Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Configure ipv6

    Scheduled Pinned Locked Moved IPv6
    10 Posts 4 Posters 1.3k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • J
      josepho
      last edited by

      Hi,

      I think this topic was covered more than once, but i cant seem to find the right info. I basically got a /64 v6 subnet from my datacenter. My Subnet is xxxx:xxxx:xxxx:21::/64. I configured xxxx:xxxx:xxxx:21::2/64 on the WAN interface of the pfsense (and gateway to xxxx:xxxx:xxxx:21::1/64). How do i now give v6 to the devices behind the pfsenes?

      1 Reply Last reply Reply Quote 0
      • JKnottJ
        JKnott
        last edited by

        How are you connecting?  Generally, when you get a prefix, it is routed to you over an IPv6 connection.  Typically, with IPv6, routers use the link local addresses (start with fe80) for this, but you might also be assigned an IPv6 address that's outside your prefix.  Did you talk to whoever provided that prefix?

        PfSense running on Qotom mini PC
        i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
        UniFi AC-Lite access point

        I haven't lost my mind. It's around here...somewhere...

        1 Reply Last reply Reply Quote 0
        • johnpozJ
          johnpoz LAYER 8 Global Moderator
          last edited by

          If they only gave you 1 /64 you don't

          They are giving you that because they believe all your devices are directly attached to their network and each device would get an IP in that /64

          But you have added a router.. So you need more than 1 /64… Because you are not directly attached to their network..  what they should do is route you say a /60 or /56 or even a /48 via a transit network.  You would then breakup that prefix they gave you into the /64 you want to use behind pfsense.

          This is no different really if they gave you IPv4 space.. If they routed you a /24 you could break it up into say /28 behind pfsense..

          An intelligent man is sometimes forced to be drunk to spend time with his fools
          If you get confused: Listen to the Music Play
          Please don't Chat/PM me for help, unless mod related
          SG-4860 24.11 | Lab VMs 2.8, 24.11

          1 Reply Last reply Reply Quote 0
          • J
            josepho
            last edited by

            John and all,

            Thanks for your response. I confused about something. You mention that they should give me a /58 (or lower) which i can then break up in /64's. On the same note, i can break up the /64 they provided into /65 or /66. I obviously don't need a full 18-billion /64. The issue is the other point you mentioned, the devices which are behind the pfsnese LAN interface are not directly attached to their network, so how would that work? Regardless what they route to me, its always going to end up arriving on the pfsense WAN interface.

            1 Reply Last reply Reply Quote 0
            • NogBadTheBadN
              NogBadTheBad
              last edited by

              Ask for more address space, don't split a /64.

              Andy

              1 x Netgate SG-4860 - 3 x Linksys LGS308P - 1 x Aruba InstantOn AP22

              1 Reply Last reply Reply Quote 0
              • J
                josepho
                last edited by

                So say they give me a second /64, can you please help me with the config?

                Lets assume i got the following 2 /64's

                xxxx:xxxx:xxxx:21::/64
                xxxx:xxxx:xxxx:22::/64

                I'll configure the xxxx:xxxx:xxxx:21::/64 subnet on the WAN interface. What am i now configuring on the LAN interface?

                Just curious, why shouldn't i split up a /64. And again, even they provide me with a /56, how would i configure it? Lets say i get xxxx:xxxx:3000::/56, would i configure xxxx:xxxx:3000::/58 on the pfsense WAN interface and then xxxx:xxxx:3000:40::/58 on the LAN interface?

                1 Reply Last reply Reply Quote 0
                • JKnottJ
                  JKnott
                  last edited by

                  @josepho:

                  John and all,

                  Thanks for your response. I confused about something. You mention that they should give me a /58 (or lower) which i can then break up in /64's. On the same note, i can break up the /64 they provided into /65 or /66. I obviously don't need a full 18-billion /64. The issue is the other point you mentioned, the devices which are behind the pfsnese LAN interface are not directly attached to their network, so how would that work? Regardless what they route to me, its always going to end up arriving on the pfsense WAN interface.

                  A /64 will work fine, but we need to know how they're providing it to you.  If it's just a bridged connection, then you can only connect to a switch for local distribution.  If they are forwarding it to you via an IP address, then you can use a router.

                  Also, it's a bad idea to split a /64 on a LAN, as it breaks things, such as the method used to assign an address to a device.

                  In my case, I get a /56 from my ISP, which I can split into 256 /64s for use on multiple networks.  But the WAN side of my firewall has a separate interface with it's own global and link local IPv6 addresses.  The link local address is used to carry my /56 prefix to my firewall.  The global address is not within my /56.

                  PfSense running on Qotom mini PC
                  i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                  UniFi AC-Lite access point

                  I haven't lost my mind. It's around here...somewhere...

                  1 Reply Last reply Reply Quote 0
                  • JKnottJ
                    JKnott
                    last edited by

                    @josepho:

                    So say they give me a second /64, can you please help me with the config?

                    Lets assume i got the following 2 /64's

                    xxxx:xxxx:xxxx:21::/64
                    xxxx:xxxx:xxxx:22::/64

                    I'll configure the xxxx:xxxx:xxxx:21::/64 subnet on the WAN interface. What am i now configuring on the LAN interface?

                    Just curious, why shouldn't i split up a /64. And again, even they provide me with a /56, how would i configure it? Lets say i get xxxx:xxxx:3000::/56, would i configure xxxx:xxxx:3000::/58 on the pfsense WAN interface and then xxxx:xxxx:3000:40::/58 on the LAN interface?

                    You need to find out what they're providing you.  Are they providing a routed connection or bridged?  As I mentioned above, if "bridged", then you cannot route to your network.

                    PfSense running on Qotom mini PC
                    i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                    UniFi AC-Lite access point

                    I haven't lost my mind. It's around here...somewhere...

                    1 Reply Last reply Reply Quote 0
                    • J
                      josepho
                      last edited by

                      Ok, let me find out. I'll post back.

                      Thanks

                      1 Reply Last reply Reply Quote 0
                      • J
                        josepho
                        last edited by

                        Phew… After a long battle with the DC...

                        I obtained a second /64 routed and carried over the existing WAN address. I assigned it to the LAN and to devices. All is good!

                        Thanks!!

                        1 Reply Last reply Reply Quote 0
                        • First post
                          Last post
                        Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.