ESXi, pfSense and Hetzner IPv6



  • Hello,

    Im new to this forum and new to pfSense, and want to say hello and good work with pfSense

    I have a box from hetzner with few IP's and /64 IPv6 block
    I have IPv4 and IPv6 Wokring under ESXi and management interface is accessible over both and can ping from console IPv4 and IPv6 addresses, the tricky part is when it try to setip pfSense and give my VM's 192.198.x.x IP and a IPv6

    em0 = WAN
    em1 = LAN

    Hetzner gave me this info
    IPv6 Address: 2a01:121:122:123::2 /64
    IPv6 gateway: fe80::1

    IPv4 works fine, boxes get 192.168.x.x IP's and internet works on them but

    When setting up interface em0 i enter 2a01:121:122:123::2 as my IPv6 with /64 subnet and when adding gateway it wont allow me to add fe80::1 as gateway, hetzner does not give out gateway in local subnet

    Can someone help me to get IPv6 going on em0 first and once that is working to assign IPv6 to VM's along with LAN IP?

    Thank you in advance, if you need any info ill provide it



  • UPDATE:

    Ok i can ping google with ping and ping6 from em0 interface but not from em1 (ping6: sendmsg: No route to host), also em0 interface is pingable from outside

    em0 WAN config
    2a01:121:122:123::2 /128
    Gateway is fe80::1

    em1 LAN config
    2a01:121:122:123::200 /64
    with no upstream gateway (dont know what to put in here)

    Thanks


  • Rebel Alliance Global Moderator

    you can not put same network on wan and lan..

    For ipv6 to work behind a router your isp should either give you a different /64 or a /128… Your lan /64 would be different than your wan..  just because you put /128 on the wan its still part of that larger /64

    And you don't put gateways on LAN interfaces..  its a LAN it doesn't have a gateway.. it is how devices on that network talk to other networks via pfsense.

    One way for a isp to hand you other networks to use on your lan would be thru prefix delegation..



  • @johnpoz:

    you can not put same network on wan and lan..

    For ipv6 to work behind a router your isp should either give you a different /64 or a /128… Your lan /64 would be different than your wan..  just because you put /128 on the wan its still part of that larger /64

    And you don't put gateways on LAN interfaces..  its a LAN it doesn't have a gateway.. it is how devices on that network talk to other networks via pfsense.

    One way for a isp to hand you other networks to use on your lan would be thru prefix delegation..

    Thank you for the reply, will look for a larger block or another block at hetzner, otherwise i will try to get a booker account for the LAN

    PS: if i want to run a VPN/OpenVPN on pfSense box and assign ipv6 to clients do i need another block for that or can it be done with the same LAN IPv6 Block

    Regards


  • Rebel Alliance Global Moderator

    another block..

    You know if your isp is not ready for ipv6 in primetime - just grab a tunnel from hurricane electric..  you can get a /48 from them with a couple of clicks for FREE!!



  • Ok got a /48 and /64 block from HE

    added the /64 block to LAN

    everything works fine and VM's get LAN IP + IPv6 from HE

    Now just need  a way how to get OpenVPN working and to assign LAN IP and HE IPv6 to clients

    Thanks for the help


  • Rebel Alliance Global Moderator

    this is pretty straight forward you should just have to put in the information in the openvpn setup.

    I ran into a slight issue, but turned out to be a hook for security software that was bound to my vpn interface that is not ready for ipv6 on the client once I remove that binding worked clickity clickity

    In the advanced section you can push route for ipv6 to go down the tunnel
    push "route-ipv6 2000::/3"




  • OK,

    Should I assign interface for OpenVPN too? as now i have 3 interfaces LAN WAN HENET64 and assign button, i will add some images too to confirm setup here

    Thanks


  • Rebel Alliance Global Moderator

    unless you want to do something special there is no reason to assign an interface to openvpn instances..



  • Ok This is the config i have please check

    PS: should i use the /48 block or the /64 from HE?

    Thanks















  • Rebel Alliance Global Moderator

    you would break the /48 up into multiple /64 you wouldn't use the whole thing ;)



  • how about my configs?

    do they look ok to you?

    cause they dont work


  • Rebel Alliance Global Moderator

    what doesn't work ipv6 over openvpn?  You don't have a tunnel network..

    Your not providing any dns servers to client.. What doesn't work?  Did you just run through the openvpn wizard?

    Where are your wan firewall rules that allow the openvpn connection, this would be created auto if you ran the wizard.



  • Hello and thanks for the reply

    Yes clients get a IP when i was playing with it the ygot a IPv6 too but id did not open IPv4 or IPv6 addresses just when i did put in a ip it worked

    For OpenVPN i did run the wizard and have default rules there


  • Rebel Alliance Global Moderator

    "IPv4 or IPv6 addresses just when i did put in a ip it worked"

    What IPv6 did they get?  You didn't put in a ipv6 tunnel network - so how is they would of gotten a ipv6 address???

    Well without any dns how would you resolve anything?



  • i have tried to put in subnet, then removed it and all over again

    Where do i put the DNS servers? should i use ISP or google DNS?

    Thanks


  • Rebel Alliance Global Moderator

    what do you mean where do you put in dns??  Right there on the openvpn setup screen..  Does googledns resolve your internal network devices?  Why would you not just point to pfsense..



  • Hello,

    At this point I have no idea what am I doing or what am I doing right or wrong

    See the screen attached, i have added 8.8.8.8 and 8.8.4.4 under Client Settings > DNS Servers > I have ticked Client Settings and put the IP's there

    I can connect to OpenVPN server but there is no internet access i get IP 192.168.10.x and dns is googledns but rest fails hard

    Thanks again



  • Rebel Alliance Global Moderator

    Where are you handing out dns???  Client tab is for when PFSENSE is the vpn CLIENT..




  • @johnpoz:

    Where are you handing out dns???  Client tab is for when PFSENSE is the vpn CLIENT..

    Hello

    Yes OpenVPN > Server > Client Settings >
    DNS Serrvers: i have ticked Provide a DNS server list to clinets
    Server #1 8.8.8.8
    Server #2 8.8.4.4

    thats all there but clients cant access net

    Regards


  • Rebel Alliance Global Moderator

    So this is where your doing it?  See pic

    On your CLIENT do an ipconfig /all.. what does it show for dns for the openvpn connection?

    So for example I connect to one of my vps running openvpn..  Now can you do a query via vpn, do a traceroute do you go down the tunnel to get to the dns you provided?