I have been given a native (no tunneling etc) IPv6 /64 block by my ISP. My pfSense router has successfully got an address, and from its WAN interface I can for instance ping ipv6.google.com and get a reply. However, on my internal network, it does not work, and I can't figure out why. I have a DHCPv6 server handing out addresses, and the router is doing router advertisements, and this seems fine to me.
I'll try to illustrate. Lets say I have a prefix 2001:a:b:c::/64. My router gets it's WAN address using SLAAC, and that becomes 2001:a:b:c:20c:29ff:fef9:b914. On the internal interface, I have assigned it 2001:a:b:c::1 (old IPv4 habit, I guess…). DNS and DHCP is hosted on a server with 2001:a:b:c::10 (static assignment). My workstation then requests an address using DHCP and has been assigned 2001:a:b:c::11ab.
My routing table contains two default (::/0) routes, one for the router's internal static IP, and one for it's link-local IP.
Pinging ipv6.google.com now gives Destination host unreachable
. Where do I start to debug this? It seems to me that it is a routing issue, but I don't know where to start looking.
Best Answer
If you only have one
/64
prefix and that prefix is on your WAN side then you can't do IPv6 for your LAN. An ISP is supposed to give you multiple/64
s so that you can put a separate/64
on each LAN. It is common for an ISP to give everybody (residential and business) a/48
(65536/64
s). For residential customers they might hand out a/56
(256/64
s). That way you have plenty prefixes to number your network, even if it gets more complicated over time (Internet-of-Things deployment etc).Some ISPs are still sticking too much to the IPv4 mentality and only giving out a
/60
(16/64
s) or so. While that will probably be enough now it will cause problems as IP-capable devices become more common, and you don't really want your living room lighting and AC to be in the same subnet as the children's toys, do you? ;)ISPs that only hand out a single
/64
prevent you from any subnetting at all. If that/64
is on the WAN interface then you'll never get decent IPv6 on your LAN(s). This is the ISPs fault and they should fix this by giving out a decent amount (/48
or/56
) of addresses.