Feature #2358
openNAT64 Support
Added by Seth Mos over 12 years ago. Updated 12 months ago.
0%
Updated by Mathieu Mourez about 11 years ago
UPVOTE. It would be really nice to have these capabilities built into pfSense. The Viagenie implementation is nice and stateful and apparently already works on pf under OpenBSD 4.6.
Updated by Andreas Peetz over 10 years ago
UPVOTE. I really like to be able to run my network with IPv6 only and make legacy IPv4 site available through NAT64.
Updated by Chris Buechler about 10 years ago
- Subject changed from NAT64 gateway Support to NAT64 Support
- Category changed from Interfaces to Rules / NAT
- Priority changed from Low to Normal
- Target version deleted (
2.2) - Affected Version changed from 2.2 to 2.1-IPv6
Updated by Rodrigo Ferraz about 9 years ago
UPVOTE. Since most ISPs are already turning IPv6 into reality on many homes and work places around the world, this feature has become a must for pfSense. I would like to kindly ask for the priority of this feature to be raised.
Updated by Acacio Cruz about 9 years ago
UPVOTE
UPC Cablecom in Switzerland just became a "IPv6 only" ISP last month. (IPv6 Dual Stack Lite)
https://support-en.upc-cablecom.ch/app/answers/detail/a_id/1251/~/information-on-ipv6-ds-lite
Updated by Tom . about 8 years ago
UPVOTE. I'd love to be able to set up an IPv6-only network and just use NAT64 to redirect old requests.
Updated by Nicolas Vollmar almost 8 years ago
UPVOTE
My new ISP provides native IPv6 and I would prefere not to have configuring my hole network with IPv4 if I could just setup my pf sense to do the NAT64 instead.
Updated by Martin Hansen almost 8 years ago
UPVOTE, word up on this. It should be prioritized significantly.
Updated by Luiz Souza almost 8 years ago
- Assignee set to Luiz Souza
- Target version set to Future
Updated by DB Tsai over 7 years ago
UPVOTE!
First of all, thank you for the great open source firewall product. As Apple starts to require all the new apps have to work under NAT64, pfSense will be a good experimenting platform if pfSense supports it natively. As far as I know, NAT64 feature was merged into the FreeBSD upstream, so it's possible that pfSense can support it without too much effort. I wonder if there is any plan that pfSense can support DNS64/NAT64 in the nearly future?
This will be a very important feature for many frustrated ios app developers who can not easily reproduce NAT64 environment in house. Thanks.
Updated by Joel Whitehouse over 7 years ago
Would like to see support for NAT64/DNS64 in pfsense. Deployment of DNS64 outside of the gateway is somewhat convoluted, requiring additional hardware, and adds latency to DDNS lookups (since the DNS requests would have to go through a separate host before going to pfsense.) It would be ideal for pfsense to integrate these services.
Updated by Arthur Wiebe over 7 years ago
Google offers a public DNS64 resolver https://developers.google.com/speed/public-dns/docs/dns64 so if we could get NAT64 working in pfSense that would already be a workable start.
Updated by Scott Rosenberg over 7 years ago
Joel Whitehouse wrote:
Would like to see support for NAT64/DNS64 in pfsense. Deployment of DNS64 outside of the gateway is somewhat convoluted, requiring additional hardware, and adds latency to DDNS lookups (since the DNS requests would have to go through a separate host before going to pfsense.) It would be ideal for pfsense to integrate these services.
I'd also like to voice my support for this integration
Updated by Scott Rosenberg over 7 years ago
UPVOTE!
I'd also like to voice my support for this integration
Updated by EDUARDO CERQUEIRA DA SILVA over 7 years ago
I would like to see this important functionality
Updated by Dmitri Toubelis over 7 years ago
UPVOTE!!!
We are switching several of our subnets from dual-stack to pure IPv6 and NAT64/DNS64 is not optional for us any longer. Having this feature on the gateway would hep us immensely.
Updated by Arthur Wiebe over 7 years ago
For those who'd like to do something now, I've finished testing a setup using TAYGA on a separate virtual machine with pfSense on the gateway. Detailed instructions are available here https://blog.artooro.com/2017/05/02/nat64-how-to-with-pfsense-and-tayga/ it seems to be working very well in my environment.
Updated by Brandon Jackson over 7 years ago
Upvote. Even if just NAT64, as other have said Google has DNS64 and also BIND can be installed and it is pretty simple to setup DNS64 on it too.
Updated by Brandon Jackson about 7 years ago
Seems FreeBSD 11.1 now has NAT64. This is what "we" were waiting on right?
https://www.freebsd.org/releases/11.1R/relnotes.html
https://svnweb.freebsd.org/base?view=revision&revision=316446
Updated by Marco Vaschetto over 6 years ago
UPVOTE!!
at the moment I have to use an external router to do this!
Updated by Isaac McDonald over 6 years ago
I would like to see this added as well. Large companies such as Microsoft are using NAT64 and going IPv6 only because they've run out of RFC 1918 addresses.
T-Mobile in America is another one. Phones on TMO's network only get an IPV6 address with all IPv4 traffic going through NAT64.
Here's an interesting article regarding Microsofts efforts to implement a pure IPv6 network using NAT64: [[https://blog.apnic.net/2017/01/19/ipv6-only-at-microsoft/]]
Updated by Sean Harlow about 6 years ago
Another upvote. At some point in the future we're going to start having needs for v6-only networks. For some of the larger networks that time may already be here. It'd be really nice to be able to start testing these things before we actually need them.
Updated by Brandon Jackson almost 6 years ago
Just noticed, it looks like Unbound (DNS Resolver) supports DNS64 as well (plus BIND/named if you want to use that), so that plus FreeBSD's ipfw_nat64 kernel module should mean everything that is needed is there.
Updated by Rick Coats over 5 years ago
I was disappointed that this has not been at least added to the roadmap for 2.5. It seems as though Netgate didn't catch the news about software developers for Apple have to be verified to work in a NAT64.
Updated by Martin GrĂ¼ning about 5 years ago
Another upvote. Would ease migration to IPv6-only LAN tremendously.
Updated by Chris Collins almost 5 years ago
UPVOTE here, put politics aside please, regardless if you hate NAT or not, this feature should at least be added.
Its now supported in baseline FreeBSD using ipfw. For PF it may never come tho due to the decision to not follow openbsd code on that.
Its two clear use cases are to prevent outgoing ipv6 dns/ntp leaks gracefully and also for single stacked ipv6 clients able to translate to outgoing ipv4.
Updated by Bipin Chandra almost 5 years ago
UPVOTE - we need this feature desperately and if this isnt coming then it will be a deciding point for us to move to a different firewall that supports this after being with pfsense for so long and having installed it on n number of systems
Updated by Dmitri Toubelis almost 5 years ago
Bipin Chandra wrote:
UPVOTE - we need this feature desperately and if this isn't coming then it will be a deciding point for us to move to a different firewall that supports this after being with pfsense for so long and having installed it on n number of systems
Just move on to a different platform, this is what we did. This issue is open for 7 years now and I voted for it 2 years ago, so it is obvious that maintainers either have no idea how important this feature is or don't have anyone with enough understanding to implement it. pfSense is a decent product but people have businesses to run.
Updated by Brandon Jackson over 4 years ago
Is it possible that anyone here is skilled in packaging?
Would it be possible for someone to make a Tayga package until officially supported/intergrated.
Updated by Viktor Gurov about 4 years ago
Updated by Jim Pingle about 4 years ago
- Status changed from New to Pull Request Review
Updated by Dmitri Toubelis about 4 years ago
Viktor Gurov wrote:
Better late than never :-) We switched to Juniper SRX about 3 years ago while waiting for this feature ;-)
Updated by Viktor Gurov about 4 years ago
IPFW NAT64 kernel support:
https://github.com/pfsense/FreeBSD-src/pull/35
Updated by Jens Groh about 4 years ago
Viktor Gurov wrote:
IPFW NAT64 kernel support:
https://github.com/pfsense/FreeBSD-src/pull/35
As it is merged, is it already available in 2.5 Snapshots to test?
Updated by Jim Pingle about 4 years ago
- Target version changed from Future to 2.5.0
Updated by Anonymous almost 4 years ago
- Target version changed from 2.5.0 to CE-Next
Updated by Jim Pingle over 3 years ago
- Target version changed from CE-Next to 2.6.0
Updated by Brandon Jackson over 3 years ago
2.6 now? Wow.. Might as well officially at least make a TAYGA package.. Seems to work well enough, because this will like not happen until 3.0 in maybe 2035 at this rate :-(
Updated by Jim Pingle over 3 years ago
Even that is unlikely, it's just an estimate -- it's a major change that needs significant review and testing, and ultimately the way that it utilizes ipfw may mean it doesn't get accepted.
If it works for you, you can apply the changes locally and use it.
Updated by Renato Botelho about 3 years ago
- Status changed from Pull Request Review to New
- Assignee deleted (
Luiz Souza)
Pull Request was closed because code was based on IPFW and we plan to stop using IPFW as soon as possible. Introducing more code using it would not be a good idea
Updated by Renato Botelho about 3 years ago
- Target version changed from 2.6.0 to Future
Updated by Thomas Wagner 12 months ago
Please, is there a plan to implement functionality with an alternative to ipfw_nat64?
pfsense is unusable if Providers are assigning IPv6-only networks directly (without a routing IP). The< are forcing users to use NDP-proxy at least.
We need this in pfsense. Current workaround is to setup another box with OpenWRT that flawlessly does the job that normally belongs to the one and only firewall pfsense (what a pain).
What could be a path to get NDP-Proxy / NAT64 or equivalent into pfsense?
Please advice.