The crucial setting is the checkbox **allow other routers IPv6 präfixes**. Without that your delegated internal prefixes will
The crucial setting is the checkbox **allow other routers IPv6 prefixes**. Without that the delegated internal prefixes will
not be reachable from the Internet.
Also, not stated in above document, I found it necessary to modify the **Internet - Permit Access** settings for
the OPNsense host. Make sure to select :menuselection:`Internet --> Permit Access -> <your OPN Host> --> IPv6 Settings --> Open firewall for delegated IPv6 prefixes of this device` in order to make your delegated
internal subnets available via Internet.
Also, not stated in above document, it is necessary to modify the **Internet - Permit Access** settings for
the OPNsense host. Make sure to select :menuselection:`Internet --> Permit Access --> <your OPN Host> --> IPv6 Settings --> Open firewall for delegated IPv6 prefixes of this device`
in order to make your delegated internal subnets available via Internet.
------------------------------------
Step 2 - configure the WAN interface
------------------------------------
On OPNSense go to :menuselection:`Interfaces --> WAN` and set the configuration type for IPv6 to **DHCPv6**. On the bottom part of the dialog in
On the OPNSense go to :menuselection:`Interfaces --> WAN` and set the configuration type for IPv6 to **DHCPv6**. On the bottom part of the dialog in
**DHCPv6 Client configuration** make sure to select
* checkbox: **Request only an IPv6 prefix**
* checkbox: **Send IPv6 prefix hint**
* dropdown: **Prefix delegation size** in our example select `60`
* dropdown: **Prefix delegation size**. For this example setup select `60`
Two things to notice here:
1. the prefix you are requesting has one bit more compared to what your ISP assigned the FB (60 vs. 59)
2. the setting **Request only an IPv6 prefix** is the important part. With this setting the FB aknowledges
your OPNsense as a router and really delegates a prefix. Your OPNSense will only get a link-local `0xfe80`
address but that is fine. If you do not use this checkbox the FB considers your OPNsense as an end-user device
and plainly refuses to delegate a prefix to your OPNsense. You end up with an valid IPv6 address but with `/64`
netmask so nothing to delegate in your home net.
-------------------------------------------------
Step 3 - configure the DMZ / LAN / WLAN interface
-------------------------------------------------
Now it's time to setup your internal interfaces. The settings are more or less the same for all of them.
Instead of 'DHCPv6' you select 'Track Interface' and on the bottom IPv6 dialog choose the WAN interface to track.
This is also the place to divide your delegated prefix into distinct sub-nets. Just specify an idividual 'Interface prefix ID'
for each interface. In our example our FB gave us `aaaa:bbbb:cccc:9410::/60` and we choose:
========= ============ =======================
Interface Interface ID result-prefix
========= ============ =======================
DMZ `0x01``aaaa:bbbb:cccc:9411::`
WLAN `0x02``aaaa:bbbb:cccc:9412::`
LAN `0x03``aaaa:bbbb:cccc:9413::`
========= ============ =======================
---------------------------------------------
Step 3.1 - configure the Router Advertisments
---------------------------------------------
With the new subnets in place it's time to configure the `Router Advertisments`. Not too much to configure here
as the defaults are already pretty good.
For this guide i did choose the following settings:
The **Interface prefix Id** acts as the subnet extension (for lack of better wording) on top of the prefix provided by the FB.
In this example we have a /60 prefix so effectively there are 4 bits left for subnetting. As a result valid values for **Interface prefix Id** are between `0x00` and `0x0f`.
In order to being able to setup the router advertisements in the next step make sure to select the checkbox
**Allow manual adjustment of DHCPv6 and Router Advertisements** for each of the internal interfaces.
----------------------------------------------
Step 3.1 - configure the Router Advertisements
----------------------------------------------
With the new subnets in place it is time to configure the **Router Advertisements**.
For this guide the following settings have been chosen:
But wait! The prefix is dynamic isn't it ? How can we deal with that ?
But wait! The prefix is dynamic isn't it ? How to deal with that ?
Easy. Just omit the variable part and configure the DHCPv6 range to be
`::1` --> `::ff`
OPNSense will automagically add the assigned dynamic prefix to that in front.
OPNSense will automatically prefix this pattern with the dynamically acquired prefix.
Repeat for all the other subnets. Don't forget to configure the `Domain search list` to point to your home network.
Repeat for all the other subnets. Don't forget to configure the `Domain search list` to match the SOHO internal DNS domain.
-----------------------------
Step 4 - setup Firewall rules
-----------------------------
We are getting close. All our clients should now have a proper IPv6 address (actually more than one), know their DNS server(s) and their upstream router.
All clients should now have a proper IPv6 address (actually more than one), know their DNS server(s) and their upstream router.
All thats left to do is adding the appropriate firewall rules.
By default outgoing traffic should already be possible but traffic from the Internet to your internal webserver needs a firewall rule.
There are different philosophies on how to manage firewall rules so I spare me the details here.
By default outgoing traffic should already be possible but traffic from the Internet to the internal server needs a firewall rule.
There are different philosophies on how to manage firewall rules. Just use a similar strategy as with your IPv4 setup so rule management
is consistent.
Just keep in mind that your DMZ/LAN/WLAN prefix is dynamic. The build-in macros`DMZ net` will work for the whole network.
But if youlike a rule for a single server your should setup an alias pointing to your (fixed) DHCP IP and use this instead.
Keep in mind that the `DMZ` / `LAN` / `WLAN` prefix is dynamic. The build-in macros like`DMZ net` will work for the whole network.
But if you need a rule for a single server your should setup an alias pointing to your (fixed) DHCP IP and use this instead.
---------------
Troubleshooting
---------------
While discovering the specifics of IPv6 behind a FB in combination with OPNsense the first point of debugging was always
going via SSH to OPNsense on the CLI.
connecting via SSH to OPNsense on the CLI.
In the directory `/tmp/` you will find several IPv6 related intermediate files. The most helpful here was `/tmp/<interfacename>_prefixv6`.
In this file you will find the prefix delegated to you by your upstream router. If you are behind an FB and this file does not exist chances
are you forgot to seth the 'Request only an IPv6 prefix' setting on the WAN interface.
are you forgot to seth the **Request only an IPv6 prefix** setting on the WAN interface.
Another helpful command was 'radvdump'. This tool dumps the output of the router advertisments in a nicly formatted way.
Another helpful command is `radvdump`. This tool dumps the output of the router advertisements in a nicely formatted way.
Thomas Klein
9 months ago