BT Full Fibre only partially functioning via pfSense Router
-
I have the same settings for my BT FF500 connection and it works fine for me - also using Unifi access points. What do you get if you try https://ipv6test.google.com/ - does it show you're using IPv6? I am assuming you are using ISC DHCP?
Do you have a firewall rule to allow IPv4+6 ICMP for ping - this may be needed for IPv6 to work correctly.
Why do you have a WAN2 interface - what is that for? Have you tried removing it?
-
@brookheather thanks for confirming your settings are the same, I will have to try that test link later as I am back on the BT Hub currently so my toddler can watch Disney+!
I believe the firewall rules for the LAN are the default currently - there's two separate ones for IPv4 and IPv6 and then there's a third which I changed to be IPv4+IPv6 - apologies, I can be more specific when I can get pfSense back in play.
The WAN2 connection is a 4G Modem which is currently set up so it takes over if the main connection drops - I have tried with WAN2 disabled too but no difference!
Connected to the BT Hub at the moment if I navigate to a "what's my IP" site I get an IPv6 starting 2a00:etc and an IPv4 starting 86.182.etc but when I was on pfSsense I got a similar IPv6 but the IPv4 would just come up "unavailable" - so, as someone who admittedly knows very little about this, I was thinking that suggested IPv6 was ok but something was wrong with my IPv4 settings somewhere and perhaps that was stopping certain sites and devices working?
-
Did you set an IP for the WAN_PPPOE Gateway Monitoring - the default doesn't work as the BT gateway doesn't respond to pings. I have my monitor IP set to 1.1.1.1 - perhaps pfSense is thinking your BT connection is down and routing traffic to WAN2 instead which is why you don't have IPv6 working? I would keep WAN2 disabled - you shouldn't need it with FTTP?
-
@brookheather I have changed mine to 1.1.1.1 as well and disabled WAN2 but you make an interesting point, I wonder if that failover is still trying to kick in and reroute to WAN2, potentially even if WAN2 is disabled?
Think that'll be my next thing to try, removing all traces of that failover and disabling WAN2 and see if that does it!
-
If you're only seeing IPv6 for clients you might have a NAT issue, IPv6 is not NAT'd. Check the outbound NAT rules. If you eve changed the mode to manual you'd need to update them or switch back to auto/hybrid.
But, yes, that setup absolutely should work.
Steve
-
Hi,
I had been scratching my head for some time with BT Business FTTC and IPv6, my symptoms were similar. I could not access this forum when IPv6 was enabled, but I could ping all IPv6 addresses on the internet.
Through trial and error and a lot more head scratching I found my issue, turned out to be Baby Jumbo Frames on the WAN interface instead of normal MTU of 1492.
My setup is a bit different as I use Proxmox as a hypervisor and Pfsense as a VM, I use vmbr0 interface in Proxmox for vtnet0 LAN in Pfsense and another seperate NIC vmbr1 to use for WAN.
Pfsense is setup for PPPOE and IPv6 set to DHCPV6.
In Proxmox vmbr1 is set to MTU of 1508
In Pfsense the WAN interface MTU is set to 1508
In Pfsense WAN advance options tick Force MTU and enter MTU of 1500 in Link ParametersWith your setup you should just need the last two lines and ignore Proxmox settings.
I dont know why this works or if its the right way to do it but it works.
Everything is now working for me perfectly except my dashboard firewall log does not show source ports anymore.
Strange!
Hope this helps,
fic.
-
Thanks for all the suggestions, finally getting an opportunity to look at this properly again today - wish me luck!
-
OK, so now I have IPv4 working (not 100% sure what setting made that work...) but IPv6 not. If I go to the ipv6test.google site it says I don't have ipv6 and if I go to an IP Checker I get an IPv4 Address showing (the BT 82.X.X.X one) but no IPv6.
In pfSense I do see an IPv6 address from the WAN:
Any ideas what I might be missing?
-
@MattDownes89 So what are your DHCPv6 Server settings? Have you set the IPv6 Prefix ID on the LAN settings under Track IPv6 Interface?
-
@brookheather thanks for continuing to help, I have LAN set to track interface and then this:
But when I go to the DHCPv6 Server it's not enabled...
Guessing this is the issue? Only trouble is... I don't remember ever configuring these before so I don't actually know what should be set in here?
Any help appreciated, apologies for only having a basic level of understanding!
-
That's fine. How do you have the WAN and LAN configured for IPv6 though?
It's probably at least mostly corret since it has pulled a prefix and is using it on the LAN.
Go to Diag Ping in pfSense and try to ping out using IPv6 there. Does that work? If not what error is shown?
-
@MattDownes89 I have my IPv6 Prefix ID set to 1 and you need to set the Prefix Delegation Size to 64 (and select Enable DHCPv6 server on LAN interface). You shouldn't need to change any other options though personally I set the IPv6 DHCP address pool range from ::d:1 to ::d:ffff so it's obvious that the IPv6 address comes from the DHCPv6 server.
-
OK, so here's the WAN Settings:
And the LAN Settings:
And then the DHCPv6 Settings:
I have no doubt I am missing something simple somewhere, I think I have probably caused myself more issues by trying to update what I had rather than starting fresh with the new ISP.
@stephenw10 Not sure what address to Ping to test? But if I ping the ISPs IPv6 address that's successful so it's getting that far!
-
You should be able to set the WAN to pull a /56 prefix so you can have addresses on more than one internal interface.
But if you can ping a v6 address from pfSense itself this is almost certainly an issue with assigning v6 addresses to the clients.
Can we assume that your LAN side clients are not getting an IPv6 address at all currently?
-
Hi, not sure if you managed to get much further but heres what I got for LAN:
This is for WAN:
This is Router Advertisement as I dont use DHCPv6:
PS, I noticed your DHCPv6 is allocating a /56, I only allocate /64, maybe that doesnt help.
PPS, make sure you refresh your clients NIC to get new addresses.
fic.
-
@stephenw10 I have set to /56 as suggested.
I think it is an issue on the LAN side - if I do an 'ipconfig /all' I can see my Laptop has picked up an IPv6 Address and if I look at DHCPv6 Leases I can see it in there as the only IPv6 Device on the list, but it just shows as idle/offline whereas in the normal DHCP list for IPv4 I can see all the devices on my network and the vast majority have a green tick and say they're online.
-
Hmm, what pfSense version is that?
That client still has the IPV6 address.
-
@stephenw10 looks like I'm up to date:
-
You are not. Probably wouldn't make any difference for this but you should upgrade anyway. Try running at the command line :
certctl rehashThen recheck. You should see 2.7.2 available.
-
@stephenw10 - that did it, will update and see if anything changes!
