prefix length should be 64

JKnott

@RobbieTT said in prefix length should be 64:

It's that kind of presumption that brought about the folly of the revised RFC that made an unsupported leap of 'IPv6 address exhaustion' and worked backwards to the idea that a new measure of IPv4-esq address conservation was needed that the original IPv6 designers must have missed with their /48 per site recommendation.

There are only enough /48s to give a bit over 4000 to every single person on the planet. We'd better not waste them.

RobbieTT

@JKnott said in prefix length should be 64:

There are only enough /48s to give a bit over 4000 to every single person on the planet. We'd better not waste them.

But that may impinge of the plan to give each grain of sand on the planet 45 quintillion unique IPv6 addresses.

Tough choices ahead, so I need to get the kettle on, which has its own /64 already!

🫖

Gertjan

@RobbieTT said in prefix length should be 64:

It's that kind of presumption ....

Humm, no, didn't want to presuming anything - I was just mentioning what I have - and what I see.
And of course /56 won't be enough. But I'll sign for it

@RobbieTT said in prefix length should be 64:

Bad IPv6 Address Management

Nice, that was written 11 years ago, and still very valid today.

Btw : I'm not a IPv6 designer, just a guy using pFsense and I can tap into the "IPv6 resource" made available by my ISP. Learning while doing, of course.

the other

Sorry @all for hijacking this thread with a short question...
My German provider gives me a /56 prefix. It is no /48 but reading here regularly, I guess my /56 is close to heaven. ;)

I set WAN on pfsense (which is behind a Fritzbox handing out everything) as DHCPv6 with a /57 prefix delegation size.
Why I did that? For once, cause both tutorials I found for a setting like that told me to :D and cause Fritzbox is using own /64s for its LAN and guest LAN out of the ISPs /56.
Everything works, all seems to be fine. VLANs get their own /64 with their own subnet part and SLAAC, clients get ULA, GUA, even changing GUAs (by ISP) don't bother me much...although..no, it does bother me, but it works for now...

So, just a theoretical question (I hope since everything works and I haven't noticed any flaws): is that the way to do it or is it bogus and I could go with /56 on pfsense's WAN delegation size?

gregeeh

@JKnott said in prefix length should be 64:

On RA, why do you have stateless? That implies you're using DHCP6, but you don't have it enabled. I use unmanaged here.

Changed to unmanaged and now all seems good.

Only issue is DHCP6 Gateway is pending.

alt text

JKnott

@gregeeh said in prefix length should be 64:

Only issue is DHCP6 Gateway is pending.

That could be due to what you're pinging. While you can ping a link local address, your ISP might not have configured it to respond. That's the case with my ISP. What I did was run a traceroute to Google and picked the first global address to use for the monitor.

gregeeh

@JKnott said in prefix length should be 64:

That could be due to what you're pinging.

I can ping the same addess from the pfSense CLI, so should it not also work in the Gateway Monitoring.

JKnott

@gregeeh

You'd think so. Did you enter the address for the gateway? Or just leave the box blank. It will default to the gateway address, so you don't have to enter anything. You could try putting some working GUA, that you can ping, in that box.

gregeeh

@JKnott said in prefix length should be 64:

Did you enter the address for the gateway?

Gateway is set to dynamic and cannot be changed.

@JKnott said in prefix length should be 64:

You could try putting some working GUA, that you can ping, in that box

Sorry, I do not know how to do that.

JKnott

@gregeeh

First, go to a command prompt in pfSense and traceroute6 go Google:
traceroute6 google.com
traceroute6 to google.com (2607:f8b0:400b:807::200e) from 2607:f798:804:90:3899:8d05:91dc:56e3, 64 hops max, 28 byte packets
1 * * *
2 2607:f798:10:10d3:0:241:5615:221 11.193 ms 14.659 ms 10.508 ms
3 2607:f798:10:2f0:0:2091:4823:2041 13.284 ms 11.321 ms 11.772 ms
4 2607:f798:10:359:0:2091:4823:5210 9.483 ms 25.759 ms 10.510 ms
5 2607:f798:14:83::2 9.943 ms 10.558 ms 9.958 ms
6 2001:4860::1c:4001:57f0 12.773 ms
2001:4860:0:17::1 11.295 ms *
7 2001:4860:0:1::5b65 9.855 ms
2001:4860:0:1::5b67 18.374 ms 9.626 ms
8 yyz12s07-in-x0e.1e100.net 13.584 ms 11.359 ms 15.533 ms

Then ping6 the address in line 2 to see if it works:
ping6 2607:f798:10:10d3:0:241:5615:221
PING6(56=40+8+8 bytes) 2607:f798:804:90:3899:8d05:91dc:56e3 --> 2607:f798:10:10d3:0:241:5615:221
16 bytes from 2607:f798:10:10d3:0:241:5615:221, icmp_seq=0 hlim=63 time=12.287 ms
16 bytes from 2607:f798:10:10d3:0:241:5615:221, icmp_seq=1 hlim=63 time=12.629 ms
16 bytes from 2607:f798:10:10d3:0:241:5615:221, icmp_seq=2 hlim=63 time=12.441 ms

It does, so that address can be pasted into the monitor address box.

gregeeh

@JKnott - Here's the result from the CLI:

[2.7.0-RELEASE][admin@pfSense.localdomain]/root: traceroute6 google.com
traceroute6 to google.com (2404:6800:4006:810::200e) from 2402:7940:f021:2903:2e0:4cff:fe68:1bb3, 64 hops max, 28 byte packets
 1  2402:2c80:1:10::22  6.017 ms  6.062 ms  5.908 ms
 2  2402:7940::1  5.770 ms  6.202 ms  6.044 ms
 3  2001:4860:1:1::1834  5.860 ms  6.638 ms  5.888 ms
 4  2001:4860:0:110a::1  5.740 ms  6.116 ms *
 5  2001:4860:0:1::4245  7.022 ms  7.684 ms
    2001:4860:0:1::4247  7.669 ms
 6  syd15s15-in-x0e.1e100.net  5.926 ms  6.056 ms  5.861 ms
[2.7.0-RELEASE][admin@pfSense.localdomain]/root: ping6 2402:7940::1
PING6(56=40+8+8 bytes) 2402:7940:f021:2903:2e0:4cff:fe68:1bb3 --> 2402:7940::1
16 bytes from 2402:7940::1, icmp_seq=0 hlim=63 time=6.321 ms
16 bytes from 2402:7940::1, icmp_seq=1 hlim=63 time=6.061 ms
16 bytes from 2402:7940::1, icmp_seq=2 hlim=63 time=6.330 ms
16 bytes from 2402:7940::1, icmp_seq=3 hlim=63 time=5.970 ms
^C
--- 2402:7940::1 ping6 statistics ---
4 packets transmitted, 4 packets received, 0.0% packet loss
round-trip min/avg/max/std-dev = 5.970/6.170/6.330/0.158 ms
[2.7.0-RELEASE][admin@pfSense.localdomain]/root:

Still getting pending on the DHCP6 Gateway.

JKnott

@gregeeh said in prefix length should be 64:

Still getting pending on the DHCP6 Gateway.

What happens if you disable gateway monitoring for IPv6?

gregeeh

@JKnott said in prefix length should be 64:

What happens if you disable gateway monitoring for IPv6?

alt text

JKnott

@gregeeh

Well, you obviously have a problem with how the monitor is configured,but I don't know how at the moment. Regardless, don't worry about it, as for most users it's not used. All I can say is use the default, if it works or plug in an address you know works.

Anyway, you appear to be up & running with IPv6.

gregeeh

@JKnott said in prefix length should be 64:

Well, you obviously have a problem with how the monitor is configured,but I don't know how at the moment.

I think you're correct. Would it help removing and adding it back in?

Thanks again for all your time and putting up with me.

JKnott

@gregeeh said in prefix length should be 64:

Would it help removing and adding it back in?

As I mentioned, you don't have to put anything in, provided the gateway can be pinged. It's only when it doesn't that you have to provide some other address.

Bob.Dig

@JKnott said in prefix length should be 64:

That could be due to what you're pinging. While you can ping a link local address, your ISP might not have configured it to respond.

He was clearly (trying) pinging googles dns server. Maybe you should enable pictures for the forum to see them (if you are able).

gregeeh

@Bob-Dig said in prefix length should be 64:

Maybe you should enable pictures for the forum.

Sorry, but can you please explain what you mean by this?

Bob.Dig

@gregeeh That was towards @JKnott .

JKnott

@Bob-Dig said in prefix length should be 64:

He was clearly (trying) pinging googles dns server. Maybe you should enable pictures for the forum to see them (if you are able).

What pictures are you talking about? I already included examples of me doing it.