PfSense - Hurricane Electric - Tunnel Broker Setup
-
Guys,
I have spent numerous hours here tonight trying to setup HE on my pfSense v2.2 instance. What should be a very straight forward tunnel setup is riddled with errors that NO ONE has addressed in the guide at http://doc.pfsense.org/index.php/Using_IPv6_on_2.1_with_a_Tunnel_Broker.
I have tried numerous times to configure a simple tunnel according to this guide and it fails at the same point each time. When you goto Status > Gateways, "offline" is all you will see regarding the newly created interface. Then further trying to establish DHCPv6 server functionality is a maze of what-nots.
Is it just me or is the implementation of IPv6 totally confusing and way harder than it has to be. Seems like somebody is hacking at it by not wanting to screw with IPv4 as much as possible, and everything is getting mashed up and half-ass works.
Can someone please create a new confirmed to work guide for HE or another confirmed working IPv6 tunnel broker?
Thanks for taking the time to read this!
-
IPv6 dual-stack and tunneling is just sort of inherently complicated.
Hurricane tunnels work just fine on 2.2. I'm posting this to 2610:160:11:11::68.
You'll probably have to provide some details of your config in order for anyone to help you find the mistake.
-
Why don't you post your firewall rules, and other configurations you have been changing here and lets see what it looks like
At minimum 2 people who are currently running that are seeing this thread. Maybe more.
It does work BTW.
-
Ok stand by, I am going to create screenshots of all steps and we can analyze together.
-
Please include what you can from the tunnelbroker config. Thanks.
-
-
Those are all the steps executed like the guide suggests. Did I miss something?
Yes I didnt complete the DHCP part in this iteration. I just want to get IPv6 functionality from pfSense before I add clients to the mix.
-
Let me look at it. In the meantime you might as well go request a /48 in case it takes a few minutes. You'll need it for your LAN(s). Unless all you'll ever have is the one LAN.
-
/48 requested and assigned now…
-
I assume IPV6 is enabled on pfsense at System: Advanced: Networking?
-
yes it is…
-
You need to create a gateway for 2001:470:1f0e:d8e::1
Then add an IPv6 static config to the OPT1 interface you assigned to the GIF tunnel.
Set it to 2001:470:1f0e:d8e::2/64 with the gateway you just created as the upstream gateway.
-
You don't want it on the LAN?
Is your client ipv4 address in HE matching your WAN IP?
I gave /64 to each physical interface (except WAN) and each openvpn interface for myself.
-
I dont understand what you mean by creating a Gateway? Are you talking about editing the gateway address for the existing 'HEIPV6_TUNNELV6' gateway?
Also the created interface for the tunnel is 'heIPv6' not opt1, are you referring to something else?
-
I didn't see you renamed it. Yes, assign the IPv6 static config to your HeIPv6 interface.
-
i have a google hangout if anyone wants to join to help out, https://plus.google.com/hangouts/_/guo7p5otgva35aq22jly7itrpqa
-
on the gateway you have as HEIPV6_TUNNELV6 change the address from dynamic to your interface ::1
-
done
-
You don't want it on the LAN?
Is your client ipv4 address in HE matching your WAN IP?
I gave /64 to each physical interface (except WAN) and each openvpn interface for myself.
We just need to get the tunnel and it's assigned interface up so he can ping his ::1 at hurricane. Then we can dole out /64s out of his shiny new /48 to his local interfaces.
-
on the gateway you have as HEIPV6_TUNNELV6 change the address from dynamic to your interface ::1
received an error…
-
What did you do on the interface then? Needs to be the ::2 /64
-
-
That shouldn't be complaining.
Is the tunnel up? Can you ping6 your ::1? It'll only work from pfSense itself.
-
Back in 45 minutes. Gotta roll.
-
That shouldn't be complaining.
Is the tunnel up? Can you ping6 your ::1? It'll only work from pfSense itself.
-
In System: Gateways: Edit gateway > gateway, I have no IP. Its set to dynamic
In my HE IPV6 interface, I have none and none for my IPv4 and IPV6 configuration.
I'm still interested to know… Is the client IP at the HE website the same as your current WAN IP?
-
In System: Gateways: Edit gateway > gateway, I have no IP. Its set to dynamic
In my HE IPV6 interface, I have none and none for my IPv4 and IPV6 configuration.
I'm still interested to know… Is the client IP at the HE website the same as your current WAN IP?
Yes, the HE client ipv4 address is my WAN ipv4 address.
-
Reboot and see if things change/
-
-
Mine is also a /48 - Never did a /64
I also have RADVD configured.
-
You still can't set the gateway to 2001:470:1f0e:d8e::1 ?
If not something is confused. Maybe delete the IPv6 interface and reconfig it or maybe restart.
-
Mine is also a /48 - Never did a /64
I also have RADVD configured.
I think it's automatic. I have a /64 I'm not using and can't give back. I figure he might as well config a /48 from the get-go. It don't cost nothin'.
-
Hmm. I can't create a gateway for my ::3. Same error. Time to do a little github diffing. The only address the gui will take is ::2, which is my interface address.
-
You still can't set the gateway to 2001:470:1f0e:d8e::1 ?
If not something is confused. Maybe delete the IPv6 interface and reconfig it or maybe restart.
no same error as before…
-
Hmm. I can't create a gateway for my ::3. Same error. Time to do a little github diffing. The only address the gui will take is ::2, which is my interface address.
ok, I have to get some sleep now. if you have some new ideas, shoot them over and I will try in the morning.
thanks for everyones time!
-
Roger that. If I had more public IPs I'd get another tunnel. I think there might be something wrong with that IPv6 gateway config page and its logic in determining the subnet of the interface. Not sure yet.
-
There are a few possibilities. Who is your ISP?
I am looking this over.
-
My IPv6 interface is 2001:470:x:67::2/64
My IPv6 Gateway is 2001:470:x:67::1
If I try to define another gateway of 2001:470:x:67::3 I get:
The following input errors were detected:
The gateway address 2001:470:x:67::3 does not lie within one of the chosen interface's subnets.
-
I think that his initial setup was 100% completely correct…
I think I had to click "disable this gateway" on the HEIPV6TUNNELV4 before mine would work though.
I didn't need to configure static IPV6 on the interface you talked about earlier
Also leaving the HEIPV6TUNNELV6 gateway set to dynamic works great for me.
I'm also pretty sure you get only 1 gateway per 1 GIF interface and only 1 GIF interface per 1 IPV4 public IP. (perhaps its different if you pay, but I doubt it)
The only other difference between mine and his is that mine is a /48
I have 3 set up like this. All working.
-
If I try to define another gateway of 2001:470:x:67::3 I get:
Why? Really, follow the docs, that works: https://doc.pfsense.org/index.php/Using_IPv6_with_a_Tunnel_Broker#Set_Gateway
