How to set up Multi-WAN with IPv6

[PeterZaitsev]

Hi,

I'm wondering how to set up Multi-WAN with IPv6 on OPNsense

Unlike with IPv4 where I use local addresses and NAT  with IPv6 I have prefix issued by provider and local IP address is assigned in this range.     Yet this means if failover to backup provider happens the address needs to be reassigned or do I miss something ?

Or is this the point where I should use some static IPv6 on LAN for it to work ?

The second problem I have is routing.  I'm with AT&T and for some reason the default gateway is not picked up. If this is only WAN network it just works.   However without IP assigned I can't set it up as monitored GW. 

I can make it work by entering fixed IP which I spot with tracert but this does not look like robust solution

[marcquark]

Regarding Gateway Monitoring, you should be able to add any arbitrary public IP as the monitoring target. Some of the big public DNS resolvers come to mind here, as they're generally considered to be "always up".

Regarding Multi-WAN:
I think this is where you'd need to use NPT. Haven't done it myself though, so i can't really tell you much about it. There are a couple of problems and i have no idea how to tackle them:

• Since IPv6 usually doesn't require any sort of NATing, i wouldn't be surprised if applications break when your host has a GUA from provider A and you're NPTing it to the prefix of provider B. I don't know if/how clients can be made aware of an existing NPT
• Dynamic prefixes may not work at all, at least with OPNsense. There's only an option to translate from one static prefix to another. I know this is also problematic on other platforms.

I would assume both problems could be addressed in part by using ULAs only on your LAN side of things. Then you at least have a chance that clients would somewhat "expect" to be NPT'd and behave accordingly. Also you would at least have a known static prefix for the NPT "source". But not for the destination, so probably not much of a gain. If you have static prefixes you might aswell advertise them on the LAN side...

[mimugmail]

Regarding multiwan and ipv6 you have to disable shared forwarding in Firewall Settings Advanced

[jfranken]

Regarding multiwan and ipv6 you have to disable shared forwarding in Firewall Settings Advanced

Michael, you made my day. It finally works. For months I have been looking for this solution to my obscure IPv6 multiwan routing problem. I would never have guessed that "shared forwarding" option on the basis of the help texts. Thank you so much for sharing.

--
Johannes Franken

[mimugmail]

Glad it works for you