4. Static IPv6 setup

Static IPv6 setup

  • M

    Hey,

    I've problems setting up my IPv6 environment, maybe you can help me…

    My provider delegates a static /48 subnet, let's say it's 2001:xxxx:yyyy::/48. My upstream gateway is 2001:xxxx:yyyy::1/64, so i configured my WAN interface with (static) 2001:xxxx:yyyy::2/64. Pinging the world works now, pinging my PFSense router from an external server, too.

    Now i want to provide IPv6 to my LAN network. I  configured the LAN interface with 2001:xxxx:yyyy:1::1/64, i can ping it from a LAN client (with static IPv6, also, couldn't get RA working...). I added 2001:xxxx:yyyy:1::1 as default gateway for my LAN client, but i can't ping neither anything outside nor the WAN ip of PFSense... so I guess that I've a mistake in my routing configuration... but.. where?

    Hope anybody could help me.

    Best regards
    Matthias

    0
  • M

    I am having this EXACT same issue and have my network configured almost identically to yours. To/From the WAN works, to/from LAN clients to the LAN interface works, but nothing WAN to LAN or LAN to WAN does. I have verified I have an allow all for IPv6 on my LAN interface as well.

    I have opened a ticket with pfSense. If they can help me figure this out, I'll post back here because I suspect we've both configured something incorrectly.

    0
  • M

    My issue was very likely not the same as yours, as I was able to ping the WAN IPv6 IP of my pfSense router. My issue wound up being a CARP issue and therefore, unrelated to a single host setup. (Props to pfSense support!)

    Did you get your issue resolved?

    0
  • N

    I have the same issue with Bell Canada.
    I'm thinking this can be resolved with virtual ip's of some sort but i have no idea.

    0
  • C

    @nunalog:

    I have the same issue with Bell Canada.
    I'm thinking this can be resolved with virtual ip's of some sort but i have no idea.

    You have the same symptom. And probably the same root cause, the routing of your LAN-side IPv6 subnet isn't working. But there are many possible reasons for that, which shouldn't all be jumbled into one thread. Please start a new thread and describe your Bell-provided IPv6 information, and what you've configured.

    0
  • R

    I know this was 2 years ago but did anyone resolve this? Having the exact same issue.

    0
  • M

    It's probably the routing. Are you using a IPv6 tunnel broker, or is your IPv6 natively provided by the same ISP as IPv4?

    0
  • M

    If you're using a tunnel broker, then let your LAN clients to use a different subnet (/64).
    2001:xxxx:xxxx:1000::1 -- isp side of ipv6 tunnel
    2001:xxxx:xxxx:1000::2 -- firewall side of ipv6 tunnel
    2001:xxxx:xxxx:2000::1 -- firewall lan interface
    2001:xxxx:xxxx:2000::/64 -- lan dhcp range anywhere in here is fine.

    Then, configure the IPv6 router as "Managed" mode.
    http://firewall/services_router_advertisements.php

    0
    R
     1 Reply
  • R

    @msf2000

    I am receiving a static /56 IPv6 block from CenturyLink Business.

    Upstream Gateway:
    2001:XXXX:XXXX:900::1

    WAN Interface:
    2001:XXXX:XXXX:900::2 /64

    LAN Interface:
    2001:XXXX:XXXX:901::1 /64

    PINGS:

    YES | LAN > WAN
    YES | WAN > Gateway
    YES | WAN > GOOGLE DNS

    NO | LAN > Gateway
    NO | WAN > LAN

    ISP PINGS:
    NO | Gateway > WAN

    Firewall rules are correct. I have RA turned on in "Assisted" Mode.

    From what I read:
    The Upstream Gateway needs to have a route for the /56 pointing to the Pfsense WAN interface

    0
  • M

    On the page /system_gateways.php
    Is there an entry for 2001:XXXX:XXXX:900::1 using interface WAN?

    0
  • R

    Yes there is and it is also the default gateway.

    0
  • M

    Try one or both of these:

    1. Traceroute from a LAN client to 2001:XXXX:XXXX:900::1
    2. Goto the top menu Diagnostics --> Routes.
      Screenshot just the section "IPv6 Routes".

    You should see:
    Destination -- Gateway
    default -- 2001:XXXX:XXXX:900::1
    2001:XXXX:XXXX:900::1 -- link##
    2001:XXXX:XXXX:900::2 -- link##
    2001:XXXX:XXXX:901::1 -- link##
    2001:XXXX:XXXX:901::/64 -- link##

    ignore the fe80:: stuff

    Keep in mind that /64 would make the WAN & LAN subnets separated properly, but a /56 would not.

    2001🔡abcd:900::1/56 is
    Start Range: 2001🔡abcd:900:0:0:0:0
    End Range: 2001🔡abcd:9ff:ffff:ffff:ffff:ffff

    0
  • L

    am having same problem

    i have BT statis ip address
    network address: 2a00:2323:ffaa::/64
    gateway 2a00:2323:ffaa::1

    WAN
    ip: 2a00:2323:ffaa::5/64

    LAN
    ip: 2a00:2323:ffaa:1000::/56

    ping
    WAN to GW - OK
    WAN to google - OK

    LAN to WAN - OK
    LAN to GW - FAIL
    LAN to google - FAIL

    system > advanced > networking > ipv6 enabled
    FIREWAL > WAN ipv6 *** pass
    FIREWAL > LAN ipv6 *** pass

    please can you help? what am i missing?

    0
  • M

    For everyone having routing problems with IPv6, be sure you setup the router under:
    http://firewall/services_router_advertisements.php?if=lan

    Router Mode should be "Managed"
    Managed - Will advertise this router with all configuration through a DHCPv6 server.

    That's the only way I've gotten it to work correctly.

    0
    N
     1 Reply
  • N

    @msf2000

    "Managed" is not the only "correct" setting. It is only needed/used IF you want to disable SLAAC and tell the client to ONLY use DHCPv6, of which you need to also have DHCPv6 correctly configured on that interface.

    In fact most deployments especially in residential will/should use unmanaged (DNS provided via RDNSS only), or stateless DHCP, this allows SLAAC addressing and RDNSS (provides DNS servers for devices supporting RDNSS) AND allows devices that only support DNS via Stateless DHCP to get DNS servers and such from DHCPv6 (Older Windows versions, including early Win10)

    In fact a setting of Managed will not allow some/many device to get an IPv6 address at all as not all support DHCPv6, Android being the biggest ones.

    If unmanaged is not working then double check all settings on the screen, also confirm the systems are getting DNS servers even if they are only IPv4 (provided they have IPv4 connectivity)

    0
  • M

    @Napsterbater

    I don't know enough about DHCPv6 to know what the correct setting in every deployment scenario. Based on the OP and others' comments, I provided the only setting that worked for me in my deployment.

    Can you please make a suggestion to @rhyde on what settings to change?

    0
  • R

    This post is deleted!
    0
  • R

    Hey guys I finally had some breakthrough with this. Please note that the below config is if you want to have dual stack support.

    Here is what ultimately worked:

    Put the LAN and WAN in Bridge Mode
    0_1534023215100_bridge-mode.png

    WAN interface config:

    0_1534022172773_wan-interface.png

    LAN interface config:

    0_1534022274936_lan-interface.png

    DHCPv6 & RA config:

    0_1534022307105_wan-dhcp.png

    0_1534022403304_wan-ra.png

    DHCP config:

    0_1534022415795_lan-dchp.png

    WAN firewall rules:

    0_1534022576203_wan-firewall-rules.png

    LAN firewall rules:

    0_1534022527910_lan-firewall-rules.png

    Let me know if you guys have any thoughts or suggestions to this config. I am open to whatever. There could be some issues with it but at least it works. :)

    0 1 Reply

  • @rhyde said in Static IPv6 setup:

    Let me know if you guys have any thoughts or suggestions to this config. I am open to whatever. There could be some issues with it but at least it works. :)

    What does the ISP say you should be using? If they're expecting you to use DHCPv6-PD and you use a static config, you may find you have problems, even if it working at the moment.

    0
    R
     1 Reply
  • R

    @jknott the ISP is giving a static IP only. This is business grade internet, not residential.

    0
  • Netgate

    I cannot imagine that a bridge like that is necessary.

    That is really ugly.

    They should route the /56 to an address on the WAN interface. That address can be obtained in multiple different ways. It can even be link-local. It is really up to them to tell you, in general terms, how to provision your router interface. For anyone else it would just be a guessing game.

    This is an example of instructions for a static /48 from a popular IPv6 transit + colo provider:

    IPv6
2001:xx:x:xx::/64
::1 is ISP
::2 is Customer

They route 2001:xxx:xxx::/48 to 2001:xx:x:xx::2

    It's as simple as that. Interface network + routed subnet.

    In that case you would set pfSense WAN to Static 2001:xx:x:xx::2/64 with a gateway of 2001:xx:x:xx::1 and use 2001:xxx:xxx::/48 on the inside however you want.

    2
 

Products

Applications

Support

Services

News

Resources

Company

Our Mission

As host of the pfSense open source firewall project, Netgate believes in enhancing network connectivity that maintains both security and privacy. We also believe everyone should be able to afford it.

Subscribe to our Newsletter

Product information, software announcements, and special offers. See our newsletter archive for past announcements.

© Copyright 2002 - 2018 Rubicon Communications, LLC | Privacy Policy