Messages

I live in a condo and unfortunately I have no way of changing ISPs.
What I do have is two separate symmetric 100Mbps pipes, with very different properties.

The first one is native IPv6, and it delivers a dynamic - albeit fairly sticky - /56 but no separate WAN IP address. IPv4 is delivered via DS-Lite only, which means CG-NAT.

The second is the exact opposite: one public static IPv4 (that I pay extra for but at least the option is there), no DHCP but no support for IPv6 at all. Connectivity to anything that is not a major CDN or out of the country is atrocious using these guys, to boot.

What I have managed so far is to get both pipes running, the first with IPv4 and IPv6 via establishing a GIF tunnel for DS-Lite, and the second as IPv4 only.
I then managed to setup IPv4 load balancing via adding the resulting two IPv4 gateways to a group with monitoring, appropriate firewall rules and some additions to force traffic to some IPv4 destinations through the first ISP.

Is there a way I can set up a second GIF tunnel with TunnelBroker to have IPv6 connectivity on the second pipe and balance IPv6 traffic as well?

Two things worry me:

• I cannot see a way to have NPT rules track prefix delegations, which means that every time ISP 1's assigned /56 changes the setup breaks
• Is there a way to ensure IPv6 traffic to establish the DS-Lite gif tunnel only ever goes through ISP 1 instead of TunnelBroker? And to ensure IPv4 traffic to establish the TunnelBroker tunnel only goes through ISP2 instead of the DS-Lite tunnel?

The second one in particular would break everything if it goes wrong.

RANT FOLLOWS
As a aside, why is it so hard to get IPv6 in general (ISPs being absolute dicks in how they provide it) and load balancing in particular working? I've gone through EdgeOS (I used an Ubiquiti EdgeRouter Lite before ISP1 moved to DS-Lite, which broke hardware offload and made it unable to keep up), VyOS and now OPNSense (I still have to try OpenWRT, but it refuses to boot on the box I have available) and there is always something along the way that blocks me.

OPNSense already has functionality to spoof an interface's MAC address though (I'm using it right now for my second WAN uplink) - couldn't that be applied to a loopback interface (I know MAC addresses are an Ethernet thing, but a way to set a specific source for EUI64 address selection on other interfaces would be useful, I think)?

EDIT
Actually never mind the above, would it not be possible to just add a way to assign a custom host part for the generated IPv6 on that interface? EdgeOS/VyOS do just that and I could get prefix delegation to propagate on loopback (unfortunately they force one to use an IP address instead of an interface for creating tunnels, so the end result was the same).

As for why I setup the system the way I did, I am running OPNSense on a box with four Ethernet ports: two are for my two ISPs, one is trunked and the last one is an untrunked "rescue" port so I can directly hook up a device for accessing the system if I mess the LAN configuration up.

My ISP provides me with only a /56 prefix, without a separate address for the WAN interface. That /56 is not static, and on top of that the ISP only provides IPv4 connectivity via DS-Lite.

How can I get the WAN interface to track itself, so that I can assign it a /64 from that /56 and have it generate its own address? I really need this to establish the GIF tunnel for DS-Lite.

I tried these workarounds so far, but they are not stable (after a reboot I have to unplug and replug the WAN cable hoping the GIF tunnel actually gets established)

• Creating the GIF tunnel using one of my LAN interfaces that tracks the WAN one: this breaks the tunnel if the interface's LAN cable is unplugged
• Creating an additional loopback interface to use as source for the GIF tunnel, but attempting to have it track the WAN breaks dhcp6c (log mentions invalid configuration) and then no prefix delegation or assignment to any interface happens
• Manually assigning an IP from the allocation to the loopback for the GIF tunnel, this is what I've been using but I think it makes the GIF tunnel break since the system tries to bring it up on boot before the WAN is up - hence the instability. Also, this breaks when the ISP assigns me a different /56

I've been banging my head against a wall for days now - what can I do?