pfSense

Hello,

I'm very interrested by this topic (IPv6 for CP). Do you have any plan or any schedule for this development ? If your team is ready to work on this, is a targeted donation is possible (and does it help) ?

this is, like everything with IPv6, targeted for 2.1. This is likely the single most complex and time consuming piece (actually several pieces directly related to this) of anything outstanding with IPv6. We're seeking donations for IPv6 work in general, and specifically if you could put something towards this that would be very helpful. Please email me to discuss details - cmb at pfsense dot org.

For CP on IPv6 to work ipfw tables need to be tought about v6 addresses and
ipfw forward at layer2 needs to be coded for v6.

... and CP_speedup.diff also.

I think ipv6 fwd support on ipfw is not on 8.3, though i might be wrong!
And you forgot to attach as well.

As usual github pull requests are better in general :)

I'll just add this here so that it doesn't get lost:
Add IPv6 support to 'pfSense_ip_to_mac' function https://github.com/bsdperimeter/pfsense-tools/pull/57

I assume there won't be any major changes anymore to 2.1 thus this feature will be integrated in 2.2? So I can either upload the patches here in a zip file or on github and create a pull request. What do you prefer?

I could also provide a working iso if someone wants to test it.
Maybe an admin can also cleanup my mess here and remove the files that I have previously attached, some of them required further modifications.

Go ahead and attach it here for now, though that will almost certainly require some updating to merge cleanly post-2.1, we don't want any v6 CP in 2.1. This likely will require a lot of work to be usable in real world scenarios for a variety of reasons and that's not something we can support for 2.1. I'll remove the files attached to this point.

Great work, and Thanks Cyrill.

Unfortunately I found another bug in the code, while setting up the CP for v6 in my network.
Since I'm using a central RADIUS authentication, there is an error shown while going through the captive portal.

There is a response on from the pfsense appliance, which says "Fatal Error: Error in converting address in /etc/inc/radius.inc on line 210"

I'm running the setup with a virtual machine.

Hopefully we can fix that somehow?

Best wishes,

Thomas from Munich

Hi,

I just stumbled over this ticket after trying to find the reason for IPv6 not working in my guest WiFi. Since IPv6 is becoming more and more important (my ISP has started to switch customers to DS-Lite already), I think this feature would really be a big step towards better IPv6 adoption. I am willing to even through a little bit of money towards anyone who gets this included in one of the upcoming versions. Unfortunately, I am not a developer myself, but I can of course help with testing (and reading code, which is by far easier than writing). Please let me know what else I can do.

Thanks,
Martin

Hi,

I think this is an important issue, I would like to see it as early as possible in pfsense, as IPV6 is an important protocol at our site.

With the growing demand for IPv6 it is essential that this feature is implemented ASAP.
Do we have a timeline on when this would be completed?

Bump. Its 2018, how is this still a thing.

It's 2019 and guess what: This is still missing, while the fixes were apparently ready years ago....

PHP RADIUS package (used for RADIUS authentication/accounting) is not IPv6 compatible, which is a captive portal dependency. That is one of the reasons why captiveportal does not support IPv6 yet.

If you want to contribute to this PHP package to implement IPv6, please feel free to do it : https://pear.php.net/package/Auth_RADIUS

Unfortunately that site is down. However, I've done some additional research and it seems like others simply use string datatype for IPv6 Addresses instead of IP-Address Datatype. Any reason why this wouldn't work here?

Flole Systems wrote:

Unfortunately that site is down. However, I've done some additional research and it seems like others simply use string datatype for IPv6 Addresses instead of IP-Address Datatype. Any reason why this wouldn't work here?

Won't that mean the user will need to log in at least twice separately – once via IPv4 and once via IPv6? (Plus again every 10 hours if they have IPv6 tempaddr / 'privacy extensions' enabled.)

If authentication is based on IP Address yes, if it would be based on MAC Address then no.

If it's not MAC based then there are quite a few other issues like pfsense only seeing the IPv4 Address and not the IPv6 or vice versa. Of course when using MAC based authentication you can't have another router between client and pfsense but I think thats a limitation most people won't care about (another option would be to make it configurable to enable IP based authentication and add a note that doing so breaks IPv6 Support).