pfSense » pfSense Packages

Yuki Hiramatsu wrote:

ISPs around the world are making effective use of IPv6.
DHCPv6-PD and others are already supported, but pfsense has no documentation on ndproxy.

The ndproxy package exists in FreebSD.
We strongly prefer that the ndproxy package be integrated into the pfsense plus package rather than having to manually install it in pfsense plus!

I know that a similar FR was opened long ago and you responded. (Feature# 7746)

There is now a ndproxy package in the FreeBSD repo.
Therefore, I would love to see it integrated into pfsense.

There is a growing need for this with more providers sticking us with /64. It's understandable that this wouldn't be wanted in all configurations since it goes against IPv6 practices, but we are left with no choice in some cases and it leads to hacky workarounds that are worse.

With the package now in FreeBSD I hope this request can be revisited.

NDProxy is the only way we have been able to get IPv6 working for our company network, and that have been possible only moving from pfSense to OpenWrt, which already supports this feature (see https://openwrt.org/docs/guide-user/network/ipv6/configuration#ipv6_relay).

We hope to see NDProxy coming to pfSense too in the near future, so we can get back to our most loved firewall.

The port does not currently build on FreeBSD 14 according to:
https://gitlab.com/FreeBSD/freebsd-ports/-/commit/d7389449aa8031688c211004edf013573b2d16f7

That would need to be resolved first at least.
https://github.com/AlexandreFenyo/ndproxy

Bump! ndproxy has been patched and now builds on FreeBSD 14 - see commit history:

https://www.freshports.org/net/ndproxy

A binary package exists for 14 now, but as opposed to earlier versions where I happily used a FreeBSD 12 module for several years in pfSense up to 2.6.x, I can't load a prebuilt 14 module on 2.7. I'd have to build a specific kernel and compile it under that, and then keep doing it if pfsense kernel changes.

Having this package available would be a godsend for a huge number of users only having access to a single /64. VPS, ISPs, many others. With all the caveats ndproxy brings, it is really useful. It's currently preventing me from upgrading to 2.7 because my pfsense sits on a /64 and hands out VPN client addresses from the same /64. Others have other uses I'm sure...

Firstname Surname wrote in #note-7:

8. Load the module (kldload ndproxy), if you get no warnings on load and no errors in dmesg and `sysctl -a | grep ndproxy` shows the series of net.inet6.ndproxy* sysctls, all is well, continue using ndproxy as before on 2.6 or whatever. I normally use a shellcmd to load and configure ndproxy.

Hello, I was able to successfully load the module, but pfSense config differs a lot from FreeBSD one.
Do you mind posting a functioning configuration, please?

A few points that might be helpful to others.

Version 25 and greater are currently using FreeBSD 15, you can clone the above pfsense FreeBSD-src repo and checkout git hash

bf06074106cf

I installed FreeBSD 15 in a VM, renamed the /usr/src directory and then clone FreeBSD-src into a new /usr/src directory. I'm sure SRCTOP variable will work...but went down this road instead.

zfs rename zroot/usr/src zroot/usr/src.old
git clone https://github.com/pfsense/FreeBSD-src.git /usr/src
git checkout bf06074106cf

Then you can build ndproxy.ko:

cd /usr/ports/net/ndproxy
make clean
make

Then scp the resulting

./work/ndproxy-3.2/ndproxy.ko

to the /boot/modules directory on your router.

Type kldload ndproxy and then type

sysctl -a | grep ndproxy

and you should see the following:

net.inet6.ndproxycount: 0
net.inet6.ndproxyconf_uplink_ipv6_addresses:
net.inet6.ndproxyconf_exception_ipv6_addresses:
net.inet6.ndproxyconf_downlink_mac_address:
net.inet6.ndproxyconf_uplink_interface:

I'm currently hunting down how to make the sysctl parameters persistent. pfSense doesn't seem to be loading the values in `sysctl.conf`

UPDATE:

Don't use a /boot/loader.conf.local file to load ndproxy.ko at boot time. It seems to be loaded too early in the boot process and won't receive icmpv6 packets from any interfaces created after the kernel module is loaded (or so it seems).

Also, getting sysctl entries set and putting your WAN interface into promiscuous mode proved futile using standard means.

The solution I found came from Netgates (very good) documentation, specifically https://docs.netgate.com/pfsense/en/latest/development/boot-commands.html

Create a shell script in /usr/local/etc/rc.d, make sure it has a .sh extension and that it is executable.

Here is a sample script:

kldload ndproxy

sysctl -w net.inet6.ndproxyconf_uplink_ipv6_addresses="fe80::ipv6:address:of:your:isps:modem;2603::global:ipv6:address:of:isp:modem" 
sysctl -w net.inet6.ndproxyconf_downlink_mac_address=<mac address of your routers interface facing the isp equipment>
sysctl -w net.inet6.ndproxyconf_exception_ipv6_addresses="fe80::your:routers:WAN:link:local:address;2603:your:routers:WAN:global:ipv6:address" 
sysctl -w net.inet6.ndproxyconf_uplink_interface=wan_iface_name

ifconfig wan_iface_name promisc

NOTES:

• Address for the uplink_ipv6_addresses can be found by using tcpdump on your pfsense router (e.g. tcpdump -i igb3 "icmp6 and icmp6[0]=135"). While running tcpdump, ping a remote ipv6 address from a device inside your network and look to see what ipv6 address is trying to find that internal machine (via NS packets). That ipv6 address is the uplink address. Most of the time it will be a link local address, it is possible that your ISP's equipment might use a global address as well, so keep an eye out for it. Multiple addresses are delineated with a semi-colon.

• Mac address format for downlink_mac_address is just as it is from ifconfig, xx:xx:xx:xx:xx:xx

• It is good practice to add the addresses of your WAN interface of your router to the exceptions address list (exception_ipv6_addresses) so that ndproxy doesn't respond to the router's own NS solicitations. Add all of the IPv6 addresses assigned to your WAN interface to this list.

• For what it is worth, you can clone directly from FreeBSPs git repository instead of using the snapshot in pfSense's github repo, the git hash to find the right /usr/src files is the same.