<![CDATA[So close on IPv6 yet so far away - Can't get to internet over IPv6 despite everything seeming to be in place.]]>I am trying to get my LAN IPv6 to route properly over my WAN IPv6 and seem to be running into a wall.

I can ping IPv6 addresses from the wan interface of the firewall using Diagnostics -> ping but I can do the same with the LAN interface.

If this is something obvious I apologies I just can't seem to formulate the right question to find the answer

Version info:
PfSense CE 2.7.2

ISP info
Rogers (former Shaw)

Using DHCPv6 to pull IPv6 successfully
f42e9c78-56e9-4710-ac78-6011bec89f4d-image.png
With "Request a IPv6 prefix/information through the IPv4 connectivity link" enabled
With "DHCPv6 Prefix Delegation size" set to none

a6702327-efd9-476f-9c94-b1236a029d63-image.png

(I know that Rogers doles out /128 prefix addresses (I can see this using with other client who use FortiGate routers to do IPv6) so I can't specify a proper prefix

02fbb226-ac90-4bb1-8be5-1e093df8258c-image.png

PfSense is coming up with a gateway address from Link-Local (fe80::201:XXXXX:XXXX:8445%vmx0)
d647e3fc-5048-4682-90d5-ae1f03749c2f-image.png

Gateway monitoring says it is up even if I put in a Public IPv6 address to verify with.

LAN info
I am using Kea DHCP on the LAN to dole out 2001:XXXX:XXXX:8e01::/64 addresses
Systems are getting addresses properly but when I look at the IPv6 Gateway on my systems they come back with another Link-Local address which I think is weird. On my Fortinet Clients this would come back as the IPv6 address of the LAN interface.
f2dca0ba-794e-430f-9588-062b3dd40625-image.png

I can ping other IPv6 addresses on my LAN.
I can ping the IPv6 interface on the firewall.
I can ping the IPv6 address on the WAN

I cannot ping any public IPv6 address

External hosts can ping my public IPv6 address.

I have a IPv6 rule in the firewall for outbound traffic that seems to be working as far as I can tell. The counter are going up.
91c67885-8329-4020-815d-92e38498a7df-image.png

So I don't know where to look next. This feels like a routing issue with the weird gateway address, but I can't seem to figure out what to do next.

UPDATE: So I turned on logging on the IPv6 rule and it is not recording traffic from the LAN to internet, but to a OpenVPN tunnel I also have on this firewall. Irritatingly enough traffic works over the VPN just fine, just not from my internal LAN to Internet

]]>https://forum.netgate.com/topic/189271/so-close-on-ipv6-yet-so-far-away-can-t-get-to-internet-over-ipv6-despite-everything-seeming-to-be-in-placeRSS for NodeFri, 17 Jul 2026 18:23:24 GMTSat, 20 Jul 2024 00:00:16 GMT60<![CDATA[Reply to So close on IPv6 yet so far away - Can't get to internet over IPv6 despite everything seeming to be in place. on Sat, 27 Jul 2024 11:32:22 GMT]]>@br8bruno said in So close on IPv6 yet so far away - Can't get to internet over IPv6 despite everything seeming to be in place.:

Not really sure, but I will as the ISP

They will ask you to execute a traceroute to, for example, 8.8.8.8
The second, third, maybe fourth IP listed is theirs - on of their equipment. Pick any of these, as long as they answer to ping.
Further on, you'll will find the main 'highway Internet core routers'.

]]>https://forum.netgate.com/post/1178443https://forum.netgate.com/post/1178443Sat, 27 Jul 2024 11:32:22 GMT<![CDATA[Reply to So close on IPv6 yet so far away - Can't get to internet over IPv6 despite everything seeming to be in place. on Sat, 27 Jul 2024 08:42:51 GMT]]>@Gertjan
Thank you for the reply.

In the end it was pfBlocker that was causing the problem. I didn't have to change any configuration, since they were not blocking anything. But I turned it off and on... now it all works.

I will try and find the correct pings to monitor. Not really sure, but I will as the ISP. Thanks.

]]>https://forum.netgate.com/post/1178439https://forum.netgate.com/post/1178439Sat, 27 Jul 2024 08:42:51 GMT<![CDATA[Reply to So close on IPv6 yet so far away - Can't get to internet over IPv6 despite everything seeming to be in place. on Fri, 26 Jul 2024 10:27:46 GMT]]>@br8bruno

All screen look, fine to me.
IPv6 uses 'prefixes' for the LANs, your ISP has 00->ff = 256 available.
Can't see if that worked out fine, as you've hidden them ^^

Where I've difference :

b8e21092-3b9c-4352-a282-3cab2ab29c6f-image.png

where the third gateway is my OpenVPN server, so that's valid.
But my WAN has an Ipv4 and IPv6 mode DHCP.

I don't understand your LAN gateway ... neither the 3 ? WAN gateways.

You have DHCP for IPv4 and DHCP6 for IPv6 - so the first two are the correct ones.

Btw : just for the fun : don't ping 2001:4860:4860::8888 (and 8.8.8.8 and 8.8.4.4) as that's a DNS server IP. Not a ping answering machine.
The day 'they' decide not to answer to a ping because this costs them a lot of bandwidth and bandwith == expensive they will shut down the ping answer. Result : your networks go down.
Solution : ping a nearby ISP-based IPv4 and IPv6 upstream device that answers to ping.
You pay your ISP (right ?) : they are payed to answer to your traffic, your pings so your pfSense can "test" the connection.

Image the situation : Google 8.8.8.8 goes down. As a result, half the planet will lose it's Internet connection (as dpinger will detect the ping loss, and continuously restart the WAN interface).
That will be the day I will be ROFL all day long.
It happened : remember Facebook being down all day ?

]]>https://forum.netgate.com/post/1178338https://forum.netgate.com/post/1178338Fri, 26 Jul 2024 10:27:46 GMT<![CDATA[Reply to So close on IPv6 yet so far away - Can't get to internet over IPv6 despite everything seeming to be in place. on Mon, 22 Jul 2024 06:33:56 GMT]]>@Gertjan

So you are aware I am running windows Domain controllers at this site. I modified them as required for the Prefix provided by the earlier steps.

DNS is working just fine
b3ae29cc-b71f-4263-846f-dbdd8e8cfe06-image.png

Back here I left myself some IP's for use on static devices

b43d4eed-7768-4b21-8a0d-305c08acc3b7-image.png

And I'm using this IPv6 address as the gateway address on the statically assigned systems
677ade63-ac9c-4491-800c-2e71c42e1a99-image.png

]]>https://forum.netgate.com/post/1177920https://forum.netgate.com/post/1177920Mon, 22 Jul 2024 06:33:56 GMT<![CDATA[Reply to So close on IPv6 yet so far away - Can't get to internet over IPv6 despite everything seeming to be in place. on Mon, 22 Jul 2024 05:54:17 GMT]]>@MerikFyndhorn

Delete these two hardcoded DNS entries :

ee617ff0-3d5a-4fe4-867f-2edfd548a0d9-image.png

you don't need them.
And the day your ISP decides to give you another prefix, you've broken DNS ...

]]>https://forum.netgate.com/post/1177915https://forum.netgate.com/post/1177915Mon, 22 Jul 2024 05:54:17 GMT<![CDATA[Reply to So close on IPv6 yet so far away - Can't get to internet over IPv6 despite everything seeming to be in place. on Sun, 21 Jul 2024 02:48:51 GMT]]>@JKnott
I guess I will have to adapt to the new way of things.:

Thanks for all your help!

]]>https://forum.netgate.com/post/1177852https://forum.netgate.com/post/1177852Sun, 21 Jul 2024 02:48:51 GMT<![CDATA[Reply to So close on IPv6 yet so far away - Can't get to internet over IPv6 despite everything seeming to be in place. on Sat, 20 Jul 2024 23:43:49 GMT]]>@MerikFyndhorn

Change the DHCPv6 delegation size to 56 or whatever your ISP provides. With 64 you'll only get a single /64. I just realized 64 was from back in the days when Rogers only offered a single /64. Now they provide a /56. I have corrected that link.

Eventually I do get a LAN IPv6 address to show, but as expected it is a address of external origin.
Since I think the ISP is providing me the range?

Is the take away from this? You can't run a different internal range for IPv6 than the external range or you can't route on PfSense? That seems wrong.... :(

Yes, you will get public IP addresses, which is what the Internet gods intended, before NAT messed things up.

]]>https://forum.netgate.com/post/1177846https://forum.netgate.com/post/1177846Sat, 20 Jul 2024 23:43:49 GMT<![CDATA[Reply to So close on IPv6 yet so far away - Can't get to internet over IPv6 despite everything seeming to be in place. on Sat, 20 Jul 2024 22:56:26 GMT]]>@JonathanLee

Yes indeed. The setting changes recommended by @JKnott did work, I'm just pouting about having the IPv6 range dictated inside my network, but I can get over that.

DHCPv6
0ba28542-38ea-479b-968a-9f7cd45de4ae-image.png

Router Advertisement
814551ca-8832-4b2b-90e3-548b0c9018f8-image.png

DNS
7e362625-9eb3-4126-981f-db1a47dd4d66-image.png

Yes on LAN IPv6
c1f038a1-8d10-4f6e-b7d3-e3fdca0d2e1e-image.png

Also IPv6 is not turned off on the firewall
13194c11-e06b-475c-a8f9-e6b144da1838-image.png

]]>https://forum.netgate.com/post/1177844https://forum.netgate.com/post/1177844Sat, 20 Jul 2024 22:56:26 GMT<![CDATA[Reply to So close on IPv6 yet so far away - Can't get to internet over IPv6 despite everything seeming to be in place. on Sat, 20 Jul 2024 22:48:02 GMT]]>@JKnott
Changes made to WAN as per your recommendation
965bea2f-ffe8-455c-adad-89c7f79a6b75-image.png

I am still getting the same IPv6 address as before.

Changes made to LAN as per your recommendation
8f2929bf-ac52-4dab-8c14-40245f34bc45-image.png

Eventually I do get a LAN IPv6 address to show, but as expected it is a address of external origin.
Since I think the ISP is providing me the range?

Is the take away from this? You can't run a different internal range for IPv6 than the external range or you can't route on PfSense? That seems wrong.... :(

Worse yet is the results when I test the implementation.
https://www.whatismyip.com/ give me my devices IPv6 not the external IPv6 of my firewall.

Feels like I'm hanging my bum out on the internet for all to see rather than directing them to the firewall, but maybe I'm just been sensitive.

]]>https://forum.netgate.com/post/1177842https://forum.netgate.com/post/1177842Sat, 20 Jul 2024 22:48:02 GMT<![CDATA[Reply to So close on IPv6 yet so far away - Can't get to internet over IPv6 despite everything seeming to be in place. on Sat, 20 Jul 2024 17:41:16 GMT]]>Have you enabled dhcp IPv6 and router advertising? Do your DNS server list contain some IPv6 servers to resolve with? Does your LAN have IPv6 also assigned to it?

]]>https://forum.netgate.com/post/1177818https://forum.netgate.com/post/1177818Sat, 20 Jul 2024 17:41:16 GMT<![CDATA[Reply to So close on IPv6 yet so far away - Can't get to internet over IPv6 despite everything seeming to be in place. on Sat, 20 Jul 2024 11:10:45 GMT]]>@MerikFyndhorn

Here's Rogers pfSense configuration. How does it compare with what you have?

]]>https://forum.netgate.com/post/1177796https://forum.netgate.com/post/1177796Sat, 20 Jul 2024 11:10:45 GMT<![CDATA[Reply to So close on IPv6 yet so far away - Can't get to internet over IPv6 despite everything seeming to be in place. on Sat, 20 Jul 2024 02:51:51 GMT]]>The modem is definitely in Bridge Mode

I operate with a static IPv4 assigned by my ISP.

Rogers does not provide static IPv6 address, as as I mentioned earlier I am getting an IPv6 address successfully using DHCPv6.

When I switch to SLAAC I get no IPv6

]]>https://forum.netgate.com/post/1177781https://forum.netgate.com/post/1177781Sat, 20 Jul 2024 02:51:51 GMT<![CDATA[Reply to So close on IPv6 yet so far away - Can't get to internet over IPv6 despite everything seeming to be in place. on Sat, 20 Jul 2024 02:21:23 GMT]]>@MerikFyndhorn

Is your modem in bridge mode? That's what you need for pfSense to handle IPv6 properly. I don't know what modem you have, but with Rogers modems it's trivial to switch to bridge mode. As soon as you login to the modem, the button is right in front of you.

BTW, unless you have a specific need for DHCP, you're better off using SLAAC, as thanks to some genius at Google, Android devices won't work with DHCPv6.

]]>https://forum.netgate.com/post/1177779https://forum.netgate.com/post/1177779Sat, 20 Jul 2024 02:21:23 GMT