this post was submitted on 18 Jun 2024
2 points (100.0% liked)

Selfhosted

39937 readers
360 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

  1. Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.

  2. No spam posting.

  3. Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.

  4. Don't duplicate the full text of your blog or github here. Just post the link for folks to click.

  5. Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).

  6. No trolling.

Resources:

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 1 year ago
MODERATORS
ruud@lemmy.world
Loki@lemmy.world
CannaVet@lemmy.world
devve@lemmy.world
HybridSarcasm@lemmy.world
HybridSarcasm@lemmy.hybridsarcasm.xyz
2
Help with IPv6 (lemmy.world)
submitted 4 months ago by cakeofhonor@lemmy.world to c/selfhosted@lemmy.world
9 comments fedilink hide all child comments
 

My ISP recently made IPv6 available and I'm trying to figure out how to make it work with my network. The setup I have is an OPNsense box connected to my ISP's router and I'm using it to isolate my homelab from the rest of the network. However, the machines on my OPNsense LAN aren't being assigned IPv6 addresses that allow them to connect to the internet.

I can ping IPv6 sites from my OPNsense box and I see that it's being assigned a /64 prefix from the ISP router. If I use my laptop to connect to my ISP's router, I can visit IPv6 sites just fine as well. My devices in the OPNsense LAN also have IPv6 addresses and can ping each other using IPv6 but not the internet.

Are there special settings that I need to set for OPNsense to make this setup work? I've tried reading up on the different modes like SLAAC but I'm not quite grasping the concepts.

top 9 comments
sorted by: hot top controversial new old
[–] mhzawadi@lemmy.horwood.cloud 0 points 4 months ago (1 children)

not tested this, but you might want to look at DHCPv6 Relay to get an IP from your ISP router

[–] chronicledmonocle@lemmy.world -1 points 4 months ago

If you're allocated DHCPv6-PD with a subnet, you don't use a relay.

[–] Toes@ani.social 0 points 4 months ago (1 children)

Confirm the ipv6 addresses your clients in the LAN are being assigned an ipv6 address within the scope of what your ISP is assigning.

If you are check default routes and firewall rules.

If you aren't, investigate "router advertisement".

[–] cakeofhonor@lemmy.world 0 points 4 months ago (1 children)

I did forget to mention that. The IP addresses of the devices on the LAN do not share the same first half of the address as the IP on the ISP router. I have the OPNsense LAN set to track WAN interface, but the DHCP server is stuck saying "No available address range for configured interface subnet size.". I also noticed that my WAN for OPNsense has a global routable IP starting with 2402 as well as a LLA starting with fe80 but my LAN only has a LLA.

Which routes and firewall rules should I be checking?

[–] Toes@ani.social 1 points 4 months ago

If your lan devices only have a fe80, your clients are not receiving a proper router advertisement.

Which routes and firewall rules should I be checking?

Since the OPNsense device is getting a ipv6 address and is able to ping ipv6 devices on the internet.

It sounds like you don't have ipv6 configured for the LAN. Try enabling "Assisted" mode.

https://docs.opnsense.org/manual/radvd.html

[–] domi@lemmy.secnd.me 0 points 4 months ago* (last edited 4 months ago) (1 children)

I'm no expert on IPv6 but here's how I did it on my OPNsense box:

  • Activate IPv6 on your WAN interface (probably already done)
  • Activate IPv6 on the LAN interface, use Track interface on IPv6, track the WAN interface and choose a prefix ID like 0x1
  • Activate DHCPv6 under Services -> ISC DHCPv6 for your LAN interface (you can shorten the range like ::eeee to ::ffff, you don't have to type the full IP)
  • Activate Router advertisments under Services -> Router Advertisments for your LAN interface (set Advertisments to Managed and Priority to High

After that your DHCP server should serve public IPv6 addresses inside of your prefix and clients should be able to connect to the internet.

A few notes:

  • Don't forget to add an allow rule for IPv6 on your LAN as well if you only have one for IPv4
  • Repeat the steps above for every VLAN you have, always use a different prefix ID
  • You don't have to use NAT rules with IPv6 anymore and can just directly add a regular firewall rule to WAN with the target IP and port and you are done
  • Make sure you don't have any of the various "Disable IPv6" toggles enabled, there's a few in the firewall settings and general settings for example
[–] cakeofhonor@lemmy.world 0 points 4 months ago (1 children)

I'll try this when I get a chance. Off the top of my head, why did you set the prefix to 0x1? I was under the impression that it only needs to be set if there are multiple vlans and what are your rules for the WAN side of the firewall? My LAN interface is only getting an LLA so maybe it's being blocked from communicating with the ISP router.

[–] chronicledmonocle@lemmy.world -1 points 4 months ago

Prefix ID of 0x1 means "Use the first prefix available in the block as a /64 for the LAN". Essentially your ISP probably gave you a /48, /56, or /60. The firewall is giving prefix IDs to all of the /64s you can fit inside of one of these and allocating them numbers 1 through whatever. Each LAN you have can have its own prefix ID. A /60 has 16 /64 networks that you can subnet it into.

[–] chronicledmonocle@lemmy.world -1 points 4 months ago* (last edited 4 months ago)

If you're getting a /64 from your ISP via DHCPv6, you likely need to send a prefix hint. I'd guess /60. Then you'll have multiple /64s to work with on your inside interfaces.

Who is the ISP?