pfSense

UPVOTE. It would be really nice to have these capabilities built into pfSense. The Viagenie implementation is nice and stateful and apparently already works on pf under OpenBSD 4.6.

UPVOTE. I really like to be able to run my network with IPv6 only and make legacy IPv4 site available through NAT64.

UPVOTE. Since most ISPs are already turning IPv6 into reality on many homes and work places around the world, this feature has become a must for pfSense. I would like to kindly ask for the priority of this feature to be raised.

UPVOTE
UPC Cablecom in Switzerland just became a "IPv6 only" ISP last month. (IPv6 Dual Stack Lite)
https://support-en.upc-cablecom.ch/app/answers/detail/a_id/1251/~/information-on-ipv6-ds-lite

UPVOTE

UPVOTE. I'd love to be able to set up an IPv6-only network and just use NAT64 to redirect old requests.

UPVOTE
My new ISP provides native IPv6 and I would prefere not to have configuring my hole network with IPv4 if I could just setup my pf sense to do the NAT64 instead.

UPVOTE, word up on this. It should be prioritized significantly.

UPVOTE

Too late for 2.4.0...

UPVOTE!

First of all, thank you for the great open source firewall product. As Apple starts to require all the new apps have to work under NAT64, pfSense will be a good experimenting platform if pfSense supports it natively. As far as I know, NAT64 feature was merged into the FreeBSD upstream, so it's possible that pfSense can support it without too much effort. I wonder if there is any plan that pfSense can support DNS64/NAT64 in the nearly future?

This will be a very important feature for many frustrated ios app developers who can not easily reproduce NAT64 environment in house. Thanks.

Would like to see support for NAT64/DNS64 in pfsense. Deployment of DNS64 outside of the gateway is somewhat convoluted, requiring additional hardware, and adds latency to DDNS lookups (since the DNS requests would have to go through a separate host before going to pfsense.) It would be ideal for pfsense to integrate these services.

Google offers a public DNS64 resolver https://developers.google.com/speed/public-dns/docs/dns64 so if we could get NAT64 working in pfSense that would already be a workable start.

Joel Whitehouse wrote:

Would like to see support for NAT64/DNS64 in pfsense. Deployment of DNS64 outside of the gateway is somewhat convoluted, requiring additional hardware, and adds latency to DDNS lookups (since the DNS requests would have to go through a separate host before going to pfsense.) It would be ideal for pfsense to integrate these services.

I'd also like to voice my support for this integration

UPVOTE!
I'd also like to voice my support for this integration

I would like to see this important functionality

UPVOTE!!!
We are switching several of our subnets from dual-stack to pure IPv6 and NAT64/DNS64 is not optional for us any longer. Having this feature on the gateway would hep us immensely.

Upvote

For those who'd like to do something now, I've finished testing a setup using TAYGA on a separate virtual machine with pfSense on the gateway. Detailed instructions are available here https://blog.artooro.com/2017/05/02/nat64-how-to-with-pfsense-and-tayga/ it seems to be working very well in my environment.

Upvote. Even if just NAT64, as other have said Google has DNS64 and also BIND can be installed and it is pretty simple to setup DNS64 on it too.

Seems FreeBSD 11.1 now has NAT64. This is what "we" were waiting on right?

https://www.freebsd.org/releases/11.1R/relnotes.html
https://svnweb.freebsd.org/base?view=revision&revision=316446

UPVOTE!!

at the moment I have to use an external router to do this!

I would like to see this added as well. Large companies such as Microsoft are using NAT64 and going IPv6 only because they've run out of RFC 1918 addresses.

T-Mobile in America is another one. Phones on TMO's network only get an IPV6 address with all IPv4 traffic going through NAT64.

Here's an interesting article regarding Microsofts efforts to implement a pure IPv6 network using NAT64: [[https://blog.apnic.net/2017/01/19/ipv6-only-at-microsoft/]]

Bump + UpVote !

UPVOTE

TRIPLE UPVOTE!

Another upvote. At some point in the future we're going to start having needs for v6-only networks. For some of the larger networks that time may already be here. It'd be really nice to be able to start testing these things before we actually need them.

Just noticed, it looks like Unbound (DNS Resolver) supports DNS64 as well (plus BIND/named if you want to use that), so that plus FreeBSD's ipfw_nat64 kernel module should mean everything that is needed is there.

I was disappointed that this has not been at least added to the roadmap for 2.5. It seems as though Netgate didn't catch the news about software developers for Apple have to be verified to work in a NAT64.

Another upvote. Would ease migration to IPv6-only LAN tremendously.

UPVOTE here, put politics aside please, regardless if you hate NAT or not, this feature should at least be added.

Its now supported in baseline FreeBSD using ipfw. For PF it may never come tho due to the decision to not follow openbsd code on that.

Its two clear use cases are to prevent outgoing ipv6 dns/ntp leaks gracefully and also for single stacked ipv6 clients able to translate to outgoing ipv4.

UPVOTE - we need this feature desperately and if this isnt coming then it will be a deciding point for us to move to a different firewall that supports this after being with pfsense for so long and having installed it on n number of systems

Bipin Chandra wrote:

UPVOTE - we need this feature desperately and if this isn't coming then it will be a deciding point for us to move to a different firewall that supports this after being with pfsense for so long and having installed it on n number of systems

Just move on to a different platform, this is what we did. This issue is open for 7 years now and I voted for it 2 years ago, so it is obvious that maintainers either have no idea how important this feature is or don't have anyone with enough understanding to implement it. pfSense is a decent product but people have businesses to run.

Please add NAT64 we need this feature!

Is it possible that anyone here is skilled in packaging?

Would it be possible for someone to make a Tayga package until officially supported/intergrated.

https://github.com/pfsense/pfsense/pull/4405

Viktor Gurov wrote:

https://github.com/pfsense/pfsense/pull/4405

Better late than never :-) We switched to Juniper SRX about 3 years ago while waiting for this feature ;-)

IPFW NAT64 kernel support:
https://github.com/pfsense/FreeBSD-src/pull/35

Viktor Gurov wrote:

IPFW NAT64 kernel support:
https://github.com/pfsense/FreeBSD-src/pull/35

As it is merged, is it already available in 2.5 Snapshots to test?

2.6 now? Wow.. Might as well officially at least make a TAYGA package.. Seems to work well enough, because this will like not happen until 3.0 in maybe 2035 at this rate :-(

Even that is unlikely, it's just an estimate -- it's a major change that needs significant review and testing, and ultimately the way that it utilizes ipfw may mean it doesn't get accepted.

If it works for you, you can apply the changes locally and use it.

Please, is there a plan to implement functionality with an alternative to ipfw_nat64?

pfsense is unusable if Providers are assigning IPv6-only networks directly (without a routing IP). The< are forcing users to use NDP-proxy at least.

We need this in pfsense. Current workaround is to setup another box with OpenWRT that flawlessly does the job that normally belongs to the one and only firewall pfsense (what a pain).

What could be a path to get NDP-Proxy / NAT64 or equivalent into pfsense?
Please advice.