he.net tunnel up, but General Failure when pinging from Hosts within the network

hazenvs01234

Good Day; this is a general request as I have used the following setup article here:
https://docs.netgate.com/pfsense/en/latest/interfaces/using-ipv6-with-a-tunnel-broker.html

Now when I ping from the Firewall to the internet using v6 everything is fine:
[2.4.4-RELEASE][admin@firewall1.altignus.com]/root: ping6 www.google.com
PING6(56=40+8+8 bytes) 2001:470:1c:7e8::2 --> 2607:f8b0:400b:800::2004
16 bytes from 2607:f8b0:400b:800::2004, icmp_seq=0 hlim=58 time=18.615 ms
16 bytes from 2607:f8b0:400b:800::2004, icmp_seq=1 hlim=58 time=17.531 ms
16 bytes from 2607:f8b0:400b:800::2004, icmp_seq=2 hlim=58 time=19.201 ms
16 bytes from 2607:f8b0:400b:800::2004, icmp_seq=3 hlim=58 time=17.094 ms
16 bytes from 2607:f8b0:400b:800::2004, icmp_seq=4 hlim=58 time=17.672 ms

When i ping from an internal host using v6 out i get a general failure:

C:\WINDOWS\system32>ping -6 www.google.com
Pinging www.google.com [2607:f8b0:4002:811::2004] with 32 bytes of data:
General failure.
General failure.
General failure.
General failure.

Ping statistics for 2607:f8b0:4002:811::2004:
Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),

C:\WINDOWS\system32>
The article above does not show the updated gateway interface:

I have put firewall rules to allow the outbound subnets via a Pass from the Lan interface:

I have double and triple checked my v6 addresses (my GIF interface is diffrent than my routed /64 and /48) I only use the routed /64.

Hosts in my network use BIND on PFSense; and resolution works for both v4 and v6 addresses. It's only when i send packets to the firewall do they get a general failure.

Mabye this is an issue with 2.4.4? I dunno I've reached my wit's end on this so I'm posting in the hopes that somone more expierenced than myself my help out.

JKnott

You'll have to fire up Wireshark or Packet Capture, to see what's happening. I had a similar problem recently, where the problem was with my ISP, not pfSense. It took months to get the problem resolved. First thing you have to do is eliminate anything on your end, to determine where the problem is. That means put your modem in gateway mode, to see if that works. If it does, then the problem is with pfSense. If it doesn't then the problem is with the ISP.

hazenvs01234

Here's the thing;

The firewall tunnel works, I can ping6 all day anywhere on the internet, from the firewall.

Internally this worked previously, which leads me to believe it's a PFSense 2.4.4 specific issue.

My intuition tells me the new Gateway mechanisms are to blame, or alternatively PFSense 2.4.4 does not work with IPv6.

hazenvs01234

ping6 www.google.com
PING6(56=40+8+8 bytes) 2001:470:1c:7e8::2 --> 2607:f8b0:400b:800::2004
16 bytes from 2607:f8b0:400b:800::2004, icmp_seq=0 hlim=58 time=16.983 ms
16 bytes from 2607:f8b0:400b:800::2004, icmp_seq=1 hlim=58 time=18.399 ms
16 bytes from 2607:f8b0:400b:800::2004, icmp_seq=2 hlim=58 time=26.196 ms
16 bytes from 2607:f8b0:400b:800::2004, icmp_seq=3 hlim=58 time=19.502 ms
16 bytes from 2607:f8b0:400b:800::2004, icmp_seq=4 hlim=58 time=16.492 ms
16 bytes from 2607:f8b0:400b:800::2004, icmp_seq=5 hlim=58 time=17.710 ms
16 bytes from 2607:f8b0:400b:800::2004, icmp_seq=6 hlim=58 time=16.601 ms
^C
--- www.google.com ping6 statistics ---
7 packets transmitted, 7 packets received, 0.0% packet loss
round-trip min/avg/max/std-dev = 16.492/18.840/26.196/3.162 ms

[2.4.4-RELEASE][admin@firewall1.altignus.com]/root: ping6 www.yahoo.com
PING6(56=40+8+8 bytes) 2001:470:1c:7e8::2 --> 2001:4998:58:1836::10
16 bytes from 2001:4998:58:1836::10, icmp_seq=0 hlim=57 time=22.511 ms
16 bytes from 2001:4998:58:1836::10, icmp_seq=1 hlim=57 time=20.087 ms
16 bytes from 2001:4998:58:1836::10, icmp_seq=2 hlim=57 time=19.663 ms
16 bytes from 2001:4998:58:1836::10, icmp_seq=3 hlim=57 time=41.867 ms

hazenvs01234

If it were an ISP / Modem / Internet issue then those pings would not work.

I think i may have solved it; on the affected host the Default Gateway is set inccorectly for IPv6:
Windows IP Configuration

Ethernet adapter Ethernet 2:

Connection-specific DNS Suffix . : devfactory.local
Link-local IPv6 Address . . . . . : fe80::ad4e:5ce1:660a:a241%9
Link-local IPv6 Address . . . . . : fe80::ed09:55eb:b11f:96b%9
IPv4 Address. . . . . . . . . . . : 10.119.124.209
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : ::

Ethernet adapter Ethernet:

Connection-specific DNS Suffix . : altignus.com
IPv6 Address. . . . . . . . . . . : 2001:470:1d:7e8:4da6:be69:7adc:ddcf
IPv6 Address. . . . . . . . . . . : 2001:470:1d:7e8:b902:303c:5f61:e2c5
Temporary IPv6 Address. . . . . . : 2001:470:1d:7e8:4161:6a89:a87c:3166
Link-local IPv6 Address . . . . . : fe80::b902:303c:5f61:e2c5%2
IPv4 Address. . . . . . . . . . . : 192.168.10.204
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : fe80::230:18ff:fe08:af53%2
192.168.10.1

The DGW needs to be set as:
2001:470:1d:7e8::1

Where in PFSense do I tell the DHCPv6 Server to specify the DGW for SSDP, AHAVI and others?

Napsterbater

@hazenvs01234 said in he.net tunnel up, but General Failure when pinging from Hosts within the network:

Where in PFSense do I tell the DHCPv6 Server to specify the DGW

You don't. Gateway is derived by clients from the Router Advertisements.

@hazenvs01234 said in he.net tunnel up, but General Failure when pinging from Hosts within the network:

on the affected host the Default Gateway is set inccorectly for IPv6

The DGW needs to be set as:
2001:470:1d:7e8::1

No, a IPv6 LL i.e. a fe80::, is normal and fine for a Gateway.

Though fe80::230:18ff:fe08:af53 should be visible on the LAN Interface of pfSesne at Status > Interfaces, next to "IPv6 Link Local"

hazenvs01234

@Napsterbater said in he.net tunnel up, but General Failure when pinging from Hosts within the network:

fe80::230:18ff:fe08:af53

I cannot see any Link Local interfaces under "INterfaces > Status".

hazenvs01234

LAN

And Interfaces:

Here's the Gateway Layout:

I cannot see any link local addresses anywhere and PFSense Router Advertisement is set to "Managed" as per the article. The client's are not getting the correct Gateway Address.

JKnott

@hazenvs01234 said in he.net tunnel up, but General Failure when pinging from Hosts within the network:

The firewall tunnel works, I can ping6 all day anywhere on the internet, from the firewall.

If it were an ISP / Modem / Internet issue then those pings would not work.

Those are exactly the symptoms I saw and it was the ISP.

I cannot see any Link Local interfaces under "INterfaces > Status".

You don't have link local interfaces. You have interfaces that have link local and global addresses. I see fe80::b902:303c:5f61:e2c5%2 on your Ethernet address.

While much of IPv6 works similar to IPv4, there are some significant differences. Many ISPs use something called DHCPv6-PD to assign an interface address to the firewall/router and also a prefix to the local LAN. The interface address is often not used for routing, as link local addresses are often used. You mentioned you could ping from pfSense, but not anything behind it. That was exactly the problem I had. If you check, you'll find your LAN and WAN prefixes are differenet. They have absolutely nothing to do with each other. Your problem, as was mine, was that you cannot access the Internet from behind the firewall. This is why I said you have to use Wireshark or Packet Capture to see what's actually on the wire. In my case, I could see the ping going out, but no reply. When I tried pinging from elsewhere, I could ping the firewall, but the pings for devices on my LAN never even arrived at my firewall, let alone my LAN. This was due to a problem with my ISP and that problem also happened with their modem in gateway mode. If you do the same test, with gateway mode, and it still fails, then the problem is with the ISP. If it's OK, then you can start looking at pfSense. But first you must determine where the problem lies. While it certainly could be with pfSense, it also could be with the ISP, as was my case.

Incidentally, my problem affected every one on my node/CMTS, including my next door neighbour. When a senior tech came out with his own modem, it also failed in gateway mode. That tech went to the head end and verified the problem was on the CMTS I was connected to and not any of 3 others he tried. It was the same CMTS I had identified weeks earlier, by using Wireshark.

So, try in gateway mode and lets go from there.

Napsterbater

@hazenvs01234

@hazenvs01234 said in he.net tunnel up, but General Failure when pinging from Hosts within the network:

I cannot see any Link Local interfaces under "INterfaces > Status".

That is because I said Status > Interfaces

JKnott

@JKnott said in he.net tunnel up, but General Failure when pinging from Hosts within the network:

So, try in gateway mode and lets go from there.

Sorry, I forgot you were with he.net and not getting IPv6 from your ISP. Regardless, packet captures often help.

Gertjan

@hazenvs01234 :
What is this gateway ?
Yours :

Mine :

Status => Interfaces :

Some PC on LAN (a Windows 7 pro) :

C:\Users>ping -6 google.com
Envoi d'une requête 'ping' sur google.com [2a00:1450:4007:816::200e] avec 32 octets de données :
Réponse de 2a00:1450:4007:816::200e : temps=54 ms
Réponse de 2a00:1450:4007:816::200e : temps=52 ms
Réponse de 2a00:1450:4007:816::200e : temps=51 ms
Réponse de 2a00:1450:4007:816::200e : temps=53 ms

Statistiques Ping pour 2a00:1450:4007:816::200e:
    Paquets : envoyés = 4, reçus = 4, perdus = 0 (perte 0%),
Durée approximative des boucles en millisecondes :
    Minimum = 51ms, Maximum = 54ms, Moyenne = 52ms

C:\Users>ipconfig

Configuration IP de Windows
Carte Ethernet Connexion au réseau local :
   Suffixe DNS propre à la connexion. . . : brit-hotel-fumel.not
   Adresse IPv6. . . . . . . . . . . . . .: 2001:470:1f13:5c0:2::f6
   Adresse IPv6 de liaison locale. . . . .: fe80::341c:c69c:84a9:1c84%17
   Adresse IPv4. . . . . . . . . . . . . .: 192.168.1.6
   Masque de sous-réseau. . . . . . . . . : 255.255.255.0
   Passerelle par défaut. . . . . . . . . : fe80::212:3fff:f4b3:5875%17
                                       192.168.1.1

C:\Users>

hazenvs01234

My gateways are online;

My gateways are Up:

Interface Status is here:

Link Local addresses seem o.k. but I still get a general failure when I attmpt to ping the v6LL or the LAN interface address.

Gertjan

This one :

is this ( from your account @ he.net ) :

right ?

What is that third, not default gateway ?

For your own purposes ?

hazenvs01234

My he.net tunnel is fine, my address is :1 thiers is :2

You can see I can ping any v6 address from the tunnel.

When i try to ping from my network i get a general failure:

The third is a troubleshooting attempt nothing more. (the two one v4 and one v6) are configured as per the Aritcle mentioned at the head of this post.

johnpoz

@hazenvs01234 said in he.net tunnel up, but General Failure when pinging from Hosts within the network:

Mabye this is an issue with 2.4.4?

Or morelikely an issue with your client..

Lets see the ipconfig /all for your client... Look at your ndp table
windows would be
netsh interface ipv6 show neighbors

What are the lan rules.. the default ipv6 any any?

hazenvs01234

                                                        C:\Users\Hazen>netsh interface ipv6 show neighbors
                                                        Interface 2: Ethernet

Internet Address Physical Address Type

2001:470:1d:7e8::1 00-30-18-08-af-53 Stale (Router)
fe80::1:1 00-00-00-00-00-00 Unreachable
fe80::230:18ff:fe08:af53 00-30-18-08-af-53 Stale (Router)
fe80::e4a4:c85e:f21c:13ae 00-00-00-00-00-00 Unreachable
ff02::1 33-33-00-00-00-01 Permanent
ff02::2 33-33-00-00-00-02 Permanent
ff02::c 33-33-00-00-00-0c Permanent
ff02::16 33-33-00-00-00-16 Permanent
ff02::fb 33-33-00-00-00-fb Permanent
ff02::1:2 33-33-00-01-00-02 Permanent
ff02::1:3 33-33-00-01-00-03 Permanent
ff02::1:ff00:1 33-33-ff-00-00-01 Permanent
ff02::1:ff05:9d9d 33-33-ff-05-9d-9d Permanent
ff02::1:ff08:af53 33-33-ff-08-af-53 Permanent
ff02::1:ff1c:13ae 33-33-ff-1c-13-ae Permanent
ff02::1:ff1c:898c 33-33-ff-1c-89-8c Permanent ff02::1:ff22:6dc7 33-33-ff-22-6d-c7 Permanent ff02::1:ff23:33e2 33-33-ff-23-33-e2 Permanent ff02::1:ff2e:c85d 33-33-ff-2e-c8-5d Permanent ff02::1:ff2e:d440 33-33-ff-2e-d4-40 Permanent ff02::1:ff36:a36 33-33-ff-36-0a-36 Permanent
ff02::1:ff4e:11f 33-33-ff-4e-01-1f Permanent
ff02::1:ff61:e2c5 33-33-ff-61-e2-c5 Permanent ff02::1:ff69:2f9c 33-33-ff-69-2f-9c Permanent ff02::1:ff72:e6d1 33-33-ff-72-e6-d1 Permanent
ff02::1:ff7c:3166 33-33-ff-7c-31-66 Permanent
ff02::1:ff83:c7da 33-33-ff-83-c7-da Permanent
ff02::1:ff86:5975 33-33-ff-86-59-75 Permanent
ff02::1:ff8b:99e2 33-33-ff-8b-99-e2 Permanent
ff02::1:ff9b:f048 33-33-ff-9b-f0-48 Permanent
ff02::1:ffa1:4953 33-33-ff-a1-49-53 Permanent
ff02::1:ffa7:3fce 33-33-ff-a7-3f-ce Permanent
ff02::1:ffb0:5c5c 33-33-ff-b0-5c-5c Permanent
ff02::1:ffb6:4c10 33-33-ff-b6-4c-10 Permanent
ff02::1:ffbb:69ce 33-33-ff-bb-69-ce Permanent
ff02::1:ffbd:7f48 33-33-ff-bd-7f-48 Permanent
ff02::1:ffc1:f161 33-33-ff-c1-f1-61 Permanent
ff02::1:ffc2:32 33-33-ff-c2-00-32 Permanent
ff02::1:ffd6:1b02 33-33-ff-d6-1b-02 Permanent
ff02::1:ffdc:ddcf 33-33-ff-dc-dd-cf Permanent
ff02::1:ffe2:89e0 33-33-ff-e2-89-e0 Permanent
ff02::1:fff1:d310 33-33-ff-f1-d3-10 Permanent
ff02::1:fffb:5041 33-33-ff-fb-50-41 Permanent
ff05::c 33-33-00-00-00-0c Permanent
ff0e::c 33-33-00-00-00-0c Permanent

Interface 12: Wi-Fi

Internet Address Physical Address Type

ff02::1 ff02::1:ff00:1 ff02::1:ff05:9d9d ff02::1:ff1c:898c ff02::1:ff22:6dc7 ff02::1:ff23:33e2 ff02::1:ff2e:c85d ff02::1:ff2e:d440 ff02::1:ff36:a36 ff02::1:ff44:1b5f ff02::1:ff4e:11f ff02::1:ff69:2f9c ff02::1:ff72:e6d1 ff02::1:ff83:c7da ff02::1:ff86:5975 ff02::1:ff8b:99e2 ff02::1:ff9b:f048 ff02::1:ffa1:4953 ff02::1:ffa7:3fce ff02::1:ffb0:5c5c ff02::1:ffb6:4c10 ff02::1:ffbb:69ce ff02::1:ffbd:7f48 ff02::1:ffc2:32 ff02::1:ffd6:1b02 ff02::1:ffe2:89e0 ff02::1:fff1:d310 ff02::1:fffb:5041 ff05::c ff0e::c 33-33-00-00-00-01 Permanent ff02::2 33-33-00-00-00-02 Permanent ff02::16 33-33-00-00-00-16 Permanent ff02::fb 33-33-00-00-00-fb Permanent ff02::1:2 33-33-00-01-00-02 Permanent ff02::1:3 33-33-00-01-00-03 Permanent
33-33-ff-00-00-01 Permanent
33-33-ff-05-9d-9d Permanent ff02::1:ff08:af53 33-33-ff-08-af-53 Permanent ff02::1:ff1c:13ae 33-33-ff-1c-13-ae Permanent
33-33-ff-1c-89-8c Permanent
33-33-ff-22-6d-c7 Permanent
33-33-ff-23-33-e2 Permanent
33-33-ff-2e-c8-5d Permanent
33-33-ff-2e-d4-40 Permanent
33-33-ff-36-0a-36 Permanent
33-33-ff-44-1b-5f Permanent
33-33-ff-4e-01-1f Permanent
33-33-ff-69-2f-9c Permanent
33-33-ff-72-e6-d1 Permanent
33-33-ff-83-c7-da Permanent
33-33-ff-86-59-75 Permanent
33-33-ff-8b-99-e2 Permanent
33-33-ff-9b-f0-48 Permanent
33-33-ff-a1-49-53 Permanent
33-33-ff-a7-3f-ce Permanent
33-33-ff-b0-5c-5c Permanent
33-33-ff-b6-4c-10 Permanent
33-33-ff-bb-69-ce Permanent
33-33-ff-bd-7f-48 Permanent
33-33-ff-c2-00-32 Permanent
33-33-ff-d6-1b-02 Permanent
33-33-ff-e2-89-e0 Permanent
33-33-ff-f1-d3-10 Permanent
33-33-ff-fb-50-41 Permanent
33-33-00-00-00-0c Permanent
33-33-00-00-00-0c Permanent

Interface 1: Loopback Pseudo-Interface 1

Internet Address Physical Address Type

ff02::2 Permanent
ff02::c Permanent
ff02::16 Permanent
ff02::fb Permanent
ff02::1:2 Permanent
ff02::1:3 Permanent
ff02::1:ff00:1 Permanent
ff02::1:ff05:9d9d Permanent
ff02::1:ff08:af53 Permanent
ff02::1:ff1c:13ae Permanent
ff02::1:ff1c:898c Permanent
ff02::1:ff22:6dc7 Permanent
ff02::1:ff23:33e2 Permanent
ff02::1:ff2e:c85d Permanent
ff02::1:ff2e:d440 Permanent
ff02::1:ff36:a36 Permanent
ff02::1:ff4e:11f Permanent
ff02::1:ff5c:49dc Permanent
ff02::1:ff69:2f9c Permanent
ff02::1:ff71:478b Permanent
ff02::1:ff72:e6d1 Permanent
ff02::1:ff83:c7da Permanent
ff02::1:ff86:5975 Permanent
ff02::1:ff8b:99e2 Permanent
ff02::1:ff9b:f048 Permanent
ff02::1:ffa1:4953 Permanent
ff02::1:ffa7:3fce Permanent
ff02::1:ffb0:5c5c Permanent
ff02::1:ffb6:4c10 Permanent
ff02::1:ffbb:69ce Permanent
ff02::1:ffbd:7f48 Permanent
ff02::1:ffc2:32 Permanent
ff02::1:ffd3:542c Permanent
ff02::1:ffd6:1b02 Permanent
ff02::1:ffe2:89e0 Permanent
ff02::1:fff1:d310 Permanent
ff02::1:fffb:5041 Permanent
ff05::c Permanent
ff0e::c Permanent

Interface 8: Local Area Connection* 2

Internet Address Physical Address Type

fe80::217:10ff:fe93:70a7 00-00-00-00-00-00 Unreachable
fe80::230:18ff:fe08:af53 00-00-00-00-00-00 Unreachable
fe80::e4a4:c85e:f21c:13ae 00-00-00-00-00-00 Unreachable
ff02::2 33-33-00-00-00-02 Permanent
ff02::16 33-33-00-00-00-16 Permanent
ff02::fb 33-33-00-00-00-fb Permanent
ff02::1:2 33-33-00-01-00-02 Permanent
ff02::1:3 33-33-00-01-00-03 Permanent
ff02::1:ff00:1 33-33-ff-00-00-01 Permanent
ff02::1:ff05:9d9d 33-33-ff-05-9d-9d Permanent
ff02::1:ff08:af53 33-33-ff-08-af-53 Permanent
ff02::1:ff1c:13ae 33-33-ff-1c-13-ae Permanent
ff02::1:ff1c:898c 33-33-ff-1c-89-8c Permanent
ff02::1:ff22:6dc7 33-33-ff-22-6d-c7 Permanent
ff02::1:ff23:33e2 33-33-ff-23-33-e2 Permanent
ff02::1:ff2e:c85d 33-33-ff-2e-c8-5d Permanent
ff02::1:ff2e:d440 33-33-ff-2e-d4-40 Permanent
ff02::1:ff36:a36 33-33-ff-36-0a-36 Permanent
ff02::1:ff4e:11f 33-33-ff-4e-01-1f Permanent
ff02::1:ff5c:49dc 33-33-ff-5c-49-dc Permanent
ff02::1:ff69:2f9c 33-33-ff-69-2f-9c Permanent
ff02::1:ff71:478b 33-33-ff-71-47-8b Permanent
ff02::1:ff72:e6d1 33-33-ff-72-e6-d1 Permanent
ff02::1:ff83:c7da 33-33-ff-83-c7-da Permanent
ff02::1:ff86:5975 33-33-ff-86-59-75 Permanent
ff02::1:ff8b:99e2 33-33-ff-8b-99-e2 Permanent
ff02::1:ff9b:f048 33-33-ff-9b-f0-48 Permanent
ff02::1:ffa1:4953 33-33-ff-a1-49-53 Permanent
ff02::1:ffa7:3fce 33-33-ff-a7-3f-ce Permanent
ff02::1:ffb0:5c5c 33-33-ff-b0-5c-5c Permanent
ff02::1:ffb6:4c10 33-33-ff-b6-4c-10 Permanent
ff02::1:ffbb:69ce 33-33-ff-bb-69-ce Permanent
ff02::1:ffbd:7f48 33-33-ff-bd-7f-48 Permanent
ff02::1:ffc2:32 33-33-ff-c2-00-32 Permanent
ff02::1:ffd3:542c 33-33-ff-d3-54-2c Permanent
ff02::1:ffd6:1b02 33-33-ff-d6-1b-02 Permanent
ff02::1:ffe2:89e0 33-33-ff-e2-89-e0 Permanent
ff02::1:fff1:d310 33-33-ff-f1-d3-10 Permanent
ff02::1:fffb:5041 33-33-ff-fb-50-41 Permanent
ff05::c 33-33-00-00-00-0c Permanent
ff0e::c 33-33-00-00-00-0c Permanent

Interface 15: Local Area Connection* 1

Internet Address Physical Address Type

fe80::217:10ff:fe93:70a7 00-00-00-00-00-00 Unreachable
fe80::230:18ff:fe08:af53 00-00-00-00-00-00 Unreachable
fe80::e4a4:c85e:f21c:13ae 00-00-00-00-00-00 Unreachable
ff02::2 33-33-00-00-00-02 Permanent
ff02::16 33-33-00-00-00-16 Permanent
ff02::fb 33-33-00-00-00-fb Permanent
ff02::1:2 33-33-00-01-00-02 Permanent
ff02::1:3 33-33-00-01-00-03 Permanent
ff02::1:ff00:1 33-33-ff-00-00-01 Permanent
ff02::1:ff05:9d9d 33-33-ff-05-9d-9d Permanent
ff02::1:ff08:af53 33-33-ff-08-af-53 Permanent
ff02::1:ff1c:13ae 33-33-ff-1c-13-ae Permanent
ff02::1:ff1c:898c 33-33-ff-1c-89-8c Permanent
ff02::1:ff22:6dc7 33-33-ff-22-6d-c7 Permanent
ff02::1:ff23:33e2 33-33-ff-23-33-e2 Permanent
ff02::1:ff2e:c85d 33-33-ff-2e-c8-5d Permanent
ff02::1:ff2e:d440 33-33-ff-2e-d4-40 Permanent
ff02::1:ff36:a36 33-33-ff-36-0a-36 Permanent
ff02::1:ff4e:11f 33-33-ff-4e-01-1f Permanent
ff02::1:ff5c:49dc 33-33-ff-5c-49-dc Permanent
ff02::1:ff69:2f9c 33-33-ff-69-2f-9c Permanent
ff02::1:ff71:478b 33-33-ff-71-47-8b Permanent
ff02::1:ff72:e6d1 33-33-ff-72-e6-d1 Permanent
ff02::1:ff83:c7da 33-33-ff-83-c7-da Permanent
ff02::1:ff86:5975 33-33-ff-86-59-75 Permanent
ff02::1:ff8b:99e2 33-33-ff-8b-99-e2 Permanent
ff02::1:ff9b:f048 33-33-ff-9b-f0-48 Permanent
ff02::1:ffa1:4953 33-33-ff-a1-49-53 Permanent
ff02::1:ffa7:3fce 33-33-ff-a7-3f-ce Permanent
ff02::1:ffb0:5c5c 33-33-ff-b0-5c-5c Permanent
ff02::1:ffb6:4c10 33-33-ff-b6-4c-10 Permanent
ff02::1:ffbb:69ce 33-33-ff-bb-69-ce Permanent
ff02::1:ffbd:7f48 33-33-ff-bd-7f-48 Permanent
ff02::1:ffc2:32 33-33-ff-c2-00-32 Permanent
ff02::1:ffd3:542c 33-33-ff-d3-54-2c Permanent
ff02::1:ffd6:1b02 33-33-ff-d6-1b-02 Permanent
ff02::1:ffe2:89e0 33-33-ff-e2-89-e0 Permanent
ff02::1:fff1:d310 33-33-ff-f1-d3-10 Permanent
ff02::1:fffb:5041 33-33-ff-fb-50-41 Permanent
ff05::c 33-33-00-00-00-0c Permanent
ff0e::c 33-33-00-00-00-0c Permanent

Interface 9: Ethernet 2

Internet Address Physical Address Type

:: 00-00-00-00-00-00 Unreachable
2001:470:1d:7e8::1 00-00-00-00-00-00 Unreachable
2001:470:1d:7e8:45c3:e560:1bb:69ce 00-00-00-00-00-00 Unreachable
2001:478:65::53 00-00-00-00-00-00 Unreachable
2001:4860:4860::8888 00-00-00-00-00-00 Unreachable
2001:4998:44:41d::3 00-00-00-00-00-00 Unreachable
2001:4998:44:41d::4 00-00-00-00-00-00 Unreachable
2001:4998:58:1836::10 00-00-00-00-00-00 Unreachable
2001:4998:58:1836::11 00-00-00-00-00-00 Unreachable
2015::abcd 00-00-00-00-00-00 Unreachable
2603:1036:600::2 00-00-00-00-00-00 Unreachable
2603:1036:902::2 00-00-00-00-00-00 Unreachable
2603:1036:902:16::2 00-00-00-00-00-00 Unreachable
2603:1036:902:18::2 00-00-00-00-00-00 Unreachable
2603:1036:902:2b::2 00-00-00-00-00-00 Unreachable
2603:1036:902:2c::2 00-00-00-00-00-00 Unreachable
2603:1036:902:66::2 00-00-00-00-00-00 Unreachable
2603:1036:902:7a::2 00-00-00-00-00-00 Unreachable
2603:1036:902:7b::2 00-00-00-00-00-00 Unreachable
2603:1036:902:7c::2 00-00-00-00-00-00 Unreachable
2603:1036:902:8f::2 00-00-00-00-00-00 Unreachable
2603:1036:902:90::2 00-00-00-00-00-00 Unreachable
2603:1036:902:a3::2 00-00-00-00-00-00 Unreachable
2603:1036:902:b3::2 00-00-00-00-00-00 Unreachable
2603:1036:902:c5::2 00-00-00-00-00-00 Unreachable
2603:1036:902:ca::2 00-00-00-00-00-00 Unreachable
2603:1036:902:2 00-00-00-00-00-00 Unreachable
2603:1036:902:df::2 00-00-00-00-00-00 Unreachable
2603:1036:902:e0::2 00-00-00-00-00-00 Unreachable
2603:1036:902:f4::2 00-00-00-00-00-00 Unreachable
2603:1036:902:106::2 00-00-00-00-00-00 Unreachable
2603:1036:902:108::2 00-00-00-00-00-00 Unreachable
2603:1036:902:11a::2 00-00-00-00-00-00 Unreachable
2603:1036:902:11c::2 00-00-00-00-00-00 Unreachable
2603:1036:902:12e::2 00-00-00-00-00-00 Unreachable
2603:1036:902:12f::2 00-00-00-00-00-00 Unreachable
2603:1036:906:14::2 00-00-00-00-00-00 Unreachable
2603:1036:906:15::2 00-00-00-00-00-00 Unreachable
2603:1036:906:16::2 00-00-00-00-00-00 Unreachable
2603:1036:906:3c::2 00-00-00-00-00-00 Unreachable
2603:1036:906:3d::2 00-00-00-00-00-00 Unreachable
2603:1036:906:3e::2 00-00-00-00-00-00 Unreachable
2603:1036:906:4d::2 00-00-00-00-00-00 Unreachable
2603:1036:906:4f::2 00-00-00-00-00-00 Unreachable
2603:1036:906:5e::2 00-00-00-00-00-00 Unreachable
2603:1036:906:5f::2 00-00-00-00-00-00 Unreachable
2603:1036:906:60::2 00-00-00-00-00-00 Unreachable
2603:1036:906:72::2 00-00-00-00-00-00 Unreachable
2603:1036:906:74::2 00-00-00-00-00-00 Unreachable
2603:1036:906:84::2 00-00-00-00-00-00 Unreachable
2603:1036:906:85::2 00-00-00-00-00-00 Unreachable
2607:f8b0:4001:c01::bd 00-00-00-00-00-00 Unreachable
2607:f8b0:4001:c03::bd 00-00-00-00-00-00 Unreachable
2607:f8b0:4001:c12::bd 00-00-00-00-00-00 Unreachable
2607:f8b0:4001:c19::bd 00-00-00-00-00-00 Unreachable
2607:f8b0:4002:813::2004 00-00-00-00-00-00 Unreachable
2607:f8b0:400b:800::2003 00-00-00-00-00-00 Unreachable
2607:f8b0:400b:802::200b Unreachable Unreachable
2607:f8b0:400b:809::200e 00-00-00-00-00-00 Unreachable
2607:f8b0:400b:80f::200e Unreachable Unreachable
2a01:111:f400:31ab::2 00-00-00-00-00-00 Unreachable
fe80::230:18ff:fe08:af53 00-00-00-00-00-00 Unreachable
fe80::e4a4:c85e:f21c:13ae 00-00-00-00-00-00 Unreachable
ff02::2 33-33-00-00-00-02 Permanent
ff02::16 33-33-00-00-00-16 Permanent
ff02::fb 33-33-00-00-00-fb Permanent
ff02::1:2 33-33-00-01-00-02 Permanent
ff02::1:ff00:200b 33-33-ff-00-20-0b Permanent
ff02::1:ff00:200e 33-33-ff-00-20-0e Permanent

Interface 11: Ethernet 3

Internet Address Physical Address Type

fe80::230:18ff:fe08:af53 00-00-00-00-00-00 Unreachable
fe80::e4a4:c85e:f21c:13ae 00-00-00-00-00-00 Unreachable
ff02::2 33-33-00-00-00-02 Permanent
ff02::16 33-33-00-00-00-16 Permanent
ff02::fb 33-33-00-00-00-fb Permanent
ff02::1:2 33-33-00-01-00-02 Permanent
ff02::1:3 33-33-00-01-00-03 Permanent
ff02::1:ff00:1 33-33-ff-00-00-01 Permanent
ff02::1:ff05:9d9d 33-33-ff-05-9d-9d Permanent
ff02::1:ff08:af53 33-33-ff-08-af-53 Permanent
ff02::1:ff1c:13ae 33-33-ff-1c-13-ae Permanent
ff02::1:ff1c:898c 33-33-ff-1c-89-8c Permanent
ff02::1:ff22:6dc7 33-33-ff-22-6d-c7 Permanent
ff02::1:ff23:33e2 33-33-ff-23-33-e2 Permanent
ff02::1:ff2e:c85d 33-33-ff-2e-c8-5d Permanent
ff02::1:ff2e:d440 33-33-ff-2e-d4-40 Permanent
ff02::1:ff36:a36 33-33-ff-36-0a-36 Permanent
ff02::1:ff4e:11f 33-33-ff-4e-01-1f Permanent
ff02::1:ff69:2f9c 33-33-ff-69-2f-9c Permanent
ff02::1:ff72:e6d1 33-33-ff-72-e6-d1 Permanent
ff02::1:ff83:c7da 33-33-ff-83-c7-da Permanent
ff02::1:ff86:5975 33-33-ff-86-59-75 Permanent
ff02::1:ff8b:99e2 33-33-ff-8b-99-e2 Permanent
ff02::1:ff9b:f048 33-33-ff-9b-f0-48 Permanent
ff02::1:ffa1:4953 33-33-ff-a1-49-53 Permanent
ff02::1:ffa7:3fce 33-33-ff-a7-3f-ce Permanent
ff02::1:ffb0:5c5c 33-33-ff-b0-5c-5c Permanent
ff02::1:ffb6:4c10 33-33-ff-b6-4c-10 Permanent
ff02::1:ffbb:69ce 33-33-ff-bb-69-ce Permanent
ff02::1:ffbd:7f48 33-33-ff-bd-7f-48 Permanent
ff02::1:ffc2:32 33-33-ff-c2-00-32 Permanent
ff02::1:ffd6:1b02 33-33-ff-d6-1b-02 Permanent
ff02::1:ffe2:89e0 33-33-ff-e2-89-e0 Permanent
ff02::1:fff1:d310 33-33-ff-f1-d3-10 Permanent
ff02::1:fffb:5041 33-33-ff-fb-50-41 Permanent
ff05::c 33-33-00-00-00-0c Permanent
ff0e::c 33-33-00-00-00-0c Permanent

Interface 10: Bluetooth Network Connection 2

Internet Address Physical Address Type

fe80::217:10ff:fe93:70a7 00-00-00-00-00-00 Unreachable
fe80::230:18ff:fe08:af53 00-00-00-00-00-00 Unreachable
fe80::e4a4:c85e:f21c:13ae 00-00-00-00-00-00 Unreachable
ff02::2 33-33-00-00-00-02 Permanent
ff02::16 33-33-00-00-00-16 Permanent
ff02::fb 33-33-00-00-00-fb Permanent
ff02::1:2 33-33-00-01-00-02 Permanent
ff02::1:3 33-33-00-01-00-03 Permanent
ff02::1:ff00:1 33-33-ff-00-00-01 Permanent
ff02::1:ff05:9d9d 33-33-ff-05-9d-9d Permanent
ff02::1:ff08:af53 33-33-ff-08-af-53 Permanent
ff02::1:ff1c:13ae 33-33-ff-1c-13-ae Permanent
ff02::1:ff1c:898c 33-33-ff-1c-89-8c Permanent
ff02::1:ff22:6dc7 33-33-ff-22-6d-c7 Permanent
ff02::1:ff23:33e2 33-33-ff-23-33-e2 Permanent
ff02::1:ff2e:c85d 33-33-ff-2e-c8-5d Permanent
ff02::1:ff2e:d440 33-33-ff-2e-d4-40 Permanent
ff02::1:ff36:a36 33-33-ff-36-0a-36 Permanent
ff02::1:ff4e:11f 33-33-ff-4e-01-1f Permanent
ff02::1:ff5c:49dc 33-33-ff-5c-49-dc Permanent
ff02::1:ff69:2f9c 33-33-ff-69-2f-9c Permanent
ff02::1:ff71:478b 33-33-ff-71-47-8b Permanent
ff02::1:ff72:e6d1 33-33-ff-72-e6-d1 Permanent
ff02::1:ff83:c7da 33-33-ff-83-c7-da Permanent
ff02::1:ff86:5975 33-33-ff-86-59-75 Permanent
ff02::1:ff8b:99e2 33-33-ff-8b-99-e2 Permanent
ff02::1:ff9b:f048 33-33-ff-9b-f0-48 Permanent
ff02::1:ffa1:4953 33-33-ff-a1-49-53 Permanent
ff02::1:ffa7:3fce 33-33-ff-a7-3f-ce Permanent
ff02::1:ffb0:5c5c 33-33-ff-b0-5c-5c Permanent
ff02::1:ffb6:4c10 33-33-ff-b6-4c-10 Permanent
ff02::1:ffbb:69ce 33-33-ff-bb-69-ce Permanent
ff02::1:ffbd:7f48 33-33-ff-bd-7f-48 Permanent
ff02::1:ffc2:32 33-33-ff-c2-00-32 Permanent
ff02::1:ffd3:542c 33-33-ff-d3-54-2c Permanent
ff02::1:ffd6:1b02 33-33-ff-d6-1b-02 Permanent
ff02::1:ffe2:89e0 33-33-ff-e2-89-e0 Permanent
ff02::1:fff1:d310 33-33-ff-f1-d3-10 Permanent
ff02::1:fffb:5041 33-33-ff-fb-50-41 Permanent
ff05::c 33-33-00-00-00-0c Permanent
ff0e::c 33-33-00-00-00-0c Permanent

C:\Users\Hazen>

hazenvs01234

Ethernet adapter Ethernet 2:

Connection-specific DNS Suffix . : devfactory.local
Description . . . . . . . . . . . : Cisco AnyConnect Secure Mobility Client Virtual Miniport Adapter for Windows x64
Physical Address. . . . . . . . . : 00-05-9A-3C-7A-00
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes
Link-local IPv6 Address . . . . . : fe80::ad4e:5ce1:660a:a241%9(Preferred)
Link-local IPv6 Address . . . . . : fe80::ed09:55eb:b11f:96b%9(Preferred)
IPv4 Address. . . . . . . . . . . : 10.119.124.209(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : ::
DHCPv6 IAID . . . . . . . . . . . : 117441946
DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-23-11-50-48-98-28-A6-1E-1D-AC
DNS Servers . . . . . . . . . . . : 10.119.11.199
NetBIOS over Tcpip. . . . . . . . : Enabled

Ethernet adapter Ethernet:

Connection-specific DNS Suffix . : altignus.com
Description . . . . . . . . . . . : Realtek PCIe GBE Family Controller
Physical Address. . . . . . . . . : 98-28-A6-1E-1D-AC
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
IPv6 Address. . . . . . . . . . . : 2001:470:1d:7e8:4da6:be69:7adc:ddcf(Preferred)
Lease Obtained. . . . . . . . . . : May 1, 2019 5:14:58 PM
Lease Expires . . . . . . . . . . : May 3, 2019 11:14:57 AM
IPv6 Address. . . . . . . . . . . : 2001:470:1d:7e8:b902:303c:5f61:e2c5(Preferred)
Temporary IPv6 Address. . . . . . : 2001:470:1d:7e8:4161:6a89:a87c:3166(Deprecated)
Temporary IPv6 Address. . . . . . : 2001:470:1d:7e8:a1ce:b978:70c1:f161(Preferred)
Link-local IPv6 Address . . . . . : fe80::b902:303c:5f61:e2c5%2(Preferred)
IPv4 Address. . . . . . . . . . . : 192.168.10.30(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Lease Obtained. . . . . . . . . . : May 2, 2019 6:06:17 PM
Lease Expires . . . . . . . . . . : May 3, 2019 11:06:15 AM
Default Gateway . . . . . . . . . : fe80::230:18ff:fe08:af53%2
192.168.10.1
DHCP Server . . . . . . . . . . . : 192.168.10.1
DHCPv6 IAID . . . . . . . . . . . : 43526310
DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-23-11-50-48-98-28-A6-1E-1D-AC
DNS Servers . . . . . . . . . . . : 2001:470:1d:7e8::1
192.168.10.1
NetBIOS over Tcpip. . . . . . . . : Enabled
Connection-specific DNS Suffix Search List :
altignus.com

Wireless LAN adapter Local Area Connection* 2:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Microsoft Wi-Fi Direct Virtual Adapter
Physical Address. . . . . . . . . : 34-E1-2D-1A-7C-1A
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes

Wireless LAN adapter Local Area Connection* 1:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Microsoft Wi-Fi Direct Virtual Adapter #2
Physical Address. . . . . . . . . : 36-E1-2D-1A-7C-19
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes

Ethernet adapter Ethernet 3:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Kerio Virtual Network Adapter
Physical Address. . . . . . . . . : 44-45-53-54-4F-53
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes

Wireless LAN adapter Wi-Fi:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . : altignus.com
Description . . . . . . . . . . . : Intel(R) Wireless-AC 9560
Physical Address. . . . . . . . . : 34-E1-2D-1A-7C-19
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes

Ethernet adapter Bluetooth Network Connection 2:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Bluetooth Device (Personal Area Network) #2
Physical Address. . . . . . . . . : 34-E1-2D-1A-7C-1D
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes

C:\Users\Hazen>

Gertjan

Compare yours :

Ethernet adapter Ethernet:

Connection-specific DNS Suffix . : altignus.com
IPv6 Address. . . . . . . . . . . : 2001:470:1d:7e8:4da6:be69:7adc:ddcf
IPv6 Address. . . . . . . . . . . : 2001:470:1d:7e8:b902:303c:5f61:e2c5
Temporary IPv6 Address. . . . . . : 2001:470:1d:7e8:4161:6a89:a87c:3166
Link-local IPv6 Address . . . . . : fe80::b902:303c:5f61:e2c5%2
IPv4 Address. . . . . . . . . . . : 192.168.10.204
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : fe80::230:18ff:fe08:af53%2
192.168.10.1

With this :

Btw : de acivate your "Ethernet adapter Ethernet 2:" during tests.

Suffixe DNS propre à la connexion. . . : brit-hotel-fumel.net
Description. . . . . . . . . . . . . . : Broadcom NetLink (TM) Gigabit Ethernet
Adresse physique . . . . . . . . . . . : B8-AC-6F-47-2C-77
DHCP activé. . . . . . . . . . . . . . : Oui
Configuration automatique activée. . . : Oui
Adresse IPv6. . . . . . . . . . . . . .: 2001:470:1f13:5c0:2::c6(préféré)
Bail obtenu. . . . . . . . . . . . . . : mercredi 1 mai 2019 18:53:07
Bail expirant. . . . . . . . . . . . . : vendredi 3 mai 2019 17:02:40
Adresse IPv6 de liaison locale. . . . .: fe80::340c:c69c:81a9:1c84%17(préféré
)
Adresse IPv4. . . . . . . . . . . . . .: 192.168.1.6(préféré)
Masque de sous-réseau. . . . . . . . . : 255.255.255.0
Bail obtenu. . . . . . . . . . . . . . : mercredi 1 mai 2019 18:53:06
Bail expirant. . . . . . . . . . . . . : samedi 4 mai 2019 06:53:06
Passerelle par défaut. . . . . . . . . : fe80::212:3fff:feb3:5875%17
                                    192.168.1.1
Serveur DHCP . . . . . . . . . . . . . : 192.168.1.1
IAID DHCPv6 . . . . . . . . . . . : 364424303
DUID de client DHCPv6. . . . . . . . : 00-01-00-01-14-20-18-E3-B8-AC-6F-47-2C-77
Serveurs DNS. . .  . . . . . . . . . . : 2001:470:1f13:5c0:2::1
                                    192.168.1.1
NetBIOS sur Tcpip. . . . . . . . . . . : Activé

I have on one "IPv6 Address" and one "Link-local IPv6 Address"
I have no : "Temporary IPv6 Address"

From what I know, the DHCPv6 on pfSense sets all these values.
Your Pc is all DHCP6, right, nothing set static ?

hazenvs01234

I've solved it; this host uses a VPN, my bad, it's a PEBKAC. my non vpn'd hosts on the newtork work just fine.

johnpoz

@hazenvs01234 said in he.net tunnel up, but General Failure when pinging from Hosts within the network:

Cisco AnyConnect Secure Mobility Client

So your connected to a vpn same time your trying to ping your local gateway via IPv6... Your ndp shows unreachable to pfsense ipv6

What doe your local ipv6 routing table look like.

Gertjan

@hazenvs01234 said in he.net tunnel up, but General Failure when pinging from Hosts within the network:

I've solved it; this host uses a VPN, my bad, it's a PEBKAC. my non vpn'd hosts on the newtork work just fine.

Ok !!
So now we switch over to "repair or enable IPv6 on VPN" ?

hazenvs01234

Exactly.

When i dissconnect from the 2 vpn's i use on this host it tests just fine.

Derelict

So you have to figure out how to get that host to route IPv6 properly when connected to whatever VPNs are in use.

Not a pfSense problem.

hazenvs01234

@Derelict I stated previously it was a PEBKAC error (as in the problem lies between the Keyboard and Chair). Again thanks everyone for your help and time on this.

I have multiple clients and many of them run multiple VPN's.

Putting a mention in the document to remind troglodytes like myself to disable VPN's when testing might deserve a mention?