Setup IPv6 over IPv4 tunnel with Hurricane Electric - Howto doesn't work

[Redguy]

I am trying to setup a IPv6 over IPv4 Tunnel using the Hurricane electric service, by using the howto at https://wiki.opnsense.org/manual/how-tos/ipv6_tunnelbroker.html

For this i am using my 18.1.11 OPNsense system.

It seems that the Howto no longer fits the menu's and settings on this version of OPNSense, and i cant get it to work properly.


Step1 - Add a gif tunnel
The howto says i must include the /64 mask at the "GIF tunnel local address", however, this is not accepted. I can only enter the IPv6 address, without the /64 mask.

Step 2 - Configure the GIF tunnel as a new interface
So i assign the GIF tunnel to a new interface, the edit the interface. I give it a new name and description and leave everything else as-is, like the howto says.

After this is done, i cheked if this works. I ping my own IPv6 address, which works. The i ping the IPv6 address for the far side interface. This works as well.

Then the howto mentions "The newly created interface must now be set as the default IPv6 gateway under System->Gateways->All"  This no longer fits the menu structure on v18.1.11 so i go to System-> Gateways -> Single.

There i should edit the new gateway entry called TUNNELBROKER_V6 and check the default gateway option ans save.  However, there is no new gateway entry, just my regular IPv4 gateway ??

I tried creating an entry manually and check the  default gateway option, but this is not accepted. So i entered the IPv6 address on the far side (Hurricane electric side). This not accepted either, OPnSense states that the gateway address i entered does not fall within any of the subnets configured on my interfaces.

I tried entering my local IPv6 address as a gateway, which strangely IS accepted, but off course does not work.


At his point i am stuck. I tried following the howto several times and even had a look at a few pfSense howto's etc. I seem to remember that i tried this on pfSense a long time ago, and there a gateway entry was configured automatically.


Help ??

[franco]

> The howto says i must include the /64 mask at the "GIF tunnel local address", however, this is not accepted. I can only enter the IPv6 address, without the /64 mask.

I have it set up in the same way. Looks like the documentation is wrong.

> There i should edit the new gateway entry called TUNNELBROKER_V6 and check the default gateway option ans save.  However, there is no new gateway entry, just my regular IPv4 gateway ??

After assigning, did you go to Interfaces: [TUNNELBROKER] and enable it (save + apply)?

My Gateway comes right back when I purge it, so I guess that could be the only thing that's missing here.


Cheers,
Franco

[Redguy]

new try ..

Step 1 - create GIF as specified in howto, save, done..
Step 2 - Assign interface to GIF -> OPTx , save, done..
Step 3 - Edit said interface, enable, set description to TUNNELBROKER, save, apply, done..

Step 4 - Go to system -> gateways -> single.. No tunnelbroker gateway to be found..

I have 2 interfaces that show up by themselves.. 1 for my interconnection (received through DHCP)  and one for an ExpressVPN tunnel (also received by DHCP), none for the HE ipv6 tunnel..

[franco]

I don't think this can be solved without looking at the system. It's probably something small we're missing, but it's impossible to find through discussion.

What I can rule out is a general unwillingness for HE to work, because I use it every day at home.

I've been tempted to rewrite the HE handling to make it latch on to a particular WAN configuration for various reasons which would rule out some of the problems you seem to be having in setting it up. But that is for 19.1, not now.


Cheers,
Franco

[Redguy]

I try to avoid comparing pfSense eand OPNSense..    however, just to be sure.. I did the exact same on a pfSense firewall, and the gateway showed up immediatly ??

[franco]

If you insist. For me it works on pfSense and OPNsense.


Cheers,
Franco

[Redguy]

Solved...   

Firewall -> Settings -> Advanced -> Allow IPv6   

Boy do i feel stupid now..   Weird thing is, i could ping the HE gateway over the GIF interface when this was off..

[franco]

Ah, glad you found it and it works now. One small setting. Happens to all of us so no worries.


Cheers,
Franco