Starting pfsense for New Users

[it_geek]

let me know ur pfsense results. want to know if this is some pfsense related issue.

lol no reply haha

anyway i managed to find the issue. ipv6 faces packet loss when i want more than one LAN interface to get each its own /64 ipv6 space.

When I set more than one LAN side interface to track the same WAN interface, my WAN side ipv6 goes down.

This shouldn't happen since Singtel gives a /56 PD? So by right if both LAN interfaces track the Singtel WAN with its own unique prefix ID (e.g. 58 on the primary LAN and A6 on the secondary VLAN, i should theoretically see 2400:d802:abcd:ef58:xxxxxxxx on the primary LAN and 2400:d802:abcd:efa6:xxxxxxxx on the secondary VLAN?

Anyone knows the solution to this?

So far can only get one LAN interface to track the WAN if i want ipv6 connectivity.

 

[xiaofan]

lol no reply haha

anyway i managed to find the issue. ipv6 faces packet loss when i want more than one LAN interface to get each its own /64 ipv6 space.

When I set more than one LAN side interface to track the same WAN interface, my WAN side ipv6 goes down.

This shouldn't happen since Singtel gives a /56 PD? So by right if both LAN interfaces track the Singtel WAN with its own unique prefix ID (e.g. 58 on the primary LAN and A6 on the secondary VLAN, i should theoretically see 2400:d802:abcd:ef58:xxxxxxxx on the primary LAN and 2400:d802:abcd:efa6:xxxxxxxx on the secondary VLAN?

Anyone knows the solution to this?

So far can only get one LAN interface to track the WAN if i want ipv6 connectivity.

No solution as of now.

You basically found out the issue I found quite some time ago. Effectively /56 becomes /64.

Earlier discussions back in Oct 2025.
https://forums.hardwarezone.com.sg/threads/ipv6-discussions.6976522/page-27 (also Page 25).

There were even earlier discussions back in Nov 2024 at the same IPv6 thread.

It does not matter which router OS I use, OpenWRT, pfSense or Asus.

Last time it worked at the ONT time.

Looks like a SingTel side issue -- they block something on IPv6.

 

[it_geek]

No solution as of now.

You basically found out the issue I found quite some time ago. Effectively /56 becomes /64.

Earlier discussions back in Oct 2025.
https://forums.hardwarezone.com.sg/threads/ipv6-discussions.6976522/page-27 (also Page 25).

There were even earlier discussions back in Nov 2024 at the same IPv6 thread.

It does not matter which router OS I use, OpenWRT, pfSense or Asus.

Last time it worked at the ONT time.

Looks like a SingTel side issue -- they block something on IPv6.

i don't know what i did, but somehow i managed to derive two IPV6 addresses configured to the right interface prefix:

 

[xiaofan]

i don't know what i did, but somehow i managed to derive two IPV6 addresses configured to the right interface prefix:

Great job!

If you can, post the configuration page for WAN, LAN and VLAN100.

 

[it_geek]

Great job!

If you can, post the configuration page for WAN, LAN and VLAN100.

My LAN is intentionally unconfigured because I use it as a bridge interface to the WLAN, so in place of it i use the config for the bridge.

 

[xiaofan]

Only for paid pfSense Plus users -- Threatgate

 

[keenklee]

Only for paid pfSense Plus users -- Threatgate

IMHO.
Just wondering the level of skillset and effort require for this.
Could be tough for newbies.

 

[xiaofan]

Upgrade one simple pfSense CE 2.8.0 installation to CE 2.8.1 and no issues.

This one is behind the main OpenWRT router (Double NAT and only for testing purpose). It is using DNS Forwarder and not DNS Resolver, since my upstream OpenWRT DNS server has some basic hijack function to prevent downstream clients to use their own DNS servers (but not blocking DoT and DoH).

Upgrade my old main pfSense installation (with upstream 1Gbps link to Internet) from CE 2.7.2 to CE 2.8.1.

This installation has some stuff like Wireguard VPN Server, Taiscale, DuckDNS DDNS and pfBlockerNG-devel.

Just upgraded the two instances from pfSense CE 2.8.1 to pfSense CE 2.9.0.

Now I am using M1 10Gbps plan and no longer have two IPv4 address when I was using Singtel 5Gbps plan. So both instances of virtual pfSense CE are behind the main router (TP-Link Archer BE805 for now, may change to OpenWRT in the future). Therefore it is Double NAT in this case.

One main change is to create a virtual IP for pfBlockerNG-devel.

Reference:
https://forum.netgate.com/topic/200...e-configured-manually-@-2026-04-07-20-09-33/5

 

[xiaofan]

pfSense in 2026
Looks like pfSense CE is kind of lagging behind the Plus edition by quite a bit.