IPv6 issues
-
Hi all,
I have some issues with my IPv6 setup.
My WAN receives an IPv6 address from my modem by DHCPv6, I have set a static address for the LAN where my WAN is xxxx:xxxx:xxxx:xxxx:etc:etc:etc:etc my lan is xxxx:xxxx:xxxx:yyyy::1
Have enabled the DHCPv6 server for LAN and Router Advertisements set to Managed. All clients receives an IPv6 address and are able to ping the firewall.
The DNS server returns a valid IPv6 address, I have added a new IPv6 rule and with logging enabled and I see the requests, but the clients are not able to contact external addresses the connections are getting timed out.
When I do a port test from WAN I can contact external addresses but not from LAN
I have tried multiple things which I have read from this forum but no luck so far.
Thanks
-
@homersimpson said in IPv6 issues:
I have set a static address for the LAN where my WAN is xxxx:xxxx:xxxx:xxxx:etc:etc:etc:etc my lan is xxxx:xxxx:xxxx:yyyy::1
Where would you have gotten the idea that would work? Did you get a prefix delegation from your isp a /60, /56? And the range you put on your lan is within this delegation?
If you want to use IPv6 on lan side networks. You need a delegation from your ISP that gives you that range..
-
As mentioned by @johnpoz, you have to use addresses assigned by your ISP. The usual method is via DHCPv6-PD. The "PD" refers to prefix delegation, where they assign you a prefix, which you then use on your LAN. You should get at least 1 /64 and likely more. Many ISPs provide a /56 for 256 /64s. Others may provide a /16, /48 or other.
-
@jknott said in IPv6 issues:
Others may provide a /16
Clearly that is a typo ;) That sure and the hell would never be handed out PD hehehe
-
Yeah, I meant a /60, which provides 16 /64s. I haven't had my morning beer yet.
-
@jknott said in IPv6 issues:
I haven't had my morning beer yet
Me and you both.. Which we all know is the breakfast of champions! ;)
-
I followed someones blog post because I am a n00b :-) I thought I got an /64 prefix but just checked again and it seems to be a /128 prefix
-
You need to ask for, and your isp needs to support giving you a prefix other than 1 single /64 if you want to use IPv6 behind pfsense.
Or you could just give up on whatever crappy ipv6 support your isp has and setup a Hurricane electric tunnel and get a /48 to use however you want..
A /48 would give you 65K /64s to play with - that should be more than enough ;)
edit: a /128 is fine for the transit.. Did you setup pfsense to request a delegation of say a /60? You then can setup your lan side interfaces to track this and assign a specific /64 prefix from the /60 to use on your lan side interface..
But to be honest just getting a /48 from HE is much easier setup ;) And you can take that /48 with you if you change ISPs.. You can do whatever static setups you want - with no worry that your prefix from your isp might change, etc. etc. You can setup PTRs for any of the IPv6 address in your /48.. etc.
-
@johnpoz awesome thanks!
-
@johnpoz Having just done exactly this I can say it was a painless setup. Takes a bit of time to get static ipv6 leases setup, but once done your done for good. Those will not change and you can create aliases to do what you require without fear of a prefix change.
-
Yeah dhcpv6 can be a bit of a learning curve ;)
-
Turns out the modems DHCPv6 server is using a /64 prefix
-
"modems" don't have dhcp servers neither v4 or v6.. You mean some gateway isp device you have? Ie a modem/router combo..
Some modems might hand out a 192.168.100 address when they don't have an internet connection.
But if your isp device is handing pfsense a /64 ipv6 address on its wan - there is prob zero chance of getting delegation to work..
-
@johnpoz /128 on the WAN and /64 on the LAN side
-
So you asked for a delegation in pfsense and then set track on lan side interface..
Where does "modem" dhcp come into play there?? What isp device do you have - what is the make and model?
-
@homersimpson said in IPv6 issues:
I followed someones blog post because I am a n00b :-) I thought I got an /64 prefix but just checked again and it seems to be a /128 prefix
That /128 is only for your WAN interface and has nothing to do with whatever prefix you get. Your gateway will be a link local address, as that is commonly used with IPv6. You should have at least a /64.
-
@johnpoz said in IPv6 issues:
edit: a /128 is fine for the transit..
It's not even used for transit. It's just an identifier for that interface and can be used for testing, VPNs etc. Given that a /128 allows for no other device, it can't even be directly used for traffic.
-
@jknott got it fixed, turns out the modem router had an issue thank you for all your help.
-
@jknott said in IPv6 issues:
it can't even be directly used for traffic.
Huh??
Here I did a ipv6 traceroute from the internet to one of my ntp server that is using an IPv6 from one of my /64s out of my /48
As you can see it hits my /128 address that is used for the transit network to my /48..
While yes /128 is full mask, just like /32 in ipv4 - and is used for loopback addressing, etc. It for sure can be used as address and mask you assign to the interface that is used for transit of networks routed via the transit network..
-
@johnpoz said in IPv6 issues:
it can't even be directly used for traffic.
Huh??
Here I did a ipv6 traceroute from the internet to one of my ntp server that is using an IPv6 from one of my /64s out of my /48
As you can see it hits my /128 address that is used for the transit network to my /48..With a /128, like a /32 on IPv4, how many possible addresses are there on the subnet? Only one in both cases. This means you cannot assign a /128 to an interface, plug it into a switch and then expect to communicate with another /128. You have to route through something else. So, the ISP will have a route to that /128 via the link local address, just as it would for any address within the customer's prefix.
-
What does that have to do with the price of tea in china?
My statement to the OP was an easy way to say to him that /128 is fine for the transit network - ie his connection to his isp..
Your getting way to deep into the weeds..
-
@johnpoz said in IPv6 issues:
My statement to the OP was an easy way to say to him that /128 is fine for the transit network - ie his connection to his isp..
Your getting way to deep into the weeds..With a /128, it can't possibly be the transit network as it can't communicate directly, that is without passing through a router, with any other device. That is what the link local address is used for. With a transit network, the addresses at each end must be able to communicate directly with the other end. That cannot happen with a /128. Think back to IPv4, where link local addresses weren't used. You would have some pipe, could be Ethernet, PPP or whatever. You would have an IP path, with addresses at each end that could communicate with each other. The only exception was point to point links, where the interface could be used, instead of an IP address.
Here's what netstat -r shows for my gateway:
Internet6:
Destination Gateway Flags Netif Expire
default fe80::217:10ff:fe9 UG em0Notice that link local address? Coming the other way, my ISP would route to my network by the link local address of the WAN side of pfSense. At no point is my /128 WAN address used for routing. In fact, I don't even need that address for my IPv6 Internet connection to work.
-
@johnpoz
I know :
which matches :
but I set the subnet as /64 :
I know, this is not what instructions told me.
Like this "GIF tunnel subnet" setting is a "don't care" ??The IPv6 he.net side of things :
which tells me that /64 should be used.
All this doesn't match up with what @JKnott tells me = "a /128 will be a no go for communication", and I know that is true.
This tunnel tunnels ??So it is the local link
that matters ?
Btw : sorry for lossing the initial subject..
-
Guys... All I stated to the OP that is was ok to see a /128 on the wan interface.. There is zero reason to confuse him even more..
Yes /128 is a loopback - we all know that.. Doesn't have anything to do with his problem..
And yes you can talk to a loopback address.. And it can pass traffic - I prob made it worse by even having to point that out..
-
Is it even a loopback? On IPv6, the loopback is ::1. I don't think we're running OSPF here, where you need an address of some sort for loopback.
-
Talk about off the subject ;)
-
Perhaps a touch. However, I have noticed a lot of misunderstanding about IPv6, because people are so used to IPv4. While many things work the same way, some others are quite different. When I had that IPv6 problem, a couple of years ago, I found I had to educate the 2nd level tech support (I wouldn't waste my time with 1st) and senior tech at my ISP on the finer details of how some things worked with IPv6.
As for the WAN address, a public address is entirely optional with IPv6, relying on the link local address for routing. That seems to be quite a leap for many to understand.
