Subneting my /56 prefix to multiple internal LANs


  • Hello,

    I'm facing some issues on getting IPv6 working as I want it to work.

    pfSense v2.4.5-p1 virtualized (2 x Intel NIC passthrough from) on a Proxmox v6.2-16 host.

    ISP is Orange (France) giving me a /56 prefix.

    What I've done :

    • WAN : to my bridged modem

      • General Configuration
        • IPv6 Configuration Type: DHCP6 (adv_dhcp6_config_advanced)
      • DHCP6 Client Configuration
        • Options
          • Advanced Configuration (I have to send raw-option 11 to authenticate with the ISP)
        • By reading the code in /etc/inc/interfaces.inc it looks like the 2 next options are useless since the Advanced Configuration option is checked
          • Request only an IPv6 prefix : yes (dhcp6prefixonly)
          • DHCPv6 Prefix Delegation size : 56 (dhcp6-ia-pd-len = 8)
      • Advanced DHCP6 Client Configuration
        • Send options
          • ia-pd 0
          • raw-option 15 (user class)
          • raw-option 16 (vendor class)
          • raw-option 6 (option request 11 - authentication, 17 - vendor-specific information, 23 - DNS recursive name server, 24 - domain search list)
          • raw-option 11 (authenticate with ISP)
        • Identity Association Statement
          • Prefix Delegation : yes (adv_dhcp6_id_assoc_statement_prefix_enable)
          • id-assoc pd ID : 0 (adv_dhcp6_id_assoc_statement_prefix_id)
          • IPv6 prefix : ::/56 (adv_dhcp6_id_assoc_statement_prefix)
          • pltime : infinity (adv_dhcp6_id_assoc_statement_prefix_pltime)
        • Prefix interface statement
          • Prefix Interface sla-id : 0 (adv_dhcp6_prefix_interface_statement_sla_id)
          • sla-len : 8 (adv_dhcp6_prefix_interface_statement_sla_len)
        • Prefix Interface : WAN (adv_dhcp6_prefix_selected_interface)
    • LAN1

      • General Configuration
        • IPv6 Configuration Type : Static IPv6 (type6)
      • Static IPv6 Configuration
        • IPv6 address : 2a01:aaaa:bbbb:1::1/64 (ipaddrv6/subnetv6)
    • LAN2

      • General Configuration
        • IPv6 Configuration Type : Static IPv6 (type6)
      • Static IPv6 Configuration
        • IPv6 address : 2a01:aaaa:bbbb:2::1/64 (ipaddrv6/subnetv6)

    With this, clients on the LAN1, LAN2, ... side are given their IPv6 address with SLAAC : fine !

    Subnets can be from 2a01:aaaa:bbbb:0000::/64 to 2a01:aaaa:bbbb:00ff::/64 without any issue.

    My issues come when I wanted to get rid of writing down the prefix for each LAN interfaces : I tried to switch IPv6 Configuration Type to Track Interface WAN.

    I was thinking the WAN interface was getting the full /56 prefix and then each internal interfaces will be getting it's own /64 subnet from it (just have to set prefix ID between 0 and FF) : wrong, my clients wont get an IP anymore 😬

    There is something I do wrong... but what ?

    I've read the code for the Track Interface option and I've seen that, if the WAN interface is not itself setup with the option "track6-interface" nothing will happen.

    function interface_track6_configure($interface = "lan", $wancfg, $linkupevent = false) {
    	[...]
    	/* If the interface is not configured via another, exit */
    	if (empty($wancfg['track6-interface'])) {
    		return;
    	}
    	[...]
    }
    

    The interface_track6_configure function is called each time you set an interface as "track6" and it looks like it's checking if the WAN interface is also tracking another interface 😳

    Do I have to set the /56 prefix on another interface than WAN and then make the WAN interface track it ?

    What would be the configuration like if I want to give each of my LANs a /64 prefix that can feed their clients with SLAAC ?

    Thanks for reading me, sorry if something is not clear enough, maybe someone can help me getting this to work 🙏


  • I have my prefix size on the WAN interface as /56 and I set the LAN interfaces to the prefix ID and IPv6 interface to WAN. However, I think your problem is you selected static for IPv6 configuration type, when you should be using track interface. This tells pfsense to use the selected /64 for that LAN. Also, I don't use the DHCP6 client advanced options at all. Do you need them for your ISP?


  • @JKnott said in Subneting my /56 prefix to multiple internal LANs:

    I have my prefix size on the WAN interface as /56 and I set the LAN interfaces to the prefix ID and IPv6 interface to WAN. However, I think your problem is you selected static for IPv6 configuration type, when you should be using track interface. This tells pfsense to use the selected /64 for that LAN.

    I can't get it to work when selecting "Track Interface" on the LAN interfaces...

    @JKnott said in Subneting my /56 prefix to multiple internal LANs:

    Also, I don't use the DHCP6 client advanced options at all. Do you need them for your ISP?

    Yes I need to send some raw-options to authenticate with the ISP so I need to use Advanced Configuration.

    But it looks like using Advanced Configuration get to some features ignored.


  • What is the "best practice" for delegating a /56 subnet on a pfSense router ?

    The WAN interface is the one doing the DHCP6C stuff to retrieve the /56 prefix from ISP. Can we say "the /56 prefix is on the WAN interface (without assigning it any IPv6 as it would burn out a /64 for nothing...)" ?

    Does DHCP6C needs to know how to give /64 subnets to each LAN side interfaces ?

    Does DHCP6C knows how to give a /64 prefix to an interface because that interface is in "Configuration type" = "Track Interface WAN + <prefix ID>" ?

    If yes then pfSense might add to the "/var/etc/dhcp6c_<iface>.conf" file something like :

    prefix-interface <iface> {
            sla-id 0;
            sla-len 8;
    };
    

    in the "id-assoc pd" statement ?


  • @Dough29

    Actually, the WAN address likely has nothing to do with the prefix. When pfsense receives the prefix it's available for use on the LANs. This is done with the prefix ID on each LAN interface. With a /56, the choices range from 0 to ff, with each being used only once. I try to arrange things so that numbers match up. For example my IPv4 NAT addresses are in the 172.16.0.0 block, with the 3 octet matching the prefix ID. So, my main LAN has prefix ID 0 and 3rd octet 0. My guest WiFi is on ID 3 and octet 3. Further since it uses a VLAN to carry the 2nd SSID to the AP, it uses VLAN 3. Etc..


  • Ok, by the way how do we know pfSense successfully received to prefix on the WAN interface ?

    Doesn't pfSense have to write something in the "/var/etc/dhcp6c_wan.conf" file ?

    In this file for now I have :

    interface em0 {
    	send ia-pd 0;
    	send raw-option 15 00:2b:46:53:56:44:53:4c:5f:6c:69:76:65:62:6f:78:2e:49:6e:74:65:72:6e:65:74:2e:73:6f:66:74:61:74:68:6f:6d:65:2e:6c:69:76:65:62:6f:78:33;
    	send raw-option 16 00:00:04:0e:00:05:73:61:67:65:6d;
    	send raw-option 6 00:0b:00:11:00:17:00:18;
    	send raw-option 11 00:00:00:00:[...]:00:00:00:00;
    	script "/var/etc/dhcp6c_wan_script.sh";
    };
    id-assoc pd 0 { 
    	prefix ::/56 infinity;
    };
    
    • em0 is my WAN interface
    • option 15 is user class (Livebox Internet for Orange french ISP)
    • option 16 is vendor class (Sagem for Orange french ISP)
    • option 6 is option request
      • 11 authentication
      • 17 vendor-specific information
      • 23 DNS recursive name server
      • 24 domaine search list
    • option 11 is authentication

    With this I have IPv6 working ONLY if I manually set a static IPv6 /64 subnet on the LAN interfaces... If I set it to "Track - WAN - Interface" the LAN interfaces never get an IPv6 /64 subnet...


  • @Dough29 said in Subneting my /56 prefix to multiple internal LANs:

    With this I have IPv6 working ONLY if I manually set a static IPv6 /64 subnet on the LAN interfaces... If I set it to "Track - WAN - Interface" the LAN interfaces never get an IPv6 /64 subnet...

    It sounds like there may be something weird with Orange. I have no experience with them.


  • Does the content of file "/var/etc/dhcp6c_wan.conf" looks good for you if I have :

    • WAN (em0) in DHCP6 mode
    • LAN (em1) in Track Interface WAN prefix ID 1
    • OP1 (em1.10) in Track Interface WAN prefix ID 10
    • OPT2 (em1.20) in Track Interface WAN prefix ID 20

    ?

    In DHCP6C logs I can the the prefix retrieved :

    Dec 1 21:07:14 	dhcp6c 	23909 	send solicit to ff02::1:2%em0
    Dec 1 21:07:14 	dhcp6c 	23909 	freeing op data at 0x800e732d0
    Dec 1 21:07:14 	dhcp6c 	23909 	freeing op data at 0x800e1f040
    Dec 1 21:07:14 	dhcp6c 	23909 	freeing op data at 0x800e15048
    Dec 1 21:07:14 	dhcp6c 	23909 	freeing op data at 0x800e28050
    Dec 1 21:07:14 	dhcp6c 	23909 	reset a timer on em0, state=SOLICIT, timeo=0, retrans=1004
    Dec 1 21:07:15 	dhcp6c 	23909 	receive advertise from fe80::ba0:bab%em0 on em0
    Dec 1 21:07:15 	dhcp6c 	23909 	get DHCP option IA_PD, len 41
    Dec 1 21:07:15 	dhcp6c 	23909 	IA_PD: ID=0, T1=89310, T2=207360
    Dec 1 21:07:15 	dhcp6c 	23909 	get DHCP option IA_PD prefix, len 25
    Dec 1 21:07:15 	dhcp6c 	23909 	IA_PD prefix: 2a01:aaaa:bbbb::/56 pltime=259200 vltime=259200
    Dec 1 21:07:15 	dhcp6c 	23909 	get DHCP option server ID, len 20
    Dec 1 21:07:15 	dhcp6c 	23909 	DUID: 00:02:00:00:05:58:44:45:53:48:41:59:45:53:53:55:44:52:4f:54
    Dec 1 21:07:15 	dhcp6c 	23909 	get DHCP option client ID, len 14
    Dec 1 21:07:15 	dhcp6c 	23909 	DUID: 00:01:00:01:27:56:36:8a:00:1b:21:32:24:45
    Dec 1 21:07:15 	dhcp6c 	23909 	get DHCP option authentication, len 27
    Dec 1 21:07:15 	dhcp6c 	23909 	proto: unknown(0), alg: unknown(0), RDM: mono counter, RD: 0000 0000 0000 0000
    Dec 1 21:07:15 	dhcp6c 	23909 	Discarding null authentication
    Dec 1 21:07:15 	dhcp6c 	23909 	get DHCP option preference, len 1
    Dec 1 21:07:15 	dhcp6c 	23909 	preference: 255
    Dec 1 21:07:15 	dhcp6c 	23909 	server ID: 00:02:00:00:05:58:44:45:53:48:41:59:45:53:53:55:44:52:4f:54, pref=255
    Dec 1 21:07:15 	dhcp6c 	23909 	Sending Request
    Dec 1 21:07:15 	dhcp6c 	23909 	a new XID (b2fff3) is generated
    Dec 1 21:07:15 	dhcp6c 	23909 	set client ID (len 14)
    Dec 1 21:07:15 	dhcp6c 	23909 	set server ID (len 20)
    Dec 1 21:07:15 	dhcp6c 	23909 	set elapsed time (len 2)
    Dec 1 21:07:15 	dhcp6c 	23909 	set IA_PD prefix
    Dec 1 21:07:15 	dhcp6c 	23909 	set IA_PD
    Dec 1 21:07:15 	dhcp6c 	23909 	raw option 15 length 45 at 0x800e73240
    Dec 1 21:07:15 	dhcp6c 	23909 	set user class (len 45)
    Dec 1 21:07:15 	dhcp6c 	23909 	raw option 16 length 11 at 0x800e73270
    Dec 1 21:07:15 	dhcp6c 	23909 	set vendor class (len 11)
    Dec 1 21:07:15 	dhcp6c 	23909 	raw option 6 length 8 at 0x800e732a0
    Dec 1 21:07:15 	dhcp6c 	23909 	set option request (len 8)
    Dec 1 21:07:15 	dhcp6c 	23909 	raw option 11 length 70 at 0x800e732d0
    Dec 1 21:07:15 	dhcp6c 	23909 	set authentication (len 70)
    Dec 1 21:07:15 	dhcp6c 	23909 	send request to ff02::1:2%em0
    Dec 1 21:07:15 	dhcp6c 	23909 	freeing op data at 0x800e73210
    Dec 1 21:07:15 	dhcp6c 	23909 	freeing op data at 0x800e1f060
    Dec 1 21:07:15 	dhcp6c 	23909 	freeing op data at 0x800e15048
    Dec 1 21:07:15 	dhcp6c 	23909 	freeing op data at 0x800e28320
    Dec 1 21:07:15 	dhcp6c 	23909 	reset a timer on em0, state=REQUEST, timeo=0, retrans=924
    Dec 1 21:07:15 	dhcp6c 	23909 	receive reply from fe80::ba0:bab%em0 on em0
    Dec 1 21:07:15 	dhcp6c 	23909 	get DHCP option IA_PD, len 41
    Dec 1 21:07:15 	dhcp6c 	23909 	IA_PD: ID=0, T1=84771, T2=207360
    Dec 1 21:07:15 	dhcp6c 	23909 	get DHCP option IA_PD prefix, len 25
    Dec 1 21:07:15 	dhcp6c 	23909 	IA_PD prefix: 2a01:aaaa:bbbb::/56 pltime=259200 vltime=259200
    Dec 1 21:07:15 	dhcp6c 	23909 	get DHCP option server ID, len 20
    Dec 1 21:07:15 	dhcp6c 	23909 	DUID: 00:02:00:00:05:58:44:45:53:48:41:59:45:53:53:55:44:52:4f:54
    Dec 1 21:07:15 	dhcp6c 	23909 	get DHCP option client ID, len 14
    Dec 1 21:07:15 	dhcp6c 	23909 	DUID: 00:01:00:01:27:56:36:8a:00:1b:21:32:24:45
    Dec 1 21:07:15 	dhcp6c 	23909 	get DHCP option authentication, len 27
    Dec 1 21:07:15 	dhcp6c 	23909 	proto: unknown(0), alg: unknown(0), RDM: mono counter, RD: 0000 0000 0000 0000
    Dec 1 21:07:15 	dhcp6c 	23909 	Discarding null authentication
    Dec 1 21:07:15 	dhcp6c 	23909 	dhcp6c Received REQUEST
    Dec 1 21:07:15 	dhcp6c 	23909 	make an IA: PD-0
    Dec 1 21:07:15 	dhcp6c 	23909 	create a prefix 2a01:aaaa:bbbb::/56 pltime=140733193647232, vltime=140733193647232
    Dec 1 21:07:15 	dhcp6c 	23909 	executes /var/etc/dhcp6c_wan_script.sh
    Dec 1 21:07:19 	dhcp6c 	23909 	script "/var/etc/dhcp6c_wan_script.sh" terminated
    Dec 1 21:07:19 	dhcp6c 	23909 	removing an event on em0, state=REQUEST
    Dec 1 21:07:19 	dhcp6c 	23909 	removing server (ID: 00:02:00:00:05:58:44:45:53:48:41:59:45:53:53:55:44:52:4f:54)
    Dec 1 21:07:19 	dhcp6c 	23909 	got an expected reply, sleeping. 
    

  • Mine looks nothing like that. I have a shell script.

    more /var/etc/dhcp6c_wan.conf
    interface em0 {
    send ia-na 0; # request stateful address
    send ia-pd 0; # request prefix delegation
    request domain-name-servers;
    request domain-name;
    script "/var/etc/dhcp6c_wan_script.sh"; # we'd like some nameservers please
    };
    id-assoc na 0 { };
    id-assoc pd 0 {
    prefix ::/56 infinity;
    prefix-interface bge0 {
    sla-id 0;
    sla-len 8;
    };
    prefix-interface bge0.3 {
    sla-id 3;
    sla-len 8;
    };
    prefix-interface re0 {
    sla-id 4;
    sla-len 8;
    };
    };


  • As I can see I'm missing the "prefix-interface" statements in "id-assoc pd"...

    Looks like when you check the "Advanced configuration" you are loosing the "Track Interface" configuration from all LAN interfaces...

    With my ISP I can't do without using the "Advanced" option...


  • @Dough29 said in Subneting my /56 prefix to multiple internal LANs:

    ISP is Orange (France) giving me a /56 prefix.

    Oh, men, you have my attention here.

    I tell you up front that the most persistent phrase in this thread is, up until now :

    @JKnott said in Subneting my /56 prefix to multiple internal LANs:

    It sounds like there may be something weird with Orange.

    @JKnott : you're not even close. But heading in the right direction.

    First things first : I'm not an IPv6 expert.

    I 'own and maintain' 2 Orange Internet connections in France, using a Livebox Pro v4 at work, and a Livebox 4 at home.

    The Pro box is really pro : no IPv6 what so ever.
    The only pro thing about it that my IPv4 is static (I guess, it never changes). The pro is more expensive. Dono why.
    I do not use TV or phone equipment. Neither the build in Wifi.
    Just the VDSL (modem) part.

    At home, because if live in the middle of no-where : just ADSL. I don't use the (VOIP) phone neither TV neither Wifi of this Livebox v4 router.
    This one has IPv6 capabilities.
    From what I know : they do somewhat reserve a /56 or even a /48 (?) for the connection/livebox but they only assign the first /64 to the LAN.
    No other /64 blocks can be accessed / routed / passed on to a more qualified downstream router (pfSense).

    edit : I think they allocate a /56 for everybody, which is fine, although a /48 is more standard. Still, they only support a (one !) routed /64.

    I have a privileged access to their support system but even after a decade or two ( !!) of asking, they still consider that a single /64 is - I quote :
    " more then enough as 2^64 is huge".
    Don't laugh.

    When I explain I have multiple LANs, things get quiet.
    I already understood, for a home set-up, I'm asking to much.
    But wait : they sell also "professional connections" - I use one of those. These are 'one LAN' only, also. Just put a router behind our router, this is where pfSense comes into play here, and "you'll be fine !"
    Me : "Right, guys, that IPv4 question - more then one network - has been solved at the end of the last century. Now I'm talking about multiple IPv6 networks ...."

    @Dough29 said in Subneting my /56 prefix to multiple internal LANs:

    What is the "best practice" for delegating a /56 subnet on a pfSense router ?

    As said, I'm using right now a /48.
    Works as the books stated : cut out a /64, assign it to an LAN type interface - set up a DHCPD IPv6 pool and done.
    At least, tunnel.he.net works that way. he.net, as they said, uses the related RFCs, no other things have to be invented.

    Ones in a while I 'scan' the news the french blogs/messages/forums about IPv6 in France, and how to do it will Orange (I know others like Free are doing more for IPv6)
    For that matter : The Openone (cloned from pfSense years ago), being based in Europe, is more aware of this subject.
    It is possible to use the IPv6 from Orange using pfSense, with the "send raw-option" stuff you mentioned above.
    What I understood : start a vanilla FreeBSD 11.2 VM, install the tools for make / compile / link and patch dhcp6d. Use this binary to replace the existing one.
    As far as I know, thing won't go better as obtaining a single /64 out of Orange.
    It's a 'prefix 0', and that's it.

    Don't forget that the Orange boxes (Livebox) have only one physical LAN port (and a 5 port switch put in front of it), thus using one IPv4 network.
    Asking for more then one /64 doesn't make sense for that box.

    Using your own modem ? That was accepted back then. Totally not supported to day.
    I also think their VDSL is proprietary (partially RFC).
    And look at the way they handle DHCP6 ! ( I guess they have their reasons).

    @Dough29 said in Subneting my /56 prefix to multiple internal LANs:

    WAN : to my bridged modem

    What is this device ?
    I could consider to go back to a modem type - pppoe is crap, but all I need, as long as fibre isn't there yet.

    Btw : I'm really hoping that I'm completely wrong here.


  • @Gertjan thank you for all these informations !

    I also don't use the TV or Voice over IP services.

    My line is VDSL2 (Sosh), I have fixed IPv4 (for now it never changed / DHCPv4 in pfSense) behind a Netgear DM200 modem in bridge mode, custom firmware : https://github.com/dough29/openwrt-netgear-dm200-bridge

    I can use the whole /56 prefix Orange gives me (see DHCP6C log / 2a01:aaaa:bbbb:0::/64 to 2a01:aaaa:bbbb:ff::/64) and expose services without any problem....


  • It's me thanking you !

    So, I can put that ISP router (livebox) where it belongs : in it's box - and use some other device like the "Netgear DM200" that supports VDSL2 - Orange - Sosh is for me the same thing as Orange btw.
    Good news !

    @Dough29 said in Subneting my /56 prefix to multiple internal LANs:

    I can use the whole /56 prefix Orange gives me

    But you have to hard code the LAB's with /64 networks.
    What happens if Orange decides to change the IPv6 prefix ?? (answer : all your IPv6 will break and you have to redo the static settings. That would be a definite show stopper).

    I understand why you want tracking to work.


  • Yep the Livebox is in it's box since the day I received it, never opened the parcel 🤣

    For now, from pfSense WEB UI, I have to put each LAN in "Static IPv6" and give it a 2a01:aaaa:bbbb:<prefix ID>::/64 subnet by hand...

    So you are right, tomorrow if the prefix changes... everything will break !

    To solve that I was thinking the "Track Interface" feature will do the job but it seems to be broken when using DHCP6C in "Advanced Configuration" on the WAN side...