Static setup, LAN->WAN forwarding not working [SOLVED]

[Elnadmin]

Hi! I've got a /48 block from an ISP for native, static setup:

WAN interface:
{prefix}::1/64 = ISP gateway
{prefix}::2/64 = My pfsense 2.2.6 on WAN

LAN interface:
{prefix}:0a00::2/64 = My pfsense 2.2.6 on LAN
RA with "unmanaged" (i.e. without DCPv6) successfully assigns addresses and router info.

However, while I can ping ISP gateway and Internet sites from the FW through WAN interface, I cannot ping them through FW's LAN interface (or the actual workstations on the LAN). Pinging the FW itself from LAN works.

In other words, from LAN,
ping6 {prefix}:0a00::2 works, and
ping6 {prefix}::2 works, but
ping6 {prefix}::1 and ping6 www.google.com only work through FW's Diagnostics/Ping, and even then only when "WAN" is selected as a source, not "LAN".

6to4 tunneling on WAN and "follow interface" on LAN worked a few days back, but this new static IPv6 setup just drops all LAN->WAN traffic.

My ISP doesn't offer DHCPv6 so I need to get static setup working, "Track interface" is not an option.

Some configuration points:

• Rules allow all traffic out from LAN interface, and ICMP from WAN to LAN.

• IPv4 is NATed out (manual NAT). Works, and most rules are IPv4+6.

• IPv4 is using CARP for High Availability. Backup device is not configured for IPv6 at all for now – I'd like to get it working on a single FW first.

• Manual routing table is empty.

• "Block bogon networks" is disabled on both WAN and LAN.

• LAN interface's "upstream gateway" field is empty. (Shouldn't be necessary to point the FW to itself. Tried and it didn't help.)

• Tried adding a default route to {prefix}:0a00::2 on a LAN workstation. Didn't work, which is not surprising, since pinging WAN doesn't work even from Pfsense itself when LAN interface is selected as a source.

Any ideas how to proceed? Since there's no NATing in IPv6, do I have to add manual routes, enable LAN->WAN IPv6 forwarding from somewhere, or what could I try?

[Elnadmin]

Solved. This turned out to be an ISP side routing issue. Like in https://forum.pfsense.org/index.php?topic=104583.0 , I was trying to advertise the /48 to the ISP gateway through SA, which is apparently not how it's supposed to work.

Testing with netcat6, I listened at a remote server for UDP packets and sent one from the LAN. It went through. So in fact LAN->Internet was working, but replies (Internet->LAN) never came through.

This was resolved by the ISP setting up a separate link network {linkprefix}::/64, and then routing {prefix}::/48 <-> {linkprefix}::1/64 (ISP GW) <-> {linkprefix}::2/64 (Pfsense) <-> LAN. (No route daemon running on pfsense, only static configs at ISP side.)

Unfortunately, I never found out why/how Internet<->Pfsense traffic worked before (regardless of Pfsense box's address), if there were no routes set up at ISP's before. Maybe their gateway added my Pfsense box as a single host to their routing tables through IPv6 Neighbor discovery or something.