Configure ipv6
-
Hi,
I think this topic was covered more than once, but i cant seem to find the right info. I basically got a /64 v6 subnet from my datacenter. My Subnet is xxxx:xxxx:xxxx:21::/64. I configured xxxx:xxxx:xxxx:21::2/64 on the WAN interface of the pfsense (and gateway to xxxx:xxxx:xxxx:21::1/64). How do i now give v6 to the devices behind the pfsenes?
-
How are you connecting? Generally, when you get a prefix, it is routed to you over an IPv6 connection. Typically, with IPv6, routers use the link local addresses (start with fe80) for this, but you might also be assigned an IPv6 address that's outside your prefix. Did you talk to whoever provided that prefix?
-
If they only gave you 1 /64 you don't
They are giving you that because they believe all your devices are directly attached to their network and each device would get an IP in that /64
But you have added a router.. So you need more than 1 /64… Because you are not directly attached to their network.. what they should do is route you say a /60 or /56 or even a /48 via a transit network. You would then breakup that prefix they gave you into the /64 you want to use behind pfsense.
This is no different really if they gave you IPv4 space.. If they routed you a /24 you could break it up into say /28 behind pfsense..
-
John and all,
Thanks for your response. I confused about something. You mention that they should give me a /58 (or lower) which i can then break up in /64's. On the same note, i can break up the /64 they provided into /65 or /66. I obviously don't need a full 18-billion /64. The issue is the other point you mentioned, the devices which are behind the pfsnese LAN interface are not directly attached to their network, so how would that work? Regardless what they route to me, its always going to end up arriving on the pfsense WAN interface.
-
Ask for more address space, don't split a /64.
-
So say they give me a second /64, can you please help me with the config?
Lets assume i got the following 2 /64's
xxxx:xxxx:xxxx:21::/64
xxxx:xxxx:xxxx:22::/64I'll configure the xxxx:xxxx:xxxx:21::/64 subnet on the WAN interface. What am i now configuring on the LAN interface?
Just curious, why shouldn't i split up a /64. And again, even they provide me with a /56, how would i configure it? Lets say i get xxxx:xxxx:3000::/56, would i configure xxxx:xxxx:3000::/58 on the pfsense WAN interface and then xxxx:xxxx:3000:40::/58 on the LAN interface?
-
John and all,
Thanks for your response. I confused about something. You mention that they should give me a /58 (or lower) which i can then break up in /64's. On the same note, i can break up the /64 they provided into /65 or /66. I obviously don't need a full 18-billion /64. The issue is the other point you mentioned, the devices which are behind the pfsnese LAN interface are not directly attached to their network, so how would that work? Regardless what they route to me, its always going to end up arriving on the pfsense WAN interface.
A /64 will work fine, but we need to know how they're providing it to you. If it's just a bridged connection, then you can only connect to a switch for local distribution. If they are forwarding it to you via an IP address, then you can use a router.
Also, it's a bad idea to split a /64 on a LAN, as it breaks things, such as the method used to assign an address to a device.
In my case, I get a /56 from my ISP, which I can split into 256 /64s for use on multiple networks. But the WAN side of my firewall has a separate interface with it's own global and link local IPv6 addresses. The link local address is used to carry my /56 prefix to my firewall. The global address is not within my /56.
-
So say they give me a second /64, can you please help me with the config?
Lets assume i got the following 2 /64's
xxxx:xxxx:xxxx:21::/64
xxxx:xxxx:xxxx:22::/64I'll configure the xxxx:xxxx:xxxx:21::/64 subnet on the WAN interface. What am i now configuring on the LAN interface?
Just curious, why shouldn't i split up a /64. And again, even they provide me with a /56, how would i configure it? Lets say i get xxxx:xxxx:3000::/56, would i configure xxxx:xxxx:3000::/58 on the pfsense WAN interface and then xxxx:xxxx:3000:40::/58 on the LAN interface?
You need to find out what they're providing you. Are they providing a routed connection or bridged? As I mentioned above, if "bridged", then you cannot route to your network.
-
Ok, let me find out. I'll post back.
Thanks
-
Phew… After a long battle with the DC...
I obtained a second /64 routed and carried over the existing WAN address. I assigned it to the LAN and to devices. All is good!
Thanks!!
