IPv6 settings for pfSense with Cerberus FTTP

Hi - I've just had Cerberus FTTP installed and need some help setting up IPv6 on my pfSense router. I can see on my Cerberus NETConnect page an IPv6 subnet so just need to know how this should be set on the WAN and LAN settings.

IPv6 Subnet : 2a01:xxxx:x:xxx::/64

The default DHCP6 setting doesn't seem to pick up the IPv6 address so I assume I need to setup a static IPv6 setting?

Edited by brookheather (Fri 29-Mar-19 17:36:58)

So I can now ping an IPv6 hostname from the pfSense router diagnostics page (ipv6.google.com). I followed these instructions to get an IPv6 address showing for the WAN connection on the status dashboard - they were posted by someone for a BT connection and I just changed the prefix delegation from /56 to /64.

Step 1: Configure your WAN interface�s IPv6 configuration type to be �DHCP6�. In the client configuration, check �Request a IPv6 prefix/information through the IPv4 connectivity link� and �Only request an IPv6 prefix, do not request an IPv6 address�. Set �DHCPv6 Prefix Delegation size� to �64�. Leave all other options as default.

Step 2: Configure your LAN interface�s IPv6 configuration to be �Track interface�. Scroll down, and under the �Track IPv6 Interface� section, select �WAN� from the IPv6 Interface dropdown. Leave �IPv6 Prefix ID� as default (0).

Step 3: Apply changes. And watch the interfaces status screen light up with that magic IPv6 address. RA will publish the prefix information out to your network shortly after connection, and your computer of choice should have an IPv6 address that�s useable.

Step 4 (optional): Reboot your pfSense box. If the interface doesn�t take the new addressing upon reconnecting, a reboot should do the trick.

I am just having a problem pinging this hostname from any of my PCs - I get different results. From the pfSense router:

PING6(56=40+8+8 bytes) 2a01:xxxx:x:xxx:92e2:baff:feef:724f --> 2a00:1450:400c:c0c::65
16 bytes from 2a00:1450:400c:c0c::65, icmp_seq=0 hlim=46 time=8.793 ms
16 bytes from 2a00:1450:400c:c0c::65, icmp_seq=1 hlim=46 time=9.410 ms
16 bytes from 2a00:1450:400c:c0c::65, icmp_seq=2 hlim=46 time=9.438 ms

--- ipv6.l.google.com ping6 statistics ---
3 packets transmitted, 3 packets received, 0.0% packet loss
round-trip min/avg/max/std-dev = 8.793/9.214/9.438/0.298 ms

but from my PC:

Pinging ipv6.l.google.com [2a00:1450:4009:80c::200e] with 32 bytes of data:
Request timed out.
Request timed out.
Request timed out.
Request timed out.

Ping statistics for 2a00:1450:4009:80c::200e:
Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),

Edited by brookheather (Fri 29-Mar-19 16:26:55)

In reply to a post by brookheather:

Hi - I've just had Cerberus FTTP installed and need some help setting up IPv6 on my pfSense router. I can see on my Cerberus NETConnect page an IPv6 subnet so just need to know how this should be set on the WAN and LAN settings.

IPv6 Subnet : 2a01:xxxx:1:xxx::/64

The default DHCP6 setting doesn't seem to pick up the IPv6 address so I assume I need to setup a static IPv6 setting?

It depends on how Cerberus have set this up, and I suggest you contact them to clarify as there are a lot of possibilities.

What I would *expect* them to do is to allocate you a /64 for the WAN link, and an additional /56 or /48 for your LAN side. You can then use this to assign /64 subnets to one or more LAN segments on your side.

It's possible they use stateless autoconfiguration or DHCP6 or IP unnumbered for the WAN link, and the /64 they have given you is for your LAN side. That would be very parsimonious of them. End users should get at least a /56, and on a business service I'd expect you to get a /48. If they only gave you a /64, it would be impossible to have even two IPv6 subnets in your house (e.g. one for internal use and one for guests)

It's possible they assigned you a /48, but haven't told you what it is, and expect you to use DHCP6 prefix delegation to assign LAN subnets. That's not ideal for a business service, where you want to configure IPv6 subnets statically.

I recall there's an RFC somewhere which lets them give you a large block, and assign the point-to-point /64 out of the same block. << Digs around: found it, this is RFC6603, "prefix exclude" option for DHCP6 >> But if they were doing that, they would have given you a /48 or /56, not a /64.

So basically: go back and ask specifically what subnets you should use for the WAN point-to-point link and for the LAN subnet(s) behind your router.

Aside: I have come across providers who sell IPv6 but don't understand how to configure it properly. At one office, from a provider who shall remain nameless, they decided to assign us a *flat* /48 network: that is, at the handover point their router was xxxx::1/48 and they expected to see a single LAN with the whole /48 on it. That's totally broken

My WAN interface is showing an IPv6 address of 2a01:xxxx:x:xxx:92e2:baff:feef:724f but my PCs are showing a different prefix - is this normal?

IPv6 Address. . . . . . . . . . . : fda7:4f6c:75bc:1:8974:cfef:fbe6:add5(Preferred)
Temporary IPv6 Address. . . . . . : fda7:4f6c:75bc:1:88e2:c43f:1693:b1c8(Preferred)
Link-local IPv6 Address . . . . . : fe80::8974:cfef:fbe6:add5%10(Preferred)

Any idea what I need to add to pfSense to route IPv6 to the WAN? Should I add a new outbound rule?

In reply to a post by brookheather:

My WAN interface is showing an IPv6 address of 2a01:xxxx:x:xxx:92e2:baff:feef:724f but my PCs are showing a different prefix - is this normal?

IPv6 Address. . . . . . . . . . . : fda7:4f6c:75bc:1:8974:cfef:fbe6:add5(Preferred)
Temporary IPv6 Address. . . . . . : fda7:4f6c:75bc:1:88e2:c43f:1693:b1c8(Preferred)
Link-local IPv6 Address . . . . . : fe80::8974:cfef:fbe6:add5%10(Preferred)

Addresses which begin fd..: are not real IPv6 addresses, these are the equivalent of private RFC1918 addresses in the IPv4 world. You won't be able to reach the Internet using these without using IPv6 NAT (yuk! Don't do it). They only have significance within a site.

Addresses which begin fe80: are link-local, and only have significance between two directly-attached devices. They are the equivalent of 169.254.x.x addresses in the IPv4 world.

So "yes", it's normal that your LAN addresses are from a different subnet than your WAN link, but "no", it's not normal to use non-routable IPv6 addresses on the LAN.

Any idea what I need to add to pfSense to route IPv6 to the WAN? Should I add a new outbound rule?

pfSense will have an "allow all outbound" rule by default, so once the addressing and routing is set up correctly, I'd expect it to just work.

Like I say, there are lots of ways Cerberus could have decided to build their IPv6 service, so you should come back when you have the details.

A *typical* configuration might be:

- provider gives you XXXX:XXXX:XXXX:XXXX::/64 as the WAN P2P link
=> configure your WAN address with XXXX:XXXX:XXXX:XXXX::2/64
=> point default route at XXXX:XXXX:XXXX:XXXX::1

- provider gives you YYYY:YYYY:YYYY::/48 as your local block
=> configure your pfSense LAN interface as YYYY:YYYY:YYYY:1::1/64
=> if you have more local subnets, configure the next interface as YYYY:YYYY:YYYY:2::1/64 etc
=> pfSense should give out IPv6 addresses to client devices from these ranges, using either SLAAC or DHCPv6
=> pfSense should give out its own IP address as default gateway, using Router Advertisements

So I am confused as to why my PCs aren't picking up an IPv6 address from the DHCPv6 Server that is running on the pfSense router. It is configured to use the subnet Prefix Delegation with a range of ::1000 to ::2000 so I would expect my PC to have a local IPv6 address like 2a01:xxxx:x:xxx:1000.

It looks like the PCs aren't asking for an IPv6 address from the DHCPv6 server? Perhaps this setting needs changing from Assisted mode?

Select the Operating Mode for the Router Advertisement (RA) Daemon.
Disabled
RADVD will not be enabled on this interface.
Router Only
Will advertise this router.
Unmanaged
Will advertise this router with stateless autoconfig.
Managed
Will advertise this router with all configuration through a DHCPv6 server.
Assisted
Will advertise this router with configuration through a DHCPv6 server and/or stateless autoconfig.
Stateless DHCP
Will advertise this router with stateless autoconfig and other configuration information available via DHCPv6.

Edited by brookheather (Fri 29-Mar-19 18:59:27)

In reply to a post by brookheather:

So I am confused as to why my PCs aren't picking up an IPv6 address from the DHCPv6 Server that is running on the pfSense router. It is configured to use the subnet Prefix Delegation with a range of ::1000 to ::2000 so I would expect my PC to have a local IPv6 address like 2a01:xxxx:x:xxx:1000.

It looks like the PCs aren't asking for an IPv6 address from the DHCPv6 server? Perhaps this setting needs changing from Assisted mode?

Select the Operating Mode for the Router Advertisement (RA) Daemon.
Disabled
RADVD will not be enabled on this interface.
Router Only
Will advertise this router.
Unmanaged
Will advertise this router with stateless autoconfig.
Managed
Will advertise this router with all configuration through a DHCPv6 server.
Assisted
Will advertise this router with configuration through a DHCPv6 server and/or stateless autoconfig.
Stateless DHCP
Will advertise this router with stateless autoconfig and other configuration information available via DHCPv6.

No, you can't use DHCP6 without radvd. This is because in their infinite wisdom, the designers of DHCP6 decided that it *wouldn't* include a gateway setting. So the only way that DHCP6 clients can pick up a gateway is by listening for router advertisements

As it happens, I do manage a site which uses IPv6, pfSense 2.4.4p2, and DHCP6 instead of SLAAC - but note this is with static LAN address assignment, not using prefix delegation to pick up LAN subnets from upstream. In fact, I don't know if pfSense has the ability to act as DHCP6 client and pick up prefixes to configure the LAN side dynamically; I've not come across any settings for it.

FWIW, the way I have it configured is:

* Services > DHCPv6 server & RA
* LAN tab
* DHCPv6 server tab
* (X) Enable DHCPv6 server on interface LAN
* Range: statically assigned from XXXX:XXXX:XXXX:XXXX::1000 to ::1ffff (matching the LAN prefix, which as I said, was already statically configured; the LAN address is XXXX:XXXX:XXXX:XXXX::1/64)
* Prefix delegation range/size: not required (*)
* Router Advertisements tab
* Router mode: Managed - RA flags [managed, other stateful]

It's the "managed" option which tells the clients to pick up an address via DHCP6, not via SLAAC.

I see you've already made the decision to use DHCP6 instead of SLAAC. In my opinion that's the right one - clients who pick up SLAAC addresses are also forced to use privacy addresses, picking up a new random address every few hours. With DHCP6 they just stick with whatever address was given to them.

(*) This is only used if there are other devices in your LAN which in turn are requesting entire prefixes to be delegated to them. So for example, if Cerberus gave you a /48 XXXX:XXXX:XXXX::/48, then you could configure your DHCP6 server to give out /56 prefixes from this, say XXXX:XXXX:XXXX:0100::/56 to XXXX:XXXX:XXXX:XXXX:ff00::/56. The chances of you ever needing this are extremely low. It would be if you plug in a downstream server or router which wants to pick up more addresses for giving out to clients further downstream (and you want to do this dynamically, not statically).

Thanks - I changed the router mode to Managed but my PC is still getting an IPv6 address starting fda7 so that hasn't changed. On Interfaces / LAN tab how do you have the IPv6 Configuration Type set? Mine is currently Track Interface so it follows the WAN IPv6 address I guess?

I have these options on the DHCPv6 server tab:

DHCPv6 Server Enable DHCPv6 server on interface LAN (checked)
Subnet Prefix Delegation
Subnet Mask 64 bits
Available Range :: to ::ffff:ffff:ffff:ffff
Prefix Delegation subnet will be appended to the beginning of the defined range
Range
::1000
From
::2000
To

In reply to a post by brookheather:

On Interfaces / LAN tab how do you have the IPv6 Configuration Type set?

Static IPv6.

If you send me a PM with the exact configuration E-mail Cerberus sent you (except blank out the PPPoE password if it's shown), I may be able to work out what they're trying to say.

Cerberus didn't send any IPv6 details - on the online portal it just states this:

IPv6 Subnet : 2a01:xxxx:x:xxx::/64

and that is what is picked up on the WAN interface automatically:

WAN 2a01:xxxx:x:xxx:92e2:baff:feef:724f

when I try and configure the LAN with a static IPv6 address of 2a01:xxxx:x:xxx::1/128 I get the folllowing error as this overlaps with the WAN address:

IPv6 address 2a01:xxxx:x:xxx::1/128 is being used by or overlaps with: WAN (2a01:xxxx:x:xxx:92e2:baff:feef:724f/64)

so presumably this means that the LAN needs to be on a different segment so the WAN? I assumed I could assign any IPv6 address on my LAN starting with 2a01:xxxx:x:xxx: - is that not how it works?

Are your WAN and LAN IPv6 addresses on different segments?

Post deleted by RobertoS

Edited by RobertoS (Mon 01-Apr-19 11:04:48)

(Odd: I thought I'd posted a reply, but it hasn't appeared)

Yes, my WAN and LAN interfaces have different IPv6 prefixes. This is how IP routing works: you need a unique prefix for each layer 2 domain.

Cerberus should have given you an additional /56 or /48, static-routed it towards you, and from that range you could pick a /64 for your LAN subnet(s).

Or they could use Prefix Delegation so that you can dynamically pick up more addresses. I found a post which suggests pfSense is capable of doing this - but since you only are only seeing local addresses from fd00::/8, that suggest pfSense is failing to pick up anything from Cerberus.

I have managed to get it working by using a different subnet for the LAN - I just made one up and used 2a01:xxxx:x:yyy::/64 instead of 2a01:xxxx:x:xxx::/64 for the WAN. I also had to change the Firewall / NAT / Outbound to Hybrid and add an additional rule for the LAN subnet 2a01:xxxx:x:yyy::/64.

Once I made these changes my PC got a new IPv6 address 2a01:xxx:x:yyy:d60:32fa:a3f8:f040 and I was able to ping ipv6.google.com:

Pinging ipv6.l.google.com [2a00:1450:4009:80c::200e] with 32 bytes of data:
Reply from 2a00:1450:4009:80c::200e: time=3ms
Reply from 2a00:1450:4009:80c::200e: time=3ms
Reply from 2a00:1450:4009:80c::200e: time=4ms
Reply from 2a00:1450:4009:80c::200e: time=3ms

Ping statistics for 2a00:1450:4009:80c::200e:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 3ms, Maximum = 4ms, Average = 3ms

So I guess I need to chase Cerberus for my official LAN IPv6 subnet rather than using a random made up one? I would then have one subnet for WAN and a different one for LAN?

I have now managed to work around the error message I was getting in pfSense when using the same subnet for WAN and LAN. I now have 2a01:xxxx:x:xxx:92e2:baff:feef:724f for the WAN as before but I've managed to set the LAN to 2a01:xxxx:x:xxx::1:1/112 with the DHCP6 server range from 2a01:xxxx:x:xxx::1:1000 to 2a01:xxxx:x:xxx::1:2000. My PCs all get IPv6 addresses in this range.

The workaround was to first set the WAN to a static IPv6 address of 2a01:xxxx:x:xxx::0:1/128 then set the LAN to 2a01:xxxx:x:xxx::1:1/112. I could then change the WAN back to DHCP6 and it all works fine. If I try and change the LAN subnet I still get the pfSense error message about overlapping addresses.

In reply to a post by brookheather:

I have managed to get it working by using a different subnet for the LAN - I just made one up and used 2a01:xxxx:x:yyy::/64 instead of 2a01:xxxx:x:xxx::/64 for the WAN. I also had to change the Firewall / NAT / Outbound to Hybrid and add an additional rule for the LAN subnet 2a01:xxxx:x:yyy::/64.

I wonder if pfSense is doing IPv6 NAT then: try "curl ifconfig.co" to see what IP address the rest of the Internet sees you as.

If you still see the address 2a01:xxxx:x:yyy::<something>, then you may be fortunate. The block 2a01:xxxx:x::/48 is the big block that Cerberus have assigned to you, inside that block 2a01:xxxx:x:xxx::/64 is the subnet allocated for the P2P link, and everything else is available for you to use as you see fit.

I would then have one subnet for WAN and a different one for LAN?

You would, but you already do: 2a01:xxxx:x:xxx::/64 and 2a01:xxxx:x:yyy::/64 are two different subnets.

/64 means the first 64 bits are the prefix (shared by all the machines on a given layer 2 network), and the remaining 64 bits are the token (different for each host on that network).

Everything between colons is 16 bits, so 2a01:xxxx:x:xxx is 64 bits; and hence 2a01:xxxx:x:yyy is a different 64 bits.

Running curl ifconfig.co from my PC shows its own allocated IPv6 address of 2a01:xxxx:x:xxx::1:1f57 so not using NAT (I am currently using 2a01:xxxx:x:xxx::1:1/112 for the LAN).

If I do have a /48 (or /56) block then I am happy to assign a LAN subnet from this - trying to get an answer about this from Cerberus is proving difficult. Their control panel shows I have one /64 subnet allocated so not sure that I can actually use some other /64 subnet in this block - need to get them to confirm this.

Not sure what the implications are if I "borrow" another /64 block for my LAN addresses - I don't intend to run any IPv6 services on my network.

Edited by brookheather (Mon 01-Apr-19 14:09:51)

Your solution of stealing a /112 from the WAN network will work, as long as the address range you use does not conflict with WAN link (which means basically just avoiding the WAN IP address of your router and the IP address of Cerberus' end of the link)

Not all devices are happy with a /112 network, because the assumption of a /64 prefix length is hard-baked into some operating systems. So it would be better to use a different /64 which doesn't overlap with the WAN link.

OK I have changed back to using a different /64 subnet for the LAN and running curl shows that it is now using NAT i.e. it shows the WAN IPv6 address. I think I will just leave it like this for the moment.

If anyone else is using pfSense with Cerberus I would be interested to know how you configured it.

Edited by brookheather (Mon 01-Apr-19 17:43:28)

I don't have Cerberus any more but I did. By default they only give you a single /64. If you ask them they will give you a second /64 and then you have one for your WAN interface and one for your LAN. This is how I had it configured in pfSense and it worked as expected.

I have now requested an "official" second /64 block which I'm now using the LAN side - obviously this still requires the router to perform NAT. I wonder why they don't supply a /48 or/56 block like BT?

Yep no idea - it's not really quite the same as NAT though (at least that's my understanding), the block they provide for LAN should be routed over the WAN prefix and so the router is just another hop in the route - these LAN addresses should be directly addressable public IPv6 addresses. My understanding is that this is exactly the same as when you get a /48 or /56 and assign a /64 from each to the LAN and WAN.

Running curl ifconfig.co shows my WAN address not the LAN address so isn't that NAT?

Do you see the WAN's same IPv6 address as the external address from all devices on your LAN (or at least more than 1)? If so, then yes that sounds like NAT - but that is not how mine was configured with Cerberus. You may need to specifically ask them to ensure that your LAN /64 is a "routed prefix" over your WAN /64. Once you do that, I think your WAN will automatically get an address from its /64, and then in pfSense you configure your LAN to use the other /64, there should be no NAT going on with this configuration.

Unfortunately I can't remember *exactly* how to do it as a I just have /48 from IDNet now, but it's definitely possible.

Edited by deleted (Thu 04-Apr-19 15:46:23)

In reply to a post by brookheather:

I have now requested an "official" second /64 block which I'm now using the LAN side - obviously this still requires the router to perform NAT.

No, that won't require NAT. Cerberus should have routed it to you, i.e. it comes down your link, with your router's WAN address as the next-hop.

You can prove whether this is working by going to some other site which has v6 (e.g. a VM in the cloud), and doing traceroutes:

traceroute6 x:x:x:x::x # your router's WAN address
traceroute6 y:y:y:y::1 # your router's LAN address (*)
traceroute6 y:y:y:y::z # some other device on your LAN

All three traceroutes should go via your router's WAN address.

The last one could even show your internal device as the last hop, but only if (a) your pfSense firewall is configured to allow inbound traffic to that address, and (b) the device's own internal firewall doesn't block traceroute responses.

(*) It's traditional to give your router the first available address in the block, as it's the default gateway for all other devices on that network.

Why on earth Cerberus don't give you a /48 or /56 though, I don't know. They will have a minimum of a /32 from RIPE. That's enough for 65.5K customers with /48's, or 16.7 million customers with /56's. And they can always get more.

So now I'm on Cerberus and IPv6 is available I've been trying to set this up. I'm using pfSense as well. My IPv6 range is 2a01:5d00:abcd:ff00/56 (the last 8 digits I've changed to save posting the actual address).

I do appear to have IPv6 up and running although I'm not sure it is configured correctly.

On the Dashboard the WAN has my public IPv4 address, but shows a local IPv6 address starting fe80:: is that correct? I thought the WAN should get a public IPv6 address? The IPv6 gateway also starts fe80::

LAN1 is allocated an IP address of 2a01:5d00:abcd:ff00.xxxx.xxxx.xxxx.xxxx and clients on the LAN are being allocated addresses starting 2a01:5d00:abcd:ff00. Now I thought the WAN side should take the first subnet of 2a01:5d00:abcd:ff00 and the LAN would get 2a01:5d00:abcd:ff01.

In pfSense the WAN interface is set as:

IPv6 Configuration type: DHCP6
Request a IPv6 prefix/information through the IPv4 connectivity link ticked
Only request an IPv6 prefix, do not request an IPv6 address ticked but tried unticked
DHCPv6 Prefix Delegation Size at 56
Nothing else checked.

The LAN is set to Track interface.

Any pointers welcome.

In reply to a post by E300:

On the Dashboard the WAN has my public IPv4 address, but shows a local IPv6 address starting fe80:: is that correct? I thought the WAN should get a public IPv6 address? The IPv6 gateway also starts fe80::

What you see is correct. The way Cerberus handle IPv6 is to use an "unnumbered" link between your router and their BRAS - no public IPs are assigned. They could have allocated a separate subnet for this link - some providers give you an extra /64 or a /127 - but they don't. This gives you the whole /56 to use as you like, and avoids them the work of having to allocate addresses for the point-to-point link.

(fe80:: addresses are "link local" - only having local significance, i.e. usable only between peers on the same link, not routable across the Internet. They are assigned automatically by the devices themselves, embedding their MAC address to ensure uniqueness)

In reply to a post by E300:

LAN1 is allocated an IP address of 2a01:5d00:abcd:ff00.xxxx.xxxx.xxxx.xxxx and clients on the LAN are being allocated addresses starting 2a01:5d00:abcd:ff00. Now I thought the WAN side should take the first subnet of 2a01:5d00:abcd:ff00 and the LAN would get 2a01:5d00:abcd:ff01.

I have configured my router statically, so I don't have experience of how Cerberus have configured DHCP service on their side. But what I suspect is they provide DHCP for "prefix delegation" (i.e. for the router to fetch a subnet for its LAN side) without DHCP for assigning the WAN IPv6 address.

You are free to statically allocate any address out of your /56 to your WAN side if you wish. For example, you could give your router 2a01:5d00:abcd:ff00::1 (and this can be the same as its address on the LAN side). This may make it easier for the router to make outbound connections to the Internet - e.g. for outbound pings or fetching firmware updates. However it may still work without this - e.g. the router may be smart enough to use its LAN address as source IP for connections, when its WAN address is link-local.

In the pfSense GUI, try checking for firmware updates. If it says that your software is up-to-date, then it's happily making outbound connections - although in all likelihood it's just using IPv4 for this. Or try pinging 2001:4860:4860::8888 from the pfSense CLI.

If you want to make inbound connections to your pfSense box - e.g. to manage it over the Internet - then you should be able to do this using its LAN address. However, pfSense blocks management access from the WAN side anyway unless you tick an option.

Edited by candlerb (Mon 30-Dec-19 09:34:22)

Many thanks for the info.

I tried a Ping6 from pfSense and as you suggested it worked with the ping source being the LAN IPv6 address.

So it seems it is all okay then and I was just being thrown by not seeing a WAN IP address, so may allocated it one. I don't wish to manage remotely but think it might come in handy for trace routes or pings to the router.

When I visit sites like http://test-ipv6.com/ I'm getting 10/10, so thought I must be along the right lines.

Thanks for your help.

To put a part of it very simply, the fe80 addresses are equivalent to the IPv4 192.168.n.n addresses.

I don�t know your Dashboard, but suggest the �... do not request an IPv6 address� should be unticked.

Yo will then also probably find that asking a site such as the Main one of thinkbroadband what your IP Address is will give you the (temporary) IPv6 address of the device you are using. Not the router address that you get on IPv4.

ipconfig/all at a Windows command prompt will tell you more. Note that the temp address will change quite frequently. Setting up an IPv6 BQM can be fun, until you find the address Cerberus has allocated to your router.

I think it is all okay. The routers IP is the same as the LAN IPv6 shown in the pfsense dashboard as I can successfully ping this externally, and have set up the BQM chart using that address and it has started charting.

There are options for Do not request an IPv6 address but checked or not I still don't get one on the WAN side, but as explained by candlerb that seems to be just how Cerberus works. So all seems to be working okay.

If you untick "Only request an IPv6 prefix" then you should see the fe80:: disappear from the WAN interface on the dashboard.

Under LAN there is a section called "Track IPv6 Interface" - set IPv6 interface to WAN and set the IPv6 Prefix ID to 1. This means your internal LAN IPv6 addresses are allocated within the 2a01:5d00:abcd:ff01/64 subnet which I think is what you want?

You should then see your pfSense router IPv6 address appear under LAN in the dashboard - this should be your router public address - I can ping mine fine (once ICMP is enabled for IPv6). I have a BQM setup for both my IPv4 and IPv6 addresses.

For some reason pfSense only shows my IPv4 address under WAN on the dashboard - just a quirk of pfSense I guess?

On the DHCPv6 Server page I have my range set from ::d:1 to ::d:ffff so it is obvious which IPv6 addresses have been allocated by DHCP as they have a ::d:xxxx at the end of the address.

Edited by brookheather (Mon 30-Dec-19 10:53:27)

In reply to a post by RobertoS:

To put a part of it very simply, the fe80 addresses are equivalent to the IPv4 192.168.n.n addresses.

That's not correct. fe80:: addresses are equivalent to IPv4 169.254.x.x link local addresses. You get these when devices do not get any response from a DHCP server.

Link-local addresses cannot be routed between subnets, even within your own site; 192.168 addresses can.

The nearest equivalent of 192.168 (RFC1918) addresses in IPv6 is fc00::/7 ULA addresses.

Edited by candlerb (Mon 30-Dec-19 13:03:02)

Sorry I know this is slightly off topic but I hope people don't mind

Does anyone use pfSense via a Netgate piece of kit like the SG-1100 or SG-3100 on their FTTP connection? If so does the pfSense functionality differ from the pfSense functionality when run on an old PC under the desk?

Edited by deleted (Mon 30-Dec-19 15:21:22)

Whilst I bow to your deeper knowledge, I suggest that to 95%+ of the users the difference is moot, as they don't even know what a subnet is.

Note I did say I was putting it very simply. However, in the context of the original question, I should perhaps have kept my trap shut as the OP is clearly not in that 95% .

On the other hand, your clarification could well be useful to the OP.

I've seen reviews on YouTube and the software is identical from what I can see. It shouldn't be any different to use as it still runs on FreeBSD with the same version web UI on it.

Hope that helps.

In reply to a post by E300:

I've seen reviews on YouTube and the software is identical from what I can see. It shouldn't be any different to use as it still runs on FreeBSD with the same version web UI on it.

OK thanks that much appreciated