IPv6 Routing not working

[axguru]

Hi there,

I am trying to configure the IPv6 subnet I got from my ISP, but I cannot get connectivity between devices on the LAN and anything outside my firewall. I have tried solutions found on the forums but nothing seems to work.

Here's what I got from the ISP:
Subnet: xxxx:xxxx:xxxx:d200::
Prefix: /56
Gateway/Router address: xxxx:xxxx:xxxx:d200::1
I am from Germany and the ISP is 1&1 Versatel, if it matters.

What I have configured on my OpnSense:
WAN: Static IPv6 xxxx:xxxx:xxxx:d200::2/64 with upstream gateway xxxx:xxxx:xxxx:d200::1
LAN: Static IPv6 xxxx:xxxx:xxxx:d201::1/64

- IPv6 is allowed in Firewall / Settings / Advanced
- ICMPv6 on WAN and LAN is allowed (in case of ndp)
- IPv6 outbound on WAN and LAN allowed

As this is a production network, I cannot enable DHCPv6 and RA without confirming that connectivity is working. I gave my client xxxx:xxxx:xxxx:d201::2/64 with a gateway of xxxx:xxxx:xxxx:d201::1. I can ping xxxx:xxxx:xxxx:d201::1 and xxxx:xxxx:xxxx:d200::2, but I cannot reach the ISP's gateway of xxxx:xxxx:xxxx:d200::1 or other external IPs.

From the firewall itself I can reach external IPv6's and the ISPs Gateway. From outside, only xxxx:xxxx:xxxx:d200::2 is pingable.

Is this a configuration problem or do I need to contact my ISP? In the beginning we had problems with IPv4 not routing correctly, but this has been fixed.

[Maurice]

You don't have to create firewall rules for ICMPv6 and outbound IPv6, that's allowed by default.

Looks like the route for the /56 is not correctly set up on your ISP's side. What happens if you ping the gateway (xxxx:xxxx:xxxx:d200::1) from OPNsense, but set the source address to xxxx:xxxx:xxxx:d201::1?

Did your ISP specifically instruct you to use xxxx:xxxx:xxxx:d200::2 as the WAN address?

Some ISPs require you to request the prefix delegation via DHCPv6, even if it's a fixed prefix. Maybe worth a try.

Cheers
Maurice

[axguru]

Thanks for the reply.

when I set the source to d201::1 i cant ping the isp gateway or any other address

I was not instructed to set d200::2 as my WAN, i just picked the next available, but it doesn't seem to matter what i set as wan the behavior keeps the same.
What I've written in the first post is all I got regarding IPv6 from them.

[Maurice]

Does this somehow involve PPP(oE)? With plain Ethernet, they need to know which address to route the /56 to. When not using DHCPv6 either, they'll have to tell you which WAN address to use or you have to tell them which you did choose (or which MAC address your WAN interface has). Can't see how this would work otherwise.

[axguru]

It seems I need to contact the ISP, thanks for you help, will update when I have a solution

Regards

[axguru]

The Problem was the ISP, they had to configure a route to my LAN net at their router.

Then I had the problem that i could ping my ipv6 from the outside but firewall and clients could not reach the outside. I had to delete everything with ipv6 and set the Ipv6 config on the firewall again.

Thanks for the help