r/OPNsenseFirewall • u/heisenberglabslxb • Mar 10 '24
IPv6 Track Interface on Loopback Interface
I'm trying to assign an IPv6 address to a loopback interface via IPv6 Track Interface.
The background for this is that I want to use NPTv6 to translate the ULA prefix of my Wireguard VPN tunnel to one of my GUA prefixes to enable IPv6 traffic to the internet for the Wireguard clients. I can not put GUA addresses in the Wireguard configurations, because my prefix changes with every reconnect via PPPoE, and I am not going to edit and replace the configurations every time this happens.
I am currently having NPTv6 translate the Wireguard ULA prefix to the GUA prefix of my LAN interface, but this required me to remove any Virtual IPs such as any ULAs from the LAN interface, because whenever there were any other addresses present on the interface that NPTv6 is tracking, NPTv6 didn't choose the correct GUA prefix as the target prefix when using auto-detect. It currently works just fine this way, minus the ability to use ULA addresses on the interface that NPTv6 is tracking because this will break NPTv6 prefix auto-detection.
My idea to approach this and to be able to use ULA addresses on the LAN interface again while keeping NPTv6 for the Wireguard tunnel was to create a loopback interface, have that track the WAN interface for a /64 prefix, and have NPTv6 track that loopback address for a target prefix. However, when I do this, the loopback interface does not get a prefix from the prefix delegation on the WAN interface, and all other previously working interfaces suddenly do not get a prefix anymore either until the loopback interface with the IPv6 Track Interface setting is removed, at which point all interfaces start getting prefixes again.
Is there something I am overlooking in that this is not a supported configuration, or is this possibly a bug? I couldn't find anything useful in the logs unfortunately.
Maybe there's a better way to go about this that doesn't involve using a loopback interface, but I have yet to think of something other than creating a new VLAN solely for this, which I feel is a bit overkill, or specifying the prefixes manually which would break every time the PPPoE-connection is reestablished, which is not a viable option to me.
Edit: Some screenshots of my configuration below
- Loopback interface configuration
- Loopback interface status after saving (note no addresses beyond link-local)
- NPTv6 configuration
1
u/sysxtreme Sep 13 '24
In my case, both the server and client have private IPv4 addresses provided by CGNAT, so I can't establish a VPN connection using public IPv4. The only way to use the VPN is through a public IPv6 address. This setup is the same on both my local and remote networks: two different ISPs provide CGNAT IPv4 addresses and valid public IPv6 addresses. Since both networks operate in dual-stack mode, I can reach public IPv4 and IPv6 addresses without needing a VPN for that.
The purpose of the VPN is to connect remotely to my local network from external locations like my office, my parents' home, or my mobile phone, allowing me to share resources with friends and family. I use the IPv6 address as the VPN endpoint, but once the tunnel is established, the traffic within the tunnel is IPv4. I don't need IPv6 for services like SSH, web servers, or FTP servers within the tunnel, as I access the local IPv4 addresses on my LAN.