Post deleted by RobertoS

Edited by RobertoS (Mon 01-Apr-19 11:04:48)

(Odd: I thought I'd posted a reply, but it hasn't appeared)

Yes, my WAN and LAN interfaces have different IPv6 prefixes. This is how IP routing works: you need a unique prefix for each layer 2 domain.

Cerberus should have given you an additional /56 or /48, static-routed it towards you, and from that range you could pick a /64 for your LAN subnet(s).

Or they could use Prefix Delegation so that you can dynamically pick up more addresses. I found a post which suggests pfSense is capable of doing this - but since you only are only seeing local addresses from fd00::/8, that suggest pfSense is failing to pick up anything from Cerberus.

I have managed to get it working by using a different subnet for the LAN - I just made one up and used 2a01:xxxx:x:yyy::/64 instead of 2a01:xxxx:x:xxx::/64 for the WAN. I also had to change the Firewall / NAT / Outbound to Hybrid and add an additional rule for the LAN subnet 2a01:xxxx:x:yyy::/64.

Once I made these changes my PC got a new IPv6 address 2a01:xxx:x:yyy:d60:32fa:a3f8:f040 and I was able to ping ipv6.google.com:

Pinging ipv6.l.google.com [2a00:1450:4009:80c::200e] with 32 bytes of data:
Reply from 2a00:1450:4009:80c::200e: time=3ms
Reply from 2a00:1450:4009:80c::200e: time=3ms
Reply from 2a00:1450:4009:80c::200e: time=4ms
Reply from 2a00:1450:4009:80c::200e: time=3ms

Ping statistics for 2a00:1450:4009:80c::200e:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 3ms, Maximum = 4ms, Average = 3ms

So I guess I need to chase Cerberus for my official LAN IPv6 subnet rather than using a random made up one? I would then have one subnet for WAN and a different one for LAN?

I have now managed to work around the error message I was getting in pfSense when using the same subnet for WAN and LAN. I now have 2a01:xxxx:x:xxx:92e2:baff:feef:724f for the WAN as before but I've managed to set the LAN to 2a01:xxxx:x:xxx::1:1/112 with the DHCP6 server range from 2a01:xxxx:x:xxx::1:1000 to 2a01:xxxx:x:xxx::1:2000. My PCs all get IPv6 addresses in this range.

The workaround was to first set the WAN to a static IPv6 address of 2a01:xxxx:x:xxx::0:1/128 then set the LAN to 2a01:xxxx:x:xxx::1:1/112. I could then change the WAN back to DHCP6 and it all works fine. If I try and change the LAN subnet I still get the pfSense error message about overlapping addresses.

In reply to a post by brookheather:

I have managed to get it working by using a different subnet for the LAN - I just made one up and used 2a01:xxxx:x:yyy::/64 instead of 2a01:xxxx:x:xxx::/64 for the WAN. I also had to change the Firewall / NAT / Outbound to Hybrid and add an additional rule for the LAN subnet 2a01:xxxx:x:yyy::/64.

I wonder if pfSense is doing IPv6 NAT then: try "curl ifconfig.co" to see what IP address the rest of the Internet sees you as.

If you still see the address 2a01:xxxx:x:yyy::<something>, then you may be fortunate. The block 2a01:xxxx:x::/48 is the big block that Cerberus have assigned to you, inside that block 2a01:xxxx:x:xxx::/64 is the subnet allocated for the P2P link, and everything else is available for you to use as you see fit.

I would then have one subnet for WAN and a different one for LAN?

You would, but you already do: 2a01:xxxx:x:xxx::/64 and 2a01:xxxx:x:yyy::/64 are two different subnets.

/64 means the first 64 bits are the prefix (shared by all the machines on a given layer 2 network), and the remaining 64 bits are the token (different for each host on that network).

Everything between colons is 16 bits, so 2a01:xxxx:x:xxx is 64 bits; and hence 2a01:xxxx:x:yyy is a different 64 bits.

Running curl ifconfig.co from my PC shows its own allocated IPv6 address of 2a01:xxxx:x:xxx::1:1f57 so not using NAT (I am currently using 2a01:xxxx:x:xxx::1:1/112 for the LAN).

If I do have a /48 (or /56) block then I am happy to assign a LAN subnet from this - trying to get an answer about this from Cerberus is proving difficult. Their control panel shows I have one /64 subnet allocated so not sure that I can actually use some other /64 subnet in this block - need to get them to confirm this.

Not sure what the implications are if I "borrow" another /64 block for my LAN addresses - I don't intend to run any IPv6 services on my network.

Edited by brookheather (Mon 01-Apr-19 14:09:51)

Your solution of stealing a /112 from the WAN network will work, as long as the address range you use does not conflict with WAN link (which means basically just avoiding the WAN IP address of your router and the IP address of Cerberus' end of the link)

Not all devices are happy with a /112 network, because the assumption of a /64 prefix length is hard-baked into some operating systems. So it would be better to use a different /64 which doesn't overlap with the WAN link.

OK I have changed back to using a different /64 subnet for the LAN and running curl shows that it is now using NAT i.e. it shows the WAN IPv6 address. I think I will just leave it like this for the moment.

If anyone else is using pfSense with Cerberus I would be interested to know how you configured it.

Edited by brookheather (Mon 01-Apr-19 17:43:28)

I don't have Cerberus any more but I did. By default they only give you a single /64. If you ask them they will give you a second /64 and then you have one for your WAN interface and one for your LAN. This is how I had it configured in pfSense and it worked as expected.

I have now requested an "official" second /64 block which I'm now using the LAN side - obviously this still requires the router to perform NAT. I wonder why they don't supply a /48 or/56 block like BT?