IPv6 Tunnel Broker not working - Ping return code -1

furgussen

Hello,

I've setup and run an IPv6 tunnel through HE.net before using this doc:

https://doc.pfsense.org/index.php/Using_IPv6_on_2.1_with_a_Tunnel_Broker

I ran through again on my pfSense 2.2.2 box and I can't get it to work. It looks like the tunnel is partially up, but the gateway is not reachable. Then when I try to ping the IPv6 gateway I get a return code of -1. I can't find any info on Google about a -1 return code.


PING6(56=40+8+8 bytes) 2001:470:1c:c84::2 --> 2001:470:1c:c84::1
ping6: wrote 2001:470:1c:c84::1 16 chars, ret=-1
ping6: wrote 2001:470:1c:c84::1 16 chars, ret=-1
ping6: wrote 2001:470:1c:c84::1 16 chars, ret=-1

--- 2001:470:1c:c84::1 ping6 statistics ---
3 packets transmitted, 0 packets received, 100.0% packet loss

I'm also seeing this in the logs:

kernel: cannot forward src fe80:2::20c:29ff:fe2a:fba2, dst 2001:0:9d38:6abd:307a:377a:a785:7ba6, nxt 6, rcvif vmx1, outif gif0

Which is bizarre. I don't know why pfSense is trying to foward link-local out to the internet.

I have IPv6 enabled in my advanced settings. I can post my full config if needed, but I was wondering if that -1 return code means something.

Tyler

furgussen

So I configured my LAN interface with my assigned IPv6 address and the kernel "cannot forward" messages went away, but I still cannot ping my IPv6 gateway.

Attaching screenshot of the gateway status screen.

gateway.JPG_thumb

doktornotor

Before doing anything else, have you rebooted the box???

furgussen

Yeah. I also removed all tunnel config, rebooted, added config and rebooted again. No change.

doktornotor

Well, then flush it down the drain and do it again, properly this time. The howto just works. Done on loads of boxes.

furgussen

I have flushed it. Twice! I can't figure it out. I started with a fresh install of 2.2. Upgraded to 2.2.2 and tried IPv6. Then I formatted and started fresh with 2.2.2 and still no go. Same symptoms both times. I can't ping my v6 gateway.

The howto was for 2.1. I know 2.2 puts in this weird IPv4 gateway that isn't mentioned. Could that be causing issues?

doktornotor

No. Just disable monitoring there and force it down. I filed a bug about this useless thing many months ago, nothing happened so far.

johnpoz

yeah I kind of recalled that discussion dok, that was quite some time ago.

More of an annoyance than any real issue - shows up on your dashboard if you don't down it.

I have never had any issues with setting up HE tunnels.. Pretty clickity clickity with not much too it. What guide you looking at, I can go through it and update it be current with 2.2.2 screenshots, etc. and reword anything that might of changed a bit.

But to be honest should still be valid.

I would document your steps and post them here and we can point out what your doing wrong, or what might be the problem.

https://doc.pfsense.org/index.php/Using_IPv6_with_a_Tunnel_Broker

Quick glance and looks like the required steps are there. Is the /128 throwing you? Per HE that should be /64 and that is what I have set.. it sets it to /128 though even if you put /64 - see 2nd attachment.

ipv4gateway.png_thumb

background128.png_thumb

cmb

The gif tunnel being /128 is fine.

@furgussen:

kernel: cannot forward src fe80:2::20c:29ff:fe2a:fba2, dst 2001:0:9d38:6abd:307a:377a:a785:7ba6, nxt 6, rcvif vmx1, outif gif0
Which is bizarre. I don't know why pfSense is trying to foward link-local out to the internet.

Because something is sourcing traffic from its link-local IP destined to its LAN MAC. This looks like what'd happen if you didn't configure your routed /64 on your LAN interface, or didn't configure RAs or DHCPv6 to assign IPv6 IPs to clients.