pfSense Gold Subscription

Author Topic: Multiple IPV6 Tunnels  (Read 6468 times)

0 Members and 1 Guest are viewing this topic.

Offline joe_cowboy

  • Jr. Member
  • **
  • Posts: 41
  • Karma: +0/-0
    • View Profile
Re: Multiple IPV6 Tunnels
« Reply #15 on: January 28, 2012, 08:12:40 pm »
This is happening to all clients on the network even on LAN.  The Wireshark output I sent you was on WLAN.

Thanks again for looking at the Wireshark data.

-Joe Cowboy

Offline mdpugh

  • Jr. Member
  • **
  • Posts: 91
  • Karma: +0/-0
    • View Profile
Re: Multiple IPV6 Tunnels
« Reply #16 on: January 29, 2012, 09:59:33 am »
Get the client in an identical state to what it was in immediately after the Wireshark capture you sent me (the corrected one).  Then run ipconfig /all and netsh interface ipv6 show int <int#> where <int#> is the interface that just obtained the IPv6 address from pfSense.  You can post the results here, obfuscate addresses if desired, or e-mail them to me.  The second Wireshark capture looks like this should be working.
« Last Edit: January 29, 2012, 10:01:48 am by mdpugh »

Offline joe_cowboy

  • Jr. Member
  • **
  • Posts: 41
  • Karma: +0/-0
    • View Profile
Re: Multiple IPV6 Tunnels
« Reply #17 on: January 30, 2012, 09:33:38 pm »
Thank you for all your extensive help mdpugh.  Figured out the major foobar from you help....  I had for the interface Bridge the wrong IPv6 address: I didn't have the proper Routed IPv6 Prefixes range of address.  So that issue is fixed now. I can get to IPv6 websites now.  So the DHCPv6 now hands out the correct Routed IPv6 Prefixes range and also the DNS server IPv6 address but still not the GATWAY IPv6 address.  That is still a work on progress from the pfSense team getting that to work.

However the other issue is still happening with the other two tunnels I have set up.  The Gateways still show Offline.

-Joe Cowboy
« Last Edit: January 30, 2012, 09:37:27 pm by joe_cowboy »

Offline mdpugh

  • Jr. Member
  • **
  • Posts: 91
  • Karma: +0/-0
    • View Profile
Re: Multiple IPV6 Tunnels
« Reply #18 on: January 30, 2012, 10:03:34 pm »
As I understand it, the current specification dictates that the router hand out only its link-local address in the RA (not counting a link-local CARP address, I suppose  ;D) and that DHCPv6 not distribute any gateway address.  I don't know if providing additional functionality violates the specification per se, but the spec doesn't call for it, and it shouldn't be counted upon.  Is that correct?  Or would it be outright nonconformance?

Offline joe_cowboy

  • Jr. Member
  • **
  • Posts: 41
  • Karma: +0/-0
    • View Profile
Re: Multiple IPV6 Tunnels
« Reply #19 on: January 31, 2012, 04:00:39 pm »
Has anybody tried setting up two or more HE.net tunnels on their pfSense router with multiple WAN interfaces?  Where each WAN has it's own tunnel?  If so does your TUNNNEL GATEWAY that is not associated with the main WAN interface show Oneline.  Why I say that WAN1 and WAN2 Tunnels show offline.  I have deleted the tunnels multiple times and recreating them. 

Another thought if you group them aka loadbalance these tunnels would you have to manually add  a IPv6 address to the interface the DHCPv6 server sits on "Routed /64" subnet from HE.net tunnel.  Then also statically add an IPv6  address on your client machines from each of the "Routed /64" subnet tunnels?


Thanks for your help.

Offline mdpugh

  • Jr. Member
  • **
  • Posts: 91
  • Karma: +0/-0
    • View Profile
Re: Multiple IPV6 Tunnels
« Reply #20 on: January 31, 2012, 04:31:31 pm »
What are your pfSense configurations for all three tunnel interfaces?  Show IPv6 address, IPv6 gateway, IPv4 endpoints, etc.

Offline yon

  • Full Member
  • ***
  • Posts: 184
  • Karma: +0/-0
    • View Profile
Re: Multiple IPV6 Tunnels
« Reply #21 on: March 28, 2012, 02:11:59 pm »
Me too. I have setup Second ipv6 tunnel via Second WAN, but it is show offline.  :(

Offline yon

  • Full Member
  • ***
  • Posts: 184
  • Karma: +0/-0
    • View Profile
Re: Multiple IPV6 Tunnels
« Reply #22 on: March 28, 2012, 03:13:05 pm »
I find once creat second ipv6 tunnel in interface,then all ipv6 tunnel link will offline.

Offline jimp

  • Administrator
  • Hero Member
  • *****
  • Posts: 14990
  • Karma: +4/-0
    • View Profile
Re: Multiple IPV6 Tunnels
« Reply #23 on: March 28, 2012, 03:22:23 pm »
I've got two tunnels, one on each WAN. Both are online, and thanks to NPt and some gateway groups, I have working IPv6 multi-wan. Not sure why others might be having issues, but the same things apply as usual.

1. Make sure you have a distinct tunnel endpoint for each tunnel. For example, one to Chicago, one to Dallas, one to NY, etc. Don't use the same HE.net endpoint for more than one.
2. Make sure all your WANs allow ICMP from the endpoints
3. Perhaps add a static route to the remote endpoint node to make sure they use the proper WAN
Need help fast? Commercial Support!

Co-Author of pfSense: The Definitive Guide. - Check the Doc Wiki for FAQs.

Do not PM for help!

Offline yon

  • Full Member
  • ***
  • Posts: 184
  • Karma: +0/-0
    • View Profile
Re: Multiple IPV6 Tunnels
« Reply #24 on: March 28, 2012, 03:36:37 pm »
I've got two tunnels, one on each WAN. Both are online, and thanks to NPt and some gateway groups, I have working IPv6 multi-wan. Not sure why others might be having issues, but the same things apply as usual.

1. Make sure you have a distinct tunnel endpoint for each tunnel. For example, one to Chicago, one to Dallas, one to NY, etc. Don't use the same HE.net endpoint for more than one.
2. Make sure all your WANs allow ICMP from the endpoints
3. Perhaps add a static route to the remote endpoint node to make sure they use the proper WAN


I have check its like you said.

1. I am sure. and success creat tunnel in tunnelbroker.net.

2. I think should had do allow ICMP from the endpoints. because tunnelbroker.net endpoint has update.

3. whats add route ?


Offline jimp

  • Administrator
  • Hero Member
  • *****
  • Posts: 14990
  • Karma: +4/-0
    • View Profile
Re: Multiple IPV6 Tunnels
« Reply #25 on: March 28, 2012, 03:49:54 pm »
System > Routing, Routes tab. Add a route for the endpoint IP, pick the WAN you have it attached to, save/apply, repeat for the other endpoints.
Need help fast? Commercial Support!

Co-Author of pfSense: The Definitive Guide. - Check the Doc Wiki for FAQs.

Do not PM for help!

Offline yon

  • Full Member
  • ***
  • Posts: 184
  • Karma: +0/-0
    • View Profile
Re: Multiple IPV6 Tunnels
« Reply #26 on: March 28, 2012, 04:06:19 pm »
System > Routing, Routes tab. Add a route for the endpoint IP, pick the WAN you have it attached to, save/apply, repeat for the other endpoints.

thank you jimp .  :-*   now it seem is online.

it is should write in your wiki doc. I have no find about this.

then How I do will second ipv6 subnet address add in LAN?  LAN only can an ipv6 address ?   


Offline jimp

  • Administrator
  • Hero Member
  • *****
  • Posts: 14990
  • Karma: +4/-0
    • View Profile
Re: Multiple IPV6 Tunnels
« Reply #27 on: March 28, 2012, 04:25:18 pm »
You don't use both at once on LAN. You just use one on LAN and setup NPt (sort of like 1:1 NAT) for the WAN routed /64's.

See my other doc here:
http://doc.pfsense.org/index.php/Multi-WAN_for_IPv6
Need help fast? Commercial Support!

Co-Author of pfSense: The Definitive Guide. - Check the Doc Wiki for FAQs.

Do not PM for help!

Offline yon

  • Full Member
  • ***
  • Posts: 184
  • Karma: +0/-0
    • View Profile
Re: Multiple IPV6 Tunnels
« Reply #28 on: March 28, 2012, 06:53:16 pm »
You don't use both at once on LAN. You just use one on LAN and setup NPt (sort of like 1:1 NAT) for the WAN routed /64's.

See my other doc here:
http://doc.pfsense.org/index.php/Multi-WAN_for_IPv6

OK.  I have done. How I know Whether this success ?

Offline jimp

  • Administrator
  • Hero Member
  • *****
  • Posts: 14990
  • Karma: +4/-0
    • View Profile
Re: Multiple IPV6 Tunnels
« Reply #29 on: April 18, 2012, 06:07:59 pm »
Just an FYI- databeestje committed some code to automatically add static routes for the gif tunnel endpoints so this should be much easier now.

And there have been other routing/gateway improvements as well that will make things work smoother.

Recently I had an outage that let me test mine more thoroughly from home and it worked rather well. When my primary WAN+Tunnel were down, I was able to get out over my secondary WAN+Tunnel and when I checked, it was using the prefix I specified in NPt. I'd call it a success.
Need help fast? Commercial Support!

Co-Author of pfSense: The Definitive Guide. - Check the Doc Wiki for FAQs.

Do not PM for help!