0

I'm running a virtual environment on a root server. To connect all my maschines to the internet i got a pfSense setup up.

For the pfSense box it got let's say the 2a01:4f8:162:xxxx::/64-network.

Currently i set my LAN on pfSense to static and use the IP 2a01:4f8:162:xxxx::/64 and setup DHCPv6 for the LAN site form 2a01:4f8:162:xxxx:9000::1000/64 to 2a01:4f8:162:xxxx:9000::2000/64.

On one of my virtual maschines I set it to static 2a01:4f8:162:xxxx:8000::2/64. I allowed ICMP and ports 80 and 443 in the firewall to go to this maschine.

I can allways ping the 2a01:4f8:162:xxxx:: address of pfSense. The 2a01:4f8:162:xxxx:8000::2 of my virtual maschine is reachable like 20% of the time. Rebooting helps but not allways.

So what am I doing wrong? What should be made different?

0

1 Answer 1

4

Your LAN and WAN need separate /64s. You seem to be using 2a01:4f8:162:xxxx::/64 on both sides, which will not work. You'll need for example 2a01:4f8:162:xxxx::/64 on the WAN and 2a01:4f8:162:yyyy::/64 on the LAN, with routing set up correctly so that the LAN addresses are routed through your firewall.

3
  • I know I expected that I need two but then it somehow worked with only one. I tries dividing my subnet into two /65 networks but then i could not setup DHCPv6 Commented Jan 28, 2017 at 14:51
  • It won't work with only one. Maybe you can ping your pfSense box (depending on whether it responds to ND on the other interface) but you won't be able to reach any machines on the LAN side without tricks like ND proxying. Using /65 will never work because your upstream will have it configured as one /64. Commented Jan 28, 2017 at 15:09
  • Your upstream should give you multiple /64s (usually a /56 or more) to run your own networks with. It might be that that's only part of a higher-level subscription though. If they don't provide enough /64s at all then they don't understand the concepts behind IPv6 and you'll be better off moving to a different provider. Commented Jan 28, 2017 at 15:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .