I have no problem getting a /56 from Rogers. Did you request one on the WAN page with DHCPv6 Prefix Delegation size? Where are you seeing those 2 addresses? It seems strange that the last 64 bits are the same for both, but the prefix is different. Also, the prefixes are too far apart to be explained by prefix ID. With a /56, the prefix ID is the rightmost 8 bits of the prefix. Are you trying to manually provide a prefix, in addition to that provided by SLAAC?
I've been running pfsense for about 5 years and it's always worked well. Currently on 2.5.0.
BTW, an easy way to see what's being provided is to look at the available prefixes, when you select prefix ID on a LAN interface. With 2.5.0, it's listed below the box where you enter the value. IIRC, on previous versions, you could select from available prefixes from a drop down list.
Here's what I have:
IIRC, this was a drop down list in previous versions, but here it actually specifies the valid range. The suffix is usually determined by the MAC address, so it is possible to have multiple addresses with the same suffix. However, the prefix should be different. Again, where are you seeing those addresses? At a command prompt? The interface page? The dashboard? The LAN page should say track interface and WAN.
Hmmm... I tried to post the screen capture of the prefix ID box, but this site didn't like it. Anyway, it had prefix 0 selected and below the box it said the valid range was 0-ff.
It's hard to understand what you're asking, but if you have a router after the modem, then the modem must be in bridge mode.
@arnym21 wrote:
Gateway mode is often preferred when a house is not ethernet wired, so there is no simple or cheap way to wire hook a remote router directly to the modem. I have a router in WiFi Client mode behind the modem in Gateway mode. The router IPv6 options are switched to relay, and its PC clients receive IPv6 traffic normally.
But their IPv6 addresses are still assigned by the modem and exposed to websites. I want the router clients IPv6 addresses assigned by its own DHCPv6 server to have my IPv6 LAN segment isolated behind NAT6. For that the modem should be able to request from Rogers server, truncate and delegate an IPv6 prefix to the router. I ask if someone succeeded in getting IPv6 prefix delegated to their router in Gateway mode, and of what length? If you don't know that, just ignore my post. 😉
Is there any technical reason why you want to implement NAT on an IPv6 network?
NAT was a necessary evil in the IPv4 world due to the problem of address space exhaustion, and it enabled the use of private address space. However, one of the benefits of IPv6 is that we can do away with NAT and all the headaches that it causes.
You may want to read this blog post on NAT66. Yes, there are reasons for implementing it... but it has its downsides as well and it introduces unnecessary complexity.
Gateway mode has nothing to do with wheter a house is wired, unless you insist on using the built in WiFi. I don't as I prefer to use a proper access point, mounted in a better location than the modem.
There is no need for NAT with IPv6 as you get a /56 prefix from Rogers. This provides 2^72 addreses, split into 256 /64 prefixes. Also, you cannot delegate prefixes from a modem in gateway mode. It would have only a single /64 and no support for DHCPv6-PD on the LAN side. DHCPv6-PD is how the prefix is provided. I agree with the other post about not using NAT. NAT was created to get around the IPv4 address shortage and breaks some things. It's better left on IPv4 and not contaminate IPv6. Also, NAT does nothing for security that a decent firewall can do.
@JKnott wrote:
Gateway mode has nothing to do with wheter a house is wired, unless you insist on using the built in WiFi. I don't as I prefer to use a proper access point, mounted in a better location than the modem.
If I understand correctly, @arnym21 is connecting an OpenWrt router to the Rogers gateway via Wi-Fi and apparently wants to masquerade or obfuscate the addresses of the end systems behind it using NAT66. It's an unusual configuration.
@arnym21 wrote:
I'm not comfortable with my PCs IPv6 addresses exposed to WAN, other modem WiFi users and browsed websites. Are you comfortable with that for your devices?
Yup. I'm totally fine with it.
Anyway, many folks switch the modem to Bridge mode namely for security reasons regardless of modem, router or end devices firewall existence and settings.
I do as well. Similar to what @JKnott described, I also request either a /56 or /60 PD. Even if you do not subnet internally, a /64 delegation gives you more address space than the entire IPv4 Internet. My firewall provides me with all the protection that I need, and implementing NAT66 would not significantly improve security or privacy... and any miniscule gains are not worth the downsides.
I don't see why would Rogers refuse to provide proper length prefix in modem Gateway mode to customers who want their IPv6 LAN be isolated behind NAT6 in a similar way??? In particular, those customers who are accustomed to popular OpenWRT and DD-WRT router freedom firmware allowing more customization and security.
In short, this is not their business to restrict how the end user configures their LAN. They are expected to provide means to not hamper legitimate LAN config options, whether such options are more or less popular among users. In fact, most users have no idea about LAN config at all, but Rogers should not target such users as prime and only customers deserving attention. 😚
I'm not sure what you are hoping to achieve or why you are asking for what you were originally asking for. If you are implementing NAT66, you should be fine with the single IPv6 address that you get from the gateway. If you want a pool of IPv6 addresses to NAT 1-1 onto, then there is still no practical gain.
If you want to live in a NAT-only world, you would be better off just disabling IPv6 on your own internal router and use IPv4 in a double-NAT configuration. That would make you "extra extra secure".
Your IPv6 addresses are not exposed to the Internet. They are behind a firewall. Also, with IPv6, you have a consistent IPv6 address and up to 7 privacy addresses. You use the privacy addresses when you connect to something, such as a web site and you get a new one every day. The consistent address is used when you want others to reach you for a server etc. That address has to be made available to the world if you want it to be. You configure the firewall to allow access to that address. You never allow access to the privacy addresses. Also, unlike IPv4, with the IPv6 address space so sparsely populated, scanning for a target is virtually impossible. A single /64 prefix contains 18.4 billion, billion addresses, which is the entire IPv4 address space squared. As for Rogers not providing a longer prefix, it's not them. In gateway mode, only a single /64 is provided. There is nothing left to pass on to other routers. And, again, there is no provision for prefix delegation behind gateway mode. As for those who have no idea about LAN config, Rogers provides a modem in gateway mode that can be used right out of the box, without configuration. For others, such as me (I'm a Cisco CCNA BTW), bridge mode is available, which can be used with a customer provided router and the customer then becomes responsible for configuring it. In my case, I run pfsense for my firewall/router. This allows me to take the /56 prefix from Rogers and split it into 256 /64s. I currently use 4. I can do much more with pfsense than you can with the modem in gateway mode or that you can do with *WRT. It's all a matter of the right tool for the job. Wishful thinking won't change that.
@arnym21 wrote:No I don't get a /56 prefix from Rogers on my WiFi Client router, or any prefix for that matter. This is seriously hampering my right to configure own IPv6 LAN segment in a manner preferred by me as a Rogers customer. In fact, providing modem Bridge mode for Rogers modem-routers was caused in the past by massive customer demand for LAN security, and by now nobody even questions whether it was needed or not.
Where are you getting that nonsense from? Gateway mode provides an easy to use box that the customer can just plug in and go. Bridge mode is for more sophisticated users who know how to properly set up networks and have the appropriate equipment to do so. Bridge mode does not provide any security. It provides a bare connection to the Internet and it's up to the customer to provide a firewall and configure it properly.
@arnym21 wrote:
If you are implementing NAT66, you should be fine with the single IPv6 address that you get from the gateway. If you want a pool of IPv6 addresses to NAT 1-1 onto, then there is still no practical gain.Would you care to explain for other interested Rogers customers, how exactly they can setup NAT66 on their downstream routers with clients getting IPv6 traffic by using a single IPv6 address received from the modem in Gateway mode without any IPv6 prefix? Or pls provide a weblink with some example of such setup, for example for an OpenWRT router, since its more flexible in config compare to consumer routers with factory firmware?
The blog post that I referenced earlier outlines the basic technique. However, I can't provide you with specific configuration advice on how to do this; it would not occur to me to set such a thing up. I don't even know how well it would work in practice.
Rogers only supports the default configuration that they provide. For most users, this is sufficient. If you have more advanced requirements, you may need to put the Rogers gateway into Bridge Mode, supply your own equipment, and configure it according to your needs, subject to the constraints of what you can and cannot do with a residential Internet service.
-
149677 views
-
62 Likes
-
-
