PfSense - Hurricane Electric - Tunnel Broker Setup
-
Hmm. I can't create a gateway for my ::3. Same error. Time to do a little github diffing. The only address the gui will take is ::2, which is my interface address.
ok, I have to get some sleep now. if you have some new ideas, shoot them over and I will try in the morning.
thanks for everyones time!
-
Roger that. If I had more public IPs I'd get another tunnel. I think there might be something wrong with that IPv6 gateway config page and its logic in determining the subnet of the interface. Not sure yet.
-
There are a few possibilities. Who is your ISP?
I am looking this over.
-
My IPv6 interface is 2001:470:x:67::2/64
My IPv6 Gateway is 2001:470:x:67::1
If I try to define another gateway of 2001:470:x:67::3 I get:
The following input errors were detected:
The gateway address 2001:470:x:67::3 does not lie within one of the chosen interface's subnets.
-
I think that his initial setup was 100% completely correct…
I think I had to click "disable this gateway" on the HEIPV6TUNNELV4 before mine would work though.
I didn't need to configure static IPV6 on the interface you talked about earlier
Also leaving the HEIPV6TUNNELV6 gateway set to dynamic works great for me.
I'm also pretty sure you get only 1 gateway per 1 GIF interface and only 1 GIF interface per 1 IPV4 public IP. (perhaps its different if you pay, but I doubt it)
The only other difference between mine and his is that mine is a /48
I have 3 set up like this. All working.
-
If I try to define another gateway of 2001:470:x:67::3 I get:
Why? Really, follow the docs, that works: https://doc.pfsense.org/index.php/Using_IPv6_with_a_Tunnel_Broker#Set_Gateway
-
Yeah - Thats works for me. The only thing extra I had to do is disable that IPV4 gateway that appeared then all was well.
I have alot of additional settings to make this available to openvpn clients also, but nothing extra was required to get it working for the LAN interface.
-
Why? Really, follow the docs, that works: https://doc.pfsense.org/index.php/Using_IPv6_with_a_Tunnel_Broker#Set_Gateway
Dude. My tunnel's up and working fine. Why should defining another gateway on the subnet be rejected?
-
Uh? As said above, as far as the WAN is concerned, you get only 1 gateway per 1 GIF interface and only 1 GIF interface per 1 IPv4 public IP. The working setup is described at the link I posted and works no matter how many /64 subnets out of the /48 you are using on your pfSense box. If you insist on inventing broken setups, feel free, but that's not something I'm going to waste my time with.
If you are trying to set up static routes in order to route some /64 from another box, then apparently you are doing it wrong.
Again - why are you doing this and what are you trying to achieve?
-
The error:
The gateway address 2001:470:x:67::3 does not lie within one of the chosen interface's subnets.
Would have probably made more sense if it had said "Only 1 Gateway per Gif interface allowed" or something
Your local access (gateway) is defined in the gif interface. Your gateway has to match it. (::2)
-
Fuck you, dude.
Wonderful. May I ask why are you suggesting completely broken things to the OP here - such as messing with the dynamic GW, creating useless additional GWs or assigning static config to the OPT iface that has the GIF tunnnel on it - without actually being able to provide any reason for suggesting them in the first place? This is load of bollocks and it goes downhill from there on. No such nonsense is needed, and much more importantly is not wanted. It won't fix anything and will only results in completely broken setup.
-
Okay, OP. Delete everything. Do it again. The docs are perfect.
-
Not perfect - I think he has to disable that auto-appearing useless IPV4 interface for this to work…
Other than that, yes. That guide does work.
Doesn't mean the ISP isn't breaking GIF or blocking HEIPV6 or that the HE server wasn't having issues at the IPV4 address for HE he is using though.
There is still room for error beyond OPs control.
-
The docs work. Both on 2.1.5 and 2.2. (The only thing they are missing on 2.2 is making the bogus additional IPv4 dynamic GW created no-op, but that does not affect the tunnel functionality at all.)
@OP: If you get "Offline" on the TunnelV6 GW when you goto Status > Gateways after you have edited the dynamic GW to make it default per the docs, simply reboot the pfSense box. This is the only thing needed and only needed once when you complete the initial tunnel set up.
If that still does not work, post relevant configuration screenshots here (OPT, GIF, GWs) and ifconfig output for the GIF tunnel interface.
P.S. And yes - delete everything and reboot before trying to follow the docs again.
-
There are a few possibilities. Who is your ISP?
I am looking this over.
AT&T Gigapower 1Gbps Symmetrical - Residential Service - NVG589 for the Gateway, not using their supplied IPv6 6rd services, they are all disabled in the residential gateway device (I disabled them).
I am using IP Passthrough to pfSense, no IPv6 is being pushed to pfSense since I disabled it. I would highly doubt this would cause any trouble on pfSense trying to make a tunnel over IPv4 for IPv6 functionality.
-
"they are all disabled in the residential gateway device"
So your behind a nat? Are you allowing ping to your ipv4 IP? I can tell you for fact that guide in the docs work. I don't recall any issues with it..
I have the /64 working on 1 segment and some of the /64s out of the /48 working on other segments without any problem. They recently fixed gateway stuff so could disable the nonsense ipv4 that kept getting added. But that was before the release of 2.2
-
IP Passthrough I hope is a non-technical term for bridged?
See - Thing is you CAN NAT a connection if it will pass Protocol 41
I have even enabled ICMP on a pfsense in the USA, use my USA pfsense IP and set up IPV6 on a second pfsense in manila because pfsense does pass that protocol.
However, thats the only way I've ever been able to get it to work behind NAT. When pfsense was the 1st layer.
If you are using a NAT (Network Address Translation) appliance, please make sure it allows and forwards IP protocol 41.
What is IP Protocol 41?
IP Protocol 41 is one of the Internet Protocol numbers. Within the IPv4 header, the IPv4 Protocol field is set to 41 to indicate an encapsulated IPv6 packet.So, my guess is your modem/router/ont whatever thingy might be killing protocol 41 or at minimum not passing it along.
That said, I'd do a fresh install and fresh config and try abit more before giving up. Or check 1st device and see if its got setting relevant to protocol 41.
-
So here is confirmation that AT&T has fucked me again!
http://forums.att.com/t5/Residential-Wi-Fi-Gateway/IPv6-Tunnels-broken-yet-again-this-time-on-the-NVG589-modem/td-p/3896665
Post number 9 in that thread. FUCK!
Thanks for all the help guys!
-
With the protocol 41, yeah some gateways will pass it if you put the box behind in the DMZ.. But yeah if your behind nat you can have issues. What is the IP on pfsense wan - is it rfc1918??
-
Well - This sucks…
Read em and weep (Seriously - Start weeping)
https://forums.he.net/index.php?topic=3110.0
