2.2.1: No IPv6 assigned to LAN anymore

maverick_slo

Because I need: XXXX:XXXX:XXXX:XXXX::X to be static and always the same.
I have 5 subnets that I chose and of course they need to be static…

azzido

So essentially you are doing it because you want to have a short interface identifier (rightmost 64-bits) in your IPv6 address instead of having them be auto-configured, which would be the case if you used track interface. Did I understand that correctly?

maverick_slo

My provider gives me static /56 which means 256 /64 subnets.
I cant use track interface for this config to work in my 5 subnets of /64… Also small ip size is cool to have but its not intended or needed in my case...

azzido

Did you try following configuration? In your case you can have up to 256 track interfaces, so I still don't understand what exactly is not working for you.

WAN Configuration
IPv6 Configuration Type: DHCP6
DHCPv6 Prefix Delegation size: 56
VLAN1 Configuration
IPv6 Configuration Type: Track Interface
IPv6 Interface: WAN
IPv6 Prefix ID: 1
VLAN2 Configuration
IPv6 Configuration Type: Track Interface
IPv6 Interface: WAN
IPv6 Prefix ID: 2
VLAN3 Configuration
IPv6 Configuration Type: Track Interface
IPv6 Interface: WAN
IPv6 Prefix ID: 3
VLAN4 Configuration
IPv6 Configuration Type: Track Interface
IPv6 Interface: WAN
IPv6 Prefix ID: 4
VLAN5 Configuration
IPv6 Configuration Type: Track Interface
IPv6 Interface: WAN
IPv6 Prefix ID: 5

maverick_slo

Oh man….
Sorry but you will have to learn to read what I posted.
It is all working for me with advanced options or custom conf file.

For the last time I DON`T WANT TO USE TRACK INTERFACE OPTION! :)

kejianshi

Unless I'm confused, your setup will break eventually.

maverick_slo

My setup?
Why?

hda

@kejianshi:

Unless I'm confused, your setup will break eventually.

Conclusion is the "Track Interface" is promoted to the default LAN config. Plus automated issuance of LAN IP using SLAAC.
The don't bother out-of-the-box solution for beginner. ;)

All other LAN config goes by using WAN "Advanced". Fine with me.

maverick_slo

Couldn't agree more.
My ipv6 setup works like this 3 years, last 2 years on pfsense…
Autoconfig of lan seems bad idea for me and my both networks, home and work...

hda

@maverick_slo:

…
Autoconfig of lan seems bad idea for me and my both networks, home and work...

IF or WHEN my native (quasi-)static number of IPv6 prefix, by DHCP(PD), is changed (by ISP) I want to have my LAN dropped !. Security. No secret unnoticed changes from the far side allowed. :)

kejianshi

IMHO its a bastardized solution and getting a tunnel would be better for what you guys are doing, but its cool. Sounds like you are well aware it is not ideal.

hda

@kejianshi:

IMHO its a bastardized solution…

Yes, Track Interface is wizard-like, the easy way out. But, if one does IPv6, they should know the manual workings, in analogy with (experience of) multiple IPv4-no-NAT. So for me the full (overly) automation with Track Interface is a security flaw or allowing meddling with your site by ISP.

kejianshi

The things you talked about are not the problem for the average user as I see it.

Yes its good to understand the inner workings and all, but the problem as I see it is that you are assigning static IPs on the LAN from a /48 or /56 or /64 or whatever that is assigned dynamically by dhcp and could break in a day or a year. Who knows?

Thats the part I'd never do, but if its working for you and you don't mind the possible breakage, then thats cool.

For me, its a show stopper if my internet breaks because my pfsense is far far away.

hda

@kejianshi:

The things you talked about are not the problem for the average user as I see it.
…

There is no such as an average user 8)

But. ISP WAN/LAN prefix changes AND the LAN SLAAC on boxes are without question a privacy security risk issue. pfSense should promote security. This comes with understanding what one is doing. Otherwise one may just get a consumer-router-FW. (duh) :)

kejianshi

I agree - Thats why I'd advise you to get a reliable /48 from HE. Its actually static.

hda

@kejianshi:

…get a reliable /48 from HE....

Dependent on IPv4, that's funny.
I want local paid accountability, not SIXXS or not HE, and parallel functionality level like multiple-IPv4.

azzido

Well, I think we got down to the bottom of the original issue. You guys choose not to use track interfaces but assign static IP instead. You don't have to do that, but you choose to do that and it is ok if that works for you. Since you don't use functionality the way it was meant to be used, don't complain when fixes to that functionality break your setup.

kejianshi

I also would prefer a static native IPV6 on the WAN when available.

maverick_slo

Guys I have a static native /56 from provider for lan…
It wont change I don't know from where u got ideas it will change :) Itz more reliable than track iface IMHO...

lobotiger

Ok I thought I'd chime in here too just to add that I too ran into this same problem that others have had.

I'm with a Canadian ISP called Teksavvy and they assign you a /64 for the WAN side of the PPPoE connection and a /56 for your LAN side. I'm assuming that you have to use DHCPv6+PD in order to get the assignments but at least for the LAN side it's always the same static /56 assignment. It's as close to Hurricane Electric's /48 assignment in terms of it practically being a static. My LAN was configured with a static IPv6 address (no tracking) from that /56 (picked the first /64) and it's been working perfectly fine since December 2014 when I migrated from HE's tunnel. I even followed this youtube video for how to set things up: https://youtu.be/zdSI7Ez0Xhs?list=PL4T5Ac0HrL3PeGPoixe8RpHEeZuhf_hDD

The upgrade to 2.2.1 definitely broke it for me and I'm not 100% sure that the way I and others were doing it was completely wrong. There are many ISPs out there that will assign you a static LAN /48 or /56 but is only made routeable to you when you request the prefix delegation from a DHCPv6 setup. Personally I had my LAN interface setup with ::1 as it made it easy to point my browser to it to get into the pfsense gui and I used it as the default gateway for some manually hard coded machines on my LAN. The track option makes sense IMHO in situations like a residential setup where you just want IPv6 to work on the LAN and you don't care one way or the other what the assignments are to the hosts and the LAN interface. If your ISP recycles your LAN assignment then you don't care so long as IPv6 still works. That's fine for that scenario but on an enterprise network that would never fly.

I've been playing with IPv6 for a number of years now and I actually deployed network wide when I worked for an ISP a few years ago. We didn't do DHCPv6 assignments as we manually assigned them to our beta customers. But from an Cisco IPv6 course that I took, I'm almost positive that one could have configured a LAN facing interface on a router to be automagically assigned via PD as well as having a hard coded IPv6 address on it. Obviously that would only work if you knew the delegation but still.

So, right now I've got things working again by doing the Advanced configuration but I've only added this "ia-pd 0" and ticked off prefix-delegation. Should I do the rest of the stuff based on azzido's image? Alternatively, should I just switch over to Tracked and use the link-local address of the LAN interface for accessing pfsense? Would this second option break my SLAAC and DHCPv6 assignments I'm doing towards the LAN?

LoboTiger