Unable to pass IPv6 Tests

CiscoKid85 · Feb 19, 2015, 8:36 PM

I recently upgraded from a Ubnt EdgeRouter to pfSense 2.2. Since I wanted to take advantage of the platform's more developed features, I decided I would try a hand and enable IPv6 (I'm using Comcast and IPv6 is enabled in my area).

While I think I have everything configured correctly, I am still unable to pass the IPv6 test or connect to IPv6 sites. I'm hoping someone can assist.

What on earth am I missing? :-\

WAN:

IPv4 address 73.4.183.xxx
IPv6 address 2001:558:6017:ed:64a0:517c:958f:xxx
ISP DNS servers 75.75.75.75, 8.8.8.8, 2001:558:FEED::1 (this was set in System -> General Settings)
IPv4 Configuration Type DHCP
IPv6 Configuration Type DHCP6
Use IPv4 connectivity as parent interface Unchecked
Request only a IPv6 prefix Unchecked
DHCPv6 Prefix Delegation size 64
Send IPv6 prefix hint Unchecked

LAN:

IPv4 Configuration Type Static IPv4
IPv6 Configuration Type Track Interface
IPv6 Interface WAN
IPv6 Prefix ID 0

Client:

Win7

Ethernet adapter Home LAN:
Connection-specific DNS Suffix . : nato
Description . . . . . . . . . . . : Qualcomm Atheros AR8161/8165 PCI-E Gigabit Ethernet Controller (NDIS 6.20)
Physical Address. . . . . . . . . : 90-2B-34-D9-59-D9
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
IPv6 Address. . . . . . . . . . . : 2601:6:7780:581a:50ec:e9d4:7aae:xxxx(Preferred)
Temporary IPv6 Address. . . . . . : 2601:6:7780:581a:68eb:e38f:e369:xxxx(Preferred)
Link-local IPv6 Address . . . . . : fe80::50ec:e9d4:7aae:1e5f%11(Preferred)
IPv4 Address. . . . . . . . . . . : 192.168.10.100(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Lease Obtained. . . . . . . . . . : Thursday, February 19, 2015 12:52:47 PM
Lease Expires . . . . . . . . . . : Thursday, February 19, 2015 4:52:47 PM
Default Gateway . . . . . . . . . : fe80::1:1%11, 192.168.10.1
DHCP Server . . . . . . . . . . . : 192.168.10.1
DHCPv6 IAID . . . . . . . . . . . : 244329268
DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-18-E7-EB-49-90-2B-34-D9-59-D2
DNS Servers . . . . . . . . . . . : 192.168.10.1, 75.75.75.75
NetBIOS over Tcpip. . . . . . . . : Enabled

Client can PING 2001:558:feed::1

Pinging 2001:558:feed::1 with 32 bytes of data:
Reply from 2001:558:feed::1: time=26ms
Reply from 2001:558:feed::1: time=11ms
Reply from 2001:558:feed::1: time=19ms

Client can PING ipv6.google.com

Pinging ipv6.l.google.com [2607:f8b0:4002:c01::71] with 32 bytes of data:
Reply from 2607:f8b0:4002:c01::71: time=49ms
Reply from 2607:f8b0:4002:c01::71: time=47ms

Client cannot pass test-ipv6.com

Test with IPv4 DNS record ok (0.058s) using ipv4
Test with IPv6 DNS record timeout (15.012s)
Test with Dual Stack DNS record ok (0.353s) using ipv4
Test for Dual Stack DNS and large packet ok (0.324s) using ipv4
Test IPv4 without DNS ok (0.056s) using ipv4
Test IPv6 without DNS timeout (15.013s)
Test IPv6 large packet timeout (15.009s)
Test if your ISP's DNS server uses IPv6 ok (0.345s) using ipv4
Find IPv4 Service Provider ok (0.144s) using ipv4 ASN 7015
Find IPv6 Service Provider timeout (15.040s)

johnpoz · Feb 19, 2015, 8:51 PM

So out of the box lan has ipv4 enabled - but I am not sure there are any rules that allow ipv6 out.. What are you lan rules in pfsense? Seems you can ping out, so you must have that allowed..

CiscoKid85 · Feb 19, 2015, 9:20 PM

@johnpoz:

So out of the box lan has ipv4 enabled - but I am not sure there are any rules that allow ipv6 out.. What are you lan rules in pfsense? Seems you can ping out, so you must have that allowed..

So that was a very good suggestion. Right now the rules I have is the following:

Floating:

IPv4+6 ICMP – Any <-> Any * *
IPv4+6 TCP/UDP -- !Guest_Network (Open WLAN) -> !Private_Networks * *

Private_Networks is simply a list of private class A address spaces. These should allow access out.

On that specific LAN interface, I have one additional IPv4 rule that allows full access to the router.

kejianshi · Feb 19, 2015, 9:29 PM

You need to have a few things.

1st I recommend having DNS running that works with IPV6 also. What are you using for DNS?

Second, and this could be very important, what browser are you using?

CiscoKid85 · Feb 19, 2015, 9:36 PM

I've run the tests in Chrome and IE.

As for DNS, please see attached.

kejianshi · Feb 19, 2015, 9:51 PM

Switch your IPV6 DNS to "none" and see what happens.
Chrome for sure should work out of the box with IPV6.

also try these as your IPV6 DNS - just to test.

2001:4860:4860::8888
2001:4860:4860::8844

I don't use those, but I know they work.

CiscoKid85 · Feb 19, 2015, 9:49 PM

Should I also remove the DNS entry or just change the gateway to none?

The thing is, IPv6 lookups work in the current setup (eg. I can ping ipv6.google.com and receive a reply).

kejianshi · Feb 19, 2015, 9:53 PM

Try just setting gateway to none and try using the two IPV6 DNS I provided.

johnpoz · Feb 19, 2015, 10:03 PM

why do you have your rules in floating and not on the actual interface - out of curiosity?

CiscoKid85 · Feb 19, 2015, 10:21 PM

The pfSense UI will not allow me to enter those DNS servers without configuring gateway interfaces.

As for the floating rules, there's a few other VLANs which they apply to, I'm just not concerned with IPv6 on those VLANs.

kejianshi · Feb 19, 2015, 10:36 PM

Thats strange to me…

I have 5 interfaces and, up till recently "none" was selected for all my dns server interfaces. IPV4 and IPV6.

Anyway - obviously whatever box you are on is getting IPV6 obviously. I assume you are not testing connectivity from pfsense, but rather are using the same machine you are attempting to browse the internet from?

CiscoKid85 · Feb 19, 2015, 10:42 PM

Correction, I was able to implement these without specifying the gateway interface and I got the same result.

2001:4860:4860::8888
2001:4860:4860::8844

I also disabled the firewall on my workstation for good measure. Still fails the IPv6 tests.

kejianshi · Feb 19, 2015, 11:07 PM

But your WORKSTATION is able to ping, for example, those two IPV6 addresses I gave you?

CiscoKid85 · Feb 19, 2015, 11:14 PM

Yes, that is correct.

Pinging 2001:4860:4860::8888 with 32 bytes of data:
Reply from 2001:4860:4860::8888: time=29ms
Reply from 2001:4860:4860::8888: time=29ms
Reply from 2001:4860:4860::8888: time=30ms

Pinging 2001:4860:4860::8844 with 32 bytes of data:
Reply from 2001:4860:4860::8844: time=29ms
Reply from 2001:4860:4860::8844: time=29ms
Reply from 2001:4860:4860::8844: time=29ms

CiscoKid85 · Feb 19, 2015, 11:25 PM

I've resolved this issue. The firewall rule IPv4+6 was not applying correctly. Listing an explicit IPv6 Any -> Any rule fixed the problem. I'll work to explore these rules in more detail.

kejianshi · Feb 19, 2015, 11:28 PM

Strange - Just to look into chrome, past this in your chrome browser:

chrome://net-internals/#dns

Then click "clear host cache"

Probably will make zero difference, but why not…

If that doesn't work, take a look to see if there is some strange rule in your firewall (or lack of a pass rule) that is letting ICMP pass but not allowing HTTP/HTTPS.

kejianshi · Feb 19, 2015, 11:29 PM

Ahh - so not passing IPV6 correctly (-;

Works now?

johnpoz · Feb 20, 2015, 11:51 AM

And again why do you have them in floating in the first place? Are they set to quick, rules in floating are for SPECIAL rules..

For example
" I'm just not concerned with IPv6 on those VLANs."

But you had a rule that should allow ipv6 out, which would be applied to ALL interfaces.. I don't recommend putting anything in floating unless it really needs to go there.