Why do I have to 'Track Interface' on LAN to WAN for IPv6 to work?

bearhntr

John I truly appreciate your attempt at an explanation - but it is not helping me to understand "WHY" I have to use this setting. I am sure there are 100s or 1000s of people who do this.

I do realize that I am a residential ISP subscriber and probably not given the same services as a business customer would have, it still makes no sense to me why I have to use the setting I am questioning if I have my own DNS and DHCP server in my home that points not only to CloudFlare (i.e. one.one.one.one and also to Comcast DNS server IPs).

I am not setting anything at the WAN - that is and always has been DHCP/DHCPv6. The LAN IPv4 is statically set by me (or I can let it pull an address from my DHCP server and it works just fine. I have tried this by disabling the IPv6 completely...letting pfSense pull any address that it wants from my DHCP server...and things just work. DHCP updates the DNS portion of my server with the new 'gateway' address and things just work.

I completely understand that IPv6 uses RA instead of a gateway, but as 'I understand it' - is is basically the same thing only having multicast capabilities.

bearhntr

@JKnott

That is what I am trying to understand. If pfSense is 'in essence' my "Path" to the Internet - why does this not work? I am able to SET my Gateway for the IPv4 address to be anything in my network 'subnet segment' and granted it is a one-to-one relationship (basically) - it works.

I feel that I should be able to do the same thing in pfSense with IPv6. Comcast setup a WAN link and an address (just like it did for IPv4).

johnpoz

@bearhntr If the isp hands you network X to use via a delegation.. And you use setup X that works fine.. But if they change that network to Y.. your X network is no longer going to work..

I am not getting what part of this you do not get??

I am sure there are 100s or 1000s of people who do this.

Yup all have to use track and let the delegation set the IP range to what the ISP delegates to them..

The isp routes X to you.. But then they don't route that too you any more and only route Y.. You still using X isn't going to work..

If you want to set static on your network - then like I said get a static from your isp, or use HE..

I am able to SET my Gateway for the IPv4 address

Ahhhh - your failing to grasp that IPv6 is not natting.. The prefix you set on the lan side interface via a track, is not natted to the IPv6 address you get on the wan.. Its a GUA that is "routed" to you.. When the isp no longer routes that network to you because they changed the delegation.. Not going to work, you can't just put some random public IPv4 address on your pfsense wan can you ;)

If you want to do that, then use a ULA ip range on your lan side networks and setup it to NAT to your IPv6 IP the isp gives you on your wan.. But that really defeats the whole purpose of IPv6.

bmeeks

@bearhntr: residential IPv6 does not generally work the same was as residential IPv4 does. To expound upon what @johnpoz is saying --

With most residential ISPs, they give the customer only a single public IPv4 address. Your pfSense firewall will then use NAT (network address translation) to map your internal LAN IP addresses over to your single public IPv4 WAN address.

IPv6 works differently. It does not use NAT at all with most configurations. Only a complete idiot ISP would use NAT for IPv6. Your ISP is allocating a /60 IPv6 subnet block to you. That block contains 295,147,905,179,352,825,856 public IPV6 addresses you can use for internal hosts! The smallest legal IPv6 subnet is a /64. The /60 your ISP is giving you allows you to have sixteen /64 subnets, all with public routable IPv6 addresses. But you must use the IPv6 addresses your ISP gave you. You can't choose your own with your own DHCPv6 server on the LAN. That's what the "Track Interface" setting is doing. It's letting the LAN side of pfSense know what is the currently "proper" IPv6 /64 prefix to use for public Internet traffic.

Your ISP gives you a different pool of those 295,147,905,179,352,825,856 IPv6 addresses each time your connection with the ISP resets. They give you a new /60 prefix. So all of your devices on the LAN will need new IPv6 addresses assigned from that new /60 address space.

JKnott

@bmeeks said in Why do I have to 'Track Interface' on LAN to WAN for IPv6 to work?:

Your ISP gives you a different pool of those 295,147,905,179,352,825,856 IPv6 addresses each time your connection with the ISP resets

Not necessarily. A customer will have a DUID, which tells the ISP what prefix they get so that it doesn't change. Some ISPs honour that and some don't. There is also a setting in pfSense that controls it for those that do. I've had the same prefix for almost 5 years, even though both my modem and the computer I run pfSense on have been changed.

JKnott

@bearhntr said in Why do I have to 'Track Interface' on LAN to WAN for IPv6 to work?:

If I have a DHCPv6 server and it can assign an IP address (IPv6) to things

Forgot to mention, you normally use SLAAC and not DHCPv6 on your LAN. Also, thanks to some genius at Google, Android devices don't work with DHCPv6.

The 2601 address (which looks to be SLAAC - as fe8b:cb26 look like part of the MAC Address on that NIC) changes every time I reboot

Your prefix, as assigned by your ISP may be changing. Make sure System / Advanced / Networking / Do not allow PD/Address release is selected. If it is and the prefix still changes, you can use Unique Local Addresses on your LAN, to provide addresses that won't change. You then use those in your DNS.

bmeeks

@JKnott said in Why do I have to 'Track Interface' on LAN to WAN for IPv6 to work?:

A customer will have a DUID, which tells the ISP what prefix they get so that it doesn't change. Some ISPs honour that and some don't.

Yeah, did not clarify my statement and made it overly broad.

However, I believe there are ISPs that are passive aggressive "hostile" to users hosting anything on their residential networks; and those ISPs can do things like making any public IP address or addresses they give you change as often as possible. They may also block certain inbound ports (port 25 being a favorite that is almost universally blocked now). They pretty much all have a policy prohibiting hosting of services on residential accounts, but there are varying degrees of enforcement. Having "non-sticky" public IPs is another tool in the ISP's arsenal.

johnpoz

@bmeeks said in Why do I have to 'Track Interface' on LAN to WAN for IPv6 to work?:

like making any public IP address or addresses they give you change as often as possible.

That is a quite possible reason for why they do it.. Never thought of it - but a always changing IP would make it more difficult to host services..

My IPv4 only has changed when they made a big IP range change when current cable company got bought by a different company and they changed their name even.

My IPv6 prefix hasn't ever changed because I just use HE tunnel and have a /48 that I can just setup static IPv6 on my interfaces vs having to worry about tracking..

bmeeks

There are likely several reasons for residential public IPs being transitory.

There would be some labor overhead in keeping up with IPs assigned to specific users, and then modifying all that when one subscriber dropped and another was added. You could automate that to some degree, but human oversight would still be necessary.
With IPv4, the majority of ISPs simply do not have enough free network addresses to make all their users quasi-static. Of course with IPv6 this is no longer an issue, but old paradigms die slowly. This is why CGNAT is growing on the IPv4 side.
It can make hosting services much more difficult with changing public IPs on residential accounts.

bearhntr

@bmeeks @johnpoz @JKnott

Let me start off by saying thanks - I am truly not trying to be 'daft', just trying to get a better grasp on it (which I mentioned in my first message). I am not wanting to come across as an ass, either. Just for reference, when I first setup pfSense with IPv6 and it was doing DNS, DDNS (with CloudFare) and DCHP/DHCPv6 (as server and resolver) - I tracked for nearly 90 days the IPv6 on the WAN and LAN in pfSense (copying and pasting into a file daily) - they never changed. I had set the setting mentioned above Do not allow PD/Address release is 'Enabled'

Even as mentioned - I get my own HE 'tunnel' (static per say) - I am not sure it is going to fix things, as for the most part...my addresses already seem to be "static" as I mentioned I kept up with them for 90+ days and they never changed - even through modem and pfSense reboots. Never seemed to have any problems until I want to add AD/DS to the mix.

I have been working on, with and around computers for about 45 years (since 1977 when I built first one at age 9). I feel that I have a pretty good grasp on things network related (and just wanting to 'sure-up' my IPv6 understanding). Again, I do appreciate your insights/input.

Let me see if I can clarify some my questions - and the information already provided has helped immensely. I simply trying to grasp this whole TRACK INTERFACE. If I take IPv6 out of the picture, here is what I understand (let me state upfront - I am a Windows guy, can do MacOS and Linux with guidance) :

"I" set my Gateway address and subnet (which I am using 10.9.28.0/24 - this I completely understand gives me 'one' segment - and I know how to make a change to get more. I give pfSense this as my LAN IP Address and all is good. The WAN is set by Comcast and pfSense handles (via its NAT and firewall the traffic from my network to the Internet. Everything in 10.9.28.xxx is under my control.
I am trying to utilize AD/DS as a singular (LDAP, etc.) means of logging into multiple things - so as not having to maintain individual logins to many, many things/apps/services as I expand my SmartHome. I already have pfSense setup to use an LDAP login on my 2019 AD/DS server with the steps I found in the NETGATE KB (this works just fine). AD/DS highly recommends the use of 'its' DNS and DHCP to keep up with things. This is why I am trying to get a better grasp on this. I tried to find something on using AD/DS with pfSense doing all of (like I had setup before - but nothing seemed to make sense or work). I guess I am trying do a STATEFUL configuration, which by reading all the comments, it fruitless and I should just give up.
I have tried many things in setting up a DHCPv6 scope on the server...using the LAN address as a 'template' if you want to call it that, and then making a reservation for the address which is on that address on the AD/DS scope...and statically setting it in the IPv6 properties in the Ethernet settings for the adapter (with 64) prefix and repeating it in the DNS block. It will work for a while and then stop.

What I simply cannot grasp is the 'static' --- and WHY I cannot do this (in some fashion) with the IPv6 (on "MY" network - anything inside pfSense). I have tried every possible combination that I can think of for the settings (using fdxx: or 2001: or 2601: as addresses) never can get fdxx: - no matter what I do to work... all IPv6 test sites will fail with this scope. Comcast appears to be give me a 2001: /128 address on my WAN (and when Track Interface is on, a 2601: /64 address on the LAN). I feel I have some understanding of the /60 setting that Comcast had me set in pfSense under the WAN setup. Under the LAN is with setting Track Interface It has '0' (I know I can use 0-f there).

I find myself rambling - just say why, Why, WHY must I use Track Interface??? I just do not understand why; if pfSense is my 'portal' to the Internet, and works just fine with IPv4 and I get to control everything on LAN.

bmeeks

@bearhntr said in Why do I have to 'Track Interface' on LAN to WAN for IPv6 to work?:

just say why, Why, WHY must I use Track Interface??? I just do not understand why; if pfSense is my 'portal' to the Internet, and works just fine with IPv4 and I get to control everything on LAN.

Bottom line reason for "why" you have to use Track Interface is this --

Your ISP configures a specific routing table in their network for the prefix they give you. Because there is no NAT, your IPv6 address segment from your ISP is your public IP subnet. But in order for it to route correctly through your ISP and on to the Internet, your LAN hosts must be using an IPv6 address from the correct prefix. So long as your ISP does not change your prefix (the /60 block they provide), then you should be able to configure an IPv6 subnet in the DHCPv6 server for Windows AD and have that work. But the instant your ISP makes a routing change on their side of the network (beyond your pfSense box) and assigns your connection a new IPv6 prefix, then your IPv6 traffic may cease to be able to get routed to and from the Internet and back to your LAN hosts if they are using the previous IPv6 prefix.

You can't just pick a DHCPv6 address scope out of the blue on your side when there is no NAT. What you choose must be recognized and routed correctly by your ISP. An analogy is even if you have a static IPv4 address, you can't just choose any other IPv4 address or subnet you desire on your WAN. You must use the address and subnet provided by your ISP because their end of the connection is routing only exactly what they give you. Similarly, you must use the IPv6 prefix your ISP has assigned on your LAN because there is no NAT. Your ISP expects all of your LAN hosts to be sending and receiving traffic on an IPv6 address from the IPv6 prefix the ISP assigned to your connection. The ISP signals what that prefix is via the "Track Interface" setting.

As has been mentioned in this thread, most ISPs will honor some IPv6 client settings that say "please let me keep this same IPv6 prefix". But not all ISPs will do that, and there are some situations where they need to change the prefix they gave you. In that scenario, if you were using static hard-coded IPv6 subnets on your side, your IPv6 traffic could stop working because the ISP would no longer be routing that prefix for you (since they changed it to a different one on their end). What "track interface" does is help the LAN side of pfSense, and all the hosts there, recognize when (or if) the ISP changes the IPv6 prefix. That triggers all the hosts there to obtain new addresses in the new prefix.

Later Edit: one more thing that might be confusing to you -- the IPv6 address that your ISP assigns for your WAN interface is usually NOT in the same subnet as the one they give for your prefix. The ISP may give your WAN firewall interface an IPv6 address for its own use, but then will assign a large block of IPv6 addresses in a prefix for use on your local networks behind the firewall. "Track Interface" is a bit of a misnomer because it does not literally mean "use what the WAN has", it instead means "here is a prefix for internal interfaces, use it for LAN and other internal interfaces". It is associated with the WAN interface because that's where the DHCPv6 client is running that receives and processes the "track interface" command sequence the ISP's system sends to pfSense.

And in fact, in many Track Interface setups, the WAN interface gets no public IPv6 address at all -- only the internal interfaces get a public IPv6 address via the "track interface" protocol. The WAN is stuck using a link-local address and communicates only with the far-end local segment gateway.

johnpoz

@bearhntr said in Why do I have to 'Track Interface' on LAN to WAN for IPv6 to work?:

and works just fine with IPv4 and I get to control everything on LAN.

As always @bmeeks is very articulate and spot on in his assessments and explanations.. Great post going into why your having an issue.

But I am going to suggest something that will drive our resident fanboy of ipv6 up the wall ;) Turn IPv6 off and forget about if it is causing you grief and your not understanding how it is different than your typical IPv4 nat setup that you are use too.

Why do you need IPv6? There is currently zero reason to actually "need" IPv6.. Name one resource that you use that requires IPv6.. I have been asking for this for years - nobody has been able to name one..

Unless you can name a resource that "requires" you to use IPv6 - it comes down to play and learning.. Until such time that some major resource turns off IPv4.. Which is what like 20 years down the road to be honest.. Using IPv6 really gets you nothing but grief and added complexity.

I have been using IPv6 for like 13 years or something.. Still have not actually found a "need".. Sure it is cool to not have to nat, and sure it is the future - don't get me wrong.. And if your in specific parts of the world where IPv4 is scare, and you want to host something to other IPv6 users - sure it has use.. Look at the mobile phone industry - they have billion of devices, IPv6 has been great for them - but they also provide natting/conversion into the IPv4 space. So while your phone might only get IPv6 - it can talk to any IPv4 address.

Sure if your isp went cgnat - its a easy way to get to your network while your out and about if you have a IPv6 address to use.. But to currently most people have zero "need" for IPv6.

My isp doesn't even provide IPv6.. I have to use a HE tunnel if I want IPv6 - which while I do want it, to play with. And help others that might have questions about it.. But I honestly have "zero" need for it.. I could just turn off my tunnel - and nothing would change from my use of the internet.

If its causing you grief - and confusing you, just do yourself a favor and forget about.. Come back to it in say 10 years ;)

JKnott

@bmeeks said in Why do I have to 'Track Interface' on LAN to WAN for IPv6 to work?:

There would be some labor overhead in keeping up with IPs assigned to specific users, and then modifying all that when one subscriber dropped and another was added. You could automate that to some degree, but human oversight would still be necessary.

What labour? It's just providing the addresses associated with the DUID.

With IPv4, the majority of ISPs simply do not have enough free network addresses to make all their users quasi-static. Of course with IPv6 this is no longer an issue, but old paradigms die slowly. This is why CGNAT is growing on the IPv4 side.

My IPv4 address is virtually static, but the host name is as permanent as my hardware, as it's based on the modem and router MAC addresses. I also get 2 IPv4 addresses.

JKnott

@bearhntr said in Why do I have to 'Track Interface' on LAN to WAN for IPv6 to work?:

What I simply cannot grasp is the 'static' --- and WHY I cannot do this (in some fashion) with the IPv6 (on "MY" network - anything inside pfSense).

The addresses provided by DHCPv6-PD are real world public addresses, not private addresses as you'd set up behind NAT on IPv4. However, you can still set up similar addresses on IPv6, with those Unique Local Addresses I mentioned. It's good you have IPv6 addresses that don't change. Some people are not so fortunate. Since it's possible your addresses can change, likely or not, your router has to be able to accommodate that change. That's where the track interface comes in.

JKnott

@johnpoz said in Why do I have to 'Track Interface' on LAN to WAN for IPv6 to work?:

Turn IPv6 off and forget about if it

That's a hanging offence!!!

Actually, as I mentioned, that's head in the sand thinking. The world is moving to IPv6 and the sooner the better. While you may not be able to think of anything that needs it, in some parts of the world people don't have the option of IPv4.

He's here to learn and he won't be able to, if he ignores IPv6. He just has to get over some bad habits learned with IPv4.

bmeeks

@JKnott said in Why do I have to 'Track Interface' on LAN to WAN for IPv6 to work?:

@bmeeks said in Why do I have to 'Track Interface' on LAN to WAN for IPv6 to work?:

There would be some labor overhead in keeping up with IPs assigned to specific users, and then modifying all that when one subscriber dropped and another was added. You could automate that to some degree, but human oversight would still be necessary.

What labour? It's just providing the addresses associated with the DUID.

With IPv4, the majority of ISPs simply do not have enough free network addresses to make all their users quasi-static. Of course with IPv6 this is no longer an issue, but old paradigms die slowly. This is why CGNAT is growing on the IPv4 side.

My IPv4 address is virtually static, but the host name is as permanent as my hardware, as it's based on the modem and router MAC addresses. I also get 2 IPv4 addresses.

Somebody somewhere has to configure something for all that to work. That's the labor I'm talking about. Even an automated system needs a human to set it up initially and then keep an eye on it.

As for what your ISP does, that has no bearing on what other ISPs may do. If I recall, you've posted several times that your ISP is one of the big Canadian telecoms. They've owned large IPv4 address blocks for probably forever. They can likely afford to be generous with quasi-static IP assignments on residential circuits. Smaller and/or newer ISPs don't have the luxury of owning huge IPv4 blocks. They will, of necessity, have to adopt other strategies.

My local ISP owns exactly a single /24 IPv4 netblock. They do have a large IPv6 block. They use CGNAT for the IPv4 block out of necessity. They keep saying they intend to offer IPv6 service, but so far have not gotten that off the ground. Of course they are only about 18 months old at this point, so I'm cutting them some slack. It's also true that in my town there is no other choice but cable Internet, and their speeds are asymmetrical (1 Gig down but only 50 meg up) and they also are using CGNAT now . I don't consider any type of satellite Internet service as viable (my personal opinion) due to the inherent latency. If I had zero other options, then I might consider satellite.

johnpoz

@bmeeks said in Why do I have to 'Track Interface' on LAN to WAN for IPv6 to work?:

If I had zero other options, then I might consider satellite.

Exactly.. I love the tech and ability to do it.. Making great strides - and can/could be very useful.. Hey you need internet in the middle of nowhere - clicky clicky, boom your on the internet. This is not something you would host services off of, etc.

From my understand IPv6 is still not enabled on it - at least not globally.. But who cares - its never going to be a "hosting" solution. Why would you need inbound unsolicited inbound traffic to some connection you bring up in the middle of nowhere?

I would never go sat, I have no need for it - because I can just get a wire.. Now if I was out in the middle of nowhere.. Sat might be better than my cell connection - shoot cell might not even be available if actually in bum f_ck ;)

I have high hopes for the tech.. But it will never be a "replacement" for a wire..

johnpoz

@JKnott said in Why do I have to 'Track Interface' on LAN to WAN for IPv6 to work?:

That's a hanging offence!!!

Still waiting for you to give just "one" example of why I need Ipv6.. Name one resource that I can only get to via IPv6.. Been asking for YEARS NOW!!!

Other than some furry/midget p0rn site that billy is running out of his house and his ISP only gives him an IPv6 address.. ;)

Told you my comment would tick off our resident fanboy ;) hehahahahha

JKnott

@johnpoz said in Why do I have to 'Track Interface' on LAN to WAN for IPv6 to work?:

Still waiting for you to give just "one" example of why I need Ipv6.

I cannot give an example for you personally, but there are a lot of people stuck behind CGNAT or no IPv4 at all. For them, IPv6 is now a necessity. Those people tend to be largely in Asia, where they never had a lot of IPv4 addresses to deploy but, even in North America, there are people stuck behind CGNAT. See message above from bmeeks: "They use CGNAT for the IPv4 block out of necessity."

bmeeks

@JKnott said in Why do I have to 'Track Interface' on LAN to WAN for IPv6 to work?:

For them, IPv6 is now a necessity.

Depends on the specific need. For instance, I currently have no IPv6 capability. But the only thing that is preventing me from doing is directly accessing my home network via VPN where the VPN server is running on my pfSense firewall (because I'm behind CGNAT on my IPv4 address). There is nothing else on the Internet that I would reasonably want to access (that I am aware of) that I am prohibited from accessing due to me not having an IPv6 connection. I think that is @johnpoz's point. I don't require IPv6 to surf the web. And every user in the world still needs an IPv4 connection to the web in order to access the full web. There are still sites with no IPv6 address. U.S. retailer Walmart is one I found, plus amazon.com does not show an IPv6 address via nslookup (at least for me). But www.amazon.com does show an IPv6 address by way of the CDN hosting that domain. There are other examples of IPv4-only websites. I am not currently aware of any IPv6-only major website. I think I could turn the table on your statement and say instead "for everyone, IPv4 is a necessity".

Setting up and learning IPv6 is most certainly a good thing if you have it available and you want to prepare for the future. But if your ISP has a crappy IPv6 implementation (or none at all), then you don't HAVE to use IPv6 or else some large swath of the Internet will be unavailable for you. That's just not the case right now. And that is the point @johnpoz makes. You are not required to have IPv6 to surf the web. There may be some IPv6-only ISP out there in the world someplace who only gives residential customers IPv6, but even that ISP must have IPv4 connections to the web or else there would be many sites his customers could not access. I suspect that ISP would use CGNAT for IPv4 residential customers.

True that in areas with limited IPv4 address space where CGNAT rules in that block, having IPv6 is necessary if you want to have direct access back into your pfSense from the Internet. But even then other alternatives exist such as LogMeIn or VPS configurations where your pfSense box behind CGNAT could establish an "always on" connection to a third-party website and through that afford you secure access back into your private home network.

I'm going to assume you don't mean to imply that in some parts of the world if you don't have IPv6 you can't use your Internet connection. I'm not aware of any place like that (not saying impossible, but I certainly have not heard of one). But when you say "IPv6 is a necessity", it seems to shade in the direction of without IPv6 you can't surf the web. It is more accurate to say that without IPv6 some things will be either hard or impossible to implement in some ISP territories.