Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    IPv6 issues

    Scheduled Pinned Locked Moved IPv6
    27 Posts 5 Posters 3.0k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • johnpozJ
      johnpoz LAYER 8 Global Moderator @A Former User
      last edited by

      Yeah dhcpv6 can be a bit of a learning curve ;)

      An intelligent man is sometimes forced to be drunk to spend time with his fools
      If you get confused: Listen to the Music Play
      Please don't Chat/PM me for help, unless mod related
      SG-4860 24.11 | Lab VMs 2.8, 24.11

      1 Reply Last reply Reply Quote 0
      • H
        HomerSimpson
        last edited by

        Turns out the modems DHCPv6 server is using a /64 prefix

        johnpozJ 1 Reply Last reply Reply Quote 0
        • johnpozJ
          johnpoz LAYER 8 Global Moderator @HomerSimpson
          last edited by

          "modems" don't have dhcp servers neither v4 or v6.. You mean some gateway isp device you have? Ie a modem/router combo..

          Some modems might hand out a 192.168.100 address when they don't have an internet connection.

          But if your isp device is handing pfsense a /64 ipv6 address on its wan - there is prob zero chance of getting delegation to work..

          An intelligent man is sometimes forced to be drunk to spend time with his fools
          If you get confused: Listen to the Music Play
          Please don't Chat/PM me for help, unless mod related
          SG-4860 24.11 | Lab VMs 2.8, 24.11

          H 1 Reply Last reply Reply Quote 0
          • H
            HomerSimpson @johnpoz
            last edited by

            @johnpoz /128 on the WAN and /64 on the LAN side

            1 Reply Last reply Reply Quote 0
            • johnpozJ
              johnpoz LAYER 8 Global Moderator
              last edited by

              So you asked for a delegation in pfsense and then set track on lan side interface..

              Where does "modem" dhcp come into play there?? What isp device do you have - what is the make and model?

              An intelligent man is sometimes forced to be drunk to spend time with his fools
              If you get confused: Listen to the Music Play
              Please don't Chat/PM me for help, unless mod related
              SG-4860 24.11 | Lab VMs 2.8, 24.11

              1 Reply Last reply Reply Quote 0
              • JKnottJ
                JKnott @HomerSimpson
                last edited by

                @homersimpson said in IPv6 issues:

                I followed someones blog post because I am a n00b :-) I thought I got an /64 prefix but just checked again and it seems to be a /128 prefix

                That /128 is only for your WAN interface and has nothing to do with whatever prefix you get. Your gateway will be a link local address, as that is commonly used with IPv6. You should have at least a /64.

                PfSense running on Qotom mini PC
                i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                UniFi AC-Lite access point

                I haven't lost my mind. It's around here...somewhere...

                1 Reply Last reply Reply Quote 0
                • JKnottJ
                  JKnott @johnpoz
                  last edited by

                  @johnpoz said in IPv6 issues:

                  edit: a /128 is fine for the transit..

                  It's not even used for transit. It's just an identifier for that interface and can be used for testing, VPNs etc. Given that a /128 allows for no other device, it can't even be directly used for traffic.

                  PfSense running on Qotom mini PC
                  i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                  UniFi AC-Lite access point

                  I haven't lost my mind. It's around here...somewhere...

                  H johnpozJ 2 Replies Last reply Reply Quote 0
                  • H
                    HomerSimpson @JKnott
                    last edited by

                    @jknott got it fixed, turns out the modem router had an issue thank you for all your help.

                    1 Reply Last reply Reply Quote 0
                    • johnpozJ
                      johnpoz LAYER 8 Global Moderator @JKnott
                      last edited by

                      @jknott said in IPv6 issues:

                      it can't even be directly used for traffic.

                      Huh??

                      Here I did a ipv6 traceroute from the internet to one of my ntp server that is using an IPv6 from one of my /64s out of my /48

                      As you can see it hits my /128 address that is used for the transit network to my /48..

                      trace.png

                      While yes /128 is full mask, just like /32 in ipv4 - and is used for loopback addressing, etc. It for sure can be used as address and mask you assign to the interface that is used for transit of networks routed via the transit network..

                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                      If you get confused: Listen to the Music Play
                      Please don't Chat/PM me for help, unless mod related
                      SG-4860 24.11 | Lab VMs 2.8, 24.11

                      GertjanG 1 Reply Last reply Reply Quote 0
                      • JKnottJ
                        JKnott
                        last edited by

                        @johnpoz said in IPv6 issues:

                        it can't even be directly used for traffic.

                        Huh??
                        Here I did a ipv6 traceroute from the internet to one of my ntp server that is using an IPv6 from one of my /64s out of my /48
                        As you can see it hits my /128 address that is used for the transit network to my /48..

                        With a /128, like a /32 on IPv4, how many possible addresses are there on the subnet? Only one in both cases. This means you cannot assign a /128 to an interface, plug it into a switch and then expect to communicate with another /128. You have to route through something else. So, the ISP will have a route to that /128 via the link local address, just as it would for any address within the customer's prefix.

                        PfSense running on Qotom mini PC
                        i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                        UniFi AC-Lite access point

                        I haven't lost my mind. It's around here...somewhere...

                        johnpozJ 1 Reply Last reply Reply Quote 0
                        • johnpozJ
                          johnpoz LAYER 8 Global Moderator @JKnott
                          last edited by johnpoz

                          What does that have to do with the price of tea in china?

                          My statement to the OP was an easy way to say to him that /128 is fine for the transit network - ie his connection to his isp..

                          Your getting way to deep into the weeds..

                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                          If you get confused: Listen to the Music Play
                          Please don't Chat/PM me for help, unless mod related
                          SG-4860 24.11 | Lab VMs 2.8, 24.11

                          JKnottJ 1 Reply Last reply Reply Quote 0
                          • JKnottJ
                            JKnott @johnpoz
                            last edited by

                            @johnpoz said in IPv6 issues:

                            My statement to the OP was an easy way to say to him that /128 is fine for the transit network - ie his connection to his isp..
                            Your getting way to deep into the weeds..

                            With a /128, it can't possibly be the transit network as it can't communicate directly, that is without passing through a router, with any other device. That is what the link local address is used for. With a transit network, the addresses at each end must be able to communicate directly with the other end. That cannot happen with a /128. Think back to IPv4, where link local addresses weren't used. You would have some pipe, could be Ethernet, PPP or whatever. You would have an IP path, with addresses at each end that could communicate with each other. The only exception was point to point links, where the interface could be used, instead of an IP address.

                            Here's what netstat -r shows for my gateway:
                            Internet6:
                            Destination Gateway Flags Netif Expire
                            default fe80::217:10ff:fe9 UG em0

                            Notice that link local address? Coming the other way, my ISP would route to my network by the link local address of the WAN side of pfSense. At no point is my /128 WAN address used for routing. In fact, I don't even need that address for my IPv6 Internet connection to work.

                            PfSense running on Qotom mini PC
                            i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                            UniFi AC-Lite access point

                            I haven't lost my mind. It's around here...somewhere...

                            1 Reply Last reply Reply Quote 0
                            • GertjanG
                              Gertjan @johnpoz
                              last edited by

                              @johnpoz
                              I know :

                              88e2cafc-a284-4a9d-a39a-dfaa9c149c63-image.png

                              which matches :

                              484d594b-cb0c-4ad2-a5be-67a0059cfac2-image.png

                              but I set the subnet as /64 :

                              d7ca72a1-0525-488a-81b5-5815a75e8205-image.png

                              I know, this is not what instructions told me.
                              Like this "GIF tunnel subnet" setting is a "don't care" ??

                              The IPv6 he.net side of things :

                              6abffc5f-d54d-4305-b23f-0e2dc3d18291-image.png

                              which tells me that /64 should be used.

                              All this doesn't match up with what @JKnott tells me = "a /128 will be a no go for communication", and I know that is true.
                              This tunnel tunnels ??

                              So it is the local link

                              d9b2b299-fc7b-4e66-9969-38da68fb8baa-image.png

                              that matters ?

                              Btw : sorry for lossing the initial subject..

                              No "help me" PM's please. Use the forum, the community will thank you.
                              Edit : and where are the logs ??

                              1 Reply Last reply Reply Quote 0
                              • johnpozJ
                                johnpoz LAYER 8 Global Moderator
                                last edited by johnpoz

                                Guys... All I stated to the OP that is was ok to see a /128 on the wan interface.. There is zero reason to confuse him even more..

                                Yes /128 is a loopback - we all know that.. Doesn't have anything to do with his problem..

                                And yes you can talk to a loopback address.. And it can pass traffic - I prob made it worse by even having to point that out..

                                An intelligent man is sometimes forced to be drunk to spend time with his fools
                                If you get confused: Listen to the Music Play
                                Please don't Chat/PM me for help, unless mod related
                                SG-4860 24.11 | Lab VMs 2.8, 24.11

                                JKnottJ 1 Reply Last reply Reply Quote 1
                                • JKnottJ
                                  JKnott @johnpoz
                                  last edited by

                                  @johnpoz

                                  Is it even a loopback? On IPv6, the loopback is ::1. I don't think we're running OSPF here, where you need an address of some sort for loopback.

                                  PfSense running on Qotom mini PC
                                  i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                                  UniFi AC-Lite access point

                                  I haven't lost my mind. It's around here...somewhere...

                                  johnpozJ 1 Reply Last reply Reply Quote 0
                                  • johnpozJ
                                    johnpoz LAYER 8 Global Moderator @JKnott
                                    last edited by

                                    Talk about off the subject ;)

                                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                                    If you get confused: Listen to the Music Play
                                    Please don't Chat/PM me for help, unless mod related
                                    SG-4860 24.11 | Lab VMs 2.8, 24.11

                                    JKnottJ 1 Reply Last reply Reply Quote 0
                                    • JKnottJ
                                      JKnott @johnpoz
                                      last edited by

                                      @johnpoz

                                      Perhaps a touch. However, I have noticed a lot of misunderstanding about IPv6, because people are so used to IPv4. While many things work the same way, some others are quite different. When I had that IPv6 problem, a couple of years ago, I found I had to educate the 2nd level tech support (I wouldn't waste my time with 1st) and senior tech at my ISP on the finer details of how some things worked with IPv6.

                                      As for the WAN address, a public address is entirely optional with IPv6, relying on the link local address for routing. That seems to be quite a leap for many to understand.

                                      PfSense running on Qotom mini PC
                                      i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                                      UniFi AC-Lite access point

                                      I haven't lost my mind. It's around here...somewhere...

                                      1 Reply Last reply Reply Quote 0
                                      • First post
                                        Last post
                                      Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.