Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    What is the one true way of using or configuring a single /64 IPv6 prefix?

    Scheduled Pinned Locked Moved IPv6
    21 Posts 10 Posters 9.2k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • M
      mqudsi
      last edited by

      Hello all,

      Fact: it is universally accepted here and everywhere else on the web that an ISP (or even worse, a datacenter host) providing only a single /64 is wrong, incorrect, hard-to-work-with, breaks SLAAC, and doesn't work correctly with RAs.

      That said, if one finds themselves in such a situation where they have been assigned a single /64 and can neither obtain a /60 or a /56 or a second /64, or even a point-to-point /126 or /128, what is the correct way of configuring pfSense so that it can correctly route and distribute traffic in a dual IPv4/IPv6 environment?

      Given a static IPv6 /64 prefix, with one address already taken by the gateway (and another by the multicast), a single WAN interface, and a single LAN interface, what is the correct way of having pfSense sit in between the WAN and LAN and correctly route traffic between the two, using NAT for IPv4 and native IPv6 address assignment for PCs on the LAN? Also, what upstream changes (if any) have to be made in order for incoming requests to the /64 prefix to be correctly routed through the router's WAN IPv6 address?

      Thank you kindly,

      1 Reply Last reply Reply Quote 0
      • M
        mqudsi
        last edited by

        (I am posting my own thoughts on possible solutions in a separate reply so as not to mislead or provide inaccurate or incomplete information in the first post for future readers. Disclaimer: everything below is conjecture and brainstorming.)

        A) Given instead two WAN interfaces (or a single interface that has been virtualized/split into two interfaces, etc), is it possible to have one dedicated to IPv6 traffic that simply bridges all IPv6 traffic from WAN to LAN, making IPv6 a bridged and not subnetted interface, while directing all IPv4 traffic to the second interface in a standard NAT configuration? While pfSense can still filter incoming IPv6 traffic to correctly act as a firewall?

        B) Is there a correct way to configure pfSense so that you split the /64 into a /112 or a /126 for the connection between the gateway and the WAN port on the pfSense router and then use the remainder of the /64 space as your local subnet, without requiring any changes to the configuration of the gateway or any routing configuration upstream (i.e. solely on the customer's end)? Assuming one is OK with the breakage of RA and/or SLAAC and will run their own DHCPv6 service on the pfSense router for the LAN subnet/prefix?

        C) Effectively, would option B be any different than configuring pfSense as an IPv6 NAT? Is there any way to assign all the /64 address space to pfSense's WAN interface, and yet run a DHCPv6 instance that will assign to local LAN machines addresses from that same pool (without the WAN and LAN routes getting confused by the presence of overlapping subnets)?

        1 Reply Last reply Reply Quote 0
        • johnpozJ
          johnpoz LAYER 8 Global Moderator
          last edited by

          "That said, if one finds themselves in such a situation"

          Show them how that is WRONG.. change ISP/DC if its such an issue to you.  Or tunnel your ipv6 traffic.. HE will give you /48 that is for sure..

          An intelligent man is sometimes forced to be drunk to spend time with his fools
          If you get confused: Listen to the Music Play
          Please don't Chat/PM me for help, unless mod related
          SG-4860 24.11 | Lab VMs 2.8, 24.11

          1 Reply Last reply Reply Quote 0
          • C
            cmb
            last edited by

            The premise of the question here is "if I have completely broken IPv6 connectivity, how do I make it not broken?" :)

            If you have an ISP that isn't willing to route you at least a /64 for your internal network, they aren't providing IPv6 service, and are completely clueless. It's really as simple as that.

            For the sake of answering the question in theory, you could do one of three things in theory.

            1. bridge LAN and WAN so your LAN hosts are on the same broadcast domain as the WAN and hence right on that WAN /64. That's a really awful thing to do in nearly every network.
            2. If you could proxy NDP a big chunk of that /64 (which we have no capability for, and that's a very uncommon feature in all routers and firewalls), then you could answer NDP WAN-side, and assign that chunk LAN-side. It's not pretty.
            3. IPv4-style NAT + ULA - shoot me now - we have no capability for this (exposed in the GUI today at least…) and thankfully most other things don't either, but you could in theory assign ULA IPv6 space on your LAN, and NAT everything to one or a small number of IPs on your WAN-side public /64. This is horrible.

            In practice, there is no reason to have to do something like that.

            1 Reply Last reply Reply Quote 0
            • C
              Cybdex
              last edited by

              Im not sure i understand your initial question mqudsi.

              Are you saying your ISP assigns you 1 /64 net, and that net gets "taken" by your WAN, and thus you cant assign this on the LAN side? Not sure what is wrong with that scenario, but your WAN does not have to have a assigned /64 or even /128 for IPV6 to work afaik.

              My WAN does not have a public IPV6 address, as it seems when i do that, all ipv6 connectivity on the LAN side stops working, so i make WAN only request a prefix, and then my LAN picks it up and things work. (Using Telenor Fibre ISP in Norway)

              Bridging or any other way of making your LAN "move" to the same side of the firewall as your WAN would ofc break all possibilities of firewalling, and is absolutely nothing to want in your case.

              Ill try to reply to your #2 post as best as i can:

              A) What you are requesting is not really possible. Well.. depends on ISP i guess, but in most cases, your ISP wont allow 2 NIC's to obtain IP addresses from 1 fibre modem (or whatever equipment you are using). Atleast highly unlikely.

              B) Everyone sais and really really consistently mean that /64 is the absolute smallest subnet you should ever work with… Wont get any of the devs here to recommend otherwise i think, nor should you consider it an option. SLAAC (afaik only thing working for android based gear) wont work with less than /64 https://en.wikipedia.org/wiki/IPv6_subnetting_reference

              C) Dont think of ipv6 with NAT. That makes no (pf)sense :)

              Other than that, im not entirely sure what you are asking here tho, so please comment further on that :) Im by no means an network (least of all IPV6) expert, so forgive me if im way off here tho.

              C

              1 Reply Last reply Reply Quote 0
              • MikeV7896M
                MikeV7896
                last edited by

                So the common response to people that are only getting a single /64 from their ISP has been "Your ISP is doing it wrong"… but a thought crossed my mind last night after reading this thread...

                Shouldn't it be possible to use SLAAC for a link-local WAN connection with the ISP router, then configure that /64 for your LAN?

                I know that with DHCPv6 and PD, if you request just a prefix and not an address, link-local will be used on the WAN side and that /64 gets applied to the LAN. Shouldn't the same be possible with SLAAC on the WAN and a static /64 on the LAN?

                The S in IOT stands for Security

                1 Reply Last reply Reply Quote 0
                • C
                  cmb
                  last edited by

                  @virgiliomi:

                  Shouldn't it be possible to use SLAAC for a link-local WAN connection with the ISP router, then configure that /64 for your LAN?

                  I know that with DHCPv6 and PD, if you request just a prefix and not an address, link-local will be used on the WAN side and that /64 gets applied to the LAN. Shouldn't the same be possible with SLAAC on the WAN and a static /64 on the LAN?

                  No, as that requires routing on the ISP's side. When they assign you a subnet via PD, they add a route to send that PD subnet to your WAN-side IP, whether that's link-local or public.

                  1 Reply Last reply Reply Quote 0
                  • MikeV7896M
                    MikeV7896
                    last edited by

                    Yep… I knew I had to be missing something... :)

                    The S in IOT stands for Security

                    1 Reply Last reply Reply Quote 0
                    • H
                      hcoin
                      last edited by

                      It gets even worse… what about the ISP's happy to charge you for a /64... the most you can get... and:  limit to  6 the number of macs the router will connect with.

                      1 Reply Last reply Reply Quote 0
                      • DerelictD
                        Derelict LAYER 8 Netgate
                        last edited by

                        Vote with your wallet if their restrictions are a burden.

                        But the number of MAC addresses should not change. you should be able to get by with at most 3 in most cases as far as the provider is concerned. Even with thousands of IPv6 hosts on LAN all with "real" IPv6 addresses.

                        Chattanooga, Tennessee, USA
                        A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                        DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                        Do Not Chat For Help! NO_WAN_EGRESS(TM)

                        1 Reply Last reply Reply Quote 0
                        • JKnottJ
                          JKnott
                          last edited by

                          Fact: it is universally accepted here and everywhere else on the web that an ISP (or even worse, a datacenter host) providing only a single /64 is wrong, incorrect, hard-to-work-with, breaks SLAAC, and doesn't work correctly with RAs.

                          SLAAC most definitely works with /64.  In fact, it's the only prefix it works with.  Shorter prefixes are simply multiple /64s, which must be split up by a router.  The standard for IPv6 local networks is /64.

                          BTW, my ISP, which recently started providing IPv6, currently hands out only a /64, but plans to move to larger blocks later.  SLAAC and RA work fine here.

                          and:  limit to  6 the number of macs the router will connect with

                          That is a bit much, given IPv6 has such a huge address space.  In fact, there are enough /48s to give every person on earth over 4000 of them and that's with 3/4 of the entire IPv6 address space unallocated for any purpose.

                          I have my cable modem in bridge mode, providing my own firewall/router running pfSense.  I have at least 6-7 devices here, each with it's own global unicast address.  It's beyond me how an ISP can be so miserly with IPv6 addresses.  Perhaps some public shaming is in order.

                          PfSense running on Qotom mini PC
                          i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                          UniFi AC-Lite access point

                          I haven't lost my mind. It's around here...somewhere...

                          1 Reply Last reply Reply Quote 0
                          • E
                            enodeb
                            last edited by

                            @hcoin:

                            It gets even worse… what about the ISP's happy to charge you for a /64... the most you can get...

                            I don't really see a big issue with that when it comes to home Internet service. Most home users do not run multiple subnets on their local network. That's more for business users and geeks like us.  ;) Of course I'm still happy that providers like Comcast provide at least a /60 for home users that want it.

                            It's a different story for those ISPs who give their users a single /128. That's completely missing the point of v6, of course.

                            and:  limit to  6 the number of macs the router will connect with.

                            Never heard of such a thing. Are you sure that's not referring to MAC bindings on the WAN side?

                            1 Reply Last reply Reply Quote 0
                            • JKnottJ
                              JKnott
                              last edited by

                              It's a different story for those ISPs who give their users a single /128

                              A /128 is completely useless.  It's only used as an interface identifier.  A point to point link requires a /127 or /126

                              PfSense running on Qotom mini PC
                              i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                              UniFi AC-Lite access point

                              I haven't lost my mind. It's around here...somewhere...

                              1 Reply Last reply Reply Quote 0
                              • E
                                enodeb
                                last edited by

                                @JKnott:

                                It's a different story for those ISPs who give their users a single /128

                                A /128 is completely useless.  It's only used as an interface identifier.  A point to point link requires a /127 or /126

                                Some ISPs actually do this. It's basically the same as v4 home Internet service. They give you a single address for your WAN interface, and you're expected to use NAT6 for internal hosts. Of course this completely negates the advantages that v6 brings.

                                1 Reply Last reply Reply Quote 0
                                • JKnottJ
                                  JKnott
                                  last edited by

                                  They give you a single address for your WAN interface

                                  You still need one address for the other end of the connection.  My ISP, on IPv4, uses a /23 subnet mask, which allows up to 510 devices, plus their router.  You can do the same with IPv6, where they could have all the customers assigned a single address out a a prefix.  The /127 prefix or /31 on IPv4 is the smallest usable block, with one address available for use on each end of a point to point link.

                                  Still, it's beyond belief that an ISP could be so stingy.  It's like going to the beach and being allowed one grain of sand to sit on.  ;)

                                  PfSense running on Qotom mini PC
                                  i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                                  UniFi AC-Lite access point

                                  I haven't lost my mind. It's around here...somewhere...

                                  1 Reply Last reply Reply Quote 0
                                  • E
                                    enodeb
                                    last edited by

                                    @JKnott:

                                    You still need one address for the other end of the connection.

                                    You're talking about two different things. Of course the ISP has a bigger inter-router subnet, but you as the user still get only a single address, which is a /128. It's just DHCP without PD. A /127 PD is also possible and would allow you to use two addresses in addition to the one assigned to the WAN interface via DHCP.

                                    Still, it's beyond belief that an ISP could be so stingy.  It's like going to the beach and being allowed one grain of sand to sit on.  ;)

                                    I don't think it's necessarily stinginess, but simply that they haven't bothered to learn about v6 and just apply what they understand from v4. That should hopefully go away once v6 becomes more common.

                                    1 Reply Last reply Reply Quote 0
                                    • B
                                      bimmerdriver
                                      last edited by

                                      OP, either change to another ISP or bide time for them to see the light by using a tunnel. I've been using an HE tunnel for several years and it's been rock solid. The performance isn't quite as fast as native, but it's okay and even better, it's free.

                                      1 Reply Last reply Reply Quote 0
                                      • JKnottJ
                                        JKnott
                                        last edited by

                                        I also used a tunnel for about 6 years, before my ISP provided IPv6.  Worked well, though there were occasional issues.

                                        As far as the number of available addresses go, there are currently enough /48s to given every person on earth over 4000 of them.  This is even with 3/4 of the IPv6 address space not currently assigned for anything.  At my count, the unicast address range could be 6x what's currently available.

                                        PfSense running on Qotom mini PC
                                        i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                                        UniFi AC-Lite access point

                                        I haven't lost my mind. It's around here...somewhere...

                                        1 Reply Last reply Reply Quote 0
                                        • M
                                          mqudsi
                                          last edited by

                                          I actually came across this thread while searching for /64 workarounds once more, all these years later (another ISP, this time).

                                          I never did post back with what happened. I managed to get up and running by bridging WAN and LAN in a very ugly fashion while continuing to fight with the ISP, insisting that I was decidedly not asking for too much and that /64 was simply not enough. In the end they gave in and gave me a separate /112 for my WAN, so I'm happy :)

                                          Now I'm fighting with another situation where an ISP is dynamically assigning a /64 to a business internet account…

                                          (btw, protip: if you're ever playing around with the IPv6 configuration and at any point enable DHCPv6 on WAN, make sure you always delete /var/db/dhcp6c_duid
                                          when changing it to something else)

                                          1 Reply Last reply Reply Quote 0
                                          • JKnottJ
                                            JKnott
                                            last edited by

                                            @mqudsi:

                                            Hello all,

                                            Fact: it is universally accepted here and everywhere else on the web that an ISP (or even worse, a datacenter host) providing only a single /64 is wrong, incorrect, hard-to-work-with, breaks SLAAC, and doesn't work correctly with RAs.

                                            That said, if one finds themselves in such a situation where they have been assigned a single /64 and can neither obtain a /60 or a /56 or a second /64, or even a point-to-point /126 or /128, what is the correct way of configuring pfSense so that it can correctly route and distribute traffic in a dual IPv4/IPv6 environment?

                                            Given a static IPv6 /64 prefix, with one address already taken by the gateway (and another by the multicast), a single WAN interface, and a single LAN interface, what is the correct way of having pfSense sit in between the WAN and LAN and correctly route traffic between the two, using NAT for IPv4 and native IPv6 address assignment for PCs on the LAN? Also, what upstream changes (if any) have to be made in order for incoming requests to the /64 prefix to be correctly routed through the router's WAN IPv6 address?

                                            Thank you kindly,

                                            Ignoring the fact this thread is so old it's gone mouldy, there is nothing wrong with a single /64, other than a stingy ISP.  A /64 is the smallest prefix that supposed to be assigned.  No matter how big your prefix is, your gateway will normally get one.  I know that with only 18.4 billion, billion addresses, you don't have any to spare.  ;)

                                            To answer your question, place your modem in bridge mode, so that pfSense is the gateway, not the modem.  That's what I have here.

                                            PfSense running on Qotom mini PC
                                            i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                                            UniFi AC-Lite access point

                                            I haven't lost my mind. It's around here...somewhere...

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.