Tata Sky Broadband: Static IPV6 - Unable to Configure

[panks21]

this is great.. if possible please upload pfsense settings on imgbb and share link here...

 

[tatyasky]

@panks21 so I FINALLY got PfSense to work with v6 on TSBB as it should. The hitch was RA set to Assisted. I changed it to "Unmanaged" to enable the machines pick up a gateway from the ISP and it works! Now Windows connection properties shows v6 connectivity as "Internet" and I connect to ipv6 dot google.com. Typing in "what's my ip" into Google gives me my v6 address. Yee haah! 😀 Sorry I am unable to post a screenshot here.

You got your 1 Gbps up and running?

 

[Chip]

@tatyasky no it was just the IPv6 bit. TSBB 1 Gbps is still a disappointment. Will try Airtel for a month in Oct.

 

[Chip]

Ok guys, this is the result of my experiments with pfSense with a Ipv6 connection and a /64 subnet

a) DHCPv6 server is not required

b) It doesn't like more than 2 DNSes being inputted on DHCPv6 config page. Add more than 2 and windows 10 stops getting an IPv6 address. Not sure if this is a bug or intentional

c) RA must be switched on - Unmanaged, Managed, Assisted modes work. Not experimented with Stateless DCHP & Router only modes

d) If no DNS is specified that it defaults to using the LAN's v6 address as the DNS server.

e) I have selected the following options on the RA config page

• Provide DNS configuration via radvd
• Use same settings as DHCPv6 server

I imagine configuration for Airtel IPv6 whenever it starts in Pune E would be similar.

 

[Chip]

this is great.. if possible please upload pfsense settings on imgbb and share link here...

Here you go bro - TSBB Static IPv6 Config on pfSense

I imagine these settings will also work for dynamic v6 which TSBB hands out..ofcourse it's without the reserved 4th quartet but with a /64 subnet mask nevertheless. Need to mention I am still experimenting with these settings and they could change. I'll share here in case of any notable changes. I would encourage other users especially those on Airtel IPv6 to check if these settings work for them.

 

[Chip]

@Sushubh whenever I click on links I get forwarded to cuelinks dot com in a new tab. How can I go to the intended site? Something I need to do? Also I cannot seem to upload images on here. Please help.

 

---

[panks21]

@Chip thanks.. I tried the same settings and it works on Airtel too... with a single VLAN.. but it seems Airtel not sending default gateway for IPv6

 

[Chip]

@panks21 great to know it works on Airtel as well. Yeah, one thing I forgot to mention..set a VLAN on the WAN port to whatever value and priority Airtel uses in its ONT. The pfSense v6 gateway is automatically set to a link local address. For e.g. in my case it is set to fe80::8ad9:8fff:fe58:3b71.
On the client machine for e.g. this Windows PC it is set to fe80::208:a2ff:fe0a:61ab%13.

These values are automatically generated. I did not do anything. Make sure your RA page settings are properly set. Rebooting pfSense may do the trick. Even the Nokia ONT has a link local address as the gateway as you will see from the cases where people asked for TS v6 address and shared screenshots.

 

[panks21]

Just now realized that the IPv6 DNS are not passed on to the clients.. I am using NextDNS and have a IPv6 DNS from them.. which I have added as part of DHCPv6 setting..

Any other setting to be enabled...

Wireless LAN adapter Wi-Fi:

   Connection-specific DNS Suffix  . : 314gi
   Description . . . . . . . . . . . : TP-LINK Wireless USB Adapter #2
   Physical Address. . . . . . . . . : E8-94-F6-25-CD-85
   DHCP Enabled. . . . . . . . . . . : Yes
   Autoconfiguration Enabled . . . . : Yes
   IPv6 Address. . . . . . . . . . . : 2401:4900:1f30:xxxx:xxxx:xxxx:xxxx:xxxx(Preferred)
   Temporary IPv6 Address. . . . . . : 2401:4900:1f30:xxxx:xxxx:xxxx:xxxx:xxxx(Preferred)
   Link-local IPv6 Address . . . . . : fe80::a444:255a:3c9a:b69d%19(Preferred)
   IPv4 Address. . . . . . . . . . . : 192.168.114.224(Preferred)
   Subnet Mask . . . . . . . . . . . : 255.255.255.192
   Lease Obtained. . . . . . . . . . : 25 September 2021 23:36:39
   Lease Expires . . . . . . . . . . : 26 September 2021 01:36:42
   Default Gateway . . . . . . . . . : fe80::4262:31ff:fe12:7e86%19
                                       192.168.114.254
   DHCP Server . . . . . . . . . . . : 192.168.114.254
   DHCPv6 IAID . . . . . . . . . . . : 183014646
   DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-26-A6-C9-F6-30-85-A9-8E-47-62
   DNS Servers . . . . . . . . . . . : 192.168.114.251
                                       45.90.28.65
   NetBIOS over Tcpip. . . . . . . . : Enabled
   Connection-specific DNS Suffix Search List :
                                       314gi

 

[Chip]

@panks21 I can see 2 DNS v4 servers - 192.168.114.251 obviously the router and 45.90.28.65 NextDNS. In the DHCPv6 server settings of pfSense, add these two:

2a07:a8c0::4a:583a
2a07:a8c1::4a:583a

From here

Or, in the System --> General Setup page of pfSense add these two v6 servers and select the corresponding v6 WAN/gateway interface. You can''t add a v4 WAN to a v6 DNS

PS - The LAN interface of the router and its v6 IP can also act as the DNS.

 

[panks21]

yeah.. I have done that.. but its not getting advertised to the client..
Also please hide your NextDNS IPv6 DNS addresses. They are unique to you..
Surprisingly, nextdns doesnt detect that I have a IPv6 enabled machine.. even though I can ping their IPv6 DNS address

alpha@alpha-mbp ~ % ping6 2a07:a8c0::xx:xxxxx -c 5
PING6(56=40+8+8 bytes) 2401:4900:1f30:xxxx:xxxx:xxxx:xxxx:xxxx --> 2a07:a8c0::xx:xxxx
16 bytes from 2a07:a8c0::xx:xxxx, icmp_seq=0 hlim=58 time=13.542 ms
16 bytes from 2a07:a8c0::xx:xxxx, icmp_seq=1 hlim=58 time=8.428 ms
16 bytes from 2a07:a8c0::xx:xxxx, icmp_seq=2 hlim=58 time=8.399 ms
16 bytes from 2a07:a8c0::xx:xxxx, icmp_seq=3 hlim=58 time=8.364 ms
16 bytes from 2a07:a8c0::xx:xxxx, icmp_seq=4 hlim=58 time=8.121 ms

 

[Chip]

@panks21 I think there's an install procedure for routers check their setup guide. Can you shift temporarily to OpenDNS/Google DNS etc to check if it works. Can you also do an IPv6 test on one of the more common v6 test sites? My setup passes all of them. Of course that's only TSBB not Airtel.

BTW those NextDNS values are not mine.. thanks for the tip though 🙂 They just appeared (browser specific) when I opened the page and are valid for 7 days. I created an account with new values of course out of curiousity and using it on my phone but I can see latency increases whilst surfing.

PS - I'll try these nextDNS settings on pfSense and report back.

 

[panks21]

none of the DNS works... be it cloudflare or google..
ipv6-test.com passes but test-ipv6.com fails

never mind.. I am giving up on IPv6 for the 5th time and reverting back to my Static IP.

 

[tatyasky]

In Windows, I run these 2 commands in elevated cmd to disable temporary IPv6 assignment. Reboot afterwards.

netsh interface ipv6 set global randomizeidentifiers=disabled
netsh interface ipv6 set privacy state=disabled

The static IPv6 now assigned to Windows PC remains unchanged till I format Windows. I believe this is how static IPv6 works.

I also for the lulz assigned 1:2:3:4 as last quartets of static IPv6 manually from Windows settings. So whatismyip.com actually started showing me that as IP on their test page.

Here are my IPv6 settings

@Chip what is your use case scenario with pfsense? I use Asus RT-AX88U and enbling IPv6 and adding 3 DNS servers is literally 1 click job of hitting Apply button. It just works and I never had to worry about anything. Just add the PC's IPv6 as an exclusion in Router's firewall and boom ! my pc is accessible via remote desktop IPv6. The PiHole which I tried running off a QNAP server from LAN left a lot of empty white spaces on webpages so switched to Adguard Browser addons for iOS and Firefox. Newest beta firmware of RT-AX88U has added support for Wireguard so even that part has been taken care off. But most important of them all.... system stability. My router is now running more than 30 days uptime and AiMesh is as good as ever. Similar settings can be used on cheaper Asus RT-AX55

Asus RT-AX55 AX1800 Dual Band WiFi 6 (Black) Router Supporting MU-MIMO and OFDMA Technology, with AiProtection Powered by Trend Micro™, Compatible with ASUS AiMesh WiFi System, and Parental Controls. - Buy Asus RT-AX55 AX1800 Dual Band WiFi 6 (Black)

Amazon.in: Buy Asus RT-AX55 AX1800 Dual Band WiFi 6 (Black) Router Supporting MU-MIMO and OFDMA Technology, with AiProtection Powered by Trend Micro™, Compatible with ASUS AiMesh WiFi System, and Parental Controls. online at low price in India on Amazon.in. Check out Asus RT-AX55 AX1800 Dual...

www.amazon.in

Because of CG-NAT on IPv4 and most routers don't have their own static IPv6 address, I have installed Tailscale on QNAP and set up a static route of Asus's LAN IP address 192.168.1.1
So if I have to access my router's GUI from outside LAN, I simply start tailscale app on iPhone or android and type 192.168.1.1 and am taken to router's home page. Tailscale can even be installed on Raspberry Pi or low power Windows PC like NUC which can run 24x7. That's the only downside of CG-NAT and using tailscale.

What am I missing?

 

[Chip]

@panks21 I am a bit surprised maybe it has something to do with Airtel's implementation. Whenever they roll out v6 in my area I'll certainly be testing it out.

@tatyasky pfsense mainly because it has an IDS/IPS plus a fully controllable open source firewall. My old Asus AC3200 does the job just like your AX88U after all these routers are meant to be easy to setup and use. I don't need to access my desktop or home network remotely as I work from home and for those instances I am away or travelling I have my files backed up in an encrypted cloud