Closed alex1702 closed 1 month ago
I'd avoid using anything other than /64.
I can fully understand that and I wouldn't prefer it either. But it's just what I have from the provider at the moment and it should actually work, shouldn't it?
If the goal is to get a single /64 to work use /64 on your LAN and /128 on your WAN?
With /128 on the WAN and /64 on the LAN it does not work either. In addition, OPNsense says “Misconfigured Gateway IP” under Gateways for the v6 gateway. I assume this is because the 1 no longer fits into the /128? I have also tried it with a /126 on the WAN. Then the gateway is online again, but the client still doesn't get a reply.
Do I have to set /128 and a manual route? What would that look like?
Sorry, I can't help with a moving goal post in a community support case more than I already have.
Ok. We now have a completely new /56 from the provider. Gateway is the 2001:----:----:100::1 Network is: 2001:----:----:100::/56 First /64 on the WAN interface: 2001:----:----:100::2/64 And the next one on the LAN: 2001:----:----:101::1/64
A client has an IP address via SLAAC: 2001:----:----:101:250:56ff:fe8e:9ad7
A tcpdump (tcpdump -n -i em1 ip6) on the WAN interface results in the following messages:
13:36:53.496899 IP6 2001:----:----:100::1 > ff02::1:ff8e:9ad7: ICMP6, neighbor solicitation, who has 2001:----:----:101:250:56ff:fe8e:9ad7, length 32
Why is the OPNsense not responding to the other gateway?
I hope you or someone else can help me with this information.
Seems to be working now. The ISP must have done something else on request.
Important notices
Our forum is located at https://forum.opnsense.org , please consider joining discussions there in stead of using GitHub for these matters.
Before you ask a new question, we ask you kindly to acknowledge the following:
We have an OPNsense in the data center in the rack. This has a /64 prefix from the operator 2001:-----:dead:-----::/64. The gateway from the data center is 2001:-----:dead:-----::1
WAN: I have given the OPNsense the static 2001:-----:dead:-----::2/64. And selected WANv6 as the gateway.
I have a manually added WANv6 gateway with the following configuration:
This is also displayed as online.
On the LAN interface I have static IPv6 with the following address: 2001:-----:dead:-----:8000::1/65
A ping on the firewall itself to any IPv6 address works. A ping from a client in the LAN network goes out and arrives at the destination, but the response does not come back to the client. The client has the IP 2001:-----:dead:-----:8000::5/65
ip a
excerpt:ip -6 r
excerpt:fe80::21a:8cff:fe16:da98
and2001:----:dead:----:8000::1
is from the OPNsense of the LAN side.tcp dump from ping destination:
In the firewall I have allowed all ICMPv6 traffic from everywhere to everywhere. Once as a floating rule, in the WAN and also in the LAN.