Unable to pass IPv6 Tests



  • I recently upgraded from a Ubnt EdgeRouter to pfSense 2.2. Since I wanted to take advantage of the platform's more developed features, I decided I would try a hand and enable IPv6 (I'm using Comcast and IPv6 is enabled in my area).

    While I think I have everything configured correctly, I am still unable to pass the IPv6 test or connect to IPv6 sites. I'm hoping someone can assist.

    What on earth am I missing?  :-\

    WAN:

    IPv4 address 73.4.183.xxx
    IPv6 address 2001:558:6017:ed:64a0:517c:958f:xxx
    ISP DNS servers 75.75.75.75, 8.8.8.8, 2001:558:FEED::1 (this was set in System -> General Settings)
    IPv4 Configuration Type DHCP
    IPv6 Configuration Type DHCP6
    Use IPv4 connectivity as parent interface Unchecked
    Request only a IPv6 prefix Unchecked
    DHCPv6 Prefix Delegation size 64
    Send IPv6 prefix hint Unchecked

    LAN:

    IPv4 Configuration Type Static IPv4
    IPv6 Configuration Type Track Interface
    IPv6 Interface WAN
    IPv6 Prefix ID 0

    Client:

    Win7

    Ethernet adapter Home LAN:
      Connection-specific DNS Suffix  . : nato
      Description . . . . . . . . . . . : Qualcomm Atheros AR8161/8165 PCI-E Gigabit Ethernet Controller (NDIS 6.20)
      Physical Address. . . . . . . . . : 90-2B-34-D9-59-D9
      DHCP Enabled. . . . . . . . . . . : Yes
      Autoconfiguration Enabled . . . . : Yes
      IPv6 Address. . . . . . . . . . . : 2601:6:7780:581a:50ec:e9d4:7aae:xxxx(Preferred)
      Temporary IPv6 Address. . . . . . : 2601:6:7780:581a:68eb:e38f:e369:xxxx(Preferred)
      Link-local IPv6 Address . . . . . : fe80::50ec:e9d4:7aae:1e5f%11(Preferred)
      IPv4 Address. . . . . . . . . . . : 192.168.10.100(Preferred)
      Subnet Mask . . . . . . . . . . . : 255.255.255.0
      Lease Obtained. . . . . . . . . . : Thursday, February 19, 2015 12:52:47 PM
      Lease Expires . . . . . . . . . . : Thursday, February 19, 2015 4:52:47 PM
      Default Gateway . . . . . . . . . : fe80::1:1%11, 192.168.10.1
      DHCP Server . . . . . . . . . . . : 192.168.10.1
      DHCPv6 IAID . . . . . . . . . . . : 244329268
      DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-18-E7-EB-49-90-2B-34-D9-59-D2
      DNS Servers . . . . . . . . . . . : 192.168.10.1, 75.75.75.75
      NetBIOS over Tcpip. . . . . . . . : Enabled

    Client can PING 2001:558:feed::1

    Pinging 2001:558:feed::1 with 32 bytes of data:
    Reply from 2001:558:feed::1: time=26ms
    Reply from 2001:558:feed::1: time=11ms
    Reply from 2001:558:feed::1: time=19ms

    Client can PING ipv6.google.com

    Pinging ipv6.l.google.com [2607:f8b0:4002:c01::71] with 32 bytes of data:
    Reply from 2607:f8b0:4002:c01::71: time=49ms
    Reply from 2607:f8b0:4002:c01::71: time=47ms

    Client cannot pass test-ipv6.com

    Test with IPv4 DNS record ok (0.058s) using ipv4
    Test with IPv6 DNS record timeout (15.012s)
    Test with Dual Stack DNS record ok (0.353s) using ipv4
    Test for Dual Stack DNS and large packet ok (0.324s) using ipv4
    Test IPv4 without DNS ok (0.056s) using ipv4
    Test IPv6 without DNS timeout (15.013s)
    Test IPv6 large packet timeout (15.009s)
    Test if your ISP's DNS server uses IPv6 ok (0.345s) using ipv4
    Find IPv4 Service Provider ok (0.144s) using ipv4 ASN 7015
    Find IPv6 Service Provider timeout (15.040s)


  • Rebel Alliance Global Moderator

    So out of the box lan has ipv4 enabled - but I am not sure there are any rules that allow ipv6 out..  What are you lan rules in pfsense?  Seems you can ping out, so you must have that allowed..



  • @johnpoz:

    So out of the box lan has ipv4 enabled - but I am not sure there are any rules that allow ipv6 out..  What are you lan rules in pfsense?  Seems you can ping out, so you must have that allowed..

    So that was a very good suggestion. Right now the rules I have is the following:

    Floating:

    IPv4+6 ICMP – Any <-> Any * *
    IPv4+6 TCP/UDP -- !Guest_Network (Open WLAN) -> !Private_Networks * *

    Private_Networks is simply a list of private class A address spaces. These should allow access out.

    On that specific LAN interface, I have one additional IPv4 rule that allows full access to the router.



  • You need to have a few things.

    1st I recommend having DNS running that works with IPV6 also.  What are you using for DNS?

    Second, and this could be very important, what browser are you using?



  • I've run the tests in Chrome and IE.

    As for DNS, please see attached.




  • Switch your IPV6 DNS to "none" and see what happens.
    Chrome for sure should work out of the box with IPV6.

    also try these as your IPV6 DNS - just to test.

    2001:4860:4860::8888
    2001:4860:4860::8844

    I don't use those, but I know they work.



  • Should I also remove the DNS entry or just change the gateway to none?

    The thing is, IPv6 lookups work in the current setup (eg. I can ping ipv6.google.com and receive a reply).



  • Try just setting gateway to none and try using the two IPV6 DNS I provided.


  • Rebel Alliance Global Moderator

    why do you have your rules in floating and not on the actual interface - out of curiosity?



  • The pfSense UI will not allow me to enter those DNS servers without configuring gateway interfaces.

    As for the floating rules, there's a few other VLANs which they apply to, I'm just not concerned with IPv6 on those VLANs.



  • Thats strange to me…

    I have 5 interfaces and, up till recently "none" was selected for all my dns server interfaces.  IPV4 and IPV6.

    Anyway - obviously whatever box you are on is getting IPV6 obviously.  I assume you are not testing connectivity from pfsense, but rather are using the same machine you are attempting to browse the internet from?



  • Correction, I was able to implement these without specifying the gateway interface and I got the same result.

    2001:4860:4860::8888
    2001:4860:4860::8844

    I also disabled the firewall on my workstation for good measure. Still fails the IPv6 tests.



  • But your WORKSTATION is able to ping, for example, those two IPV6 addresses I gave you?



  • Yes, that is correct.

    Pinging 2001:4860:4860::8888 with 32 bytes of data:
    Reply from 2001:4860:4860::8888: time=29ms
    Reply from 2001:4860:4860::8888: time=29ms
    Reply from 2001:4860:4860::8888: time=30ms

    Pinging 2001:4860:4860::8844 with 32 bytes of data:
    Reply from 2001:4860:4860::8844: time=29ms
    Reply from 2001:4860:4860::8844: time=29ms
    Reply from 2001:4860:4860::8844: time=29ms



  • I've resolved this issue. The firewall rule IPv4+6 was not applying correctly. Listing an explicit IPv6 Any -> Any rule fixed the problem. I'll work to explore these rules in more detail.



  • Strange - Just to look into chrome, past this in your chrome browser:

    chrome://net-internals/#dns

    Then click "clear host cache"

    Probably will make zero difference, but why not…

    If that doesn't work, take a look to see if there is some strange rule in your firewall (or lack of a pass rule) that is letting ICMP pass but not allowing HTTP/HTTPS.



  • Ahh - so not passing IPV6 correctly (-;

    Works now?


  • Rebel Alliance Global Moderator

    And again why do you have them in floating in the first place? Are they set to quick, rules in floating are for SPECIAL rules..

    For example
    " I'm just not concerned with IPv6 on those VLANs."

    But you had a rule that should allow ipv6 out, which would be applied to ALL interfaces..  I don't recommend putting anything in floating unless it really needs to go there.