Static IPv6 subnet on LAN announced through RA on WAN interface?

fishbone · Apr 1, 2016, 11:03 AM

Hi all,

situation is as follows:
I have a DSL line with a fritzbox on it that does not allow for IPv6 static route configurations.
The fritzbox is sending an IPv6 prefix through DHCPv6 on its LAN side; this is de WAN side of the pfSense box (let's say network ac:1::/64).
The pfSense box gets an IPv6 address and default gateway (WAN config is set to DHCPv6). From the pfSense box itself I can ping IPv6 hosts on the internet.

On the LAN side I configured a static IPv6 subnet: ac:2::/64 with ac:2::1 on the pfSense box.
Clients on the LAN do receive IPv6 configs and can ping the pfSense box. However, they cannot ping neither hosts on the WAN side of the pfSense box, nor the internet.

My guess is that this is a routing issue: hosts on the WAN side do not know how to get to the ac:2::/64 network. It is not a filtering issue because I see the packets leaving the pfSense box using tcpdump and logging is also enabled on all filter rules and they do not appear in the logs).

For this to work I need to have RA set up on the WAN side (also because the fritzbox can only be set to "Allow IPv6 prefixes announced by other IPv6 routers in the home network", as said, it does not allow IPv6 static routes to be added).

Any hints on how to achieve this?

Regards,

John

johnpoz · Apr 1, 2016, 12:00 PM

And where did you get this ac:2::/64 you put on your lan?? You can not just make shit up and expect it to work.. Is your isp routing to you more /64? Did they give you a /48 or something.

fishbone · Apr 1, 2016, 12:26 PM

Yes I have a /48 from my ISP; in this case ac::/48 ; I used ac:1::/64 and ac:2::/64 just for clarification; it is not the real prefix.

johnpoz · Apr 1, 2016, 12:45 PM

So you sure the /48 is routed to you.. Or is it just attached to you.. And your ac:1::/64 is the transit, is that the 1st /64 in the /48 – is that what your ISP told you would be the transit network.

I have a routed /48 from HE, its routed down my tunnel.. I can then subnet that out to any /64 I want and place them static on my lan segments in pfsense and works just fine.

I would validate that the /48 is fact routed to you via the network your using as a transit on your wan.

fishbone · Apr 1, 2016, 1:09 PM

Yes, I'm sure the /48 is routed to me. I can understand why it works automatically with your HE tunnel and your /48 because the pfsense box knows all attached networks.
On my transit LAN (the WAN side of the pfsense box) my internal LAN's behind pfsense are not known (I don't do NAT) . For IPv4 that's no problem because I simply add a static route on all servers in the transit LAN. For IPv6 I cannot, simply because the Fritz!Box doesn't allow me to do that. That's why I need to transmit RA's one way or another unless someone knows another solution.

hda · Apr 1, 2016, 1:31 PM

You have cascading routers (ISP-FritzBox <–> pfSenseBox). Try with prefix delegation from FritzBox(server) to pfSenseBox, say a /60 for 15 LAN's. Then again you might run into trouble with issueing IPv6-LAN subnet-values of your static choice. Solve this with LAN stick to Track Interface. To avoid all this, remove the Fritzbox or get a PPPoE towards the pfSenseBox (e.g. a DrayTek 130 i.c.o. DSL).

johnpoz · Apr 1, 2016, 1:17 PM

So your /48 is routed to your fritzbox, and your /64 is between the fritz box and pfsense..

But you can not edit routes on the firtzbox? Why do you think sending RA's would work? That seems like a pretty crappy setup.. Can you not just bridge this fritz box so that your /48 is directly routed to your pfsense wan.

fishbone · Apr 1, 2016, 1:52 PM

You're right. The /48 is routed to my fritzbox and my /64 is on the transit LAN.
And yes, I cannot edit IPv6 routes on the fritzbox. I think RA's will work for I can tell the fritzbox to accept RA's ("Allow IPv6 prefixes announced by other IPv6 routers in the home network" in the GUI).

johnpoz · Apr 1, 2016, 5:20 PM

Ah… Those are some weird ass boxes to be sure.. Sorry off the top I do not think you can announce RA out the wan.. That could be a dangerous thing to do if you were directly connected to the ISP that is for sure.

You could prob do it via manual manipulation of the configs.. But I don't see a way to do it in the gui. RA gui is tied to having static on the interface, since its under the dhcpv6 server tab.. Try setting static ipv6 on your wan interface connected to your fritz.. Then you should be able to enabled dhcpv6 and get the RA gui tab..