IPV6 setup with Hyperoptic (UK ISP)



  • Hello,

    After finally getting Hyperoptic fibre Internet in my building, I switched out their ZTE router with my Netgate SG-3100. While IPv4 worked immediately, at first, no luck with getting an IPV6 address via WAN DHCP6 (Hyperoptic offers dual stack, native IPv6, not tunnelled). I did try the Track Interface ‘trick’ people have been mentioning, but after a couple of emails to Hyperoptic support, and perhaps some change from their end and I finally have a /56 PD from them.

    Also, for info:
    -I cloned the Hyperoptic MAC on my SG-3100, and typed in RAW DUID from the Hyperoptic Router to see if would help get WAN DHCP6 to work. Since it started working, I have not reset them back to defaults to see if I will still get a WAN DHCP6 address.
    -I have LAN RA set to ‘Assisted’. Everything else is blank/default.
    -Firewall Rules WAN: Allow IPv6 ICMP any from any any TO any any
    -Firewall Rules LAN: Allow IPv6 * from 'LAN Net' any TO any any (* as Gateway)

    -Clients on the network (LAN) now work with IPv6 and https://test-ipv6.com/ shows 10/10 result.
    -Default IPv6 Gateway WAN_DHCP6 is an fe80:: address (see below)

    A couple of questions:

    1. On the WAN interface, I do not get a ‘real’ IPV6 Gateway. The WAN gets a Link Local IPv6 Gateway only (fe80:: …) . (This was true even with the Hyperoptic ZTE router). Is this ‘normal’?
    2. However I cannot ping6 from the firewall to the internet anywhere. I can ping6 from firewall to IPv6 address on the LAN. I do not see any blocked packets in the Firewall Logs. What could be happening here?

    Many TIA!



  • On 1. above, Hyperoptic support have responded the IPv6 gateway will be assigned using SLAAC only, so they cannot tell me a non-link-local address to use.

    On 2.: still cannot ping using IPv6 from the pfSense router...clients on the LAN are working fine (i.e. can ping6 from a client on LAN to anywhere).

    Point to note, IPv4 out from pfSense works fine...

    Any ideas?

    TIA



  • @yellowbrick said in IPV6 setup with Hyperoptic (UK ISP):

    /56 PD

    Did the ISP assign you an IPv6 subnet of size /56? That seems confusing since the comment you made later that the ISP is using SLAAC. If true, that would explain why DHCPv6 on the WAN is not working.

    Also, have you tried setting the WAN interface "IPv6 configuration type" to "SLAAC"?



  • Yes, pfSense is definitely getting a /56 PD, from the logs (manually blanked out):

    Sep 30 07:22:22 dhcp6c 98391 IA_PD prefix: 2a01:xxxx:xxxx:xxxx::/56 pltime=72000 vltime=86400
    Sep 30 07:22:22 dhcp6c 98391 get DHCP option IA_PD prefix, len 25
    Sep 30 07:22:22 dhcp6c 98391 IA_PD: ID=0, T1=43200, T2=64800
    Sep 30 07:22:22 dhcp6c 98391 get DHCP option IA_PD, len 41
    Sep 30 07:22:22 dhcp6c 98391 set IA_PD
    Sep 30 07:22:22 dhcp6c 98391 set IA_PD prefix
    
    

    Also, both LAN and OPT1 interfaces are set to track WAN with prefix ID 0 and 1 respectively. They both are working with clients getting correct IPv6 addresses in the correct /64 subnet.

    I agree the 'SLAAC' comment is confusing, but my ISP actually says the upstream gateway for the WAN interface (which gets a valid WAN IPv6 address not in in /56 PD) is only assigned via SLAAC. However, I suspect they mean link-local discovery (?) as the IPv6 gateway is an fe80:: address.

    Also, as I mentioned, clients can exit using IPv6 without any problems...just the pfSense box itself cannot!

    I have not tried setting WAN to SLAAC...will try it now.

    Thanks.



  • Setting the WAN interface to SLAAC results IPv6 not working at all...no WAN IPv6, no LAN/OPT IPv6 addresses, cannot route out, etc.

    Changing WAN back to DHCPv6 means WAN gets a /128, /56 PD is received, and LAN/OPT clients start working.

    strange...



  • Ah, I missed the part about LAN being set to track the WAN interface.... Yeah, let's leave that as is.

    Sounds like the ISP's DHCPv6 server is giving out ranges (ra) but not assignments (managed), or possibly routing is not correct...
    What version of pfSense are you running? People (here) have been posting DHCPv6 problems with the latest version 2.4.4.



  • I am running 2.4.4.

    Just to point out again, all the clients on LAN and OPT do get addresses in the correct /64 and are able to ping6 out to the net.

    It's just the pfSense box (SG-3100) itself that cannot exit out to WAN using IPv6 (ssh'd into SG-3100).



  • OK, now I suspect the firewall.
    If you change the FW rule on the LAN from 'LAN Net' to 'any', does that make it work? If not, enable logging on all WAN/LAN rules (and the default rules), and see if the FW logs turn up any clues.



  • @yellowbrick said in IPV6 setup with Hyperoptic (UK ISP):

    Setting the WAN interface to SLAAC results IPv6 not working at all...no WAN IPv6, no LAN/OPT IPv6 addresses, cannot route out, etc.
    Changing WAN back to DHCPv6 means WAN gets a /128, /56 PD is received, and LAN/OPT clients start working.
    strange...

    That's the way mine works. DHCPv6-PD assigns an address to the WAN interface and supplies the prefix for the LANs.



  • I don't see anything in the logs indicating blocked packets on WAN or LAN.

    Not sure if this has anything to do with it, but I do have my WAN using a MAC clone from the ISP's router. Without this, I am not able to get a DHCPv6 address on WAN at all.