pfsense IPV6 Issues with Comcast

  • Hello All,

    I'm a pfsense newbie. Comcast is my ISP. Before starting with pfsense recently , I have typically run a dual ipv4+ipv6 stack without issue on other software (like Openwrt).

    My pfsense box is set-up as follows:

    • One WAN interface
    • One LAN interface
    • 2 OPT interfaces (OPT1 and OPT2)

    I have no issues with ipv4, works just fine! I have DHCP client on WAN. On LAN, OPT1 and OPT2, I have a static RFC1918 IP and run a DHCP server on each of the interfaces. Each interface is a 192.168.x.x/24 subnet. Again, no issues here, works just fine!

    I'm trying to do the following with ipv6

    • DHCP6 client on WAN
    • Prefix delegation of /60 on WAN
    • Even though I have a /60 PD (more below), all I'm looking for is an ipv6 address for WAN and a /64 Prefix delegation from my ISP
    • With the /64 Prefix Delegation (PD), I plan to configure LAN, OPT1 and OPT2 with a static v6 IP, and run a DHCP6 server on each of the interfaces. Goal is to have a v6 subnet on each interface

    Below is my problem:

    • I'm unable to get an ipv6 address from my ISP for the WAN
    • I'm also unable to get the /64 prefix delegation

    I have tried the following to address the problem:

    • Changed the prefix delegation from /64 (original default) to /60 on my WAN interface page. I read on the net about folks having similar issues with comcast, and this was the supposed fix!
    • Made sure the firewall is not blocking icmpv6 on WAN
    • Rebooted my DOCSIS3 modem
    • Rebooted my pfsense router

    I'm still unable to get a WAN ipv6 address and a /64 PD from comcast!! What could be going on? What should I be doing different?

    Thanks much!

  • @pfsnsr

    You might try posting your config info, so we might have a clue about your configuration. For starters, have you enabled DHCPv6 on the WAN? Also, why do you want to use DHCPv6 on the LAN side. SLAAC works fine.

  • Netgate Administrator

    It may be they only give you the delegation, that's all you need really. You should be able to set the internal interfaces to track WAN and use /64s out of the /60 using different prefix IDs on each.

    Check the dhcp logs.


  • Thanks for the responses!

    I had a chance to play with this issue some more...

    I now have the following config on WAN:

    • dhcpv6 (I've always had this enabled, even during my previous post)
    • PD of 64

    Based on the responses I have set my WAN , OPT1 and OPT2 as follows:

    • Set all 3 to track WAN, with a prefix ID of 1,2 and 3 for LAN, OPT1 and OPT2 respectively

    There is some progress but still not fully configured for ipv6!

    When I look at my dhcp logs, specifically at dhcp6c entries, I see the following:

    • a /128 ipv6 address assigned to WAN
    • a /64 assigned to LAN, OPT1 and OPT2
    • However, my interfaces are still not configured with an ipv6 address!!

    The last 2 lines of the dhcp6c logs are as follows:

    • "failed initialize control message authentication"
    • "failed to open /usr/local/etc/dhcp6cctlkey: No such file or directory"

    The last 2 lines appear to be error messages. Any ideas of what this could actually mean? Is it looking for a authentication key or a key file? What could be going on?

    Appreciate your inputs- Thanks again!

  • @pfsnsr said in pfsense IPV6 Issues with Comcast:


    /root: ls /usr/local/etc/dhcp6cctlkey
    ls: /usr/local/etc/dhcp6cctlkey: No such file or directory

  • Netgate Administrator

    If you're assigning v6 subnets to the internal interfaces your PD from Commcast needs to be at least /60.
    /64 is one subnet in v6 land.

    /128 is fine for a single interface on WAN they can route your PD to but if that's only a /64 it can only be on one internal interface.


Log in to reply