ipv6 disable on Pfsense



  • @johnpoz said in ipv6 disable on Pfsense:

    And I am so all for user wanting to disable something they are not ready to use.. Its a security problem if its not managed correctly, its a management nightmare if your not ready for it.. Its just more noise on the network if your not going to correctly set it up and configure it.

    What could be a problem is stuff like Teredo, which is on by default, yet most people don't know about it. Turning off IPv6 in pfSense would do nothing about that. As I mentioned above, that senior tech didn't know about it and it was causing him confusion, because he didn't know what he was looking at.

    One of the points I made in that email was that Teredo be disabled on the computers techs use.


  • LAYER 8 Global Moderator

    Its quite possible that his box is using teredo - sure.. I would hope if he is asking about turning off in pfsense he looked into turning it off in windows..

    Simple enough to do with single reg entry or gpo, etc.


  • LAYER 8 Netgate

    @JKnott said in ipv6 disable on Pfsense:

    One of the points I made in that email was that Teredo be disabled on the computers techs use.

    Or give the techs "real" computers to use.



  • I started using IPv6 long before my ISP offered it by using a tunnel from HE. It was quite a few years ago. (I'm a big fan of HE. If I could use them as my ISP, I would.) At the time I was using Sophos UTM as my router/firewall. One thing Sophos UTM does very well is provide usage reports. Using the monthly reports, it was easy to see how much of the traffic on my network was IPv4 or IPv6. Often, there were monthly reports where the IPv6 usage was well over 50%. In some cases, well over 75%. It depends on what the usage is.

    While it's true that no one "needs" IPv6, many websites and services offer it and if you have it, access will be over IPv6. IPv6 is the preferred protocol for web browsers and for Office 365. Microsoft has invested heavily in IPv6 and it's preferred protocol for many Windows and Windows Server operating system features.

    IMO, the more people that use IPv6, the more IPSs will get the message that it's the way to go. I can see no reason whatsoever for anyone to not enable IPv6 if they can. Even if I still had to implement a tunnel, I would do so.


  • LAYER 8 Netgate

    Right - but if you're not ready to deal with it it breaks stuff. Best thing to do in that case is, often, to turn it off until you're ready to deal with it.

    Using a workstation that thinks it has IPv6 but doesn't is not a good experience.



  • @Derelict said in ipv6 disable on Pfsense:

    Right - but if you're not ready to deal with it it breaks stuff. Best thing to do in that case is, often, to turn it off until you're ready to deal with it.

    Using a workstation that thinks it has IPv6 but doesn't is not a good experience.

    Maybe this is a sweeping generality, but I would hope that anyone who can set up pfsense (or something similar) and set up a tunnel should be able to determine if IPv6 is working properly or not.

    Also, I agree that using a computer that thinks it has IPv6, but it doesn't isn't a good experience. I've experienced exactly that, but the other way around. A company I worked for did not "support" IPv6. As far as I know, IPv6 was "disabled" by the IT department using a third party security solution installed on the computer. As long as the computer was on a network that didn't support IPV6, it worked fine. As soon as it was connected to a network that had working IPv6, it got an IPv6 address, and the Office 365 applications (Outlook, Skype, etc.) used it, because that's what they're supposed to do. Of course, since IPv6 on the computer was broken, these applications didn't work properly. Every time they tried to go to the network, the request over IPv6 had to time out, so they basically ground to a halt. The only way this could be "fixed" was by disabling IPv6 in the network adapter. None of this would have happened if IPv6 was just allowed to work out of the box, the way it's supposed to.



  • @bimmerdriver said in ipv6 disable on Pfsense:

    started using IPv6 long before my ISP offered it by using a tunnel from HE.

    I also used a 6in4 tunnel, but not from HE.

    Or give the techs "real" computers to use.

    He had one of those rugged Panasonic computers, but it was running Windows. I find Linux is much better for working on networking issues.



  • In the properties of the interfaces IPv6 set in Pfsense "None".

    I repeat,
    this is interested in turning off:
    1.how to disable ipv6 on PfSense? for ifconfig not to give out a string inet6?
    2. And DNS Resolver in Diagnostics\Tables\Table to Display not resolution ipv6 addresses?
    for example:
    178.18.231.121
    178.18.231.122
    2a02:26f0:d8:394::356e
    2a02:26f0:d8:3a2::356e

    how is it most likely done by means FreeBSD 11?
    Through rc.conf, loader.conf, sysctl I did not find how to do it or in other ways.


  • Rebel Alliance Moderator

    @lucas1 said in ipv6 disable on Pfsense:

    1.how to disable ipv6 on PfSense? for ifconfig not to give out a string inet6?

    Why do you persist in that, if you are told multiple times now, that it simply isn't necessary?! It doesn't matter if the interface still outputs an inet6 with a fe80 link local address - if the general switch is off OR you didn't configure any IPv6 rules on an interface, all IPv6 traffic is blocked and ignored!

    1. And DNS Resolver in Diagnostics\Tables\Table to Display not resolution ipv6 addresses?

    DNS is supposed to answer your request with what is configured in the DNS zone. If the domain has AAAA entries, those are shown. If your client has no IPv6 capable interface, it won't use them. If you're not sure your clients behave correctly you can also set the advanced option to prefer IPv4 over IPv6 when answering.
    Otherwise I don't see the problem - an interface configured without IPv6 doesn't talk over IPv6.


  • LAYER 8 Global Moderator

    Just turn off get dns from dhcp and those go away.. Out of the box pfsense should be resolving anyway - you have zero need for any dns from your isp be it ipv4 or ipv6.



  • A good answer is just a little nervous start. -> ?!

    Yes, I agree about resolution DNS in Diagnostics\Tables\Table and so what IPv6 traffic is blocked
    and option to prefer IPv4 .

    But you yourself wrote - an interface configured without IPv6 doesn't talk over IPv6.
    This action (interface configured without IPv6) immediately performs and replaces the necessary settings System\Advanced\Networking.
    And in general, why should I not learn how to disable IPv6 in FreeBSD and/or PfSense?



  • @johnpoz said in ipv6 disable on Pfsense:

    So only 21% of top 1000 sites are IPv6... Doesn't seem like majority protocol to me..

    Ok, very true, if you "isolate" your view to public stats, taken from 'public' routers.

    When I wrote "the main network protocol" is was more thinking about all network traffic, thus also what's being used locally, on our LAN's - device to device, etc.
    Example : when my ISP (Orange, France) starts to deploy 'IPv6' a whopping 30 million users will suddenly throwing out IPv6 traffic if a point-to-point connection can be made.


  • Rebel Alliance Moderator

    @Gertjan Additionally, the graph from Google clearly states "among Google users". Not everyone (including border routers, servers, etc.) is a Google user ;) So ~23% from Google ist definitly lower than reality.


  • LAYER 8 Global Moderator

    Here is the thing I work in the space... I just came out of discussion with up and coming security/sdwan company... 42 Pops globally, etc.. Asked them about their ipv6 support, if on their roadmap, etc..

    Nope ;) Their solution arch stated they kind of waiting to see if anyone actually uses it ;) hehehehe

    You guys can all dream about it all you want... I work in the biz... While there might be traffic... Its not a major player at all unless you count mobile devices... Which really account for most of the traffic to be honest.. .Yeah when you have a bajillion phones kind of hard to give the IPv4 ;)

    But once you move those all to IPv6 - the rest of its going to be slow to come to the plate..



  • @johnpoz said in ipv6 disable on Pfsense:

    Its not a major player at all unless you count mobile devices... Which really account for most of the traffic to be honest.. .Yeah when you have a bajillion phones kind of hard to give the IPv4 ;)

    My cell phone is IPv6 only. It uses 464XLAT to handle IPv4.

    BTW, more fun with my Internet connection (same company). I just found out that the guys who are supposed to fix this closed the ticket, because I have my own router/firewall!!! This is after a senior tech came to my home with another modem, in gateway mode, and it failed too! He also went back to the head end and tried 3 other CMTS, in addition to the one I'm connected to. It failed only on mine. Yet these Bozos are once again trying to blame pfSense, after their own senior tech proved otherwise and tier 2 support verified, back in January, that the problem was on the CMTS.



  • @JKnott said in ipv6 disable on Pfsense:

    @johnpoz said in ipv6 disable on Pfsense:

    Its not a major player at all unless you count mobile devices... Which really account for most of the traffic to be honest.. .Yeah when you have a bajillion phones kind of hard to give the IPv4 ;)

    My cell phone is IPv6 only. It uses 464XLAT to handle IPv4.

    BTW, more fun with my Internet connection (same company). I just found out that the guys who are supposed to fix this closed the ticket, because I have my own router/firewall!!! This is after a senior tech came to my home with another modem, in gateway mode, and it failed too! He also went back to the head end and tried 3 other CMTS, in addition to the one I'm connected to. It failed only on mine. Yet these Bozos are once again trying to blame pfSense, after their own senior tech proved otherwise and tier 2 support verified, back in January, that the problem was on the CMTS.

    Some of my colleagues in Germany have an ISP that provides IPv4 over IPv6.

    Sorry to hear about your ISP grief. What a PITA. FWIW, Telus has no issues at all with pfSense.



  • @johnpoz said in ipv6 disable on Pfsense:

    Here is the thing I work in the space... I just came out of discussion with up and coming security/sdwan company... 42 Pops globally, etc.. Asked them about their ipv6 support, if on their roadmap, etc..

    Nope ;) Their solution arch stated they kind of waiting to see if anyone actually uses it ;) hehehehe

    You guys can all dream about it all you want... I work in the biz... While there might be traffic... Its not a major player at all unless you count mobile devices... Which really account for most of the traffic to be honest.. .Yeah when you have a bajillion phones kind of hard to give the IPv4 ;)

    But once you move those all to IPv6 - the rest of its going to be slow to come to the plate..

    They are waiting to see if anyone actually uses it? Seriously? If that wasn't a tongue in cheek comment, it's a demonstration of ignorance, not intelligence. Microsoft, as much as everyone likes to bash them, has embraced IPv6 since the Windows 7 era. Unless someone goes out of their way to disable IPv6, every PC running Windows 7 or newer is IPv6 ready out of the box. AFAIK, all new mobile phones support it and have so for several years. Macs support it. Many websites support IPv6, in particular a lot of high usage websites. The only reason IPv6 isn't the overwhelming majority protocol is because IPSs have dragged their asses to support it.



  • @bimmerdriver said in ipv6 disable on Pfsense:

    FWIW, Telus has no issues at all with pfSense.

    Rogers also works fine with pfSense. The issue is with the CMTS I'm connected to. The people who are responsible for fixing this don't seem to want to as I have my own firewall/router, despite the fact that it also fails in gateway mode, affects a neighbour and even when the senior tech came with his own modem and it also failed. Despite all that and much more, including getting the Office of the President involved, they won't fix it. I even identified the system that failed for them and the senior tech proved it again, when he went to the head end and tested there. Yet they still cancelled the ticket, without making any attempt to fix the problem. Someone is due for some serious disciplinary action.


  • LAYER 8 Netgate

    @JKnott Start sending your payments to whatever amounts to your public utilities commission. At least that's how it works here.

    Though cable/internet is a little nebulous as to exactly where they fall legislatively and it seems to change depending on wind direction here.



  • @bimmerdriver said in ipv6 disable on Pfsense:

    Microsoft, as much as everyone likes to bash them, has embraced IPv6 since the Windows 7

    Actually, XP SP3 almost fully supported it. There was some minor thing that didn't work, but it didn't have much effect overall. I know it worked fine for me. My first Android phone, a Google Nexus 1 also supported IPv6 and my current Pixel 2 even has IPv6 tethering, with a full /64 prefix.


Log in to reply