IPv6 Configuration

[sandyd]

I currently have one /64 subnet routed to a ipv6 address on eth0.

I have three internal LANs (vmbr1,vmbr2, vmbr3), and one WAN connection, which is attached to vmbr0 (internet). They are all managed via a pFSense firewall
Because I have three internal LANs (vmbr1,vmbr2,vmbr3), I seperate the /64 block into /67 blocks and assign one to each interface.

So now, here are the addresses assigned to each of the vmbr interfaces

vmbr1 - 2604:4600:0c03:xxxx:2000:0000:0000:0001/67
vmbr2 - 2604:4600:0c03:xxxx:4000:0000:0000:0001/67
vmbr3 - 2604:4600:0c03:xxxx:6000:0000:0000:0001/67

After a bit of fiddling, enabling proxy ndp, setting ipv6 neighbor advertisements on the vmbr* interfaces, and ipv6 forwarding allowed me to assign an address on pfSense for each lan, along with the corresponding vmbr address as the gateway.

pFsense Setup

LAN1 (vmbr0) - 2604:4600:0c03:xxxx:2000:0000:0000:0002/67 [Gateway: 2604:4600:0c03:xxxx:2000:0000:0000:0001]
LAN2 (vmbr2) - 2604:4600:0c03:xxxx:4000:0000:0000:0002/67 [Gateway: 2604:4600:0c03:xxxx:4000:0000:0000:0001]
LAN3 (vmbr3) - 2604:4600:0c03:xxxx:6000:0000:0000:0002/67 [Gateway: 2604:4600:0c03:xxxx:6000:0000:0000:0001]

All of the addresses are now pingable both on the machine and the internet

So now, I go to assign the addresses, and here is where the trouble starts. (Note that the below addresses are all in LAN1)

I have tried the following to enable autoconfiguration, but none of them work:

• DHCPv6 with a managed radvd
• DHCPv6 standalone
• radvd standalone

I then tried doing static address configuration on the VMs

• This worked in OpenVZ, with a address in the range and 2604:4600:0c03:xxxx:2000:0000:0000:0001 as a gateway
• This did not work in KVM with either 2604:4600:0c03:xxxx:2000:0000:0000:0001 or 2604:4600:0c03:xxxx:2000:0000:0000:0002 as a gateway

I would really love to get this working, especially with DHCPv6 and radvd.

Any ideas?

 

[fireon]

Have you solved your problem?

 

[Mitya]

/64 is minimal subnet in IPv6 by design. No one can guarantee longer prefixes to work. Need several subnets -- take several /64s.