• Welcome to Hurricane Electric's IPv6 Tunnel Broker Forums.

Multiple clients with IPv6 behind pfSense router

Started by bartgrefte, September 04, 2010, 01:56:01 PM

Previous topic - Next topic

bartgrefte

Hi :)

I'm thinking about getting the clients around here an IPv6 connection. Already done some reading about it and read about creating a tunnel. From what I've read my pfSense router supports passing protocol 41, this setting is present: "NAT encapsulated IPv6 packets (IP protocol 41/RFC2893) to:", I can enable/disable this but I must enter an IP-address.

Does this mean I can only create a tunnel to one client at a time and not simultaneous to multiple clients?

Here's some info about the clients/devices:
* Cablemodem: Arris TM702B, EuroDOCSIS 3. (ISP is not offering IPv6 to there customers, however there are rumors they are testing it...)
* Router: MSI IM-945GSE-A motherboard with 1GB RAM, a MiniBox M300LCD case and pfSense 1.2.3 nanoBSD/embedded as OS.
* One 3COM OfficeConnect® Gigabit Switch 8 and a HP ProCurve 1400-8G switch.
* Clients: Several operating systems: XP Pro SP2 & 3, 7, Kubuntu 10.04, Windows Mobile 6 (might soon be replaced by an Android phone) and a Noxon 2 Audio which just like it's predecessor will not get a firmware update I suspect.
* AP: Senao/EnGenius ECB/SCB-3220 (getting repaired atm....).

Hope anyone can shed some light on this ;)

With regards,

Bart Grefte

cholzhauer

You only need one tunnel; your router takes care of handing out addresses to your clients and sending traffic back through the tunnel to HE.

You can use Router Advertisements and DHCPv6 to assign addresses

bartgrefte

#2
Uhm, (gonna Google later ;), half a sleep... ) but how do you want the router to do that, since pfSense does not get support for IPv6 until after 2.0 is released? (Whenever that will be.)

cholzhauer

Well that I didn't know, sorry.

Then you'll need a host behind it (BSD, linux, windows, ect) that you can use to terminate your tunnel and also use to hand out addresses; Looks like your Ubuntu host should be able to do it

antillie

If you are comfortable with the nitty gritty of Linux it looks like Gentoo can do this: http://www.gentoo.org/doc/en/ipv6.xml

bartgrefte

Quote from: cholzhauer on September 07, 2010, 11:56:38 AM
Well that I didn't know, sorry.

Then you'll need a host behind it (BSD, linux, windows, ect) that you can use to terminate your tunnel and also use to hand out addresses; Looks like your Ubuntu host should be able to do it
Hmm, the only host that is running 24/7 (next to the pfSense router) has XP as OS.
(K)Ubuntu is the OS of my laptop, that one is not gonna run 24/7 ;)

Quote from: antillie on September 09, 2010, 12:59:28 PM
If you are comfortable with the nitty gritty of Linux it looks like Gentoo can do this: http://www.gentoo.org/doc/en/ipv6.xml
Well, I was hoping I wouldn't need another host that runs 24/7. Isn't there anyway FreeBSD (7.2 if I'm correct) can do this? Since pfSense is based on it.

cholzhauer

Yes, you can use FreeBSD to host your tunnel...you could also use XP.

If pfSense is based on FreeBSD, why not go to the tunnel page, pick the drop down for FreeBSD, and use those commands to start your tunnel?

bartgrefte

#7
I've been busy, but hope I can check that out this weekend :)

Are all commands necessary there? I mean, including the onces that make pfSense/FreeBSD give the clients an IPv6 address through DHCP?
Or I can just look at that page and find out :)

edit: I'm already running into a little problem, the "Setup Regular IPv6 Tunnel"-form does not accept a DynDNS domainname as endpoint, wanted to enter it because my ISP does not offer static IP-addresses and I use DynDNS because of that.
So I'm guessing only an IPv4 address is accepted? Why not a DynDNS domainname, would make things a whole lot easier when someones IP changes, it would get automatically updated when running the DynDNS updater-client in the background.

excaliburtech

I am using pfSense as well. I ended up setting up a Vyatta box and having pfSense forward protocol 41 to it. I had debated about replacing the pfSense box with Vyatta, but didn't want to incur the downtime. Not to mention the RRD graphs built into pfSense are nice.

If you want more details have a read through Configuring Vyatta with an IPv6 Tunnel Broker. It was fairly straight forward except for on pfSense you also need to create a firewall rule to allow the he.net endpoint to access the IP you forwarded protocol 41 to.

bartgrefte

I've never heard of a Vyatta box ???

Did ran into this: http://www.xaero.org/index.php/archive/configuring-a-6to4-tunnel-on-the-pfsense-firewall/ (Google cache link if site is down again)
Haven't tried it yet, but if I understand everything correctly, every client that supports IPv6 should be able to use the tunnel.

excaliburtech

Quote from: bartgrefte on October 17, 2010, 09:10:09 AM
I've never heard of a Vyatta box ???

Have a look at the Vyatta community edition website. Configuration is done through the CLI like Cisco. The command syantax is different, but easy to pick up with the auto complete.

http://www.vyatta.org/

databeestje

Hi,

I've been working on ipv6 support for pfSense on the 2.0 BETA branch last week and it's now possible to succesfully configure a he.net ipv6 tunnel via the web interface, assign the public /64 to the lan and have your lan host autoconfigure a public address.

The firewall rules on the wan and lan interface work for ipv6 so you can easily deny and allow traffic from the internet to the routed subnet.

You can find the relevant information to get your 2.0 install working with my forum post on http://forum.pfsense.org/index.php/topic,26469.0.html

Regards

bartgrefte

#12
How about 1.2.3 branch ;)

Tried http://www.xaero.org/index.php/archive/configuring-a-6to4-tunnel-on-the-pfsense-firewall , getting:
[admin@bocadelinfierno.local]/root(1): ping6 -c 4 ipv6.google.com
PING6(56=40+8+8 bytes) 2001:470:1f14:e04::2 --> 2a00:1450:8001::93
ping6: sendmsg: Operation not permitted
ping6: wrote ipv6.l.google.com 16 chars, ret=-1
ping6: sendmsg: Operation not permitted
ping6: wrote ipv6.l.google.com 16 chars, ret=-1
ping6: sendmsg: Operation not permitted
ping6: wrote ipv6.l.google.com 16 chars, ret=-1
ping6: sendmsg: Operation not permitted
ping6: wrote ipv6.l.google.com 16 chars, ret=-1

--- ipv6.l.google.com ping6 statistics ---
4 packets transmitted, 0 packets received, 100.0% packet loss

at pfSense box, logged on with Putty on console.
My test-client (with XP Pro) does not have IPv6 access either.

Ping6 results to ::1 same results as above...

edit: Never mind... Anyone know this setting? pfSense -> System -> Advanced -> "Allow IPv6 traffic" ::)
Later this week I'm gonna try the clients again....

lukec

Quoteping6: sendmsg: Operation not permitted
Suggests a local firewall issue on the host
rgds

coltexbv

Here is a link to the howto I made for the experimental pfSense 2.0 code branch.
http://iserv.nl/files/pfsense/ipv6/