Delegating IPv6 networks to a downstream router

[jihartik]

Hi all!

I have a home/homelab setup with a pfSense box connected to Internet and Ubiquiti EdgeRouterX behind it as the homelab router. My ISP doesn't provide native IPv6, but instead uses 6rd. I have successfully configured pfSense to acquire global IPv6 addresses (/56 prefix) using 6rd and am able to get /64 networks to pfSense's LAN interfaces using "Track interface" as IPv6 Configuration Type. However, when configured as "track interface" the LAN interfaces only get /64 network and thus I can't delegate networks further down behind the EdgeRouter that is connected to one of them.

Is there any way to configure pfSense so that I'd be able to get e.g. /60 prefix to one of the tracking interfaces and then run DHCPv6 server on that delegating those networks further down?

[JKnott]

@jihartik

You should be able to configure routing so that whatever block you want goes to a specific address. I have done that here, to pass a /64 to a Cisco router. You'll have to specify a gateway and route on the routing page and also RA for that network. PfSense doesn't support providing DHCPv6-PD, so you have to do it with manual configuration.

IIRC, I also did this back when I was using a 6in4 tunnel and Linux for my firewall/router.

[jihartik]

@JKnott I see, thanks for the tip! That probably works, indeed.

The downside is that my static routes will become obsolete when my public IPv4 address (and thus IPv6 networks calculated based on that) change, right?

[JKnott]

@jihartik

Probably. Do your IPv4 addresses change often? My ISP originally provided 6to4 and 6rd, but I didn't use either as I had 6in4 from elsewhere. However, my IPv4 address was virtually static. DHCP addresses normally don't change, unless you aren't connected for longer than the lease time, unless you have a nasty ISP.

[JKnott]

@jihartik

One other possibility, some here use 6in4 from he.net to get a /48. That won't change with your IPv4 address.

[jihartik]

@JKnott Not too often (maybe once every 3-4 months), but often enough still that some kind automation would probably be needed.

It seems that it might indeed be easier to separate the IPv6 gateway to a separate Linux VM or use some other IPv6 provider having static IPv6 addresses.. Too bad, the 6rd with pfSense was so easy to set up. :)

[JKnott]

@jihartik

As I said, many here use he.net. It shouldn't be too hard to set up. Unlike with 6rd and 6to4, 6in4 prefixes are not tied to your IPv4 address. Just ask someone who uses it. I believe @johnpoz can help.

[johnpoz]

Yeah just use HE here, you can do anything you want with your /48.. Its just routed down your tunnel.. If you want to route part of that to a downstream, its as simple as creating the routes..

You can also then take that /48 with you if you change ISPs..

You could route a /56 to 1 downstream router, and a another /56 to a different one, etc. etc.

[felipescosta]

@johnpoz

Can you provide some more info about "as simple a creating the routes" to delegate ipv6 networks to downstream routers? I'm trying to but only /64 (RA) worked.

[johnpoz]

With HE the /48 is routed to you statically via your tunnel.

So lets say your /48 is 2001:0420:aaaa::/48

So via a tunnel network you create just route whatever you want to some downstream router..

You could take the first /64 out of the first /56 and use that as your tunnel
2001:0420:aaaa:0000::/64

Then route the 2nd /56 to downstream 2001:0420:aaaa:0100::/56

Then you can break that up in to /64's off that downstream router..

Does this help? This is really no different than routing in IPv4, just the networks are bigger and addresses are longer.. While yes lots and lots of stuff is different in IPv6 over IPv4.. When it comes to routing basics, its the same as IPv4..

[felipescosta]

@johnpoz It is what I'm trying to do with pfsense.

For example:
The first 2001:0420:aaaa::1/56 was set on LAN.

The others/56 was configured at RA.

But the router still got a /64.

[johnpoz]

You wouldn't use RA to delegate prefixes, you would use dhcpv6

[JKnott]

@johnpoz

Or manual config. I don't know that I'd want a router to rely on DHCP. I used manual config to connect to a Cisco router.

[johnpoz]

^Exactly - how I showed manually routing the /56 to a downstream router above ;) That his how I would do it as well.

[felipescosta]

@johnpoz

Config is done and working as expected.

Got a /48 from HE and /50 subnets to LAN.

DHCPv6 Server & RA (/56 to downstream CPEs)

RA

Tested with Android 8/9, Android TV 7.1.2, iOS 9.3.6, Windows 10, Arch Linux, OpenWRT, and some others Home Gateways.