IPv6 testing

DSI

I have just freshly installed latest snapshost and had my system synced with pfSense-smos repository.
I did follow this instructions and it still says "The gateway address 2001:470:1f0a:XXXX::1 does not lie within the chosen interface's subnet."

I also noticed interesting behaviour. After gitsyncing with IPv6 repo, automatic checks for new firmware/auto update don't work anymore. It says "Unable to check for updates."

databeestje

did you reboot after gitsyncing?

DSI

Yes, I did reboot.
I will now test on other freshly reinstalled pfSense machine.

Edit: Same issue on other machine :(

Cino

I've been making some progress here. In my last post, I mention I had to go into the WAN interface and save it to route to the internet… The issue with "Unable to check for updates." is related I think. Over the weekend I setup a 3G Wan for failover. Because now I have gateway rules define for the LAN firewall tab, my clients can route to the internet without having to save the Wan interface config. The pfsense default gateway is getting messed up some how which causes the "Unable to check for updates" error and i'm unable to ping www.yahoo.com from pfsense but i can from the clients. When I save the WAN interface page, the pfsense default gateway is corrected, the IPv6 tunnels comes up, able to ping to ip4 websites from the shell.

The "The gateway address 2001:470:1f0a:XXXX::1 does not lie within the chosen interface's subnet." error: I recieved the same error when I follow the how-to write up. I ended up with the same error. In the how-to, we are using a /128 subnet. The gateway doesn't like this unless you put the subnet as /64. Was I changed the gif/wan interface to /64, I was able to put the gateway address in. But then this error poped up in my syslog

php: /interfaces.php: The command '/sbin/ifconfig gif0 inet6 2001:470:1f06:e7f::2 2001:470:xxxx:xxxx::1 prefixlen 64 ' returned exit code '1', the output was 'ifconfig: ioctl (SIOCAIFADDR): Invalid argument'

After the gateway was selected in the WANIPv6 interface, i changed the subnet back to /128 and the above error went away. I need to do some more testing to see if either /64 or /128 works… I left it at as /128 becuz i dont see the above error. HE.net tunnel info pages says its a /64 address...

I have to do some futher testing but I can't ping ipv6.google.com but i'm able to browse to the site(test-ipv6.com gave me 9/10, dns dont have ipv6 from my isp) if i ping ipv6.google.com from pfsense, "ping6: UDP connect: No route to host" from Windows 7, "Destination net unreachable"

Also there is a php error on the firewall rules page.. The page works, see screen shot:

rules_page_error.jpg_thumb

Cino

@databeestje:

The subnet check on the gif interface should now properly work again. Have not verified yet, gitsync your install to get it.

You also get (hopefully) working traffic counters for ipv6 traffic.
IPv6 packet counts are logged but not graphed yet.
Menu banner shows IPv6 addresses now too.
ICMP6 rules have been relaxed so that we might have a shot at getting dhcp v6 messages out.
I also added unblockable ICMP6 rules to make sure basic connectivity is never blocked.
Addition of Bogon support for IPv6 prefixes, although a tad large at 30k entries

databeestje great work so far!! Where can I find the traffic counters you are talking about? Under 'Status: Interfaces' the counters dont increase but 'Status: Traffic Graph' is graphing traffic.. The Interface widget on the main page shows that the WANIPv6 is up but it doesn't show the IPv6 address. 'Status: Interfaces' does sure the IP address tho.

I went to http://ipv6-speedtest.net/ to test the speed of the tunnel, wow its slow! 1m/.5m on a 50m/5m cable modem… But hey we are only testing this out to be ready for ipv6 when we will need it....

buraglio

I'm seeing similar issues with the default route. I've gotten around it by just throwing the route in the cli.
I'm also seeing issues with rtadvd not working right, but that could be an artifact of the box having some of my crufty old IPv6 stuff hacked into it, not sure yet. I'll look more at this tomorrow.

nb

buraglio

It also appears as if soem of the other routing bits are broken. After a reboot, I had no v4 default route but it clearly showed up as there and "alive" in the status_gateways. I added that manually in the CLI just to get it working before I sleep.

nb

DSI

Thank you Cino, I've got it working following your instructions.

But yes as buraglio says there must be some issue with IPv4 default route. For example whenever I change something on one of the interfaces page, default IPv4 route gets lost and I have to click "Save" on WAN interface to get IPv4 route working again. Also, after each reboot you also have to click "Save" on WAN interface page to get IPv4 route working.

buraglio

@buraglio:

It also appears as if soem of the other routing bits are broken. After a reboot, I had no v4 default route but it clearly showed up as there and "alive" in the status_gateways. I added that manually in the CLI just to get it working before I sleep.

nb

A few other observations, it appears as if (at least on my setup) I'm getting firewall blocking the all routers multicast address, which isn't really a good thing. I have a rule that allows all ipv6 from any to any on the LAN. It would also be useful to have ndp on the boxes to view neighbor status. I can work on adding ndp when I get some time if you're interested.

DSI

I've noticed that with latest Beta Snapshot (built on Wed Feb 2 04:04:51 EST 2011) hitting "Save" button on WAN interface after reboot isn't needed anymore…so it looks like droping default IPv4 route is fixed.

buraglio

Nice. I'll to an update.

Cino

@|DSI|:

I've noticed that with latest Beta Snapshot (built on Wed Feb 2 04:04:51 EST 2011) hitting "Save" button on WAN interface after reboot isn't needed anymore…so it looks like droping default IPv4 route is fixed.

I just updated my box and I still have hit save. It could because that I have multi-wan (3G USB for backup when i'm home and dont need it for my laptop).

MrKoen

I've been runnning pfSense 1.2.3 with a hacked config to get a IPv6 tunnnel to work for a while. Worked okay, but most of the web GUI wasn't usable anymore with the custom modified config files. Several forums, of which this one, speak joy about 2.0 beta and IPv6 tunnels through HE, so I'm trying to get it to work here. Unfortunately it does not seem to be able to set up a tunnel to HE. I've followed the walktrough exactly and don't see what I'm doing wrong.

Could somebody that did get it to work please post their ifconfig output of the WAN, LAN and GIF0 interfaces here please? Perhaps that shows what's wrong with my setup.

buraglio

It does work with the HE tunnel. I, too, had hacked in support for it with rudimentary gui bits well over a year ago but this is far superior, even knowing that it is beta.
My guess is that you don't have a default v6 route.

netstat -rn should look something like this in the v6 section:

Internet6:
Destination Gateway Flags Netif Expire
default 2001:xxx:xxx:xxx::1 UGS gif0
::1 ::1 UH lo0
2001:xxx:xxx:xxx::1 2001:xxx:xxx:xxx::2 UH gif0
2001:xxx:xxx:xxx::/64 link#1 U rl0
2001:xxx:xxx:xxx::1 link#1 UHS lo0
fe80::%rl0/64 link#1 U rl0
fe80::2e0:4dff:fe83:1569%rl0 link#1 UHS lo0

Do you have an entry for "default"?

Cino

@buraglio:

Do you have an entry for "default"?

I dont have a default route. When I reboot, i dont any have defaults. When I save the WAN interface, a default route is added for IPv4. I tried doing the same thing for my WANIPv6 but it doesn't create a default for IPv6.

Did you enter the route manually? If so, how did you add it for IPv6?

buraglio

Yeah, I'm entering it manually for now. For IPv6 on the CLI enter:

route -n add -inet6 default 2001:xx:xx:xx::1

where 2001:xx:xx:xx::1 is the other side of your HE tunnel.

MrKoen

buraglio, thanks for your help. Í surely believe you IPv6 tunneling will be much better in 2.0, so I'm hoping I can get it to work like you guys.

The manual databeestje provided at his website must contain an error somewhere. It kind of jumps from the left to the right with missing the step in the middle. For example when configuring the WANIPv6 interface he all of a sudden already has a gateway while adding that is dealt with after configuring the interface. And configuring the gateway gives the address not within range error like others already have reported here. Can't believe it did work for some people. They must have done something different. I'm wondering what.

My setup indeed lacked a default route. I already tried adding it manually, but to no avail. I also saw a difference between the assigned IPv6 tunnel addresses between my hacked pfSense 1.2.3 setup and this pfSense 2.0b5 setup. Before I could add the default IPv6 route on the command line, I needed to assign the IPv6 tunnel addresses to my GIF0 at the command line first. What I did:

ifconfig gif0 inet6 2001:470:1f14:xxx::2 2001:470:1f14:xxx::1prefixlen 128

after that, I could manually add the default route for IPv6 using:

route -n add -inet6 default 2001:470:1f14:xxx::1

I can send out a ping6 to ipv6.google.com now, but it does not get a reply. Still no working IPv6 tunnel. Is there somewhere where I can look to find out why it can not connect?

Does the Gateway status page (/status_gateways.php) show the HE_NET gateway as online like on the screenshot of databeestje? Here it keeps showing gathering data.

I have attached the output of my interfaces. DE0 is my internet facing NIC. It's on a private range DMZ that connects to the outside world. So it's behind NAT. DE1 is my LAN facing NIC and GIF0 obviously is the bridge. I am able to ping the HE IPv6 gateway from the console and on the border gateway I have enabled ping echo replies. I also already tried setting the pfSense instance as the default DMZ host to see if the problem was NAT related, but no results either. Maybe something is wrong in my ifconfig?

gif0.png_thumb

de0.png_thumb

de1.png_thumb

iFloris

@Koen:

Can't believe it did work for some people. They must have done something different. I'm wondering what.

You are right that some people did something different.

I was having the wrong subnet error when trying to add the gateway, so I edited the config.xml file directly using expandrive to mount the sftp as a drive and editing the file directly so I could see whether my edits were having the desired effect.
Having added the gateway manually, the tunnel came online and I was able to add the gateway to the interface WANIPv6 as is shown in the guide.
Lastly, I added the anycasted he.net ipv6 dns server to the dns server list in general.

The result is a 10/10 score on http://test-ipv6.com/ and a generally fast IPv6 internet connection (20/8 mbits).

Also, lots of rebooting!

images:
(sorry about the white space)

MrKoen

iFloris, your screenshots make me jealous ;D I'm coming from the Microsoft world, so all this Linux stuff is fairly unknown territory for me. Would you be willing to help me troubleshoot? Possibly via MSN contact? In return I will put an updated howto online which will show all the steps to get it to work :)

iFloris

@Koen:

Would you be willing to help me troubleshoot?

Of course I'm willing to help, but I fear that I have may have inadvertently led you to believe that I am rather more proficient at all this than I am.

As I wrote in an earlier post, I simply followed the steps that Databeestje wrote up in his howto but sidestepped the issues I ran into somewhat.
The issue that I had, was that I couldn't get past the part of the howto telling me to edit the gateway as pfSense complained that the v6 address that I entered was outside the chosen interface subnet.
I skipped that step for the time being and finished the howto. Then, I manually edited the gateway in the config.xml file on my pfSense machine and entered the proper v6 address. Having done that I was able to select the gateway in the WANIPv6 interface and the tunnel became operational.

Also, I'm coming from the Mac OS X world, so all this Linux (well, BSD Unix really) stuff is fairly unknown territory for me as well!