Tag Archives: packet filtering

Legacy IPv4 network space is exhausted, and new internet service providers like T-mobile 5G home internet run an IPv6 only network.

Sometimes you can’t use the IPv6 addresses due to your ISP not being mature enough to provide IPv6 prefix delegation in combination with the lack of advanced features on the T-mobile 5G home router like ‘bridge mode’ you may be stuck with a double NAT situation.

In 2021, I would say that implementing IPv6 on your network is almost mandatory. Major service providers like Netflix, Google, Cloudflare and others operate dual-stack networks.

I’ll admit that my home network running OPNsense firewall has had IPv6 disabled to avoid complexities since only 30% of the internet uses IPv6 today. However, I decided that its time to try to fix this since I wanted all my devices on my network to be able to pass IPv6 readiness tests like http://ipv6-test.com and http://test-ipv6.com.

Router: Nokia 5G Fastmile (T-mobile home internet)
Provides all direct-connected devices with a NAT IPv4 addresses in the range of 192.168.12.0/24.

IPv6 addresses are from the public unicast T-mobile segment assigned to your router, however T-mobile IPv6 network does heavy inbound packet filtering. You won’t be able to ping or access your public unicast IPv6 addresses from anywhere (sucks right?) 

To configure a dual-stack local area network in OPNSENSE, assume you have a ‘fresh install’ which already has IPv6 enabled on the system.

1. Configure your WAN interface to obtain DHCPv6 addresses.
2. Configure your LAN interface to Static IPv6
   1. assign static IPv6 of fdde:5453:540e:ff12::1
3. Configure your LAN DHCPv6 service to this range
   1. range start: fdde:5453:540e:ff12::2
   2. range end: fdde:5453:540e:ff12:ffff:ffff:ffff:ffff
4. Configure Firewall > NAT > Outbound
   1. set to ‘hybrid’
   2. Add manual rule
      1. interface WAN
      2. Version IPv6
      3. protocol any
      4. source LAN
      5. destination any
      6. translation target WAN address
5. Configure Services > Router Advertisement LAN
   1. From ‘disabled’ to ‘Assisted’
6. Save all settings and ensure all services are restarted.

Your clients on LAN should now get a local IPv6 address from DHCPv6, the outbound NAT rule should allow you to pass the IPv6 tests and communicate with IPv6 internet hosts via the single IPv6 WAN address that the T-mobile home router gives out.

I’m hoping that T-mobile becomes a more mature ISP in the future, while speeds are great there are several shortcomings to relying on 5G Home internet service for home use. These problems don’t exist in Comcast and AT&T Fiber:
– IPv6 Prefix Delegation (PD) so you can subnet all your networks.
– Packet filtering that you can’t disable or manage yourself. On AT&T fiber and comcast you can host your own remotely accessible VPN server. Not on T-mobile so beware if that’s your use case.