DDNS IPv6 Cloudflare



  • So is it possible that my homeservers get their DDNS-addresses with cloudflare updated with IPv6 by pfSense?
    I have dual-stack from my ISP and already doing it with the one IPv4-address for NAT successfully.



  • @Bob-Dig

    Is your prefix not pretty much static? The prefix should not normally change. This means you can use any DNS server, without having to worry about DHCP.



  • @JKnott It looks like you are right. I "changed" my IPv4-address with a mac-address change on the modem-connection and I got a new IPv4 but IPv6 stayed the same. Thanks for now.

    In the DHCP(v6)-Server, there is an option called Dynamic DNS. Under which circumstances is this option usable, I really want to know.



  • And also, which of the IPv6-addresses should I put in my DNS. There are two (not link-local or temporary) which look almost identical, but one got many Zeros in it.



  • @Bob-Dig

    As for the addresses, are you referring to ones on the computers that you want to reach? Or on the firewall? My firewall has 1 global address, with a /128 prefix. The computers on my LAN have one permanent address and up to 7 temporary privacy addresses. Use the permanent one, which is often based on the MAC address.

    Also, there's a setting you want to ensure is selected. It's "Do not allow PD/Address release" on the WAN page. If that's not selected, the address might change. I found all it took was to disconnect/reconnect the WAN Ethernet cable.

    As for that Dynamic DNS option, I couldn't tell you, as I have never needed to use a dynamic DNS, even on IPv4. While my IPv4 address is DHCP, it changes so seldem, it's virtually static. Also, the host name for it is based on modem and firewall MAC addresses, which won't change, unless I change the hardware. So, with the DNS server, I just created an alias from my domain host name to the MAC based host name.



  • @JKnott Windows doesn't default use the MAC for IPv6. I now also have to change my cname records to A and AAAA ones, because cname is not allowed anymore with IPv6 (dual-stack).
    Also I have to create a DDNS-"Client" for every A-Record now.
    Interestingly some Windows-machines have those two mentioned IPv6-adresses, others only have one. ๐Ÿ˜•
    I hate IPv6 already!



  • @Bob-Dig said in DDNS IPv6 Cloudflare:

    Windows doesn't default use the MAC for IPv6.

    Windows 10 :

    95e92d7c-88bd-47d2-a673-cdff8b54de4b-image.png

    The MAC of the Windows PC is tucked into the DUID.
    This DUID is important, so the DHCP6 server attributes the same IPv6 to my PC.

    @Bob-Dig said in DDNS IPv6 Cloudflare:

    because cname is not allowed anymore with IPv6 (dual-stack).

    To many messed up to hard. So, this is actually a good thing.

    @Bob-Dig said in DDNS IPv6 Cloudflare:

    In the DHCP(v6)-Server, there is an option called Dynamic DNS. Under which circumstances is this option usable, I really want to know.

    Me too !
    Played around with this one a lot.
    Nothing 'works' ..... probably because I don't understand what DDNS is doing here (DHCPv6 server). pfSense Manual or usage case are lacking here.

    But : knowing that my IPv6 prefix is more fixed a concrete - it didn't change for the mast 7 years - my IPv6 are always pointing to my devices - the IPv6 firewall being the sole frontier.
    "Look Maaaaam !! No more NAT !!!!!"
    I love IPv6.


  • LAYER 8 Global Moderator

    So you want your client to register its IPv6 with cloudflare? That wouldn't' be done via pfsense - do that via the client and your cloudflare token and api key..



  • @johnpoz You mean my servers should do it with some form of client for themselves? Wouldn't it be nice if pfsense could to that or is this impossible? Under DHCPv6 Leases I can't even see all of my PCs...



  • @Bob-Dig said in DDNS IPv6 Cloudflare:

    Windows doesn't default use the MAC for IPv6.

    That's why I said "often". It could be either the MAC address or random number. Both Windows and Linux can be configured to use either.

    I'm not sure what you mean by cname is not allowed for IPv6. I have several for IPv6 and an alias for IPv4.

    Interestingly some Windows-machines have those two mentioned IPv6-adresses, others only have one.

    You will have up to 7 privacy addresses, but you do not use those for the DNS, only the permanent one. I don't know why some only have 1 address.

    While the basics of IPv6 are similar to IPv4, there are some significant differences, which you will learn through experience. For example, my computer has 17 addresses, because it's been up over a week. I have the link local address and 8 each global and unique local addresses, of which 7 are privacy addresses. On IPv4, while possible, multiple addresses are rare. You will also have an unbelievably huge address space to yourself. A single /64 has as much address space as the entire IPv4 address space squared. With my /56 prefix, I have 256 /64s! There are some other technical details that were changed to improve performance and security.



  • @JKnott said in DDNS IPv6 Cloudflare:

    I'm not sure what you mean by cname is not allowed for IPv6. I have several for IPv6 and an alias for IPv4.

    Since now I had an A Record for my wan-IPv4 and the rest was all cname. Now this no longer works because I can not have a cname record and a AAAA-record for the same name.



  • @Bob-Dig

    I have to correct myself. I just looked at my DNS config. I have CNAME (alias) for IPv4 names that point to the long MAC based host name and AAAA records for IPv6. One thing I have found is that if I have an alias for IPv4, the AAAA for the same host name won't be used. If I have A and AAAA records, then the appropriate one is used.



  • @JKnott said in DDNS IPv6 Cloudflare:

    I have CNAME (alias) for IPv4 names that point to the long MAC based host name and AAAA records for IPv6.

    I don't know what you mean by "long MAC based host name"



  • @Bob-Dig said in DDNS IPv6 Cloudflare:

    I don't know what you mean by "long MAC based host name"

    The host name is very long, as it includes both the modem and firewall MAC addresses. It's cpe<firewall MAC>-cm<cable modem MAC>.cpe.net.cable.rogers.com. The actual MACs have been disguised to protect the guilty. ๐Ÿ˜‰

    In the DNS server, I create an alias to that host name for the host name in my domain.



  • @JKnott When you talk about DNS config, you meant your domain-DNS-Hoster (e.g. cloudflare) or do you meant pfsense?

    @JKnott said in DDNS IPv6 Cloudflare:

    I have to correct myself. I just looked at my DNS config.



  • @Bob-Dig

    My DNS is on an Enom server, which I get through Google. I also have my own DNS running on pfSense. The pfSense DNS records point to the unique local addresses and the Enom records point to my global addresses.


  • LAYER 8 Global Moderator

    You have some IPv6 Global address.. Yeah you can have a lot of them.. But you should have atleast 1 that doesn't change that you use to provide services.

    Set this IP as your AAAA in your dns... If this global that your going to serve services off is going to change, then on the box with this IP on it, not your router... Have it register its IPv6 as AAAA record in cloudflare.. That is the whole point of their api.. There are scripts for for whatever OS your running to do this.. using your cloudflare api key and token..

    Pfsense isn't going to do this for you..

    Serving services off IPs that change be ipv4 or ipv6 is bad idea... If you have a prefix that your going to use to service services off of... Then give your boxes IPs in that prefix, be it static or set to be handed out via dhcp6 so they always have this IP, no put that in dns!! Static record is easiest since this boxes IP isn't going to be changing... Or sure you can dynamically do it... Just make sure your TTLs our short - and expect problems when the IPs change, etc.



  • @JKnott said in DDNS IPv6 Cloudflare:

    @Bob-Dig

    My DNS is on an Enom server, which I get through Google. I also have my own DNS running on pfSense. The pfSense DNS records point to the unique local addresses and the enom records point to my global addresses.

    Sounds interesting but i don't get it. ๐Ÿ‘
    Is there an article or post or something which explains this?



  • @Bob-Dig

    Don't get what? Unique local addresses are the IPv6 version of IPv4 RFC 1918 addresses. It's entirely normal to have both global and unique local addresses on IPv6. As I mentioned above, I have 8 each global and unique local addresses on this computer. I have the pfSense DNS configured with the unique local addresses and Enom with the global. There's nothing difficult about that.



  • @JKnott Ok, so there is no connection between this two and no chance of pfSense updating my DDNS for IPv6. I will look out for Clients on each machine like @johnpoz said.



  • @Bob-Dig

    No. As I said, I don't use dynamic DNS. However, as long as you can create AAAA records, you shouldn't need it for IPv6.



  • @johnpoz said in DDNS IPv6 Cloudflare:

    If you have a prefix that your going to use to service services off of... Then give your boxes IPs in that prefix, be it static or set to be handed out via dhcp6 so they always have this IP,

    Will have to learn this.



  • @JKnott said in DDNS IPv6 Cloudflare:

    @Bob-Dig

    No. As I said, I don't use dynamic DNS. However, as long as you can create AAAA records, you shouldn't need it for IPv6.

    I will use clients if possible. Friend of mine has DSL and it changing the prefix every time he restarts his router (fritzbox)!


  • LAYER 8 Global Moderator

    You shouldn't be doing services off IPs that change to be honest... But how you update those records via cloudflare is all here... This has nothing to do with pfsense..

    https://support.cloudflare.com/hc/en-us/articles/360020524512-Manage-dynamic-IPs-in-Cloudflare-DNS-programmatically

    You can have pfsense update ITs IPs both ipv4 and IPv6 in cloudflare sure -- but not some client on network behind pfsense...

    edit: All that being said... I have been hosting ntp via IPv6 for years... The IP hasn't ever changed even moving to different isp... Since I use a /48 from HE... and the ntp server has a IPv6 address that I assign it, and create a AAAA record for... If your trying to serve services to the public via some IP that is going to change willy nilly, your doing it wrong ;)

    Its fine if your wanting to connect to your home connection, etc.. But even then - I have had the same IPv4 address since I have been with this ISP, got a be a year now - has never changed... Why should it - pfsense is online 24/7 and renews the lease... As for the IPv6 - that is static is as well since its one of /48 addresses...



  • @johnpoz It is just a homeserver.

    Interestingly my friends router (fritzbox) saves its firewall rules for IPv4 (NAT) and IPv6. And after a reboot it changes the ipv6 in the rule automatically to the new one. This means it is theoretically possible that the router knows the IPv6 addresses and also updates them, theoretically! ๐Ÿ˜‰


  • LAYER 8 Global Moderator

    Not saying its technically not possible... I could have a any client on my network update the IPv6 address of some other box on my network.. Especially dhcpv6 that is handing the client the IPv6 address, etc.

    What I am telling you is pfsense isn't going to do this for you with some click of a gui button...

    But if that is what your looking for - its the wrong path... You should be looking for your IP address to not be changing if your wanting to serve services off of it..



  • To bad, dnsomatic seems not to support ipv6 with cloudflare. So I am in need of a client for windows.
    When the IPv6 changes I will probably not notice it because I don't use IPv6... But some people ask, why IPv6 is not used, this is why!


  • LAYER 8 Global Moderator

    Who asks this? There is no actual need for IPv6 at this point in time... No matter how much jknott for it too be true...

    There is a powershell script floating around that works with cloudflare api I believe, or you should just be able to use the perl ddclient on windows as well..

    this powershell should work
    https://port1433.com/2017/02/20/updating-google-domains-dynamic-dns-with-powershell/



  • @Bob-Dig said in DDNS IPv6 Cloudflare:

    To bad, dnsomatic seems not to support ipv6 with cloudflare. So I am in need of a client for windows.
    When the IPv6 changes I will probably not notice it because I don't use IPv6... But some people ask, why IPv6 is not used, this is why!

    Why do you think IPv6 addresses will change? Unless your ISP screws up, your addresses are essentially static. It's only IPv4 you have to worry about.



  • @JKnott said in DDNS IPv6 Cloudflare:

    @Bob-Dig said in DDNS IPv6 Cloudflare:

    To bad, dnsomatic seems not to support ipv6 with cloudflare. So I am in need of a client for windows.
    When the IPv6 changes I will probably not notice it because I don't use IPv6... But some people ask, why IPv6 is not used, this is why!

    Why do you think IPv6 addresses will change? Unless your ISP screws up, your addresses are essentially static. It's only IPv4 you have to worry about.

    Like I said, my friends IPv6 changes all the time after each reboot of his router... Haven't watched mine.


  • LAYER 8 Global Moderator

    And what does your friends IPv6 address have to do with anything? What does it matter what their IP is?

    Them talking to you would prob always change - because they would be using one of the privacy IPs... That is not the IP you would serve up services with..

    What exactly are you trying to accomplish?? What do you want to happen - and why do you want it to be ipv6?

    If your wanting to serve up services - then you should be looking to make sure your IP doesn't change and use that/those IP(s).

    What are you and your friends trying to accomplish - play a game? what?



  • @johnpoz said in DDNS IPv6 Cloudflare:

    Who asks this? There is no actual need for IPv6 at this point in time... No matter how much jknott for it too be true...

    I recently linked to an article about how there are no longer ANY IPv4 addresses available in Europe and the Middle East. Suppose someone puts up a server there that's only on IPv6. How will you reach it if you only have IPv4? While you personally might not have such a need, there are many people who come from those regions who might want to do just that. Or perhaps you might want to contact some supplier based in Europe. How will you get to their web site, if it's IPv6 only?

    As I mentioned earlier, this IPv4 is good enough nonsense is just head in sand stupidity. We've been seeing problems caused by the lack of IPv4 addresses for many years and it will only get worse. The more people pretend IPv6 isn't needed, the longer it will take the world to switch over. In another thread here, there's a discussion about someone who's trying to connect to a hotel, when only CG NAT is available. What's your solution for him?



  • @Bob-Dig said in DDNS IPv6 Cloudflare:

    Like I said, my friends IPv6 changes all the time after each reboot of his router... Haven't watched mine.

    I thought we were talking about your pfSense firewall. Does it do that? What is your friend's router? PfSense can be configured to change the prefix too. Maybe that friend has something configured wrong.



  • @JKnott said in DDNS IPv6 Cloudflare:

    @Bob-Dig said in DDNS IPv6 Cloudflare:

    Like I said, my friends IPv6 changes all the time after each reboot of his router... Haven't watched mine.

    I thought we were talking about your pfSense firewall. Does it do that? What is your friend's router? PfSense can be configured to change the prefix too. Maybe that friend has something configured wrong.

    No, like I said before, he has a router called fritzbox. And what changes is not the temporary IP @johnpoz ! Even something in the first 4 parts changes (sorry my lag of knowledge and English). Anyway, I will look for a client that is working just to make sure IPv6 will work, even if I don't use it.


  • LAYER 8 Global Moderator

    @JKnott said in DDNS IPv6 Cloudflare:

    Suppose someone puts up a server there that's only on IPv6. How will you reach

    I have IPv6 - if I wanted to contact it... Which highly unlikely anyway...

    If it was some service that was to actually do something - then they would get IPv4... If not its not worth me needing to talk to..

    We have gone over this and over this... Until at some point some major player(s) goes only IPv6 the migration isn't going to gain any speed..

    You have a HUGE market were it would make sense and grab a whole lot of attention - and they can not even do that right... The biggest draw to get users to bitch to their isp about ipv6 is games... We have had IPv6 for how many years. It was going to be savior to head to head gaming.... Name 1 freaking game that gets IPv6 done correctly where I can play head to head agains you via just IPv6?



  • @johnpoz said in DDNS IPv6 Cloudflare:

    I have IPv6 - if I wanted to contact it... Which highly unlikely anyway...

    I know you do, but I was speaking in the general sense. There is a major phone company in Canada that's still IPv4 only. What if that supplier in Europe cannot get an IPv4 address? At the moment, he has to wait until someone has some surplus addresses to sell. We now have a world splitting in two, part IPv4 and part IPv6. On the other hand, the company I'm with provides IPv6 on both the cable and cell networks and with LTE, IPv6 only. My phone uses 464XLAT to access IPv4 sites. Other Canadian companies, both carrier and reseller, are managing to move to IPv6. Why not that phone company?

    As for games, I have no idea, as I don't play online games. However, I expect those issues are due to the mix of IPv4 and IPv6. There is nothing inherent in IPv6 that would prevent playing games over it. Also, didn't the XBox require IPv6 and used Teredo when it wasn't available?

    World IPv6 Lauch Day was June 6, 2012. That's over 7 years ago. My ISP was providing IPv6 back then, though not native. It used 6to4 and 6rd tunnels. but they were at least offering it. At that time, I was using a 6in4 tunnel, from another provider, and it worked fine.

    Like I said, head in sand stupid. Those who insist on sticking with IPv4 are holding up the rest of the world.



  • @JKnott I talk to you in this thread because it is already cluttered up. I hadn't set that option, because I didn't knew, if I needed it in the firs place. Now I set it, thanks, and I have to watch this in the future.

    Something different, in the Service DHCPv6 Server & RA I set up the DUID togehter with an hostname but no ip. There it says, if no IP is given, one will be dynamically allocated from the pool.
    But the end result always is, that there is no connection between an ip and the hostname (in DNS).

    So I guess I have to input an link-local ipv6 in the DNS (Unbound) to always have a functional DNS Setup for my LAN.



  • @Bob-Dig

    That's why I said to ensure it's set. Prior to that setting being available, all it took for my prefix to change is just disconnect/reconnect the WAN Ethernet cable.

    What setting are you referring to re DUID? I have never had to set anything like that.



  • @JKnott I was talking about
    ServicesDHCPv6 Server & RALANDHCPv6 Server

    Finally got it working, I had to use those IPv6s, which the PCs made up by themselves and not the ones from the DHCPv6 Server.

    Now the hostnames defined in the DHCP & DHCPv6 Server are automatically in DNS (unbound) and I can have the same Firewall-alias for IPv4 & v6.
    This also means, next time (?) the prefix changes, there is nothing to do in pfSense anymore, I only have to update my DNS-Provider.

    For that, I still don't have a solution, but I made up a "Dynamic DNS Client" with Cloudflare (v6) in pfSense for the LAN interface, then disabled this client. But those disabled Clients will still be checked by pfSense it seems, so I will see something red in the pfSense Dashboard, next time the prefix changes. โ˜บ



  • That was to quick, it is not possible to have the same Firewall alias (FQDN or hostname) for IPv4 & v6, is this a bug? โ˜น


Log in to reply