IPv6 on StarHub 1G Fiber Broadband?

[seletarlizard]

Hi all,
Has anyone tried to configure IPv6 on pfsense for Starhub 1GB Fiber Broadband (ONT)? I can get a IPv6 address on the WAN and LAN interfaces of my pfsense router, but unable to get IPv6 addresses on any devices on my LAN (Windows, Linux PCs and Mac). I have an unmanaged desktop switch to which all my devices are connected. I thought that could be the problem, but when I connect a laptop directly to the pfsense unit, I still do not get a IPv6 address. Help!

 

[firesong]

Hi all,
Has anyone tried to configure IPv6 on pfsense for Starhub 1GB Fiber Broadband (ONT)? I can get a IPv6 address on the WAN and LAN interfaces of my pfsense router, but unable to get IPv6 addresses on any devices on my LAN (Windows, Linux PCs and Mac). I have an unmanaged desktop switch to which all my devices are connected. I thought that could be the problem, but when I connect a laptop directly to the pfsense unit, I still do not get a IPv6 address. Help!

You need to disable "Block bogon Networks". For some weird reason, StarHub's DHCP server is on fe80::/16, which is matched on 8000::/1 in the bogon list.

That said, I've found that the current version of BSD that pfSense uses does not keep up with the DHCP changes and IPv6 may suddenly stop working. This is odd because it works fine in OpnSense. For stability reasons, I've switched out for now. Still largely prefer pfSense tho, but the IPv6 dropouts bother me too much - StarHub's network on IPv4 isn't a good experience and the difference is very tangible.

PS: The pfSense thread might have been a better place.

PPS: Above info from @zitseng
https://zitseng.com/archives/7582

 

[uncle_josh]

You may also want to follow this guide
http://hwjunkie.blog138.fc2.com/blog-entry-25.html

 

[bert64]

Hi all,
Has anyone tried to configure IPv6 on pfsense for Starhub 1GB Fiber Broadband (ONT)? I can get a IPv6 address on the WAN and LAN interfaces of my pfsense router, but unable to get IPv6 addresses on any devices on my LAN (Windows, Linux PCs and Mac). I have an unmanaged desktop switch to which all my devices are connected. I thought that could be the problem, but when I connect a laptop directly to the pfsense unit, I still do not get a IPv6 address. Help!

You've enabled Router Advertisements (RA) for the LAN interface?
DHCPv6 is not the standard way for automatic configuration on IPv6, the official way is RA and DHCPv6 is an optional addon for things like prefix delegation.

 

[seletarlizard]

You need to disable "Block bogon Networks". For some weird reason, StarHub's DHCP server is on fe80::/16, which is matched on 8000::/1 in the bogon list.

That said, I've found that the current version of BSD that pfSense uses does not keep up with the DHCP changes and IPv6 may suddenly stop working. This is odd because it works fine in OpnSense. For stability reasons, I've switched out for now. Still largely prefer pfSense tho, but the IPv6 dropouts bother me too much - StarHub's network on IPv4 isn't a good experience and the difference is very tangible.

Thanks very much for this! I did find that the IPv6 address that my pfsense box would get changed frequently. Even without rebooting my pfsense box, it would change overnight. This caused problems because I am running a DNS server internal to my network (for my home lab). Also, my Google home devices stuttered quite a lot. I've decided to just run IPv4 internally and the performance is much better!

 

[seletarlizard]

You've enabled Router Advertisements (RA) for the LAN interface?
DHCPv6 is not the standard way for automatic configuration on IPv6, the official way is RA and DHCPv6 is an optional addon for things like prefix delegation.

Yes, thanks! I tried Unmanaged, Assisted and Stateless DHCP for RA and none of them helped - devices in LAN still unable to obtain a IPv6 address. The solution by firesong is probably the answer, but the frequent changes to IPv6 address means that IPv6 is not really workable for me.

 

[bert64]

Yes, thanks! I tried Unmanaged, Assisted and Stateless DHCP for RA and none of them helped - devices in LAN still unable to obtain a IPv6 address. The solution by firesong is probably the answer, but the frequent changes to IPv6 address means that IPv6 is not really workable for me.

Ahh, you should use the link-local addresses for DNS servers and such things (they will remain static), or assign static ULA addresses for internal things which need to remain static.
You can have both ULA (used for internal) and GUA (used for external access) assigned to the same interface, and RA can advertise both ranges.

Unmanaged should work, but have you set it up to do dhcpv6 with prefix delegation on the wan interface and then set the LAN interface to track the prefix that starhub assigns you?
You're connecting your devices directly through this unmanaged switch, or is there something else there? An unmanaged switch won't block RA packets but some wireless devices might...

Also on the WAN interface, make sure to uncheck the "send a dhcp release" option, that will cause your address block to change frequently as it will release whenever you bring the interface up or down. What firesong mentioned about the bogon list would also cause the dhcp lease to time out, so with his suggested change that problem should resolve itself.
I've not used starhub myself, but my colleagues v6 addresses did not change frequently.

If IPv6 is not working in your lan and devices are not getting addresses, it wouldn't affect your lan devices at all so something else is causing the google device stuttering...

 

[seletarlizard]

Ahh, you should use the link-local addresses for DNS servers and such things (they will remain static), or assign static ULA addresses for internal things which need to remain static.

Oh! I did not know that you could use the link-local addresses!

You can have both ULA (used for internal) and GUA (used for external access) assigned to the same interface, and RA can advertise both ranges.

I tried ULA with DHCPv6, which worked internally, but externally, I couldn't get a stable IPv6 address.

Unmanaged should work, but have you set it up to do dhcpv6 with prefix delegation on the wan interface and then set the LAN interface to track the prefix that starhub assigns you?

If you mean setting
WAN interface --> IPv6 Configuration: DHCP6
Send IPv6 prefix hint: checked
LAN interface --> IPv6 Configuration: Track Interface
Track IPv6 interface --> IPv6 interface: WAN
then yeah, I tried this and no joy.

You're connecting your devices directly through this unmanaged switch, or is there something else there? An unmanaged switch won't block RA packets but some wireless devices might...

I suspect my wireless devices may not support IPv6, but I have a China mini PC box connected via wired connection to the switch, and it doesn't get a IPv6 address either.

Also on the WAN interface, make sure to uncheck the "send a dhcp release" option

Check or uncheck? It is unchecked on my pfsense box.

I'll try the Bogon setting this weekend or when I have uninterrupted free time, just to see if it works. If it doesn't, no biggie. *shrugs*

 

[TanKianW]

Been awhile since I use an unmanaged switch. Logically It should work.

From what I know, some managed switches, RA configuration requires setting up:​

 

[bert64]

Oh! I did not know that you could use the link-local addresses!



I tried ULA with DHCPv6, which worked internally, but externally, I couldn't get a stable IPv6 address.



If you mean setting
WAN interface --> IPv6 Configuration: DHCP6
Send IPv6 prefix hint: checked
LAN interface --> IPv6 Configuration: Track Interface
Track IPv6 interface --> IPv6 interface: WAN
then yeah, I tried this and no joy.


I suspect my wireless devices may not support IPv6, but I have a China mini PC box connected via wired connection to the switch, and it doesn't get a IPv6 address either.



Check or uncheck? It is unchecked on my pfsense box.

I'll try the Bogon setting this weekend or when I have uninterrupted free time, just to see if it works. If it doesn't, no biggie. *shrugs*

Yes link-local addresses will work so long as you specify the interface, eg fe80::1%eth0 or fe80::1%2 etc...
If your SLAAC hands out link-local addresses as a gateway or dns server, then your system will figure out the interface to use on its own.
If pfsense is acting as dns resolver, then it will hand out its own address and update it automatically if it changes.

For prefix hint i believe starhub only allows /64 and you won't get a delegation if you send the wrong value... The standard is actually /56 but starhub/m1 ignore this and only provide /64 which isn't great. Let me know if you get it working with /56 or /48 because that would be great.
You'll want "prefix interface" set to LAN, so whatever prefix it receives via dhcpv6 gets applied to the lan interface.

Have you run the dhcpv6 client in debug mode (theres a tickbox for that) and checked the logs?

Under system/advanced/networking check the DUID type, M1 required it be set to DUID-LL but i'm not sure if starhub has the same requirement.

Under the RA options, there is "RA Subnets" - you can add an additional static ULA range here for internal use, in addition to the GUA range assigned to you by starhub. Your devices can use the ULA for internal communication between each other, but will use the GUA for external comms.

 

[bert64]

Been awhile since I use an unmanaged switch. Logically It should work.

From what I know, some managed switches, RA configuration requires setting up:​

An unmanaged switch won't care about the packet type, it will forward everything including non ip protocols (ipx, netbeui etc), unless it's not capable of handling multicast.
RA configuration is generally only for layer 3 switches, even a managed layer 2 switch will usually not care what layer 3 protocols it's passing.

 

[xxnewbiexx]

Does Starhub has a website with IPv6 config info?
I can see IPv6 address on my WAN and LAN interface but my clients, even with IPv6 addresses has no internet access. What could be wrong??

 

[xiaofan]

Does Starhub has a website with IPv6 config info?
I can see IPv6 address on my WAN and LAN interface but my clients, even with IPv6 addresses has no internet access. What could be wrong??

What is your router?

I am not so sure if the DNS server can be an issue or not. You can check under Windows using "nslookup ipv6.google.com" and post the output.

Starhub has an IPv6 support page but kind of useless.
https://www.starhub.com/personal/support/article.html?id=SzlykqufY49bkAmkZZZTr5

If using Asus, it is said that you just select "Native" and it should work.
https://www.asus.com/sg/support/FAQ/113990/
https://forums.hardwarezone.com.sg/threads/asus-router-settings-for-starhub-ipv6.5809526/

Another example for MikroTik.
https://zitseng.com/archives/17976

 

[xxnewbiexx]

What is your router?

I am not so sure if the DNS server can be an issue or not. You can check under Windows using "nslookup ipv6.google.com" and post the output.

Starhub has an IPv6 support page but kind of useless.
https://www.starhub.com/personal/support/article.html?id=SzlykqufY49bkAmkZZZTr5

If using Asus, it is said that you just select "Native" and it should work.
https://www.asus.com/sg/support/FAQ/113990/
https://forums.hardwarezone.com.sg/threads/asus-router-settings-for-starhub-ipv6.5809526/

Another example for MikroTik.
https://zitseng.com/archives/17976

I am using pfsense as my router, any tip??

 

[xiaofan]

I am using pfsense as my router, any tip??

Have you tried the tips mentioned by @bert64 earlier in this thread?

Or you can follow the guide here, which is also mentioned earlier in this thread.
http://hwjunkie.blog138.fc2.com/blog-entry-25.html

In paticular, have you set up IPv6 firewall rule on the LAN?

 

[xiaofan]

Another possible issue with Starhub IPv6 when using pfSense. But this is an old article, I am not so sure if it is still applicable or not.
https://zitseng.com/archives/7582 (pfSense Fix for IPv6 on StarHub Broadband, article in 2015)

 

[bert64]

Does Starhub has a website with IPv6 config info?
I can see IPv6 address on my WAN and LAN interface but my clients, even with IPv6 addresses has no internet access. What could be wrong??

Global IPv6 addresses starting 2xxx, or link-local addresses starting fe80::?
The link-local are always there and can only communicate with the local network not globally. To have proper IPv6 connectivity you need global addresses which currently always start 2xxx: people often get this confused.

For IPv6 on starhub generally you want DHCPv6 with prefix delegation (PD), how that's labelled in your router settings will vary depending on type of router. DHCPv6 with PD is the standard and most common way to configure IPv6.

 

[xxnewbiexx]

Have you tried the tips mentioned by @bert64 earlier in this thread?

Or you can follow the guide here, which is also mentioned earlier in this thread.
http://hwjunkie.blog138.fc2.com/blog-entry-25.html

In paticular, have you set up IPv6 firewall rule on the LAN?

saw this and my setting is similar to what is stated in the article.

I did not set any specific firewall rule for IPv6 except the one that came with original setup

 

[xiaofan]

saw this and my setting is similar to what is stated in the article.

I did not set any specific firewall rule for IPv6 except the one that came with original setup

Then you have to troubleshoot a bit more.

As mentioned before, DNS server can be another issue. You can use `nslookup` command under Windows/Linux/macOS to see if the DNS server is properly setting up. And then use ping to see if you can reach the IPv6 only server.

I am using Singtel (6rd IPv6) and Asus RT-AX86U in the following example. But the troubleshooting method is the same.

PS C:\work\speedtest> nslookup ipv6.google.com
Server:  RT-AX86U-2D40
Address:  2400:d803:7906:5f8e::1

Non-authoritative answer:
Name:    ipv6.l.google.com
Addresses:  2404:6800:4003:c04::8b
          2404:6800:4003:c04::65
          2404:6800:4003:c04::8a
          2404:6800:4003:c04::71
Aliases:  ipv6.google.com

PS C:\work\speedtest> ping -6 ipv6.google.com

Pinging ipv6.l.google.com [2404:6800:4003:c04::8b] with 32 bytes of data:
Reply from 2404:6800:4003:c04::8b: time=5ms
Reply from 2404:6800:4003:c04::8b: time=8ms
Reply from 2404:6800:4003:c04::8b: time=9ms
Reply from 2404:6800:4003:c04::8b: time=8ms

Ping statistics for 2404:6800:4003:c04::8b:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 5ms, Maximum = 9ms, Average = 7ms

 

[Mach3.2]

I think @firesong had some issues with starhub fibre ipv6 on pfsense, he ended up switching to something else...

https://forums.hardwarezone.com.sg/threads/starting-pfsense-for-new-users.6390714/post-148202586

Edit2: Eh lmao it's also in the 2nd post of this thread.