Plusnet IPv6 on pfSense

[#1]

Hi all,

I've just had my connection enabled for IPv6 today (thanks again, Dave!), but I'm struggling to receive an IPv6 address on my pfSense firewall. I'm using the settings I used on a different ISP when I had an FTTC connection that supported IPv6, so perhaps they are wrong for Plusnet - the only modification I've made to those settings is to change the prefix delegation size to /56.

I've made sure IPv6 traffic is allowed system wide:

And I've used the following settings for the Plusnet interface - looking at other users' posts, DHCP6 is the correct method of retrieving the IPv6 address, and the prefix delegation size should be /56. I've also tried enabling and disabling the option to request IPv6 information over the IPv4 link, which makes no difference.

Whilst the logs aren't super detailed, they do seem to show that no IPv6 address is being assigned, only the link local address:

And the logs match up with what I'm seeing in the interface status, too:

Does anyone have a suggestion for further troubleshooting, or potential config changes, please? 

Cheers,

crgbt

[#2]

Whilst I don't have anything more definitive, in my testing back at original setup, 'straight dhcp' for an IP6 address didn't work for me.

I had to explicitly request prefix delegation.  My examination at the time - https://community.plus.net/t5/IPv6-Trial/IPv6-Trial-Update/m-p/2006979#M3450

Good luck!

[#3]

@crgbt whilst I dont use pFsense, I do use my own router running Openwrt so the options are very similar.

Request IPV6 over the IPV4 parent PPPoE interface using the DHCPv6 client is correct.

However, have you tried checking the 'Request only an IPv6 prefix' ? 

The WAN interface doesnt get an actual IPV6 address in itself, rather just a prefix which can then be used by the router to allocate IPv6 addresses downstream.

Also the prefix size should be automatic as its specified by Plusnet

edit:posts crossed with @MPC 

[#4]

---

The WAN interface doesnt get an actual IPV6 address in itself, rather just a prefix which can then be used by the router to allocate IPv6 addresses downstream.

I'm new to OpenWrt but just starting to learn. I do seem to have an IPv6 address for the router - whether that is a good thing or not I don't know. (It does mean that I can use a Thinkbroadband quality monitor to keep an eye on it)

[#5]

@IMM 

The LAN interface WILL get an IPv6 address , so the router itself has an IPv6 address.  What I was referreing to earlier is that the WAN interface doesnt get a GUA IPv6 address in the same way as it gets an IPv4 one.  It just has a local one , see screenshot below

[#6]

Yeah.  I added a post-interface-up script to add the prefix::1 (/128) address on the ppp0 interface to give me something on the outside to ping.

[#7]

@MisterW Yes, on the WAN - we've obviously taken different approaches to the setup - (or I've blundered my way into a problem which is yet to hit me!)

I was only pointing out that in some cases there can be an IPv6 address for the wan. I don't see it as a big deal if different setups produce different results. I'm sure I don't know enough to have a view as to which is a better way to do it.

[#8]

@IMM yes , it looks like you've used the 'automatic' option for Obtain IPv6 address' on the WAN interface, which then dynamically creates the WAN_6 interface with default settings. They are obviously different to my settings where I have 'Obtain IPv6 address' set to manual and have created the WAN6 interface myself.

I don't think either way is a problem...

NB glad you've redacted the actual addresses , I was going to suggest that before approving the image althought the first one still has a full IPv4 one ?

[#9]

If it helps with the options, for my TP-Link AX53 I used these settings

For the LAN I used SLAAC+Stateless DHCP

EDIT: For the WAN IPv6 address I did try Automatic but it failed to connect

[#10]

Thanks @MPC, @MisterW, @IMM, and @Dan_the_Van - a combination of all your assistance and information helped me solve this. What tripped me up was the interface not getting an IPv6 address, and the pfSense logs not showing DHCPv6 responses so I thought I wasn't getting a prefix, either.

It turns out you need to start the DHCPv6 client in debug mode in pfSense (System > Advanced > Networking > DHCP Options) to get any useful DHCP client logs. As soon as I enabled that, I could see no prefix was being assigned, so I tried the "Request only an IPv6 prefix" option as you suggested, @MisterW. Upon applying the settings, I saw I was now receiving a prefix so I could continue setting up everything else on the LAN side, although I needed to tweak a few more settings to get end-to-end connectivity.

Here are all of the settings I've configured to get IPv6 working on pfSense, should anyone else need to set this up on pfSense in the future:

On your WAN interface, set the IPv6 Configuration Type to DHCP6, select Use IPv4 connectivity as parent interface and Request only an IPv6 prefix, and set DHCPv6 Prefix Delegation size to 56.

On your LAN interface, set IPv6 Configuration Type to Track Interface, IPv6 Interface to your WAN interface, and IPv6 Prefix ID to 0. Note, the IPv6 Prefix ID needs to be unique per interface - if you have multiple LAN interfaces (e.g., an IoT or Guest network), you should increment this number as you go. For example, my IoT interface has an IPv6 Prefix ID of 1, and my Guest interface a IPv6 Prefix ID of 2.

Next you need to configure your Router Advertisements setting - there are a few options if you want to use SLAAC, DHCP6, or a combination of both. I'm just using SLAAC and my firewall as a DNS server, so the following settings are for this setup.

Select your LAN interface, then set Router Mode to Unmanaged, and select Enable DNS. Leave the DNS server fields blank if you are using your firewall as a DNS server or forwarder - the top entry will auto-populate with your firewalls LAN interface IPv6 address upon saving. Note, you need to repeat these settings for each of your other LAN interfaces, if you have multiple.

Last, you need to disable gateway monitoring on your IPv6 gateway, otherwise pfSense will always think it's down and not route traffic out the gateway. 

On your IPv6 gateway, select Disable Gateway Monitoring.

Now reboot your pfSense firewall. I tried restarting relevant services, but the LAN interface never picked up an IPv6 address - only a reboot fixed this. Upon reboot, you should see an IPv6 address from your IPv6 prefix assigned to the LAN interface. If you've configured multiple LAN interfaces, they should also have an IPv6 address.

Your computer should now also pick up an IPv6 address from your assigned IPv6 prefix - mine required a restart (ipconfig /renew6 didn't pick it up), but I now have end-to-end IPv6 connectivity, which I tested using https://test-ipv6.com/.

Cheers,

crgbt