Navigation

    Netgate Discussion Forum
    • Register
    • Login
    • Search
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search

    PfSense - Hurricane Electric - Tunnel Broker Setup

    IPv6
    5
    62
    18037
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • I
      icemanncsu last edited by

      Guys,

      I have spent numerous hours here tonight trying to setup HE on my pfSense v2.2 instance.  What should be a very straight forward tunnel setup is riddled with errors that NO ONE has addressed in the guide at http://doc.pfsense.org/index.php/Using_IPv6_on_2.1_with_a_Tunnel_Broker.

      I have tried numerous times to configure a simple tunnel according to this guide and it fails at the same point each time.  When you goto Status > Gateways, "offline" is all you will see regarding the newly created interface.  Then further trying to establish DHCPv6 server functionality is a maze of what-nots.

      Is it just me or is the implementation of IPv6 totally confusing and way harder than it has to be.  Seems like somebody is hacking at it by not wanting to screw with IPv4 as much as possible, and everything is getting mashed up and half-ass works.

      Can someone please create a new confirmed to work guide for HE or another confirmed working IPv6 tunnel broker?

      Thanks for taking the time to read this!

      1 Reply Last reply Reply Quote 0
      • Derelict
        Derelict LAYER 8 Netgate last edited by

        IPv6 dual-stack and tunneling is just sort of inherently complicated.

        Hurricane tunnels work just fine on 2.2.  I'm posting this to 2610:160:11:11::68.

        You'll probably have to provide some details of your config in order for anyone to help you find the mistake.

        Chattanooga, Tennessee, USA
        The pfSense Book is free of charge!
        DO NOT set a source port in a port forward or firewall rule unless you KNOW you need it!
        Do Not Chat For Help! NO_WAN_EGRESS(TM)

        1 Reply Last reply Reply Quote 0
        • K
          kejianshi last edited by

          Why don't you post your firewall rules, and other configurations you have been changing here and lets see what it looks like

          At minimum 2 people who are currently running that are seeing this thread.  Maybe more.

          It does work BTW.

          1 Reply Last reply Reply Quote 0
          • I
            icemanncsu last edited by

            Ok stand by, I am going to create screenshots of all steps and we can analyze together.

            1 Reply Last reply Reply Quote 0
            • Derelict
              Derelict LAYER 8 Netgate last edited by

              Please include what you can from the tunnelbroker config.  Thanks.

              Chattanooga, Tennessee, USA
              The pfSense Book is free of charge!
              DO NOT set a source port in a port forward or firewall rule unless you KNOW you need it!
              Do Not Chat For Help! NO_WAN_EGRESS(TM)

              1 Reply Last reply Reply Quote 0
              • I
                icemanncsu last edited by

















                1 Reply Last reply Reply Quote 0
                • I
                  icemanncsu last edited by

                  Those are all the steps executed like the guide suggests.  Did I miss something?

                  Yes I didnt complete the DHCP part in this iteration.  I just want to get IPv6 functionality from pfSense before I add clients to the mix.

                  1 Reply Last reply Reply Quote 0
                  • Derelict
                    Derelict LAYER 8 Netgate last edited by

                    Let me look at it.  In the meantime you might as well go request a /48 in case it takes a few minutes.  You'll need it for your LAN(s).  Unless all you'll ever have is the one LAN.

                    Chattanooga, Tennessee, USA
                    The pfSense Book is free of charge!
                    DO NOT set a source port in a port forward or firewall rule unless you KNOW you need it!
                    Do Not Chat For Help! NO_WAN_EGRESS(TM)

                    1 Reply Last reply Reply Quote 0
                    • I
                      icemanncsu last edited by

                      /48 requested and assigned now…

                      1 Reply Last reply Reply Quote 0
                      • K
                        kejianshi last edited by

                        I assume IPV6 is enabled on pfsense at System: Advanced: Networking?

                        1 Reply Last reply Reply Quote 0
                        • I
                          icemanncsu last edited by

                          yes it is…


                          1 Reply Last reply Reply Quote 0
                          • Derelict
                            Derelict LAYER 8 Netgate last edited by

                            You need to create a gateway for 2001:470:1f0e:d8e::1

                            Then add an IPv6 static config to the OPT1 interface you assigned to the GIF tunnel.

                            Set it to 2001:470:1f0e:d8e::2/64 with the gateway you just created as the upstream gateway.

                            Chattanooga, Tennessee, USA
                            The pfSense Book is free of charge!
                            DO NOT set a source port in a port forward or firewall rule unless you KNOW you need it!
                            Do Not Chat For Help! NO_WAN_EGRESS(TM)

                            1 Reply Last reply Reply Quote 0
                            • K
                              kejianshi last edited by

                              You don't want it on the LAN?

                              Is your client ipv4 address in HE matching your WAN IP?

                              I gave /64 to each physical interface (except WAN) and each openvpn interface for myself.

                              1 Reply Last reply Reply Quote 0
                              • I
                                icemanncsu last edited by

                                I dont understand what you mean by creating a Gateway?  Are you talking about editing the gateway address for the existing 'HEIPV6_TUNNELV6' gateway?

                                Also the created interface for the tunnel is 'heIPv6' not opt1, are you referring to something else?

                                1 Reply Last reply Reply Quote 0
                                • Derelict
                                  Derelict LAYER 8 Netgate last edited by

                                  I didn't see you renamed it.  Yes, assign the IPv6 static config to your HeIPv6 interface.

                                  Chattanooga, Tennessee, USA
                                  The pfSense Book is free of charge!
                                  DO NOT set a source port in a port forward or firewall rule unless you KNOW you need it!
                                  Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                  1 Reply Last reply Reply Quote 0
                                  • I
                                    icemanncsu last edited by

                                    i have a google hangout if anyone wants to join to help out, https://plus.google.com/hangouts/_/guo7p5otgva35aq22jly7itrpqa

                                    1 Reply Last reply Reply Quote 0
                                    • Derelict
                                      Derelict LAYER 8 Netgate last edited by

                                      on the gateway you have as HEIPV6_TUNNELV6 change the address from dynamic to your interface ::1

                                      Chattanooga, Tennessee, USA
                                      The pfSense Book is free of charge!
                                      DO NOT set a source port in a port forward or firewall rule unless you KNOW you need it!
                                      Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                      1 Reply Last reply Reply Quote 0
                                      • I
                                        icemanncsu last edited by

                                        done

                                        1 Reply Last reply Reply Quote 0
                                        • Derelict
                                          Derelict LAYER 8 Netgate last edited by

                                          @kejianshi:

                                          You don't want it on the LAN?

                                          Is your client ipv4 address in HE matching your WAN IP?

                                          I gave /64 to each physical interface (except WAN) and each openvpn interface for myself.

                                          We just need to get the tunnel and it's assigned interface up so he can ping his ::1 at hurricane.  Then we can dole out /64s out of his shiny new /48 to his local interfaces.

                                          Chattanooga, Tennessee, USA
                                          The pfSense Book is free of charge!
                                          DO NOT set a source port in a port forward or firewall rule unless you KNOW you need it!
                                          Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                          1 Reply Last reply Reply Quote 0
                                          • I
                                            icemanncsu last edited by

                                            @Derelict:

                                            on the gateway you have as HEIPV6_TUNNELV6 change the address from dynamic to your interface ::1

                                            received an error…

                                            1 Reply Last reply Reply Quote 0
                                            • Derelict
                                              Derelict LAYER 8 Netgate last edited by

                                              What did you do on the interface then?  Needs to be the ::2 /64

                                              Chattanooga, Tennessee, USA
                                              The pfSense Book is free of charge!
                                              DO NOT set a source port in a port forward or firewall rule unless you KNOW you need it!
                                              Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                              1 Reply Last reply Reply Quote 0
                                              • I
                                                icemanncsu last edited by

                                                @Derelict:

                                                What did you do on the interface then?  Needs to be the ::2 /64

                                                1 Reply Last reply Reply Quote 0
                                                • Derelict
                                                  Derelict LAYER 8 Netgate last edited by

                                                  That shouldn't be complaining.

                                                  Is the tunnel up?  Can you ping6 your ::1?  It'll only work from pfSense itself.

                                                  Chattanooga, Tennessee, USA
                                                  The pfSense Book is free of charge!
                                                  DO NOT set a source port in a port forward or firewall rule unless you KNOW you need it!
                                                  Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                                  1 Reply Last reply Reply Quote 0
                                                  • Derelict
                                                    Derelict LAYER 8 Netgate last edited by

                                                    Back in 45 minutes.  Gotta roll.

                                                    Chattanooga, Tennessee, USA
                                                    The pfSense Book is free of charge!
                                                    DO NOT set a source port in a port forward or firewall rule unless you KNOW you need it!
                                                    Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                                    1 Reply Last reply Reply Quote 0
                                                    • I
                                                      icemanncsu last edited by

                                                      @Derelict:

                                                      That shouldn't be complaining.

                                                      Is the tunnel up?  Can you ping6 your ::1?  It'll only work from pfSense itself.

                                                      1 Reply Last reply Reply Quote 0
                                                      • K
                                                        kejianshi last edited by

                                                        In System: Gateways: Edit gateway > gateway, I have no IP.  Its set to dynamic

                                                        In my HE IPV6 interface, I have none and none for my IPv4 and IPV6 configuration.

                                                        I'm still interested to know…  Is the client IP at the HE website the same as your current WAN IP?

                                                        1 Reply Last reply Reply Quote 0
                                                        • I
                                                          icemanncsu last edited by

                                                          @kejianshi:

                                                          In System: Gateways: Edit gateway > gateway, I have no IP.  Its set to dynamic

                                                          In my HE IPV6 interface, I have none and none for my IPv4 and IPV6 configuration.

                                                          I'm still interested to know…  Is the client IP at the HE website the same as your current WAN IP?

                                                          Yes, the HE client ipv4 address is my WAN ipv4 address.

                                                          1 Reply Last reply Reply Quote 0
                                                          • K
                                                            kejianshi last edited by

                                                            Reboot and see if things change/

                                                            1 Reply Last reply Reply Quote 0
                                                            • I
                                                              icemanncsu last edited by

                                                              @kejianshi:

                                                              Reboot and see if things change/

                                                              No change.

                                                              1 Reply Last reply Reply Quote 0
                                                              • K
                                                                kejianshi last edited by

                                                                Mine is also a /48 - Never did a /64

                                                                I also have RADVD configured.

                                                                1 Reply Last reply Reply Quote 0
                                                                • Derelict
                                                                  Derelict LAYER 8 Netgate last edited by

                                                                  You still can't set the gateway to 2001:470:1f0e:d8e::1 ?

                                                                  If not something is confused.  Maybe delete the IPv6 interface and reconfig it or maybe restart.

                                                                  Chattanooga, Tennessee, USA
                                                                  The pfSense Book is free of charge!
                                                                  DO NOT set a source port in a port forward or firewall rule unless you KNOW you need it!
                                                                  Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                                                  1 Reply Last reply Reply Quote 0
                                                                  • Derelict
                                                                    Derelict LAYER 8 Netgate last edited by

                                                                    @kejianshi:

                                                                    Mine is also a /48 - Never did a /64

                                                                    I also have RADVD configured.

                                                                    I think it's automatic.  I have a /64 I'm not using and can't give back.  I figure he might as well config a /48 from the get-go.  It don't cost nothin'.

                                                                    Chattanooga, Tennessee, USA
                                                                    The pfSense Book is free of charge!
                                                                    DO NOT set a source port in a port forward or firewall rule unless you KNOW you need it!
                                                                    Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                                                    1 Reply Last reply Reply Quote 0
                                                                    • Derelict
                                                                      Derelict LAYER 8 Netgate last edited by

                                                                      Hmm.  I can't create a gateway for my ::3.  Same error.  Time to do a little github diffing. The only address the gui will take is ::2, which is my interface address.

                                                                      Chattanooga, Tennessee, USA
                                                                      The pfSense Book is free of charge!
                                                                      DO NOT set a source port in a port forward or firewall rule unless you KNOW you need it!
                                                                      Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                                                      1 Reply Last reply Reply Quote 0
                                                                      • I
                                                                        icemanncsu last edited by

                                                                        @Derelict:

                                                                        You still can't set the gateway to 2001:470:1f0e:d8e::1 ?

                                                                        If not something is confused.  Maybe delete the IPv6 interface and reconfig it or maybe restart.

                                                                        no same error as before…

                                                                        1 Reply Last reply Reply Quote 0
                                                                        • I
                                                                          icemanncsu last edited by

                                                                          @Derelict:

                                                                          Hmm.  I can't create a gateway for my ::3.  Same error.  Time to do a little github diffing. The only address the gui will take is ::2, which is my interface address.

                                                                          ok, I have to get some sleep now.  if you have some new ideas, shoot them over and I will try in the morning.

                                                                          thanks for everyones time!

                                                                          1 Reply Last reply Reply Quote 0
                                                                          • Derelict
                                                                            Derelict LAYER 8 Netgate last edited by

                                                                            Roger that.  If I had more public IPs I'd get another tunnel.  I think there might be something wrong with that IPv6 gateway config page and its logic in determining the subnet of the interface.  Not sure yet.

                                                                            Chattanooga, Tennessee, USA
                                                                            The pfSense Book is free of charge!
                                                                            DO NOT set a source port in a port forward or firewall rule unless you KNOW you need it!
                                                                            Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                                                            1 Reply Last reply Reply Quote 0
                                                                            • K
                                                                              kejianshi last edited by

                                                                              There are a few possibilities.  Who is your ISP?

                                                                              I am looking this over.

                                                                              1 Reply Last reply Reply Quote 0
                                                                              • Derelict
                                                                                Derelict LAYER 8 Netgate last edited by

                                                                                My IPv6 interface is 2001:470:x:67::2/64

                                                                                My IPv6 Gateway is 2001:470:x:67::1

                                                                                If I try to define another gateway of 2001:470:x:67::3 I get:

                                                                                The following input errors were detected:

                                                                                The gateway address 2001:470:x:67::3 does not lie within one of the chosen interface's subnets.

                                                                                Chattanooga, Tennessee, USA
                                                                                The pfSense Book is free of charge!
                                                                                DO NOT set a source port in a port forward or firewall rule unless you KNOW you need it!
                                                                                Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                                                                1 Reply Last reply Reply Quote 0
                                                                                • K
                                                                                  kejianshi last edited by

                                                                                  I think that his initial setup was 100% completely correct…

                                                                                  I think I had to click "disable this gateway" on the HEIPV6TUNNELV4 before mine would work though.

                                                                                  I didn't need to configure static IPV6 on the interface you talked about earlier

                                                                                  Also leaving the HEIPV6TUNNELV6 gateway set to dynamic works great for me.

                                                                                  I'm also pretty sure you get only 1 gateway per 1 GIF interface and only 1 GIF interface per 1 IPV4 public IP.  (perhaps its different if you pay, but I doubt it)

                                                                                  The only other difference between mine and his is that mine is a /48

                                                                                  I have 3 set up like this.  All working.

                                                                                  1 Reply Last reply Reply Quote 0
                                                                                  • D
                                                                                    doktornotor Banned last edited by

                                                                                    @Derelict:

                                                                                    If I try to define another gateway of 2001:470:x:67::3 I get:

                                                                                    Why? Really, follow the docs, that works: https://doc.pfsense.org/index.php/Using_IPv6_with_a_Tunnel_Broker#Set_Gateway

                                                                                    1 Reply Last reply Reply Quote 0
                                                                                    • First post
                                                                                      Last post