Subneting my /56 prefix to multiple internal LANs
-
What is the "best practice" for delegating a /56 subnet on a pfSense router ?
The WAN interface is the one doing the DHCP6C stuff to retrieve the /56 prefix from ISP. Can we say "the /56 prefix is on the WAN interface (without assigning it any IPv6 as it would burn out a /64 for nothing...)" ?
Does DHCP6C needs to know how to give /64 subnets to each LAN side interfaces ?
Does DHCP6C knows how to give a /64 prefix to an interface because that interface is in "Configuration type" = "Track Interface WAN + <prefix ID>" ?
If yes then pfSense might add to the "/var/etc/dhcp6c_<iface>.conf" file something like :
prefix-interface <iface> { sla-id 0; sla-len 8; };in the "id-assoc pd" statement ?
-
Actually, the WAN address likely has nothing to do with the prefix. When pfsense receives the prefix it's available for use on the LANs. This is done with the prefix ID on each LAN interface. With a /56, the choices range from 0 to ff, with each being used only once. I try to arrange things so that numbers match up. For example my IPv4 NAT addresses are in the 172.16.0.0 block, with the 3 octet matching the prefix ID. So, my main LAN has prefix ID 0 and 3rd octet 0. My guest WiFi is on ID 3 and octet 3. Further since it uses a VLAN to carry the 2nd SSID to the AP, it uses VLAN 3. Etc..
-
Ok, by the way how do we know pfSense successfully received to prefix on the WAN interface ?
Doesn't pfSense have to write something in the "/var/etc/dhcp6c_wan.conf" file ?
In this file for now I have :
interface em0 { send ia-pd 0; send raw-option 15 00:2b:46:53:56:44:53:4c:5f:6c:69:76:65:62:6f:78:2e:49:6e:74:65:72:6e:65:74:2e:73:6f:66:74:61:74:68:6f:6d:65:2e:6c:69:76:65:62:6f:78:33; send raw-option 16 00:00:04:0e:00:05:73:61:67:65:6d; send raw-option 6 00:0b:00:11:00:17:00:18; send raw-option 11 00:00:00:00:[...]:00:00:00:00; script "/var/etc/dhcp6c_wan_script.sh"; }; id-assoc pd 0 { prefix ::/56 infinity; };- em0 is my WAN interface
- option 15 is user class (Livebox Internet for Orange french ISP)
- option 16 is vendor class (Sagem for Orange french ISP)
- option 6 is option request
- 11 authentication
- 17 vendor-specific information
- 23 DNS recursive name server
- 24 domaine search list
- option 11 is authentication
With this I have IPv6 working ONLY if I manually set a static IPv6 /64 subnet on the LAN interfaces... If I set it to "Track - WAN - Interface" the LAN interfaces never get an IPv6 /64 subnet...
-
@Dough29 said in Subneting my /56 prefix to multiple internal LANs:
With this I have IPv6 working ONLY if I manually set a static IPv6 /64 subnet on the LAN interfaces... If I set it to "Track - WAN - Interface" the LAN interfaces never get an IPv6 /64 subnet...
It sounds like there may be something weird with Orange. I have no experience with them.
-
Does the content of file "/var/etc/dhcp6c_wan.conf" looks good for you if I have :
- WAN (em0) in DHCP6 mode
- LAN (em1) in Track Interface WAN prefix ID 1
- OP1 (em1.10) in Track Interface WAN prefix ID 10
- OPT2 (em1.20) in Track Interface WAN prefix ID 20
?
In DHCP6C logs I can the the prefix retrieved :
Dec 1 21:07:14 dhcp6c 23909 send solicit to ff02::1:2%em0 Dec 1 21:07:14 dhcp6c 23909 freeing op data at 0x800e732d0 Dec 1 21:07:14 dhcp6c 23909 freeing op data at 0x800e1f040 Dec 1 21:07:14 dhcp6c 23909 freeing op data at 0x800e15048 Dec 1 21:07:14 dhcp6c 23909 freeing op data at 0x800e28050 Dec 1 21:07:14 dhcp6c 23909 reset a timer on em0, state=SOLICIT, timeo=0, retrans=1004 Dec 1 21:07:15 dhcp6c 23909 receive advertise from fe80::ba0:bab%em0 on em0 Dec 1 21:07:15 dhcp6c 23909 get DHCP option IA_PD, len 41 Dec 1 21:07:15 dhcp6c 23909 IA_PD: ID=0, T1=89310, T2=207360 Dec 1 21:07:15 dhcp6c 23909 get DHCP option IA_PD prefix, len 25 Dec 1 21:07:15 dhcp6c 23909 IA_PD prefix: 2a01:aaaa:bbbb::/56 pltime=259200 vltime=259200 Dec 1 21:07:15 dhcp6c 23909 get DHCP option server ID, len 20 Dec 1 21:07:15 dhcp6c 23909 DUID: 00:02:00:00:05:58:44:45:53:48:41:59:45:53:53:55:44:52:4f:54 Dec 1 21:07:15 dhcp6c 23909 get DHCP option client ID, len 14 Dec 1 21:07:15 dhcp6c 23909 DUID: 00:01:00:01:27:56:36:8a:00:1b:21:32:24:45 Dec 1 21:07:15 dhcp6c 23909 get DHCP option authentication, len 27 Dec 1 21:07:15 dhcp6c 23909 proto: unknown(0), alg: unknown(0), RDM: mono counter, RD: 0000 0000 0000 0000 Dec 1 21:07:15 dhcp6c 23909 Discarding null authentication Dec 1 21:07:15 dhcp6c 23909 get DHCP option preference, len 1 Dec 1 21:07:15 dhcp6c 23909 preference: 255 Dec 1 21:07:15 dhcp6c 23909 server ID: 00:02:00:00:05:58:44:45:53:48:41:59:45:53:53:55:44:52:4f:54, pref=255 Dec 1 21:07:15 dhcp6c 23909 Sending Request Dec 1 21:07:15 dhcp6c 23909 a new XID (b2fff3) is generated Dec 1 21:07:15 dhcp6c 23909 set client ID (len 14) Dec 1 21:07:15 dhcp6c 23909 set server ID (len 20) Dec 1 21:07:15 dhcp6c 23909 set elapsed time (len 2) Dec 1 21:07:15 dhcp6c 23909 set IA_PD prefix Dec 1 21:07:15 dhcp6c 23909 set IA_PD Dec 1 21:07:15 dhcp6c 23909 raw option 15 length 45 at 0x800e73240 Dec 1 21:07:15 dhcp6c 23909 set user class (len 45) Dec 1 21:07:15 dhcp6c 23909 raw option 16 length 11 at 0x800e73270 Dec 1 21:07:15 dhcp6c 23909 set vendor class (len 11) Dec 1 21:07:15 dhcp6c 23909 raw option 6 length 8 at 0x800e732a0 Dec 1 21:07:15 dhcp6c 23909 set option request (len 8) Dec 1 21:07:15 dhcp6c 23909 raw option 11 length 70 at 0x800e732d0 Dec 1 21:07:15 dhcp6c 23909 set authentication (len 70) Dec 1 21:07:15 dhcp6c 23909 send request to ff02::1:2%em0 Dec 1 21:07:15 dhcp6c 23909 freeing op data at 0x800e73210 Dec 1 21:07:15 dhcp6c 23909 freeing op data at 0x800e1f060 Dec 1 21:07:15 dhcp6c 23909 freeing op data at 0x800e15048 Dec 1 21:07:15 dhcp6c 23909 freeing op data at 0x800e28320 Dec 1 21:07:15 dhcp6c 23909 reset a timer on em0, state=REQUEST, timeo=0, retrans=924 Dec 1 21:07:15 dhcp6c 23909 receive reply from fe80::ba0:bab%em0 on em0 Dec 1 21:07:15 dhcp6c 23909 get DHCP option IA_PD, len 41 Dec 1 21:07:15 dhcp6c 23909 IA_PD: ID=0, T1=84771, T2=207360 Dec 1 21:07:15 dhcp6c 23909 get DHCP option IA_PD prefix, len 25 Dec 1 21:07:15 dhcp6c 23909 IA_PD prefix: 2a01:aaaa:bbbb::/56 pltime=259200 vltime=259200 Dec 1 21:07:15 dhcp6c 23909 get DHCP option server ID, len 20 Dec 1 21:07:15 dhcp6c 23909 DUID: 00:02:00:00:05:58:44:45:53:48:41:59:45:53:53:55:44:52:4f:54 Dec 1 21:07:15 dhcp6c 23909 get DHCP option client ID, len 14 Dec 1 21:07:15 dhcp6c 23909 DUID: 00:01:00:01:27:56:36:8a:00:1b:21:32:24:45 Dec 1 21:07:15 dhcp6c 23909 get DHCP option authentication, len 27 Dec 1 21:07:15 dhcp6c 23909 proto: unknown(0), alg: unknown(0), RDM: mono counter, RD: 0000 0000 0000 0000 Dec 1 21:07:15 dhcp6c 23909 Discarding null authentication Dec 1 21:07:15 dhcp6c 23909 dhcp6c Received REQUEST Dec 1 21:07:15 dhcp6c 23909 make an IA: PD-0 Dec 1 21:07:15 dhcp6c 23909 create a prefix 2a01:aaaa:bbbb::/56 pltime=140733193647232, vltime=140733193647232 Dec 1 21:07:15 dhcp6c 23909 executes /var/etc/dhcp6c_wan_script.sh Dec 1 21:07:19 dhcp6c 23909 script "/var/etc/dhcp6c_wan_script.sh" terminated Dec 1 21:07:19 dhcp6c 23909 removing an event on em0, state=REQUEST Dec 1 21:07:19 dhcp6c 23909 removing server (ID: 00:02:00:00:05:58:44:45:53:48:41:59:45:53:53:55:44:52:4f:54) Dec 1 21:07:19 dhcp6c 23909 got an expected reply, sleeping. -
Mine looks nothing like that. I have a shell script.
more /var/etc/dhcp6c_wan.conf
interface em0 {
send ia-na 0; # request stateful address
send ia-pd 0; # request prefix delegation
request domain-name-servers;
request domain-name;
script "/var/etc/dhcp6c_wan_script.sh"; # we'd like some nameservers please
};
id-assoc na 0 { };
id-assoc pd 0 {
prefix ::/56 infinity;
prefix-interface bge0 {
sla-id 0;
sla-len 8;
};
prefix-interface bge0.3 {
sla-id 3;
sla-len 8;
};
prefix-interface re0 {
sla-id 4;
sla-len 8;
};
}; -
As I can see I'm missing the "prefix-interface" statements in "id-assoc pd"...
Looks like when you check the "Advanced configuration" you are loosing the "Track Interface" configuration from all LAN interfaces...
With my ISP I can't do without using the "Advanced" option...
-
@Dough29 said in Subneting my /56 prefix to multiple internal LANs:
ISP is Orange (France) giving me a /56 prefix.
Oh, men, you have my attention here.
I tell you up front that the most persistent phrase in this thread is, up until now :
@JKnott said in Subneting my /56 prefix to multiple internal LANs:
It sounds like there may be something weird with Orange.
@JKnott : you're not even close. But heading in the right direction.
First things first : I'm not an IPv6 expert.
I 'own and maintain' 2 Orange Internet connections in France, using a Livebox Pro v4 at work, and a Livebox 4 at home.
The Pro box is really pro : no IPv6 what so ever.
The only pro thing about it that my IPv4 is static (I guess, it never changes). The pro is more expensive. Dono why.
I do not use TV or phone equipment. Neither the build in Wifi.
Just the VDSL (modem) part.At home, because if live in the middle of no-where : just ADSL. I don't use the (VOIP) phone neither TV neither Wifi of this Livebox v4 router.
This one has IPv6 capabilities.
From what I know : they do somewhat reserve a /56 or even a /48 (?) for the connection/livebox but they only assign the first /64 to the LAN.
No other /64 blocks can be accessed / routed / passed on to a more qualified downstream router (pfSense).edit : I think they allocate a /56 for everybody, which is fine, although a /48 is more standard. Still, they only support a (one !) routed /64.
I have a privileged access to their support system but even after a decade or two ( !!) of asking, they still consider that a single /64 is - I quote :
" more then enough as 2^64 is huge".
Don't laugh.When I explain I have multiple LANs, things get quiet.
I already understood, for a home set-up, I'm asking to much.
But wait : they sell also "professional connections" - I use one of those. These are 'one LAN' only, also. Just put a router behind our router, this is where pfSense comes into play here, and "you'll be fine !"
Me : "Right, guys, that IPv4 question - more then one network - has been solved at the end of the last century. Now I'm talking about multiple IPv6 networks ...."@Dough29 said in Subneting my /56 prefix to multiple internal LANs:
What is the "best practice" for delegating a /56 subnet on a pfSense router ?
As said, I'm using right now a /48.
Works as the books stated : cut out a /64, assign it to an LAN type interface - set up a DHCPD IPv6 pool and done.
At least, tunnel.he.net works that way. he.net, as they said, uses the related RFCs, no other things have to be invented.Ones in a while I 'scan' the news the french blogs/messages/forums about IPv6 in France, and how to do it will Orange (I know others like Free are doing more for IPv6)
For that matter : The Openone (cloned from pfSense years ago), being based in Europe, is more aware of this subject.
It is possible to use the IPv6 from Orange using pfSense, with the "send raw-option" stuff you mentioned above.
What I understood : start a vanilla FreeBSD 11.2 VM, install the tools for make / compile / link and patch dhcp6d. Use this binary to replace the existing one.
As far as I know, thing won't go better as obtaining a single /64 out of Orange.
It's a 'prefix 0', and that's it.Don't forget that the Orange boxes (Livebox) have only one physical LAN port (and a 5 port switch put in front of it), thus using one IPv4 network.
Asking for more then one /64 doesn't make sense for that box.Using your own modem ? That was accepted back then. Totally not supported to day.
I also think their VDSL is proprietary (partially RFC).
And look at the way they handle DHCP6 ! ( I guess they have their reasons).@Dough29 said in Subneting my /56 prefix to multiple internal LANs:
WAN : to my bridged modem
What is this device ?
I could consider to go back to a modem type - pppoe is crap, but all I need, as long as fibre isn't there yet.Btw : I'm really hoping that I'm completely wrong here.
-
@Gertjan thank you for all these informations !
I also don't use the TV or Voice over IP services.
My line is VDSL2 (Sosh), I have fixed IPv4 (for now it never changed / DHCPv4 in pfSense) behind a Netgear DM200 modem in bridge mode, custom firmware : https://github.com/dough29/openwrt-netgear-dm200-bridge
I can use the whole /56 prefix Orange gives me (see DHCP6C log / 2a01:aaaa:bbbb:0::/64 to 2a01:aaaa:bbbb:ff::/64) and expose services without any problem....
-
It's me thanking you !
So, I can put that ISP router (livebox) where it belongs : in it's box - and use some other device like the "Netgear DM200" that supports VDSL2 - Orange - Sosh is for me the same thing as Orange btw.
Good news !@Dough29 said in Subneting my /56 prefix to multiple internal LANs:
I can use the whole /56 prefix Orange gives me
But you have to hard code the LAB's with /64 networks.
What happens if Orange decides to change the IPv6 prefix ?? (answer : all your IPv6 will break and you have to redo the static settings. That would be a definite show stopper).I understand why you want tracking to work.
-
Yep the Livebox is in it's box since the day I received it, never opened the parcel
For now, from pfSense WEB UI, I have to put each LAN in "Static IPv6" and give it a 2a01:aaaa:bbbb:<prefix ID>::/64 subnet by hand...
So you are right, tomorrow if the prefix changes... everything will break !
To solve that I was thinking the "Track Interface" feature will do the job but it seems to be broken when using DHCP6C in "Advanced Configuration" on the WAN side...
-
Hello there.
I gave a try again on using my ::/56 prefix with the option "Track interface" on my LAN interfaces.
This time I got through the code and the answer is simple : when you have "Advanced Configuration" checked (so we can add send options for example) there is no code that could handle the LAN interfaces using "Track interface" for IPv6.
In interfaces.inc we come in function interface_dhcpv6_configure and go to subfunction DHCP6_Config_File_Advanced that doesn't handle the "Track interface" option.
Is it something missing ? Or is this related to a RFC or other thing ?
For now I'm still using the "Configuration Override" option so I have to handle the config file by myself...
-
What Livebox are you using ?
I'm using the "6" - firmware Version SG60-fr-G03.R00.C01_02.pfSense Interface WAN : I've set the "IPv6 Configuration Type" to "DHCP6".
My DHCP6 client (on WAN interface) settings :
The LAN interface "IPv6 Configuration Type" is set to "Tracking".
You see the "(hexadecimal from 0 to 0)" ?
This doesn't mean 'nothing or zero' but there is one prefix available.
And that's the first part of the issue right now.
AFAIK : You can do what you want with the (dhcp6c) settings, the Livebox will only give ONE prefix to a downstream router (pfSense) that asks for one or more prefix.On the Livebox side :
It says - what I make of it - that it has a /56 available. That's 256 prefixes of /64 - great.
It gave prefix number "0xdc" to the device called pfSense, the MAC shwon is the MAC of y pfSense WAN interface.
So, my prefix isn't number zero, but number "0xdc" or 220 decimal.
Note : whatever I do : I always get that prefix - my Orange Ipv6 never changed since I joined the fiber, end of last year.The "2a01:cb19:xxx:a6dc::/64" is mapped to my LAN interface, and the DHCP6 server on the LAN page can use a IPv6 pool from this prefix to hand over IPv6 to LAN clients.
This part works : outgoing IPv6 traffic is ok. Most LAN initiated traffic is now IPv6, it was already the case for local traffic, but now also for outgoing traffic.
For example : I'm posting on this forum for years now using only IPv6.What doesn't work :
The Livebox firewall : whatever I do, I can't set up IPv6 rule so I can contact a LAN based device using 2a01:cb19:xxx:a6dc::/64, for example 2a01:cb19:xxx:a6dc::88 (a NAS).pfSense only obtains one (1) prefix with the size of a /64, not more.
edit : I'm not an dhcp6v expert - I've tried to craft my own dhcp6c config file .....
The Livebox can probably give another /64 to another router attached to it's LAN ports .... but that doesn't make sense. I'm not going to add another pfSense to my Livebox so I can make available to a second LAN .....edit : my conclusion : IPv6 works for classic home IPv6 usage : just one LAN. And you can't reach these IPv6 from the Internet, as I could do with IPv4 (that still works).
And no, I'm not going to even try "NAT" IPV6 ...... -
@Gertjan I'm not using the Livebox, it's left in its box
I'm using a NetGear DM200 Modem in bridge mode to give pfSense the full control of the line.
-
Interesting.
You are using the phone ?
TV ? -
@Gertjan I have no need for phone or TV but some are doing well on this. You can check on forum lafibre.info for this
-
@Dough29 said in Subneting my /56 prefix to multiple internal LANs:
forum lafibre.info
That's where I go to check if any progress exists
