IPv6 with prefix delegation for OpenVPN remote users
-
I have Verizon Fios service, with a /56 delegated IPv6 prefix. I have seen that the prefix does occasionally change. All of my regular interfaces (physical and VLAN) are set to "Track Interface" on the WAN with appropriate prefix IDs.
I would like to also have IPv6 available for remote users on OpenVPN. To do that, I need to put a value in the "IPv6 Tunnel Network" box on the OpenVPN Server settings page.
If I use one of my delegated /64 networks, it won't update automatically when the ISP's prefix changes, so it will no longer be able to route traffic if the prefix changes, until someone logs in and updates the value.
Other than writing some kind of scheduled script that monitors the prefix I have and updates the OpenVPN configuration, is there any better way to do this?
I've seen a few references to NPt (and I read the pfSense documentation for it), which seems like it might allow me to use ULA addresses on the VPN and translate them to a prefix, but I don't see any way to set a tracked interface in there either, only to choose a specific prefix or the delegated prefix of another LAN interface. Would this feature help me, and how would I set it up?
-
To access stuff on your network, you can use Unique Local Addresses. Use the ULA addresses in DNS rather than global.
ULA is the IPv6 equivalent of RFC1918 on IPv4. -
@JKnott I guess I should have been more clear - I want these users to be able to access the Internet via this VPN as well.
-
Do you have System/Advanced/Networking/Do not allow PD/Address release checked?
-
@JKnott I do have that option checked. I think the prefix only changes if the connection is disconnected (for power outages, cables being unplugged or broken, etc.) for a long enough period of time that Verizon expires the lease, but I do not know how long that period is. (For IPv4, the DHCP lease period is 2 hours, but I've seen reports online that the IPv6 lease time is only one hour.)
-
I've had the same prefix for a few years. It's even survived replacing both the computer I run pfSense on and the cable modem. The IPv4 lease wouldn't survive either. IPv6 uses something called DUID, which is supposed to tell the ISP what your prefix is. I understand some ISPs ignore it. I have no idea what Verizon does. Maybe someone else here knows.