Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Static IPv6 setup

    Scheduled Pinned Locked Moved IPv6
    21 Posts 10 Posters 8.1k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • M
      MatthiasLohr
      last edited by

      Hey,

      I've problems setting up my IPv6 environment, maybe you can help me…

      My provider delegates a static /48 subnet, let's say it's 2001:xxxx:yyyy::/48. My upstream gateway is 2001:xxxx:yyyy::1/64, so i configured my WAN interface with (static) 2001:xxxx:yyyy::2/64. Pinging the world works now, pinging my PFSense router from an external server, too.

      Now i want to provide IPv6 to my LAN network. I  configured the LAN interface with 2001:xxxx:yyyy:1::1/64, i can ping it from a LAN client (with static IPv6, also, couldn't get RA working...). I added 2001:xxxx:yyyy:1::1 as default gateway for my LAN client, but i can't ping neither anything outside nor the WAN ip of PFSense... so I guess that I've a mistake in my routing configuration... but.. where?

      Hope anybody could help me.

      Best regards
      Matthias

      1 Reply Last reply Reply Quote 1
      • M
        mevans336
        last edited by

        I am having this EXACT same issue and have my network configured almost identically to yours. To/From the WAN works, to/from LAN clients to the LAN interface works, but nothing WAN to LAN or LAN to WAN does. I have verified I have an allow all for IPv6 on my LAN interface as well.

        I have opened a ticket with pfSense. If they can help me figure this out, I'll post back here because I suspect we've both configured something incorrectly.

        1 Reply Last reply Reply Quote 0
        • M
          mevans336
          last edited by

          My issue was very likely not the same as yours, as I was able to ping the WAN IPv6 IP of my pfSense router. My issue wound up being a CARP issue and therefore, unrelated to a single host setup. (Props to pfSense support!)

          Did you get your issue resolved?

          1 Reply Last reply Reply Quote 1
          • N
            nunalog
            last edited by

            I have the same issue with Bell Canada.
            I'm thinking this can be resolved with virtual ip's of some sort but i have no idea.

            1 Reply Last reply Reply Quote 0
            • C
              cmb
              last edited by

              @nunalog:

              I have the same issue with Bell Canada.
              I'm thinking this can be resolved with virtual ip's of some sort but i have no idea.

              You have the same symptom. And probably the same root cause, the routing of your LAN-side IPv6 subnet isn't working. But there are many possible reasons for that, which shouldn't all be jumbled into one thread. Please start a new thread and describe your Bell-provided IPv6 information, and what you've configured.

              1 Reply Last reply Reply Quote 0
              • R
                rhyde
                last edited by

                I know this was 2 years ago but did anyone resolve this? Having the exact same issue.

                1 Reply Last reply Reply Quote 0
                • M
                  msf2000
                  last edited by

                  It's probably the routing. Are you using a IPv6 tunnel broker, or is your IPv6 natively provided by the same ISP as IPv4?

                  1 Reply Last reply Reply Quote 0
                  • M
                    msf2000
                    last edited by msf2000

                    If you're using a tunnel broker, then let your LAN clients to use a different subnet (/64).
                    2001:xxxx:xxxx:1000::1 -- isp side of ipv6 tunnel
                    2001:xxxx:xxxx:1000::2 -- firewall side of ipv6 tunnel
                    2001:xxxx:xxxx:2000::1 -- firewall lan interface
                    2001:xxxx:xxxx:2000::/64 -- lan dhcp range anywhere in here is fine.

                    Then, configure the IPv6 router as "Managed" mode.
                    http://firewall/services_router_advertisements.php

                    R 1 Reply Last reply Reply Quote 0
                    • R
                      rhyde @msf2000
                      last edited by

                      @msf2000

                      I am receiving a static /56 IPv6 block from CenturyLink Business.

                      Upstream Gateway:
                      2001:XXXX:XXXX:900::1

                      WAN Interface:
                      2001:XXXX:XXXX:900::2 /64

                      LAN Interface:
                      2001:XXXX:XXXX:901::1 /64

                      PINGS:

                      YES | LAN > WAN
                      YES | WAN > Gateway
                      YES | WAN > GOOGLE DNS

                      NO | LAN > Gateway
                      NO | WAN > LAN

                      ISP PINGS:
                      NO | Gateway > WAN

                      Firewall rules are correct. I have RA turned on in "Assisted" Mode.

                      From what I read:
                      The Upstream Gateway needs to have a route for the /56 pointing to the Pfsense WAN interface

                      1 Reply Last reply Reply Quote 0
                      • M
                        msf2000
                        last edited by

                        On the page /system_gateways.php
                        Is there an entry for 2001:XXXX:XXXX:900::1 using interface WAN?

                        1 Reply Last reply Reply Quote 0
                        • R
                          rhyde
                          last edited by

                          Yes there is and it is also the default gateway.

                          1 Reply Last reply Reply Quote 0
                          • M
                            msf2000
                            last edited by msf2000

                            Try one or both of these:

                            1. Traceroute from a LAN client to 2001:XXXX:XXXX:900::1
                            2. Goto the top menu Diagnostics --> Routes.
                              Screenshot just the section "IPv6 Routes".

                            You should see:
                            Destination -- Gateway
                            default -- 2001:XXXX:XXXX:900::1
                            2001:XXXX:XXXX:900::1 -- link##
                            2001:XXXX:XXXX:900::2 -- link##
                            2001:XXXX:XXXX:901::1 -- link##
                            2001:XXXX:XXXX:901::/64 -- link##

                            ignore the fe80:: stuff

                            Keep in mind that /64 would make the WAN & LAN subnets separated properly, but a /56 would not.

                            2001🔡abcd:900::1/56 is
                            Start Range: 2001🔡abcd:900:0:0:0:0
                            End Range: 2001🔡abcd:9ff:ffff:ffff:ffff:ffff

                            1 Reply Last reply Reply Quote 0
                            • L
                              lam16
                              last edited by

                              am having same problem

                              i have BT statis ip address
                              network address: 2a00:2323:ffaa::/64
                              gateway 2a00:2323:ffaa::1

                              WAN
                              ip: 2a00:2323:ffaa::5/64

                              LAN
                              ip: 2a00:2323:ffaa:1000::/56

                              ping
                              WAN to GW - OK
                              WAN to google - OK

                              LAN to WAN - OK
                              LAN to GW - FAIL
                              LAN to google - FAIL

                              system > advanced > networking > ipv6 enabled
                              FIREWAL > WAN ipv6 *** pass
                              FIREWAL > LAN ipv6 *** pass

                              please can you help? what am i missing?

                              1 Reply Last reply Reply Quote 0
                              • M
                                msf2000
                                last edited by

                                For everyone having routing problems with IPv6, be sure you setup the router under:
                                http://firewall/services_router_advertisements.php?if=lan

                                Router Mode should be "Managed"
                                Managed - Will advertise this router with all configuration through a DHCPv6 server.

                                That's the only way I've gotten it to work correctly.

                                N 1 Reply Last reply Reply Quote 0
                                • N
                                  Napsterbater @msf2000
                                  last edited by

                                  @msf2000

                                  "Managed" is not the only "correct" setting. It is only needed/used IF you want to disable SLAAC and tell the client to ONLY use DHCPv6, of which you need to also have DHCPv6 correctly configured on that interface.

                                  In fact most deployments especially in residential will/should use unmanaged (DNS provided via RDNSS only), or stateless DHCP, this allows SLAAC addressing and RDNSS (provides DNS servers for devices supporting RDNSS) AND allows devices that only support DNS via Stateless DHCP to get DNS servers and such from DHCPv6 (Older Windows versions, including early Win10)

                                  In fact a setting of Managed will not allow some/many device to get an IPv6 address at all as not all support DHCPv6, Android being the biggest ones.

                                  If unmanaged is not working then double check all settings on the screen, also confirm the systems are getting DNS servers even if they are only IPv4 (provided they have IPv4 connectivity)

                                  1 Reply Last reply Reply Quote 0
                                  • M
                                    msf2000
                                    last edited by

                                    @Napsterbater

                                    I don't know enough about DHCPv6 to know what the correct setting in every deployment scenario. Based on the OP and others' comments, I provided the only setting that worked for me in my deployment.

                                    Can you please make a suggestion to @rhyde on what settings to change?

                                    1 Reply Last reply Reply Quote 0
                                    • R
                                      rhyde
                                      last edited by

                                      This post is deleted!
                                      1 Reply Last reply Reply Quote 0
                                      • R
                                        rhyde
                                        last edited by rhyde

                                        Hey guys I finally had some breakthrough with this. Please note that the below config is if you want to have dual stack support.

                                        Here is what ultimately worked:

                                        Put the LAN and WAN in Bridge Mode
                                        0_1534023215100_bridge-mode.png

                                        WAN interface config:

                                        0_1534022172773_wan-interface.png

                                        LAN interface config:

                                        0_1534022274936_lan-interface.png

                                        DHCPv6 & RA config:

                                        0_1534022307105_wan-dhcp.png

                                        0_1534022403304_wan-ra.png

                                        DHCP config:

                                        0_1534022415795_lan-dchp.png

                                        WAN firewall rules:

                                        0_1534022576203_wan-firewall-rules.png

                                        LAN firewall rules:

                                        0_1534022527910_lan-firewall-rules.png

                                        Let me know if you guys have any thoughts or suggestions to this config. I am open to whatever. There could be some issues with it but at least it works. :)

                                        JKnottJ 1 Reply Last reply Reply Quote 0
                                        • JKnottJ
                                          JKnott @rhyde
                                          last edited by

                                          @rhyde said in Static IPv6 setup:

                                          Let me know if you guys have any thoughts or suggestions to this config. I am open to whatever. There could be some issues with it but at least it works. :)

                                          What does the ISP say you should be using? If they're expecting you to use DHCPv6-PD and you use a static config, you may find you have problems, even if it working at the moment.

                                          PfSense running on Qotom mini PC
                                          i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                                          UniFi AC-Lite access point

                                          I haven't lost my mind. It's around here...somewhere...

                                          R 1 Reply Last reply Reply Quote 0
                                          • R
                                            rhyde @JKnott
                                            last edited by

                                            @jknott the ISP is giving a static IP only. This is business grade internet, not residential.

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.