Yep no idea - it's not really quite the same as NAT though (at least that's my understanding), the block they provide for LAN should be routed over the WAN prefix and so the router is just another hop in the route - these LAN addresses should be directly addressable public IPv6 addresses. My understanding is that this is exactly the same as when you get a /48 or /56 and assign a /64 from each to the LAN and WAN.

Running curl ifconfig.co shows my WAN address not the LAN address so isn't that NAT?

Do you see the WAN's same IPv6 address as the external address from all devices on your LAN (or at least more than 1)? If so, then yes that sounds like NAT - but that is not how mine was configured with Cerberus. You may need to specifically ask them to ensure that your LAN /64 is a "routed prefix" over your WAN /64. Once you do that, I think your WAN will automatically get an address from its /64, and then in pfSense you configure your LAN to use the other /64, there should be no NAT going on with this configuration.

Unfortunately I can't remember *exactly* how to do it as a I just have /48 from IDNet now, but it's definitely possible.

Edited by deleted (Thu 04-Apr-19 15:46:23)

In reply to a post by brookheather:

I have now requested an "official" second /64 block which I'm now using the LAN side - obviously this still requires the router to perform NAT.

No, that won't require NAT. Cerberus should have routed it to you, i.e. it comes down your link, with your router's WAN address as the next-hop.

You can prove whether this is working by going to some other site which has v6 (e.g. a VM in the cloud), and doing traceroutes:

traceroute6 x:x:x:x::x # your router's WAN address
traceroute6 y:y:y:y::1 # your router's LAN address (*)
traceroute6 y:y:y:y::z # some other device on your LAN

All three traceroutes should go via your router's WAN address.

The last one could even show your internal device as the last hop, but only if (a) your pfSense firewall is configured to allow inbound traffic to that address, and (b) the device's own internal firewall doesn't block traceroute responses.

(*) It's traditional to give your router the first available address in the block, as it's the default gateway for all other devices on that network.

Why on earth Cerberus don't give you a /48 or /56 though, I don't know. They will have a minimum of a /32 from RIPE. That's enough for 65.5K customers with /48's, or 16.7 million customers with /56's. And they can always get more.

So now I'm on Cerberus and IPv6 is available I've been trying to set this up. I'm using pfSense as well. My IPv6 range is 2a01:5d00:abcd:ff00/56 (the last 8 digits I've changed to save posting the actual address).

I do appear to have IPv6 up and running although I'm not sure it is configured correctly.

On the Dashboard the WAN has my public IPv4 address, but shows a local IPv6 address starting fe80:: is that correct? I thought the WAN should get a public IPv6 address? The IPv6 gateway also starts fe80::

LAN1 is allocated an IP address of 2a01:5d00:abcd:ff00.xxxx.xxxx.xxxx.xxxx and clients on the LAN are being allocated addresses starting 2a01:5d00:abcd:ff00. Now I thought the WAN side should take the first subnet of 2a01:5d00:abcd:ff00 and the LAN would get 2a01:5d00:abcd:ff01.

In pfSense the WAN interface is set as:

IPv6 Configuration type: DHCP6
Request a IPv6 prefix/information through the IPv4 connectivity link ticked
Only request an IPv6 prefix, do not request an IPv6 address ticked but tried unticked
DHCPv6 Prefix Delegation Size at 56
Nothing else checked.

The LAN is set to Track interface.

Any pointers welcome.

In reply to a post by E300:

On the Dashboard the WAN has my public IPv4 address, but shows a local IPv6 address starting fe80:: is that correct? I thought the WAN should get a public IPv6 address? The IPv6 gateway also starts fe80::

What you see is correct. The way Cerberus handle IPv6 is to use an "unnumbered" link between your router and their BRAS - no public IPs are assigned. They could have allocated a separate subnet for this link - some providers give you an extra /64 or a /127 - but they don't. This gives you the whole /56 to use as you like, and avoids them the work of having to allocate addresses for the point-to-point link.

(fe80:: addresses are "link local" - only having local significance, i.e. usable only between peers on the same link, not routable across the Internet. They are assigned automatically by the devices themselves, embedding their MAC address to ensure uniqueness)

In reply to a post by E300:

LAN1 is allocated an IP address of 2a01:5d00:abcd:ff00.xxxx.xxxx.xxxx.xxxx and clients on the LAN are being allocated addresses starting 2a01:5d00:abcd:ff00. Now I thought the WAN side should take the first subnet of 2a01:5d00:abcd:ff00 and the LAN would get 2a01:5d00:abcd:ff01.

I have configured my router statically, so I don't have experience of how Cerberus have configured DHCP service on their side. But what I suspect is they provide DHCP for "prefix delegation" (i.e. for the router to fetch a subnet for its LAN side) without DHCP for assigning the WAN IPv6 address.

You are free to statically allocate any address out of your /56 to your WAN side if you wish. For example, you could give your router 2a01:5d00:abcd:ff00::1 (and this can be the same as its address on the LAN side). This may make it easier for the router to make outbound connections to the Internet - e.g. for outbound pings or fetching firmware updates. However it may still work without this - e.g. the router may be smart enough to use its LAN address as source IP for connections, when its WAN address is link-local.

In the pfSense GUI, try checking for firmware updates. If it says that your software is up-to-date, then it's happily making outbound connections - although in all likelihood it's just using IPv4 for this. Or try pinging 2001:4860:4860::8888 from the pfSense CLI.

If you want to make inbound connections to your pfSense box - e.g. to manage it over the Internet - then you should be able to do this using its LAN address. However, pfSense blocks management access from the WAN side anyway unless you tick an option.

Edited by candlerb (Mon 30-Dec-19 09:34:22)

Many thanks for the info.

I tried a Ping6 from pfSense and as you suggested it worked with the ping source being the LAN IPv6 address.

So it seems it is all okay then and I was just being thrown by not seeing a WAN IP address, so may allocated it one. I don't wish to manage remotely but think it might come in handy for trace routes or pings to the router.

When I visit sites like http://test-ipv6.com/ I'm getting 10/10, so thought I must be along the right lines.

Thanks for your help.

To put a part of it very simply, the fe80 addresses are equivalent to the IPv4 192.168.n.n addresses.

I don�t know your Dashboard, but suggest the �... do not request an IPv6 address� should be unticked.

Yo will then also probably find that asking a site such as the Main one of thinkbroadband what your IP Address is will give you the (temporary) IPv6 address of the device you are using. Not the router address that you get on IPv4.

ipconfig/all at a Windows command prompt will tell you more. Note that the temp address will change quite frequently. Setting up an IPv6 BQM can be fun, until you find the address Cerberus has allocated to your router.

I think it is all okay. The routers IP is the same as the LAN IPv6 shown in the pfsense dashboard as I can successfully ping this externally, and have set up the BQM chart using that address and it has started charting.

There are options for Do not request an IPv6 address but checked or not I still don't get one on the WAN side, but as explained by candlerb that seems to be just how Cerberus works. So all seems to be working okay.

If you untick "Only request an IPv6 prefix" then you should see the fe80:: disappear from the WAN interface on the dashboard.

Under LAN there is a section called "Track IPv6 Interface" - set IPv6 interface to WAN and set the IPv6 Prefix ID to 1. This means your internal LAN IPv6 addresses are allocated within the 2a01:5d00:abcd:ff01/64 subnet which I think is what you want?

You should then see your pfSense router IPv6 address appear under LAN in the dashboard - this should be your router public address - I can ping mine fine (once ICMP is enabled for IPv6). I have a BQM setup for both my IPv4 and IPv6 addresses.

For some reason pfSense only shows my IPv4 address under WAN on the dashboard - just a quirk of pfSense I guess?

On the DHCPv6 Server page I have my range set from ::d:1 to ::d:ffff so it is obvious which IPv6 addresses have been allocated by DHCP as they have a ::d:xxxx at the end of the address.

Edited by brookheather (Mon 30-Dec-19 10:53:27)