IPv6 network alias and firewall rule
-
Hello fellow pfsense admins. I am looking for knowledge on a topic that is eluding me.
I have two sites. Site A has a server, site B has clients. Site B has a /60 dynamic IPv6 prefix delegated from the ISP with /64 networks assigned to VLANs using the handy Track Interface settings. Clients are assigned addresses in their respective networks and otherwise have a working IPv6 setup.
On Site A how can I write a firewall rule to allow incoming traffic from Site B's networks? I have successfully made a firewall rule on Site A allowing a client from Site B but when that client has a new IPv6 address i need to manually update the rule.
I'd like to have Site B somehow tell Site A what networks it has and the firewall rule to adjust automatically. Could I use DDNS somehow? Like have a DDNS client on Site B update a record of LAN 1 interface, Site A queries the record, somehow converts that address to only the network address and update the firewall rule?
I'm at a loss.
-
@bmarkel I would use IPv4 for that. But you also could use ULA or NPt.
-
How would ULA work across the Internet? Assuming the prefix is constant, the network can be used to filtering.
-
Thanks for replying. This gave me some food for thought.
IPv4 is working between the two sites. With the magic of NAT, each VLAN (internal network) at Site B is automatically masked by its WAN IP address. Site A only sees the one source IP address. I've setup a Dynamic DNS client on Site B to update a public DNS server that is periodically updated. On Site A I've setup an IP Alias matching the public DNS record. This allows the firewalls to run unassisted and a firewall rule to automatically update to a new address.
IPv6 isn't as easy. I hoped to make a similar setup as i have with IPv4. The additional magic I need is for the router at Site A automatically update its IP Alias periodically. As of now I make Site B update a public DNS server with the LAN 1 interface ip address. Then I manually do a AAAA record lookup on my PC, do some IPv6 subnet math to collect the /60 network in use at the far end and manually update the IP Alias with that network number. Honestly it works pretty good because the provider doesn't change things very often. I usually get the same network. This setup lives on a house of cards because if the Site B IPv6 address changes the firewall rule on Site A is incorrect.
ULA wouldn't work very well in this situation because i'm trying to send this traffic across the public internet.
NPt wouldn't work either because I don't own a static IPv6 network or have any way to force Site B's network to stay static. It could change at any time as is the ISPs prerogative.
One idea i've thought about is to write a script to do what i've been doing manually. Make the script run from a machine living at Site A, do the DNS lookup collecting an address, do some subnetting math then hit an API on the pfSense router to update the IP Alias.
Another idea is to wrap all this traffic with an IPsec tunnel between the sites.
continuing to chew on this... the script seems like a fun challenge.
Privacy Policy · Cookie Policy