[Solved] OPNsense + ISP box Freebox in Bridge mode + IPv6

[BenjaMwaye]

Hello,

I can't get IPv6 to work and I can't find the error in my config. I think it's not far from working but something is missing.

My config:
    • Freebox pop in bridge mode
    • OPNsense VM on a Proxmox 7
    • Need IPv6 for the Free pop TV box
    • Nexthop ok on the box
    • Static IPv6 on WAN and LAN
    • Publication of RA router in router mode only on WAN and Assisted on LAN

My problem:
IPv6 communication does not go from LAN to WAN (no problem with IPv4):
    • I ping well from OPNsense, in IPv6, the OPNsense IPv6 interfaces, my personal workstation on my LAN, the Freebox and the external IPv6 servers (like DNS Google or k6usy.net).
    • I ping well from my post, in IPv6, the LAN1 LAN2 and WAN interfaces of the OPNsense.
    • But I don't ping from my post, the Freebox, or anything outside.
    • And from the Proxmox I ping the LAN legs of OPNsense but not the WAN leg

It looks like the traffic has been blocked by OPNsense, Proxmox or the Freebox.
Or that a routing or a firewall rule is missing.
I'm not far I think, maybe it's just a routing or a rule to put in place, but I'm a bit lost with IPv6 and by dint of trying things, I end up getting confused.

I don't know if my explanation is clear.
Thank you in advance for your assistance.

Have a good day,

[BenjaMwaye]

Hello,

I bring some precisions which will perhaps allow you to bring me a little help.
Because really I am lost and I do not understand where it gets stuck.

I tested by adding a second LAN in IPv6. And same problem.
In all cases from a LAN workstation:
- we have an IPv6
- we ping the IPv6 LAN leg of OPNsense
- we ping the leg of LAN 2
- we ping the WAN leg of OPNsense
- but we do not ping the IPv6 of the Freebox or external sites

From the OPNsense, in the ping tests page:
- we ping the WAN leg, the Freebox and the outside in IPv6 if we source the WAN
- we ping the WAN leg, the Freebox and the outside in IPv6 if we source a LAN only IPv4 of the LAN
- we do not ping the WAN leg the Freebox and the outside of the we source a LAN in ipv6

From what I understand it implies that IPv6 is well managed by OPNsense, that the address assignment on the link works well and that the "NAT" of IPv6 from LAN to WAN does not work not.
So I guess a network translation problem from LAN to WAN. But I have no idea how to go about fixing the problem (in OPNsense, and maybe also in Proxmox).

I'm a little lost on what to look at modifying to make it work.
Anyone have an idea?

Thanks in advance for any help you can give me.

Have a good day,
Benjamin

[BenjaMwaye]

Hello,

That's it, I solved the problem and IPv6 works.
If so, I have 2 small remarks concerning your article which could be useful to others:
The rule to allow the traffic you are talking about is created automatically by OPNsense.
To make it work, I added NPTv6 rules (NAT IPv6) for each LAN that needs IPv6, with the prefixes of the LAN concerned and that of the WAN. I had read in various places that it's not normally useful in IPv6 but I didn't succeed in creating its NATv6 rules.

Apart from that, I have the impression that suddenly I have lost speed since the implementation of IPv6. I don't know if it comes from the OPNsense configuration (NATv6 or firewall rules), from the box or from IPv6 as such).
Did you have this problem too?

So much for my contribution and my little problem following the IPv6 migration.

Have a good day.
Good for you,

[sot3]

I have the same problem with IPv6, and noticed that my speed has dropped as well.  Thanks for posting your findings, but I don't understand the rules you created to fix it.  Is there a page that describes the NPTv6 rules you've created?