c8fc:f5d1:217d:2086 prefixlen 64 scopeid 0x0<global> inet6 fd48:1a37:2160:0:e51c:9fc5:89d7:f7e6 prefixlen 64 scopeid 0x0<global> -
@jknott
I disagree.
None of this is automagically filling it self out.
Also, you keep talking about GUA
I understand what it is, i have no clue what mine is nor how to find it. -
That's not where it happens. You're looking at the WAN side and you'll have to follow the directions from CenturyLink. Those addresses I provided are on a Linux computer connected to my LAN. The computer receives the prefix via SLAAC and then appends the suffixes.
GUA - Global Unique Address - public address. They start with 2 or 3 and you will have them on the LAN and possibly on the WAN interface. Not all ISPs use them on the WAN side.
ULA - Unique Local Address - private addresses where you create the prefix. They start with fc or fd. They are the same concept as the RFC1918 addresses in IPv4, in that they're not allowed on the Internet, but can be used within your own network.
Also, you should be on the RA page, not VIP.
-
@jknott Im still back trying to follow directions from a few posts ago.
You told me a couple of times to follow the directions on "Using Unique Local Addresses"
Im still trying to figure out this step. -
@jknott
Is this my GUA?
-
@cr8tor said in IPV6 and firewall rules - My newb is showing:
You told me a couple of times to follow the directions on "Using Unique Local Addresses"
On that page, I said "There are two parts to enabling ULA. First, a prefix has to be created on the Router Advertisements page.". The other part is about assigning an address to the pfsense LAN interface. Funny thing though, ULA will work without that address assigned. You just won't be able to communicate with pfsense, though you can route through it, as link local addresses are used for routing. However, when you create a VIP, you can just copy your existing GUA LAN address for that interface and replace the prefix portion with the ULA prefix you created, to create the full 128 bit address. The address will then have the ULA prefix, but the original GUA suffix. However, there is no need for the ULA and GUA suffixes to match, it's just a convenience. You could have just as easily used ::1 or some other number for the suffix. In fact, pfsense does that with the link local address. The link local address for pfsense, which is used for a lot of stuff, on my LAN is fe80::1:1. Fe80 indicates a link local address, and the remainder can be anything, though often based on the MAC. In this example, ::1:1 is used.
Yes, that is the GUA, as it starts with 2.
Here's a Wikipedia article which covers the different address types.
-
-
@jknott said in IPV6 and firewall rules - My newb is showing:
The subnet in RA is done.
Its set to fd18:1B87:B34B:0:: as i used in my example.However, when you create a VIP, you can just copy your existing GUA LAN address for that interface and replace the prefix portion with the ULA prefix you created, to create the full 128 bit address. The address will then have the ULA prefix, but the original GUA suffix.
How do i do this?
Step by step.
Copy from where, paste to where? Replace what with from where?
You speak as if speaking to someone that knows what they are doing. I do not. Hence, "My newb is showing" in the title.I am sure you are frustrated trying to help me with my lack of understanding.
Many thanks though for continuing to work with me. -
@cr8tor said in IPV6 and firewall rules - My newb is showing:
How do i do this?
Step by step.
Copy from where, paste to where? Replace what with from where?
You speak as if speaking to someone that knows what they are doing. I do not. Hence, "My newb is showing" in the title.On the Dashboard, all the interfaces are shown with their GUA. You can copy the LAN GUA from there. Then paste the entire address into the box where you create the VIP. Next, replace the prefix with the one you created.
I have been running IPv6 on my home network for over 11 years and have done a lot of reading about it. I also got my Cisco CCNA. I first started learning about IP in 1995, working with Ethernet in the late '80s and LANs in 1978.
-
@jknott
Here is whats on my dashboard.
My LAN GUA is below correct?
2602:b8:6364:a00::1I take that and paste the entire address into the box where I create the VIP.
Next, replace the prefix with one I created.So this: 2602:b8:6364:a00::1
Becomes this: fd18:1B87:B34B:0::1 which is what put in the VIP? -
Yes, that's correct. That page is interesting. They provide only the prefix, not a usable address on the WAN. Also, there isn't an IPv6 address for the wireless. What size prefix are they giving you? It looks like it might be a single /64, which means you might not have one for the wireless. As I mentioned, I get a /56 from my ISP, which provides 256 /64s. I have one each for my LAN, guest WiFi, test LAN, connection to a Cisco router and OpenVPN and have plenty left over.
Perhaps there's someone here who knows CenturyLink better.
