A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.
Rules:
Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.
No spam posting.
Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.
Don't duplicate the full text of your blog or github here. Just post the link for folks to click.
Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).
No trolling.
Resources:
Any issues on the community? Report it using the report flag.
Questions? DM the mods!
Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I've seen in this thread:
| Fewer Letters | More Letters |
|---|---|
| DHCP | Dynamic Host Configuration Protocol, automates assignment of IPs when connecting to a network |
| IP | Internet Protocol |
| NAT | Network Address Translation |
[Thread #813 for this sub, first seen 18th Jun 2024, 10:55] [FAQ] [Full list] [Contact] [Source code]
Confirm the ipv6 addresses your clients in the LAN are being assigned an ipv6 address within the scope of what your ISP is assigning.
If you are check default routes and firewall rules.
If you aren't, investigate "router advertisement".
I did forget to mention that. The IP addresses of the devices on the LAN do not share the same first half of the address as the IP on the ISP router. I have the OPNsense LAN set to track WAN interface, but the DHCP server is stuck saying "No available address range for configured interface subnet size.". I also noticed that my WAN for OPNsense has a global routable IP starting with 2402 as well as a LLA starting with fe80 but my LAN only has a LLA.
Which routes and firewall rules should I be checking?
If your lan devices only have a fe80, your clients are not receiving a proper router advertisement.
Which routes and firewall rules should I be checking?
Since the OPNsense device is getting a ipv6 address and is able to ping ipv6 devices on the internet.
It sounds like you don't have ipv6 configured for the LAN. Try enabling "Assisted" mode.
not tested this, but you might want to look at DHCPv6 Relay to get an IP from your ISP router
If you're allocated DHCPv6-PD with a subnet, you don't use a relay.
noted
Hey I just had another thought. Do you have your ISP provided router in bridge mode? That would help if you're not using it for anything else.
I'm no expert on IPv6 but here's how I did it on my OPNsense box:
WAN interface (probably already done)LAN interface, use Track interface on IPv6, track the WAN interface and choose a prefix ID like 0x1::eeee to ::ffff, you don't have to type the full IP)Advertisments to Managed and Priority to HighAfter that your DHCP server should serve public IPv6 addresses inside of your prefix and clients should be able to connect to the internet.
A few notes:
I'll try this when I get a chance. Off the top of my head, why did you set the prefix to 0x1? I was under the impression that it only needs to be set if there are multiple vlans and what are your rules for the WAN side of the firewall? My LAN interface is only getting an LLA so maybe it's being blocked from communicating with the ISP router.
Off the top of my head, why did you set the prefix to 0x1? I was under the impression that it only needs to be set if there are multiple vlans
I have multiple VLANs, 0x1 is my LAN and 0x10 is my DMZ for example. I then get IP addresses abcd:abcd:a01::abcd in my LAN and abcd:abcd:a10::bcdf in my DMZ.
However, I get a /56 from my ISP wich gets subnetted into /64. I heard it's not ideal to subnet a /64 but you might want to double check what you really got.
what are your rules for the WAN side of the firewall?
Only IPv4 + IPv6 ICMP, the normal NAT rules for IPv4 and the same rules for IPv6 but as regular rule instead of NAT rule.
My LAN interface is only getting an LLA so maybe it’s being blocked from communicating with the ISP router.
If you enable DHCPv6 in your network your firewall should be the one to hand out IP addresses, your ISP assigns your OPNsense the prefix and your OPNsense then subnets them into smaller chunks for your internal networks.
It is possible to do it without DHCPv6 but I didn't read into it yet since DHCPv6 does exactly what I want it to do.
Prefix ID of 0x1 means "Use the first prefix available in the block as a /64 for the LAN". Essentially your ISP probably gave you a /48, /56, or /60. The firewall is giving prefix IDs to all of the /64s you can fit inside of one of these and allocating them numbers 1 through whatever. Each LAN you have can have its own prefix ID. A /60 has 16 /64 networks that you can subnet it into.
If you're getting a /64 from your ISP via DHCPv6, you likely need to send a prefix hint. I'd guess /60. Then you'll have multiple /64s to work with on your inside interfaces.
Who is the ISP?
If it's any use, here are the WAN IPv6 options (auto, manual, or IPv6CP Extension) for the ZTE-ZXHN-F670, it's set to auto right now:
And these are the available LAN settings:
I'm located in Vietnam; the ISP is Viettel (probably not useful information, but hey, why not).
Is it possible to send the hint from OPNsense itself? I mentioned in the original post that OPNsense is behind the ISP router (ZTE-ZXHN-F670) which I kind of don't want to touch due to the fact that the terminology is quite different and that the ISP people come over to run tests on it whenever there are service issues. Either way, I've already tried to search through the settings and couldn't find any options for setting the prefix hint on the WAN side. I'm open to digging though those settings again if you're familiar with the router.
Is it possible to send the hint from OPNsense itself?
Yes, to me it sounds like you're already getting a big enough prefix from your ISP (all devices getting a /64), but you'll have to request a bigger prefix from OPNsense. I believe it should give you the options to do this when you set the IPv6 mode to DHCPv6 on OPNsense, but I can't say if your ISP router will handle it.