Problem routing IPv6
-
I have been struggling with getting IPv6 working for a day and now i give up and ask for help. My ISP have given me a /48 subnet to use as i want, the only instruction i got is that the router is advertised by RA.
The setup is as follows
Subnet from ISP: 2XX1:2XX0:5XX0::/48
WAN interface: 2XX1:2XX0:5XX0::2/64
LAN interface: 2XX1:2XX0:5XX0:1::1/64
Desktop: 2XX1:2XX0:5XX0:1::10/64
The firewall is open for all IPv6 traffic on both WAN and LAN. It have already a working IPv4 setup with NAT.The desktop can ping the WAN and LAN interface on the pfSense. From internet i can ping the WAN interface.
What can i have missed?
Can i mix NAT (IPv4) and public (IPv6)? -
Can i mix NAT (IPv4) and public (IPv6)?
Hi,
yes, you can.
I think, your ISP gives you an /48 for your LAN site of the router. You should not use ist on wan as you did with
WAN interface: 2XX1:2XX0:5XX0::2/64
pfadmin
-
And do you realy want your firewall open for connections from the internet?
Allow ICMPv6 in all matters.
pfadmin
-
And do you realy want your firewall open for connections from the internet?
Allow ICMPv6 in all matters.
pfadmin
I only have that firewall rule to get anything to work. Once i see that the traffic is routed i will lock it down with more normal firewalls rules. :)
-
I think, your ISP gives you an /48 for your LAN site of the router. You should not use ist on wan as you did with
WAN interface: 2XX1:2XX0:5XX0::2/64
Aha, but don't i need a adress on the WAN side to?
-
There needs to be a WAN interface subnet and they should route the /48 to you there. It could also be link-local but they still need to route the /48 to you somehow.
They should have some sort of instructions for how the WAN interface should be configured.
What, exactly, did their instructions say?
What ISP/service plan is it?
-
There needs to be a WAN interface subnet and they should route the /48 to you there. It could also be link-local but they still need to route the /48 to you somehow.
They should have some sort of instructions for how the WAN interface should be configured.
What, exactly, did their instructions say?
What ISP/service plan is it?
There is not much instructions, it just said that i got a subnet and that i should not use a gateway as the RA protocol was used. Since this is my first time to add public IP:s behind a firewall everything is new to me and it makes it harder. :)
The ISP is Telia Prolane.
This is all the info i got:
Information about IP-address
IP-version IPv6
IP-adresser 2XX1:2XX0:5XX0::/48
Default gateway *
Name on reversezon 0.X.X.5.0.X.X.2.1.X.X.2.ip6.arpa.(*) Normally, you do not need to manually configure any default gateway on ipv6. The router announces the default gateway via Route Advertisment to the computers that are connected directly to Telia's CPE. There may be situations when manually entering the default gateway. In that case, enter the link-local address fe80 :: 1.
-
There needs to be a WAN interface subnet and they should route the /48 to you there. It could also be link-local but they still need to route the /48 to you somehow.
They should have some sort of instructions for how the WAN interface should be configured.
What, exactly, did their instructions say?
What ISP/service plan is it?
There is not much instructions, it just said that i got a subnet and that i should not use a gateway as the RA protocol was used. Since this is my first time to add public IP:s behind a firewall everything is new to me and it makes it harder. :)
The ISP is Telia Prolane.
This is all the info i got:
Information about IP-address
IP-version IPv6
IP-adresser 2XX1:2XX0:5XX0::/48
Default gateway *
Name on reversezon 0.X.X.5.0.X.X.2.1.X.X.2.ip6.arpa.(*) Normally, you do not need to manually configure any default gateway on ipv6. The router announces the default gateway via Route Advertisment to the computers that are connected directly to Telia's CPE. There may be situations when manually entering the default gateway. In that case, enter the link-local address fe80 :: 1.
My ISP also uses RAs, but also DHCPv6-PD to assign my local prefix. On the WAN side, while it's assigned a global address, it uses a link local address for the router.
-
Your ISP is doing something similar to mine, how is the initial negotiation for IPv4 handled is it PPPoE?
What version of pfSense are you running, It may be in an earlier message but I did not see it.
-
My ISP also uses RAs, but also DHCPv6-PD to assign my local prefix. On the WAN side, while it's assigned a global address, it uses a link local address for the router.
When i setup my WAN on DHCP i do get a IPv6 address.
@marjohn56:
Your ISP is doing something similar to mine, how is the initial negotiation for IPv4 handled is it PPPoE?
What version of pfSense are you running, It may be in an earlier message but I did not see it.
We have been given a subnet of IPv4 addresses so no DHCP or anything at the IPv4.
-
Silly I know, but have you allowed IPv6 in System->Advanced->Networking?
-
@marjohn56:
Silly I know, but have you allowed IPv6 in System->Advanced->Networking?
Yes, that is checked. :)
-
If you leave the WAN side as dhcp6 you should get something. Set it to dhcp6 and then look at the dhcp logs and look for dhcp6c entries, see if anything is there.
-
@marjohn56:
If you leave the WAN side as dhcp6 you should get something. Set it to dhcp6 and then look at the dhcp logs and look for dhcp6c entries, see if anything is there.
I do, then i try to use the 2XX1:2XX0:5XX0::/48 on the LAN side but it still don't route.
-
Set your lan v6 to track the Wan interface. Set up your dhcp6 server on lan too. You do not want the whole 48 on your lan, 64 is fine.
-
I got a call from Telia today they will take a session with me tomorrow and try to solve this. :)
-
Telia added a route to my route for the /48 i have got and now it works. So the problem was that Telia didn't route the traffic back to my router.
Case closed! Thanks for all your help!
-
Telia added a route to my route for the /48 i have got and now it works. So the problem was that Telia didn't route the traffic back to my router.
Case closed! Thanks for all your help!
Do you now have multiple /64s available?
-
Telia added a route to my route for the /48 i have got and now it works. So the problem was that Telia didn't route the traffic back to my router.
Case closed! Thanks for all your help!
Good stuff, they are not the only ISP to have done that, seems a common problem.
-
Do you now have multiple /64s available?
Yes, they route the whole /48 to my router and i can split it to multiple /64 and my router takes care of that routing.