pfSense IPv6 NAT

Question

I know many of you said that IPv6 has no NAT, but my server provider told me, that it is possible. I have no idea how...

I have a pfSense Server as my Firewall (Not the router!). I have a /28 IPv4 and a /64 IPv6 Subnet from my hoster.

I have my WAN and my LAN on pfSense. The NAT worked successfully with IPv4.

WAN - Public IPv4 LAN - 192.168.1.0/24

Now I want to do that stuff with IPv6. I don't care if I use local IPv6 addresses on my LAN and match them with public on WAN or set directly the public ipv6 to my clients.

It is important that I can handle any traffic with my pfSense firewall.

My first idea: I set the LAN IPv6 Address to static with fd00::1/8 (Also my clients got addresses from that range) and match that via NAT - Outbound to my public ipv6 address. This is not working...

My second idea: Set my LAN IPv6 Interface to Track interface. But the problem is: I have to set WAN IPv6 interface to DHCP, which my provider doesn't support.

So, what can I do to support IPv6? Any idea?

Answer 1

The fundamental issue that makes the internet architects uncomfortable with NAT is that it appears to conflict with the end to end principle. This basically says that intermediate layer 3 routers should ignore layer 4 connection state so that packets can be routed efficiently down alternative routes. However, NAT is easy to implement in the context of a stateful firewall, and this is how it should be viewed.

The need for firewalls became apparent as the internet approached its 20th birthday in the late 80s. Nowadays, all data passing in and out of a private network is constrained to pass through a firewall, which needs to track connection state to be able to filter packets effectively.

Although it wasn’t at all clear in 1994, if you take away the address reuse requirement, then NAT is a firewall function whose primary purpose is to prevent private data leaving the private network.

Specifically, when a client initiates a connection to an external server, the private part of the source address (routing prefix, host identifier and port) used within the private network should never be allowed to leak out onto any external network.

The Linux Ip6tables NAT has been available since kernel version 3 and does a thoroughly professional job, e.g. by producing unique random host addresses which are only valid for a single session.

Unfortunately this feature has not been fully documented on the grounds that no one has come up with a use case! Well, here it is. And while you’re at it can you also make sure port numbers are included.

If viewed in this way, it is the firewall that has a requirement to hold state, and NAT is performed by the firewall, so there never has been any such thing as a NAT router. The end to end principle does not apply.

Answer 2

I know, many of you told that IPv6 has no NAT. But my server provider told me, that it is possibile. I have no idea how...

IPv4 and IPv6 are fundamentally quite similar. The basic principles of NAT work equally well (or equally badly depending on your point of view) for both.

IPv6 NAT (especially one to many NAT) while possible is strongly discouraged. The IETF has not published any specifications for one to many IPv6 NAT and the one to one stuff (known as network prefix translation) has only been published as an "Experimental" RFC.

As far as I can tell pfsense only supports prefix translation ( https://doc.pfsense.org/index.php/NPt ) and not one to many NAT. Linux on the other hand supports both prefix translation and one to many NAT.

I don't think prefix translation is going to help you, so unless you are prepared to move away from pfsense I don't think NAT will solve your problem.

Now I want to do that stuff with IPv6. I dont care, if I use local IPv6 Addesses on my LAN and match them with public on WAN or set directly the public ipv6 to my clients. Important for me is, that I can handle any traffic with my pfSense firewall.

The proper way to do this is for your provider to allocate you a "routed" block of public IPv6. This block is used to address machines on the LAN(s) behind your firewall/router. Your provider then adds a route pointing your "routed" block at the external interface of your firewall.

Many server hosting providers give their customers a /64 by default but it's an "on-link" /64. That is fine if you just want to run a single (real or virtual) server with a few IPs but it's not great if you want to run a router/firewall for your own internal (real or virtual) networks.

In an ideal world you would just speak to your hosting provider, ask for a routed block of suitable size and they would give it to you. Unfortunately in the real world that doesn't always work.

You can work around the lack of a "routed" block by doing something called "proxy NDP". Basically you use your /64 as normal on your internal network. Then to suck up traffic from the outside you have your router/firewall respond to NDP requests as-if it was the destination for the IPs. Unfortunately from some quick searching it seems while there are implementations of this for Freebsd they have not been integrated into pfsense, so some manual hackery is likely to be needed.