Source
r/OPNsenseFirewall•
NullableType

Help getting IPv6 working on OPNSense

I'm using the net graph + wap_supplicant method here...

https://github.com/MonkWho/pfatt/tree/supplicant_OPNsense_testing

...to have OPNsense replace my ATT gateway. IPv4 is working fine, but I'm not getting an IPv6 assigned to my WAN. I know this method fully works with pfSense (I've had it up and running myself), but I'm struggling to understand where the same settings are to set this up correctly in OPNsense.

I've used what gstuartj speaks of here to figure out what my DUID-EN should be. If I'm understanding correctly I run the gen-duid.sh script from pfatt to get the ID of my ATT gateway and slap that on the end of: "00:02:00:00:0D:EA:" So my final DUID-EN looks like: "00:02:00:00:0D:EA:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx" And I've set that under Interfaces > Settings > DHCP Unique Identifier

Interfaces > WAN I have set:

IPv6 Configuration Type: DHCPv6

but I'm not sure what settings to place under "DHCPv6 client configuration" in order to match the pfSense instructions:

WAN Setup

  1. Enable DHCPv6 Prefix Delegation size as 60
  2. Enable Send IPv6 prefix hint
  3. Enable Do not wait for a RA

and then I'm not quite sure if I'm setting up the DHCPv6 ranges correctly. Their instructions say:

DHCPv6 Server & RA

  1. Configure a range of ::0001 to ::ffff:ffff:ffff:fffe
  2. Configure a Prefix Delegation Range to 64

Do I enter ::0001 to ::ffff:ffff:ffff:fffe in the "Range" field, leave the "Prefix Delegation Range" fields blank and then set the "Prefix Delegation Size" to 64?

Posted Feb 2, 2021, 6:31 PM UTC

29
SamsonMcNulty•

I never had to use my duid with ATT when I was running the bypass. I just set wan to pull dhcp6 and gave it a pd of 60. After that I just assigned pd's to each LAN. you may also have luck with the method laid out here which is what I'm currently using: https://forum.netgate.com/topic/153288/multiple-ipv6-prefix-delegation-over-at-t-residential-gateway-for-pfsense-2-4-5/23?_=1612307428462&lang=en-US

3
NullableTypeOP•

You're beautiful! And I'm a complete dunce that clicked on "Advance" under Interfaces > WAN > DHCPv6 client configuration thinking it's just shows more option, instead of its action of show you different options. 🤦🏻‍♂️ I set "prefix delegation size", and "send IPv6 prefix hint" there and I'm working great! Thank you again!

1
fryfrog•

If they delegate a prefix to you, you just use that in your lan interface config. And you can use a hint to say which subnet you want to use, say they give you a /60 and you want a /64 per lan.

It's the track interface, like this, but I'm not doing it on mine so it doesn't really show a useful example.

Edit: Hang on, are you getting rid of the gateway? Or using it in IP passthrough mode? I use mine in IP passthrough mode and its fine.

2
NullableTypeOP•

I got rid of my gateway and have OPNsense hooked up to the ONT.

1
fryfrog•

Ah, then I'm no use to you sorry :(

And I've only got DSL, so double no use.

I understand the desire to remove one device from the chain, but do you also expect to see a performance difference? Also, I know this is a common thing to do w/ USG so you might find some helpful information there.

2
NullableTypeOP•

Yeah, and I'm quite familiar with Ubiquiti devices as I've designed and implemented systems with them at my work. I actually was just looking at maybe buying a dream machine pro. My only hesitation was I'd be "stuck" with AC access points, but it looks like they now have AX access points with WiFi 6! So I might just roll with that.

1
fryfrog•

The UDM Pro doesn't have any wifi at all, I'm not sure what you mean. Also, it seems to have a lot of problems so I'd watch out for it. Most of the network nerds in my work groups who've gotten it have retired it until they work out more of the kinks. :(

2