Welcome Guest ( Log In | Register )

Outline · [ Standard ] · Linear+

Unifi TMnet Streamyx/Unifi & IPv6, Now live!

views
     
Sharingan
post Nov 5 2013, 11:28 PM

New Member
*
Junior Member
26 posts

Joined: Apr 2005


@asellus

Did u run successfully run Mikrotik with TM DHCP-PD ? Kinda wondering how's ur config looks like since i'm trying hard to follow the code and till now still return NULL . Well to be exact, i did get the address but i can't ping to ipv6.google.com nor www.kame.net .

My current setup:
Virtualbox 4.1.24
2 x Physical NIC
Mikrotik 5.25
ADSL 4M Streamyx

Few hours ago i did tried on pfSense 2.1-RELEASE , same condition met . Can't ping to both address at all and this time i'm quite sure that all my firewall rules are set for accept and forwarded properly. If else fails, i'll go back to tunnelbroker setup. Thanks for the attention and insights.
Sharingan
post Nov 6 2013, 12:16 AM

New Member
*
Junior Member
26 posts

Joined: Apr 2005


@asellus

Ah the no.2, i did try that and yes i did get the address via SLAAC. Hmm must be my rules then. Would you mind compare mine with you then please,

CODE
/ipv6 firewall filter
add action=accept chain=input connection-state=established disabled=no \
   in-interface=ether1
add action=accept chain=forward connection-state=established disabled=no \
   in-interface=ether1
add action=accept chain=input connection-state=related disabled=no \
   in-interface=ether1
add action=accept chain=forward connection-state=related disabled=no \
   in-interface=ether1
add action=accept chain=input disabled=no dst-port=546 in-interface=ether1 \
   protocol=udp src-address=fe80::/16
add action=drop chain=input disabled=no in-interface=ether1
add action=drop chain=forward disabled=no in-interface=ether1
add action=accept chain=input comment="Allow established connections" \
   connection-state=established disabled=no



Sharingan
post Nov 6 2013, 08:36 PM

New Member
*
Junior Member
26 posts

Joined: Apr 2005


QUOTE(maxiscool @ Nov 6 2013, 08:27 PM)
Hi @Sharingan ,

I'm facing the same issue whereby I'm not able to ping the domain name. However when tried with web browser, I'm able to surf the IPV6 domain.

Are you able to get thru this?

Thanks.
*
@maxiscool

Hey there buddy, well i haven't figure it out yet since i'm quite confused as to @asellus config. In the statement that asellus pasted, i noticed that there's a bridge interface . Not sure on how to achieve this or what interface to bind/group with into the bridge. Will dig deeper later on since i'm quite handful with other task atm. I'm sure prasys or wkKay wouldn't mind shedding some light on this situation.

@asellus ,
Sorry for the late reply, i'm still figuring it out your full config atm and as i mentioned in this post, atm i'm kinda got my hands full with other tasks to complete. But if you wouldn't mind to shed some light on your full config please , it would really help us Mikrotik users here. Thanks .
Sharingan
post Nov 11 2013, 12:44 AM

New Member
*
Junior Member
26 posts

Joined: Apr 2005


@asellus

I seems to got the IPv6 part but sadly it's from HE.Net tunnelbroker. Will update here or via your PM about my findings tomorrow once i got back from work on TM IPv6.

Btw thanks, if this forum supports +1 or some sort of karma, you have my vote.
Sharingan
post Nov 11 2013, 05:11 PM

New Member
*
Junior Member
26 posts

Joined: Apr 2005


Looks like i share the same fate as UserU, i got the address but it seems that my client cannot surf properly IPv6 sites. Even www.kame.net that turtle didn't dance for me.. sleep.gif . Right now i'm using HE.net tunnelbroker and it works like charm.. rules are default and RA is running fine inside Mikrotik (Virtualbox).
Sharingan
post Nov 12 2013, 12:15 AM

New Member
*
Junior Member
26 posts

Joined: Apr 2005


@asellus

In fact i did emptied it, i did test with HE.Net with emptied my firewall (IPv6 that is) and can get it working. So it's not the firewall rules i figured, something went beyond which i can reach atm. I'll look into it later after i got back from work.
Sharingan
post Nov 12 2013, 06:29 PM

New Member
*
Junior Member
26 posts

Joined: Apr 2005


@asellus

I've done some checking and i found that all of my IPv6 traffic went Unreplied after Syn Sent.

Mikrotik -> IPv6 -> Firewall -> Connection Tab

I even try ping from inside Mikrotik Terminal and here's the results:

CODE
[admin@MikroTik] > ping [:resolve ipv6.google.com]          
HOST                                     SIZE TTL TIME  STATUS                    
2404:6800:4001:803::1012                                timeout                  
2404:6800:4001:803::1012                                timeout                  
2404:6800:4001:803::1012                                timeout                  
2001:e68:4410:64a7::                      104  64 2ms   address unreachable      
   sent=4 received=0 packet-loss=100%

[admin@MikroTik] > ping 2001:200:dff:fff1:216:3eff:feb1:44d7
HOST                                     SIZE TTL TIME  STATUS                    
2001:200:dff:fff1:216:3eff:feb1:44d7                    timeout                  
2001:200:dff:fff1:216:3eff:feb1:44d7                    timeout                  
   sent=2 received=0 packet-loss=100%

[admin@MikroTik] > ping [:resolve ipv6.google.com]          
HOST                                     SIZE TTL TIME  STATUS                    
2404:6800:4001:803::1012                                timeout                  
2404:6800:4001:803::1012                                timeout                  
2404:6800:4001:803::1012                                timeout                  
2404:6800:4001:803::1012                                timeout                  
   sent=4 received=0 packet-loss=100%

[admin@MikroTik] >


Here's the info on Firewall -> Connection

CODE
[admin@MikroTik] /ipv6 firewall connection> print
Flags: S - seen reply, A - assured
#    PROTOCOL SRC-ADDRESS                 DST-ADDRESS                 TCP-STATE  
0 SA tcp      fe80::a02b:1dd9:d366:c5ef   fe80::a00:27ff:fe9d:aaa2    established
1    icmpv6   2001:e68:4410:64a7:35c2:... 2001:200:dff:fff1:216:3e...
2    tcp      2001:e68:4410:64a7:35c2:... 2404:6800:4001:c01::5f      syn-sent  
3    tcp      2001:e68:4410:64a7:35c2:... 2a02:26f0:8:181::eed        syn-sent  
4    tcp      2001:e68:4410:64a7:35c2:... 2401:3400:2000:1::17        syn-sent  
5    tcp      2001:e68:4410:64a7:35c2:... 2401:3400:2000:1::17        syn-sent  
6    tcp      2001:e68:4410:64a7:35c2:... 2a02:26f0:8:181::eed        syn-sent  
[admin@MikroTik] /ipv6 firewall connection> print
Flags: S - seen reply, A - assured
#    PROTOCOL SRC-ADDRESS                 DST-ADDRESS                 TCP-STATE  
0 SA tcp      fe80::a02b:1dd9:d366:c5ef   fe80::a00:27ff:fe9d:aaa2    established
1    icmpv6   2001:e68:4410:64a7:35c2:... 2001:200:dff:fff1:216:3e...
2    icmpv6   2001:e68:4410:64a7:35c2:... 2404:6800:4001:803::1012  
[admin@MikroTik] /ipv6 firewall connection>


As of the moment, here's my firewall IPv6 current rules

CODE
/ipv6 firewall filter
add action=accept chain=input comment="Router - Allow IPv6 ICMP" disabled=yes protocol=icmpv6
add action=accept chain=input comment="Router - Accept established connections" connection-state=established disabled=yes
add action=accept chain=input comment="Router - Accept related connections" connection-state=related disabled=yes
add action=drop chain=input comment="Router - Drop invalid connections" connection-state=invalid disabled=yes
add action=accept chain=input comment="Router- UDP" disabled=yes protocol=udp
add action=accept chain=input comment="Router - From our LAN" disabled=yes in-interface=ether1
add action=drop chain=input comment="Router - Drop other traffic" disabled=yes
add action=drop chain=forward comment="LAN - Drop invalid Connections" connection-state=invalid disabled=yes
add action=accept chain=forward comment="LAN - Accept UDP" disabled=no protocol=udp
add action=accept chain=forward comment="LAN - Accept ICMPv6 " disabled=yes protocol=icmpv6
add action=accept chain=forward comment="LAN - Accept established Connections" connection-state=established disabled=yes
add action=accept chain=forward comment="LAN - Accept related connections" connection-state=related disabled=yes
add action=accept chain=forward comment="LAN - Internal traffic" disabled=yes in-interface=ether1
add action=log chain=forward comment="LAN - Log everything else" disabled=yes log-prefix="Log IPv6"
add action=reject chain=forward comment="LAN - Drop everything else" connection-state=new disabled=yes in-interface=ether2 reject-with=icmp-no-route
add action=drop chain=input disabled=yes in-interface=sit1
add action=accept chain=forward disabled=yes protocol=icmpv6
add action=accept chain=forward connection-state=established disabled=yes
add action=accept chain=forward connection-state=related disabled=yes
add action=accept chain=forward disabled=yes
add action=accept chain=input connection-state=established disabled=yes
[admin@MikroTik] /ipv6 firewall>


And as you can see no rules are active and even if i active all or some of the rules, it still fails to ping or respond. DNS however responding though and correctly resolve name-> ipv6 .

My current setup,
Host OS: Windows 7 Ultimate 64
Virtualization: Virtualbox
Hardware : 2 Physical NIC (bridge setup both inside Virtualbox)
Software : Mikrotik 5.25

I can confirm that pfSense with HE.net Tunnelbroker setup works and all my LAN client can obtain address either via RA or DHCPv6. I can confirm also that Mikrotik with HE.Net tunnelbroker setup also works with/without firewall rules. Any comments from the forumers is much appreciated and please do not hesitate to ask for more information if needed.

p/s: Maybe it's not my time yet?

Regards


Sharingan
post Nov 16 2013, 02:03 AM

New Member
*
Junior Member
26 posts

Joined: Apr 2005


@asellus

Sorry for the late reply,

here's my output of /ipv6 route print


CODE
[admin@MikroTik] > ipv6 route print
Flags: X - disabled, A - active, D - dynamic, C - connect, S - static, r - rip, o - ospf, b - bgp, U - unreachable
#      DST-ADDRESS              GATEWAY                  DISTANCE
0 ADS  ::/0                     Streamyx                        1
1  DS  ::/0                     fe80::121b:54ff:fe83:...        1
2 X S  ::/0                     2001:470:36:bd::1               1
3 X S  2000::/3                 2001:470:35:bd::1               1
4 X S  2000::/3                 ether2                          1
5 X S  2000::/3                 ether1                          1
6 ADC  2001:e68:4410:6d1f::/64  ether1                          0
[admin@MikroTik] >


The only active route is #6

Sharingan
post Nov 17 2013, 09:52 PM

New Member
*
Junior Member
26 posts

Joined: Apr 2005


@asellus,

Yes ether1 is where the DHCP runs

ether1 = LAN NIC
ether2 = Streamyx NIC
Sharingan
post Nov 17 2013, 10:50 PM

New Member
*
Junior Member
26 posts

Joined: Apr 2005


@asellus ,

1. Client did received address via router (SLAAC)
2. radvd did listen on all interface
Sharingan
post Nov 17 2013, 10:59 PM

New Member
*
Junior Member
26 posts

Joined: Apr 2005


@asellus

No i didn't, but lemme try that and get back to you in a moment.
Sharingan
post Nov 17 2013, 11:02 PM

New Member
*
Junior Member
26 posts

Joined: Apr 2005


Well it's still the same results as earlier.
Sharingan
post Dec 29 2013, 02:35 AM

New Member
*
Junior Member
26 posts

Joined: Apr 2005


Any news on how to get the IPv6 PD on pfsense (2.1-RELEASE) anyone? Please do share your story. Thank you.
Sharingan
post Dec 29 2013, 11:22 PM

New Member
*
Junior Member
26 posts

Joined: Apr 2005


I've tried mine but still have the same fail status as the rest . I'm right now using HE Tunnelbroker via Singapore node for IPv6 connectivity and so far it's working atm.

This post has been edited by Sharingan: Dec 29 2013, 11:23 PM
Sharingan
post Sep 2 2014, 05:21 PM

New Member
*
Junior Member
26 posts

Joined: Apr 2005


Still waiting for pfSense to support Streamyx IPv6. Both config (SLAAC & DHCP6) is not working as of pfSense 2.1.5



EDIT: Using HE Tunnelbroker atm . Seems that TM also uses Hurricane Electric IPv6 allocation and hands out the address to Streamyx/Unifi users.

This post has been edited by Sharingan: Sep 2 2014, 05:22 PM
Sharingan
post Sep 3 2014, 08:12 PM

New Member
*
Junior Member
26 posts

Joined: Apr 2005


sorry my bad. sleep.gif
Sharingan
post Sep 24 2014, 08:44 PM

New Member
*
Junior Member
26 posts

Joined: Apr 2005


QUOTE(InSplre @ Sep 10 2014, 10:09 PM)
Seremban
*
I'm in Bandar Sri Sendayan on Streamyx 8Mbps. IPv6 address obtainable but can't go anywhere . I've tried Windows 7 PPPoE dialer with IPv6 enabled. I can see the address assigned but ping -6 or tracert -6 (or -d) won't go anywhere and stuck there. Tried with pfsense, mikrotik, openwrt (all of these on Virtualbox - Host PC Windows 7 64). I'm not sure as to why they assigned address but no route at all.
Sharingan
post Oct 24 2014, 07:51 PM

New Member
*
Junior Member
26 posts

Joined: Apr 2005


Dear TM IPv6 Implementor,

IMHO, i've successfully run TM_IPv6 on pfSense and managed to get it working SLAAC mode and DHCPv6 mode (one mode at a time - not both). (Streamyx ADSL 8Mbps here - PPPoE)

After relentless hour of searching, calling here and there (esp TM guys) and the results is very good. I'm able to replicate the case if needed but to pfSense users/IPv6 Implementor please do read on.

Findings:

1. Only works in pfSense 2.2 . Currently i'm on BETA specifically pfSense-LiveCD-2.2-BETA-i386-20141017-1129

2. Set your WAN to DHCPv6 , Tick Request IPv6 via IPv4 connectivity, Tick Request Prefix no IP Address , Select 64 as for the size and last Tick the box third .Of course you'll need to setup your PPPoE Username and Password.

3. Go to LAN and as usual set your IPv4 LAN IP and for IPv6, Pick DHCPv6 here. Tick the first and the third box only and set 64 too.

4. You may want to adjust your DNS Server at System -> General Setup accordingly.

As soon as all the configuration in place and you have your internet connectivity, please head on to Status -> Interfaces . Your pfSense LAN interface should pickup the PD (Prefix Delegation IP) and you can set your PC/Netbook/Notebook "statically" using the information. Below are the example:

PD Info
pfSense IPV6 "LAN" IP - 2001:4411:7a4::1:1
YOUR PC IPv6 "LAN" IP - 2001:4411:7a4::1:fdc0:c0d3
Subnet - 64
Gateway - 2001:4411:7a4::1:1

EDITED: The IPv6 Address will change once you reboot your pfSense and you'll have to manually assign the address again. So do watch out.

Another caveat to look for, as far as i'm testing, i do suffer MTU problem (certain website lag and unable to accesss) and i haven't lowered yet the MTU. You should try to lower your MTU at 1432 as per suggested on previous post and test it out. YMMV

As always, pfSense 2.2 is still in BETA mode and i can't wait for RELEASE version of 2.2
If anyone wishes to look at my config and screenshot, please state it here and i'll try my best to upload somewhere.

P/S: the "LAN" IPv6 is actually Globally Routed IP - WAN IPv6 so to speak . I'm trying to differentiate the terms so that hopefully you might grasp the idea. Please do pardon me for any confusion.



credit: Thanks to asellus for answering some of my question earlier on.

Regards

This post has been edited by Sharingan: Oct 24 2014, 07:55 PM
Sharingan
post Oct 25 2014, 02:14 PM

New Member
*
Junior Member
26 posts

Joined: Apr 2005


QUOTE(neuromancerx @ Oct 25 2014, 01:14 PM)
Thank you Sharingan for the sharing, can you post screenshot for item 2 & 3?
*
Sure thing, let me reboot and take some screenshot.
Sharingan
post Oct 25 2014, 11:21 PM

New Member
*
Junior Member
26 posts

Joined: Apr 2005


UPDATE:

Unfortunately, pfSense RAdvd (Router Advertisement) still broken and i can't replicate back the setup i used last night. I can assure it was working and i've test it 10 times with different scenario (off & on modem, reboot PC, restart my virtualbox) and it's working last night. I'll try another approach and update to this thread once i reached the conclusion on pfSense platform. Seems that pfSense doesn't do send rapid-commit; at this point.



2 Pages  1 2 >Top
 

Change to:
| Lo-Fi Version
0.0209sec    0.45    7 queries    GZIP Disabled
Time is now: 1st December 2025 - 05:33 AM