Comments on: Configuring native IPv6 in pfSense firewall

By: Remco Bressers

Remco Bressers — Thu, 21 Oct 2010 07:25:59 +0000

@Scott Ullrich I don’t know if it makes any difference for you guys, but we are willing to provide you with native-IPv6 over a IPv4 GRE tunnel. This way you can still use native-IPv6 to test.

By: Shell

Shell — Thu, 21 Oct 2010 05:57:09 +0000

@Scott Ullrich, from a long-time PFsense supporter and advocate

I think you’ve totally missing the point we’re making, when you say “it’s extremely difficult to get ipv6 without using a tunnel”. What PFsense urgently needs (for 1.2.3 and not just the oh-so-mythical-and-long-promised-but-never-finished2.0) is a way to get tunneled IPv6 on it as the endpoint, because that’s the only way that most individuals and businesses are going to be getting v6 for some considerable time.

Only 1 ISP where I live can even offer native IPv6, and they are 120$ a month for basic ADSL. Tunnels, however, are free, functional, available over 15$ a month ADSL, yet appear to have been ignored by the PFsense developers for _far_ too long, giving the impression that pfsense is now a legacy appliance. The situation is much the same worldwide.

I’ve been using (at home) and recommending (to work customers) PFsense for years now, yet all but two of the pfsense boxes at those customers have been ripped out in a purge of v4-only equipment, as the replacement cycle dictates that dual-stack equipment is now required. The irony is, of course, that PFsense is dual-stack but the GUI code screws up attempts to use IPv6 properly.

The gap between PFsense 1.2.3 and the long-awaited 2.0 has been filled by Cisco, much to my dismay, due to the slow response to requests for IPv6 in the GUI.
Those customers will now be PFsense-less for 3-5 years until the Ciscos come up for replacement again, a tragic loss.

Most of these companies (sohos to smb’s) bought the wonderful book about PFsense 1.2.3 but were rather annoyed to find that it’s the “end of the line”.
We can only wonder at how much useful bounty and contributed code has been lost due to abandoning 1.2.3 and ignoring IPv6 for so long.

……sometimes you have to hear it from your nearest and dearest, but it had to be said, sorry

By: halli

halli — Wed, 11 Aug 2010 08:51:37 +0000

@Scott Ullrich

rh@bdsm:~$ date
Mi 11. Aug 10:47:07 CEST 2010

pfSense : pfSense-2.0-BETA4-20100811-0244.iso.gz

As Larry Wall did xmas but wich year ?

By: barf

barf — Thu, 03 Jun 2010 14:17:37 +0000

you can also use git0 interface for a 6-to-4 tunnel if you don’t have native IPv6
ifconfig gif0 create
ifconfig gif0 tunnel x.x.xx.xxx 192.88.99.1
ifconfig gif0 inet6 alias 2002:beef:b00b::f00d
route add -inet6 default -interface gif0

but you will then need to add a route for the new ipv6 subnetwork you send router advertisments to:
route add -net -inet6 2002:beef:b00b:face::/64 -interface rl0

By: mthode

mthode — Sat, 24 Apr 2010 06:29:27 +0000

I know this is old but it’s worth a shot.

All I’d need to do for vlan support is to change the interface name to be the vlan interface name?

By: Susi Ledermüller

Susi Ledermüller — Fri, 05 Feb 2010 07:19:04 +0000

There is still enough V4 space left, but I have played with V6, too and it seems to work well with pfsense now. I made a tunnel between two locations with V6 without any trouble.

By: pfsense user

pfsense user — Fri, 29 Jan 2010 08:09:56 +0000

P. Harmor were you able to find anything with getting this to work on tunnelbroker.com?
I can’t get a native tunnel through my ISP either and am facing this problem

I like how this is addressed and hope it works with tunnelbroker.com… but I just do not know

By: P. Harmor

P. Harmor — Wed, 23 Dec 2009 18:52:53 +0000

Thanx for this howto! I now have hope again, that IPv6 and pfSense might work together, for me. However, I use a tunnel (/48) with tunnelbroker.com, and don’t yet know quite what changes need to be made to accommodate for that difference.

ATM, my IPv4 network is trashed, as I believe it’s all trying to be routed thru the tunnel, and I’m not sure what to do to fix it…

By: Scott Ullrich

Scott Ullrich — Tue, 22 Dec 2009 19:48:47 +0000

IPV6 will be backported from m0n0wall shortly after 2.0 releases. 2.0 will be going BETA on xmas so it is not as far off as some might think.

And saying we do not care at all about IPV6 is false. It is extremely hard to get a IPV6 connection where we live without using a tunnel.

By: Beat

Beat — Mon, 14 Dec 2009 20:05:14 +0000

Hi,
Thanks!! Your investigations helped me out of a big problem I have a m0n0wall/pfSense combination and had the problem that pfSense blocked IPv6 between the (bridged) LAN and WLAN. Developers are sadly zero interested in resolving. Your Text helped me a lot to manipulate pf in needed order. But anyway.. looking for IPv6 capable home-firewall project with 802.11n capable WLAN.