IPv6 testing

BlueMatt

The smos repo hasn't been updated in quite a while, and there have been many changes since then. I would recommend you set up proto 41 passthrough and set up an IPv6 router on a separate machine so that you can get the latest updates. You could also apply the commits since smos last updated the IPv6 repo you are using.

databeestje

Merged up with current 2.0 mainline. Still have not resolved the ipv6 support in the binaries from the snapshot builder

Zeon

We have just got 2x /48 subnets setup. One for our rack at one of the datacenters here in NZ (the DC is probably one of the 10 largest in the country and has less than 100 racks lol). The other for our office fibre connction. I will start the experiments!

databeestje

I've added a fix in 2.0 mainline so that it will not remove the default route when you update to a newer snapshot but have a ipv6 pfsense config. With basic connectivity still working it's a lot easier to re-sync against the git repo.

I have not managed to track down the builder issue where binaries are built without ipv6 support.

Cino

I was able to install your git with no issues using 2.0-BETA5 (i386) built on Thu Jan 20 05:02:05 EST 2011 but when I rebooted the box dhcpd wouldn't start. In the log it only gave Exit 1 as its error code. Any ideas?

databeestje

I'll have to check that dhcp issue out, I've successfully had simultaneous dhcp v4 and dhcpv6 active, not sure what broke. Could be a silly user or group thing.

Here is another bit of update.

I have slowly been building out support in pfSense, it can do CARP with ipv6 addresses for redundancy now and a test cluster I've built has been working fine for over a month now. That cluster is providing connectivity for a Nameserver, webserver and mailserver. Basic firewalling and routing is working as it should.

I have also been working on the Multiwan support for IPv6, this appears to be biting a number of small business networks or home users that have more then 1 internet connection.

For this I have implemented "Network Prefix translation" (NPt previously NAT66) support. The way this works is that you can use a ULA range on the LAN networks (I registered my ULA range on sixxs.net). The network prefix translation then replaces the left 64 bits of the network prefix with the global unicast range when traffic goes out onto the internet. It performs the reverse step for traffic directed to the global unicast address which is then mapped the correct ULA address.

In my test setup I have 3 WAN networks, each with their own global unicast range. Using this method all LAN devices have just 1 address and the pfSense firewall will perform all policy routing, this takes away all the need for intelligence on the LAN devices. This also makes all LAN devices directly reachable over either of the 3 internet connections. As long as I make firewall rules that permit the traffic ofcourse.

This is, in my opinion, a huge step forward for management of the network.

Never ever needing to change the local LAN addressing is a huge step in right direction.

Cino

i should had pasted my log but I think remembering seeing error about the group dhcpd wasn't define. How would I add that to via command line?

databeestje

I just committed a fix for the dhcp server group. It was supposed to be _dhcp, but I was using dhcpd instead.

That should now be fixed. Also, it appears that apinger and lighttpd binaries are now properly built with ipv6 support. Dnsmasq is built with ipv6 support too, I just don't know if it actually listens on a ipv6 socket.

derekivey

Hi all,

I'm having issues setting this up. I am able to ping IPv6 addresses from pfsense, but all of my machines on my LAN are unable to ping external IPv6 addresses.

Pfsense (2001:470:7:XXX:2 HE WAN IP / 2001:470:8:XXX:1 LAN IP):
[2.0-BETA5][root@pfsense.mydomain.net]/tmp(68): ping6 ipv6.google.com
PING6(56=40+8+8 bytes) 2001:470:7:XXX::2 –> 2001:4860:800f::63
16 bytes from 2001:4860:800f::63, icmp_seq=0 hlim=59 time=19.898 ms
16 bytes from 2001:4860:800f::63, icmp_seq=1 hlim=59 time=19.810 ms
16 bytes from 2001:4860:800f::63, icmp_seq=2 hlim=59 time=21.954 ms
16 bytes from 2001:4860:800f::63, icmp_seq=3 hlim=59 time=19.631 ms

LAN Computer (2001:470:8:XXX::9)
Pinging Google:
D:\Users\Derek>ping 2001:4860:800f::63

Pinging 2001:4860:800f::63 with 32 bytes of data:
Request timed out.
Request timed out.
Request timed out.
Request timed out.

Traceroute:
D:\Users\Derek>tracert ipv6.google.com

Tracing route to ipv6.l.google.com [2001:4860:800f::68]
over a maximum of 30 hops:

1 * * * Request timed out.
2 * * * Request timed out.
3 * * * Request timed out.
4 ^C

Pinging Default Gateway (Pfsense):
D:\Users\Derek>ping 2001:470:8:XXX::1

Pinging 2001:470:8:XXX::1 with 32 bytes of data:
Reply from 2001:470:8:XXX::1: time<1ms
Reply from 2001:470:8:XXX::1: time=2ms
Reply from 2001:470:8:XXX::1: time<1ms
Reply from 2001:470:8:XXX::1: time<1ms

Ping statistics for 2001:470:8:XXX::1:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 0ms, Maximum = 2ms, Average = 0ms

I see traffic being passed in the firewall when I ping Google and also when I try to ping my self from a website (http://www.subnetonline.com/pages/ipv6-network-tools/online-ipv6-ping.php), so I'm not sure what's going on. Here is a screenshot of my log:

I have disabled the Windows firewall on my PC.

I also tried to run the IPv6 test:

Any ideas?

Thanks,
Derek

derekivey

I fixed my issue. For some season pfsense was not forwarding IPv6 traffic. I ran:

sysctl net.inet6.ip6.forwarding=1

Where do I need to go to set this so it keeps that setting if I reboot pfsense?

Thanks,
Derek

databeestje

you can set that sysctl in the system tunables.

I think you just didn't reboot after gitsyncing. It's in the rc.bootup script.

Cino

I've noticed a couple of other issues. After rebooting my box when the git is first installs, I can't access the internet. When i try to ping from the box to yahoo, it says there is no route. If i go to interfaces-WAN then click save-apply; I'm able to access the internet. I have to do this every time I reboot the box. When I install http://gitweb.pfsense.org/pfsense/mainline.git or just perform an update to the firmware, everything is back to normal.

When I try get the gateway under routing. The box wont let me input the ipv6 address that i got from he.net. It says the subnet is not within the range. If I leave the gateway blank and click save, it puts the ipv6 address that i try to manually enter.

When creating the WANIP6 interface after creating the gateway, I don't get an option to select the gateway.. Only option is none.

My box is setup with a DHCP WAN from my ISP (TWC). 1 LAN, 2 OpenVPN connects(i didn't create interfaces for them, 1 roadwarrior, the other is a site2site). I have a few packages installed but snort is the only networking one that would touch the wan interface.

When i have time I will do a fresh install without restoring my config file and see if there is a difference.. I've been meaning to do this since I have issues with the traffic-shaper. I can't access the internet after using the shaper wizard.. Somthing is blocking the traffic but i dont see it in the logs…. But that issue is for another thread :-)

derekivey

@databeestje:

you can set that sysctl in the system tunables.

I think you just didn't reboot after gitsyncing. It's in the rc.bootup script.

Ahh, ok that must've been the issue. Yeah, I never rebooted.

Thanks!

Derek

Efonnes

Something that might be useful to those who are trying this code: once you've set up gitsync for the first time, there is an additional option on the firmware updater settings in the web gui to gitsync when an update has been installed. This way you won't need to run gitsync after the reboot (unless the gitsync failed for some reason). I might later add some kind of pre-update check to make sure it is possible to do the operations needed for the gitsync, like fetching the code, etc., and cancel the update if the gitsync will fail - useful for when it is critical that the gitsync succeeds.

gnhb

Hi guys,
I really want to participate in the IPv6 fun here, but all my routers are running nanoBSD firmware and gitsync doesn't work there. What can I do?

GB

databeestje

We might need to investigate in somehow producing a build or snapshot based on this branch, we'll investigate.

sullrich

@gnhb:

Hi guys,
I really want to participate in the IPv6 fun here, but all my routers are running nanoBSD firmware and gitsync doesn't work there. What can I do?
GB

gitsync should work on nanobsd? Just need to make the image rw before you run it?

jimp

Last time I tried, it ran out of space on /var trying to actually install git.

sullrich

Custom images built from Seth's REPO:

http://cvs.pfsense.org/~sullrich/ipv6/

m4rcu5

@sullrich:

Custom images built from Seth's REPO:

http://cvs.pfsense.org/~sullrich/ipv6/

Nice, is it auto build like the normal snapshots?

-m4rcu5