En hikari cross fixed ip for opnsense setup
**Guide for フレッツ光クロス (Hikari Cross) with Xpass DS-Lite and Fixed IPv4**
-----
Note: i created it because it took me too long to make it work and it is so anoying that i cannot find any proper guide online. This is working for me tried and tested thru proxmox vm opnsense.
I used ai to draft the settings. I hope it can help
## Overview
This guide covers setting up **OPNsense** with:
- **DS-Lite (Xpass/クロスパス)** — dynamic/shared IPv4 for general internet
- **Fixed IP (IPIP6)** — your static IPv4 for servers, VPNs, port forwarding
Both tunnels run simultaneously over the same IPv6 WAN connection.
> ✅ Tested and confirmed working on OPNsense with enひかり フレッツ光クロス
-----
## What You Need From enひかり
When you subscribe to the fixed IP option, enひかり provides:
|Item |Description |
|--------------------------|---------------------------|
|Fixed IPv4 address |e.g. `202.xxx.xx.xxx` |
|Tunnel Destination Address|e.g. `2001:f60:0:200::4` |
|FQDN |e.g. `abc123.v4v6.xpass.jp`|
|DDNS Password |provided by enひかり |
|DDNS User ID |usually same as FQDN |
|Basic Auth ID |for DDNS activation |
|Basic Auth Password |for DDNS activation |
-----
## Part 1: WAN Setup
Go to **Interfaces → WAN:**
- IPv4 Configuration Type: `None`
- IPv6 Configuration Type: `DHCPv6`
- Under DHCPv6 settings:
- ✅ Request only an IPv6 prefix
- Prefix Delegation size: `56`
- ✅ Send IPv6 prefix hint
Go to **Interfaces → LAN:**
- IPv6 Configuration Type: `Track Interface`
- IPv6 Interface: `WAN`
- IPv6 Prefix ID: `0`
Confirm your WAN has a valid IPv6 address before continuing.
-----
## Part 2: DS-Lite (Xpass) Setup
Go to **Interfaces → Devices → GIF → Add:**
|Field |Value |
|---------------------------|---------------------|
|Parent Interface |WAN |
|GIF Remote Address |`2001:f60:0:200::1:1`|
|GIF Tunnel Local Address |`192.0.0.2` |
|GIF Tunnel Remote Address |`192.0.0.1` |
|Netmask |`29` |
|✅ Disable Ingress Filtering|checked |
Assign this GIF as a new interface (e.g. `XPASS`), enable it.
Go to **Firewall → NAT → Outbound → Hybrid mode** and add a rule:
- Interface: XPASS
- Source: LAN net
- Destination: any
- Translation: Interface address
-----
## Part 3: Fixed IP (IPIP6) Setup
### Step 1 — Create the ::feed Virtual IP
This is the **critical step** that makes IPIP6 work on OPNsense/FreeBSD.
Go to **Interfaces → Virtual IPs → Add:**
|Field |Value |
|---------------|-----------------------------|
|Mode |`IP Alias` |
|Interface |`WAN` |
|Network Address|`<your /56 prefix>::feed/128`|
Example: if your prefix is `2001:f60:xxxx:xx00::/56`, enter:
`2001:f60:xxxx:xx00::feed/128`
Save.
### Step 2 — Run the DDNS Activation URL
This tells enひかり’s Border Router your current IPv6 address.
Access this URL in your browser **from behind OPNsense** (must go over IPv6):
```
https://ddnsweb1.ddns.vbbnet.jp/cgi-bin/ddns\_api.cgi?d=<FQDN>&p=<password>&a=<your prefix>::feed&u=<FQDN>
```
Replace:
- `<FQDN>` → e.g. `abc123.v4v6.xpass.jp`
- `<password>` → your DDNS password
- `<your prefix>::feed` → e.g. `2001:f60:xxxx:xx00::feed`
A successful response looks like:
```
Query parameter check: OK
Router OK
Record check: OK
Router info update: OK
Record update: OK
DDNS API update: Success
```
> ⚠️ You must re-run this URL whenever your WAN IPv6 changes (e.g. after reboot/reconnection)
### Step 3 — Create the IPIP6 GIF Tunnel
Go to **Interfaces → Devices → GIF → Add:**
|Field |Value |
|---------------------------|--------------------------------------------------------|
|Parent Interface |WAN |
|GIF Remote Address |Tunnel Destination from enひかり (e.g. `2001:f60:0:200::4`)|
|GIF Local Address |`<your ::feed Virtual IP>` |
|GIF Tunnel Local Address |Your fixed IPv4 (e.g. `202.xxx.xx.xxx`) |
|GIF Tunnel Remote Address |`192.0.0.3` |
|Netmask |`32` |
|✅ Disable Ingress Filtering|checked |
Assign this GIF as a new interface (e.g. `FIXEDIP`), enable it.
### Step 4 — Add NAT Outbound Rule
Go to **Firewall → NAT → Outbound** (Hybrid mode):
- Interface: FIXEDIP
- Source: LAN net
- Destination: any
- Translation: Interface address
-----
## Part 4: Routing
### To use Fixed IP as default for all traffic:
Go to **Firewall → Rules → LAN:**
- Edit the default IPv4 allow rule
- Expand **Advanced Options**
- Set **Gateway** to your IPIP6/FIXEDIP gateway
- Save & Apply
### To use DS-Lite as default (fixed IP for specific traffic only):
Leave the default LAN rule gateway as `default` (DS-Lite).
Create specific policy rules for traffic that should use the fixed IP.
-----
## Part 5: Verification
Test DS-Lite is working:
```
https://ipv4.icanhazip.com → should show shared/CGNAT IP
```
Test Fixed IP tunnel from OPNsense shell (**System → Diagnostics → Shell**):
```bash
ping -S <your fixed IPv4> 8.8.8.8
curl --interface <your fixed IPv4> https://ipv4.icanhazip.com
```
Both should work if the tunnel is up.
If Fixed IP is set as default gateway:
```
https://ipv4.icanhazip.com → should show your fixed IPv4
```
-----
## Key Notes
- The `::feed` Virtual IP is **essential** — without it OPNsense cannot properly source the IPIP6 tunnel
- The DDNS activation URL must be accessed **over IPv6** — if DS-Lite is active it may route over IPv4 and fail
- DS-Lite AFTR: `2001:f60:0:200::1:1` (dgw.xpass.jp)
- Fixed IP BR: provided by enひかり in your documents
- Both tunnels can coexist simultaneously
-----
## Troubleshooting
|Problem |Solution |
|-----------------------------------------|-------------------------------------------------------------|
|DDNS returns Error 700 |Make sure you’re accessing it over IPv6, not IPv4 |
|Fixed IP tunnel not appearing in gateways|Check `::feed` vIP is created and set as GIF Local Address |
|Still showing DS-Lite IP |Check Firewall → Rules → LAN gateway setting |
|Tunnel drops after reboot |Re-run DDNS activation URL, consider automating with a script|
-----
*Guide based on enひかり フレッツ光クロス with Arteria Networks Xpass. Confirmed working on OPNsense 26.*
Posted Mar 8, 2026, 1:22 PM UTC