US Cable Support > Comcast HSI > [IPv6] Troubleshooting Comcast IPv6 (Start Here)

·Vonage

reply to mojo1

said by mojo1:

So far, so good. The only issue I am experiencing right now is on the Netalyzr test. Everything passes except the IPv6 MTU. I get a warning that my system cannot process fragmented packets. The test indicates that the MTU should be 1496. But, when I change MTU in my router from 1500 to 1496, I still get the same error. It appears changing the value in the router has no effect on IPv6 traffic.

I see that same warning in the current Netalyzr test whether I go through my Netgear WNR1000v2, my D-Link DIR655, or a test PC directly connected to my cable modem. That is something that has only recently started happening with the Netalyzr test. At this point I don't know if Comcast has recently done something with their IPv6 implementation, or if the Netalyzr test has changed some parameter.

I also have set the IPv6 MTU on a Windows PC on the NIC doing the IPv6 to 1496 (as shown below), and that did not change the Netalyz test results.

netsh interface ipv6>set interface "Local Area Connection 2" mtu=1496
Ok.
 
netsh interface ipv6>show int
Querying active state...
 
Idx  Met   MTU    State         Name
---  ----  -----  ------------  -----
  8     0   1496  Connected     Local Area Connection 2
  5     2   1280  Disconnected  Teredo Tunneling Pseudo-Interface
  3     1   1280  Connected     6to4 Pseudo-Interface
  2     1   1280  Connected     Automatic Tunneling Pseudo-Interface
  1     0   1500  Connected     Loopback Pseudo-Interface

FWIW, I have not had any problems accessing sites that use IPv6 (and many mainstream sites these days do use IPv6), and test-ipv6.com indicates that my connection is able to to do "large packet" transfers using IPv6.

Unless I see some actual real-world problems, I am not really too concerned about this recent development in the Netalyzr test.

--
We can never have enough of nature.
We need to witness our own limits transgressed, and some life pasturing freely where we never wander.

to forum · permalink · 2012-12-09 00:25:37 ·

mojo1

join:2006-12-05
Atlanta, GA

Thanks for the reassurance. I was taking the same position of wait and see. Everything seems to be working fine. My pings on speedtest.net went to 15ms from my usual 5ms to a local server, but that isn't a huge deal to me.

to forum · permalink · 2012-12-09 00:47:39 ·

NetFixer
From my cold dead hands
Premium
join:2004-06-24
The Boro

Reviews:

·Vonage

said by mojo1:

The Netalyzr test tells me that outbound ftp is blocked on most of my PCs, yet I have absolutely no problems accessing any ftp servers. I tend to not take Netalyzr warnings very seriously unless I can verify their results independently.
--
We can never have enough of nature.
We need to witness our own limits transgressed, and some life pasturing freely where we never wander.

to forum · permalink · 2012-12-09 00:53:47 ·

brad

join:2007-09-06
Etobicoke, ON

reply to AVonGauss

said by AVonGauss:

Well, since we're jibbing Cisco, I think it's ironic the one's who often indirectly claim to be the leaders in networking are the ones slackin' on IPv6...

With Cisco and pretty much every other vendor the level of support for IPv6 very much varies from product to product and model to model. They have good if not great support for most of their routers and switches but other products are still very much hit or miss. Cisco is the Microsoft of networking. The 800 lb gorilla. It doesn't mean they're perfect or that every product is the best.

to forum · permalink · 2012-12-09 02:53:23 ·

plencnerb
Premium
join:2000-09-25
Elgin, IL
kudos:2

reply to NetDog
Well this morning I went ahead and installed pfsense 2.1 beta. Once installed, I verified the items that whfsdude pointed out, and then rebooted both my pfsense box, and my cable modem.

Below is the status information on my WAN side

 
Status up
DHCP up  
MAC address 00:40:05:7e:91:5b
IPv4 address 24.13.17.39  
Subnet mask IPv4 255.255.248.0
Gateway IPv4 24.13.16.1
IPv6 Link Local fe80::240:5ff:fe7e:915b  
IPv6 address 2001:558:6033:ad:25e7:534c:e450:d625  
Subnet mask IPv6 64
Gateway IPv6 fe80::201:5cff:fe3d:4e41
ISP DNS servers 127.0.0.1
75.75.75.75
75.75.76.76
2001:558:feed::1
2001:558:feed::2
Media 100baseTX <full-duplex>
In/out packets 4300/3388 (1.59 MB/349 KB)
In/out packets (pass) 4300/3388 (1.59 MB/349 KB)
In/out packets (block) 0/0 (0 bytes/0 bytes)
In/out errors 0/0
Collisions 0

However, when I test for ipv6, the test site does not show my ipv6 ip (only shows my ipv4 one), and the test failes with a result of 0/10. Also, when I try to do the tracert test to google, I cannot get past the first hop.

So, I know the problem is what NetDog

mentions below

quote:
If you don't see the first hop check your default route on your desktop, make sure your seeing the RA's.

Don't block all ICMPv6 (for the adv users)
I am a big fan of blocking everything and opening only what I really want. But v6 uses ICMPv6 messages to talk ND's, RA's. If you block all ICMPv6 traffic you will block the important communication to get your DHCPv6 address and PD.

However, I'm not sure where in pfsense I need to go to modify this setting, or how I can verify if I am seeing my RA's.

Thanks!

--Brian

--
============================
--Brian Plencner

E-Mail: CoasterBrian72Cancer@gmail.com
Note: Kill Cancer to Reply via e-mail

to forum · permalink · 2012-12-09 08:59:44 ·

whfsdude
Premium
join:2003-04-05
Washington, DC

You might have to add an IPv6 firewall rule under Firewall > Rules. Then click the LAN tab.

Also make sure your LAN interface has a IPv6 address (verify PD is working).

to forum · permalink · 2012-12-09 09:56:36 ·

plencnerb
Premium
join:2000-09-25
Elgin, IL
kudos:2

1 edit

As far as I can tell, IPv6 to the LAN side is working.

ipconfig
 
Windows IP Configuration
 
Ethernet adapter Local Area Connection:
 
   Connection-specific DNS Suffix  . : localdomain
   IPv6 Address. . . . . . . . . . . : 2601:d:4c00:5d:34c8:339c:31d4:729b
   Temporary IPv6 Address. . . . . . : 2601:d:4c00:5d:bdf2:69ed:b924:805b
   Link-local IPv6 Address . . . . . : fe80::34c8:339c:31d4:729b%11
   IPv4 Address. . . . . . . . . . . : 192.168.1.100
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Default Gateway . . . . . . . . . : fe80::250:4ff:fe21:713d%11
                                       192.168.1.1
 
Tunnel adapter isatap.localdomain:
 
   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . : localdomain
 
Tunnel adapter Teredo Tunneling Pseudo-Interface:
 
   Connection-specific DNS Suffix  . :
   IPv6 Address. . . . . . . . . . . : 2001:0:4137:9e76:884:3172:3f57:fe9b
   Link-local IPv6 Address . . . . . : fe80::884:3172:3f57:fe9b%19
   Default Gateway . . . . . . . . . :
 
Tunnel adapter 6TO4 Adapter:
 
   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . :

I've attached a picture of the Firewall rules on the LAN side for further review.

--Brian

--
============================
--Brian Plencner

E-Mail: CoasterBrian72Cancer@gmail.com
Note: Kill Cancer to Reply via e-mail

to forum · permalink · 2012-12-09 10:05:43 ·

whfsdude
Premium
join:2003-04-05
Washington, DC

reply to NetDog
Whoops - just looked at my config. You also need to allow v6 on the "WAN" firewall rule.

to forum · permalink · 2012-12-09 12:08:40 ·

NetFixer
From my cold dead hands
Premium
join:2004-06-24
The Boro

Reviews:

·Vonage

reply to plencnerb
I opened a couple of command prompt windows on an XP workstation and a Windows server so that I could provide examples for your dual IPv6 address question, but I see that when I got back to your post, you had edited the ipconfig display and removed your question. I guess that means that you found out why you were getting the same IP addresses repeated twice.

However, I can still provide some insight on the "Temporary" and "Permanent" IPv6 addresses (and one way to dispense with the "Temporary" IPv6 address if you wish to do it.

Shown below is ipconfig and netsh information from one of my Windows XP workstations that uses DHCP. It has "Temporary" and "Public" IPv6 addresses which correspond to your "Temporary" and "Permanent" entries. Note that the IP address to the right of the prefix is the same for both the "Public" and "Link-local" entries.

C:\>ipconfig
 
Windows IP Configuration
 
Ethernet adapter Local Area Connection 2:
 
        Connection-specific DNS Suffix  . : dcs-net
        IP Address. . . . . . . . . . . . : 192.168.9.100
        Subnet Mask . . . . . . . . . . . : 255.255.255.0
        IP Address. . . . . . . . . . . . : 2601:5:c80:91:900c:4383:6312:b26b
        IP Address. . . . . . . . . . . . : 2601:5:c80:91:e291:f5ff:fe95:b69d
        IP Address. . . . . . . . . . . . : fe80::e291:f5ff:fe95:b69d%8
        Default Gateway . . . . . . . . . : 192.168.9.254
                                            fe80::1e7e:e5ff:fe4c:e6ff%8
 
C:\>netsh int ipv6 show addr
Querying active state...
 
Interface 8: Local Area Connection 2
 
Addr Type  DAD State  Valid Life   Pref. Life   Address
---------  ---------- ------------ ------------ -----------------------------
Temporary  Preferred   3d19h54m27s    12h26m25s 2601:5:c80:91:900c:4383:6312:b26b
Public     Preferred   3d19h54m27s  3d19h54m27s 2601:5:c80:91:e291:f5ff:fe95:b69d
Link       Preferred      infinite     infinite fe80::e291:f5ff:fe95:b69d

Shown below is the same information from my Windows 2003 server which has a IPv4 static IP addresson its LAN interface, and IPv4 DHCP on its WAN interface

C:\>ipconfig
 
Windows IP Configuration
 
Ethernet adapter Local Area Connection:
 
   Connection-specific DNS Suffix  . : dcs-net
   IP Address. . . . . . . . . . . . : 192.168.9.2
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   IP Address. . . . . . . . . . . . : 2601:5:c80:91:e291:f5ff:fe95:beac
   IP Address. . . . . . . . . . . . : fe80::e291:f5ff:fe95:beac%4
   Default Gateway . . . . . . . . . : fe80::1e7e:e5ff:fe4c:e6ff%4
 
Ethernet adapter Local Area Connection 2:
 
   Connection-specific DNS Suffix  . : hsd1.tn.comcast.net.
   IP Address. . . . . . . . . . . . : 174.49.12.155
   Subnet Mask . . . . . . . . . . . : 255.255.248.0
   Default Gateway . . . . . . . . . : 174.49.8.1
 
C:\>netsh int ipv6 show addr
Querying active state...
 
Interface 4: Local Area Connection
 
Addr Type  DAD State  Valid Life   Pref. Life   Address
---------  ---------- ------------ ------------ -----------------------------
Public     Preferred   3d19h52m57s  3d19h52m57s 2601:5:c80:91:e291:f5ff:fe95:beac
Link       Preferred      infinite     infinite fe80::e291:f5ff:fe95:beac

Using a static IPv4 assignment, eliminates the "Temporary" IPv6 address from being assigned. That means that as long as the PD prefix does not change, the server's public IPv6 address will not change. My experience has been that (at least with Windows XP) the "Temporary" IPv6 address can and will change for PCs that use DHCP (and the "Temporary" IPv6 address is used as the preferred IP address). That is possibly due to the fact that Windows XP and Windows Server 2003 do not have a native DHCP6 client, so if you are using Windows 7 or 8, you may not see the frequently changing IPv6 addresses that I see on my DHCP PCs.

--
We can never have enough of nature.
We need to witness our own limits transgressed, and some life pasturing freely where we never wander.

to forum · permalink · 2012-12-09 12:30:28 ·

plencnerb
Premium
join:2000-09-25
Elgin, IL
kudos:2

1 edit

reply to whfsdude

I went ahead and created a rule on the WAN side for IPv6. I used the information from the IPv6 default rule on the LAN side as a guide.

Picture is what my WAN side firewall rules now look like.

I have not done so, but should I reboot pfsense and / or cable modem now that I have the change in place?

In reply to NetFixer

, yes I did edit my post to remove the double IPv6 IP's. (Did a reboot and they went away).

However, thanks for the detailed explanation on the different types of IPv6 addresses (Temporary, Permanent, and so on).

I have also gone and disabled the following three Network Adapters (had to turn on hidden devices to have them show up)
• Microsoft 6to4 Adapter
• Microsoft ISATAP Adapter
• Teredo Tunneling Pseudo-Interface

My thought was that since I'm getting both an IPv4 and IPv6 IP from pfsense, (and they are "true" IP's), and that Comcast is using native IPv6, I would not need to use these.

In doing so, my updated "ipconfig" and "int ipv6 show addr" information is below for review

 
ipconfig
 
Windows IP Configuration
 
Ethernet adapter Local Area Connection:
 
   Connection-specific DNS Suffix  . : localdomain
   IPv6 Address. . . . . . . . . . . : 2601:d:4c00:5d:34c8:339c:31d4:729b
   Temporary IPv6 Address. . . . . . : 2601:d:4c00:5d:bdf2:69ed:b924:805b
   Link-local IPv6 Address . . . . . : fe80::34c8:339c:31d4:729b%11
   IPv4 Address. . . . . . . . . . . : 192.168.1.100
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Default Gateway . . . . . . . . . : fe80::250:4ff:fe21:713d%11
                                       192.168.1.1
 
netsh int ipv6 show addr
 
Interface 1: Loopback Pseudo-Interface 1
 
Addr Type  DAD State   Valid Life Pref. Life Address
---------  ----------- ---------- ---------- ------------------------
Other      Preferred     infinite   infinite ::1
 
Interface 11: Local Area Connection
 
Addr Type  DAD State   Valid Life Pref. Life Address
---------  ----------- ---------- ---------- ------------------------
Public     Preferred    23h59m59s   3h59m59s 2601:d:4c00:5d:34c8:339c:31d4:729b
Temporary  Preferred    23h59m59s   3h59m59s 2601:d:4c00:5d:bdf2:69ed:b924:805b
Other      Preferred     infinite   infinite fe80::34c8:339c:31d4:729b%11

--Brian
--
============================
--Brian Plencner

E-Mail: CoasterBrian72Cancer@gmail.com
Note: Kill Cancer to Reply via e-mail

to forum · permalink · 2012-12-09 12:38:56 ·

whfsdude
Premium
join:2003-04-05
Washington, DC

Reviews:

·T-Mobile US

reply to NetDog

Remove the source as LAN on the WAN firewall rule. If you still want a to block incoming traffic we can go through that after we get this working.

to forum · permalink · 2012-12-09 12:48:48 ·

plencnerb
Premium
join:2000-09-25
Elgin, IL
kudos:2

Done.

Do I need to reboot anything? I did a tracert to www.google.com, and that works now, however it shows the IPv4 IP's and not IPv6 ones.
Comcast's IPv6 test also only shows my IPv4 IP.

--Brian
--
============================
--Brian Plencner

E-Mail: CoasterBrian72Cancer@gmail.com
Note: Kill Cancer to Reply via e-mail

to forum · permalink · 2012-12-09 12:58:49 ·

whfsdude
Premium
join:2003-04-05
Washington, DC

Reviews:

·T-Mobile US

reply to NetDog
I think you're good now, I can ping you.

Depending on the happy eyeballs implementation, you might have to restart your browser.

If you do want to block incoming connections:
1. Create an allow all ICMP rule under LAN. This way you don't break Path MTU Discovery.
2. Create your block rule under the LAN section, not the WAN. Otherwise you'll have to poke holes for things like DHCP. It's also a better security practice to have the ACLs as close to the segment as possible.

FWIW, I don't run a firewall on v6. Firewalls break too much stuff (eg. SCTP) and I'd rather just implement security on my hosts since 99% of the stuff nowadays doesn't come over the network.

to forum · permalink · 2012-12-09 13:17:25 ·

plencnerb
Premium
join:2000-09-25
Elgin, IL
kudos:2

I have not made these last two changes yet, but I will go ahead and do so.

While you can ping me, and that's a good thing, I think I still have some issues.

The above picture is when I go do a test at test-ipv6.com.

--Brian
--
============================
--Brian Plencner

E-Mail: CoasterBrian72Cancer@gmail.com
Note: Kill Cancer to Reply via e-mail

to forum · permalink · 2012-12-09 14:40:16 ·

whfsdude
Premium
join:2003-04-05
Washington, DC

Reviews:

·T-Mobile US

Maybe try a different browser? Are you using alternative DNS servers that could be stripping the AAAA records?

Seeing as your machine has connectivity now, I don't think it's a network problem.

Edit: Was this screenshot before or after you locked down the firewall?

to forum · permalink · 2012-12-09 14:46:52 ·

Mike Wolf

join:2009-05-24
Beachwood, NJ
kudos:3

reply to NetFixer
I'd be more interested in forcing the use of a consumer router on the MetroEthernet service in the same manner one can use a consumer router when attached to a cable modem.

to forum · permalink · 2012-12-09 15:31:39 ·

plencnerb
Premium
join:2000-09-25
Elgin, IL
kudos:2

reply to whfsdude

WAN Interface status from pfsense
WAN Firewall Rules
LAN Firewall Rules
IPv6 Test from Waterfox

Figured I would put everything into one post in this thread.

I did a reboot on my desktop, and tested again.

Below is what I see on my desktop from both the "ipconfig" command as well as the "netsh int ipv6 show addr" command.

 
C:\Users\Brian A. Plencner>ipconfig
 
Windows IP Configuration
 
Ethernet adapter Local Area Connection:
 
   Connection-specific DNS Suffix  . : localdomain
   IPv6 Address. . . . . . . . . . . : 2601:d:4c00:68:34c8:339c:31d4:729b
   Temporary IPv6 Address. . . . . . : 2601:d:4c00:68:a87f:4530:6b2f:2036
   Link-local IPv6 Address . . . . . : fe80::34c8:339c:31d4:729b%11
   IPv4 Address. . . . . . . . . . . : 192.168.1.100
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Default Gateway . . . . . . . . . : fe80::250:4ff:fe21:713d%11
                                       192.168.1.1
 
Tunnel adapter isatap.localdomain:
 
   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . : localdomain
 
Tunnel adapter Teredo Tunneling Pseudo-Interface:
 
   Connection-specific DNS Suffix  . :
   IPv6 Address. . . . . . . . . . . : 2001:0:9d38:6ab8:24d2:3553:3f57:fe9b
   Link-local IPv6 Address . . . . . : fe80::24d2:3553:3f57:fe9b%18
   Default Gateway . . . . . . . . . :
 
C:\Users\Brian A. Plencner>netsh int ipv6 show addr
 
Interface 1: Loopback Pseudo-Interface 1
 
Addr Type  DAD State   Valid Life Pref. Life Address
---------  ----------- ---------- ---------- ------------------------
Other      Preferred     infinite   infinite ::1
 
Interface 17: isatap.localdomain
 
Addr Type  DAD State   Valid Life Pref. Life Address
---------  ----------- ---------- ---------- ------------------------
Other      Deprecated    infinite   infinite fe80::5efe:192.168.1.100%17
 
Interface 18: Teredo Tunneling Pseudo-Interface
 
Addr Type  DAD State   Valid Life Pref. Life Address
---------  ----------- ---------- ---------- ------------------------
Public     Preferred     infinite   infinite 2001:0:9d38:6ab8:24d2:3553:3f57:fe9b
Other      Preferred     infinite   infinite fe80::24d2:3553:3f57:fe9b%18
 
Interface 11: Local Area Connection
 
Addr Type  DAD State   Valid Life Pref. Life Address
---------  ----------- ---------- ---------- ------------------------
Public     Preferred    23h59m55s   3h59m55s 2601:d:4c00:68:34c8:339c:31d4:729b
Temporary  Preferred    23h59m55s   3h59m55s 2601:d:4c00:68:a87f:4530:6b2f:2036
Other      Preferred     infinite   infinite fe80::34c8:339c:31d4:729b%11
 
C:\Users\Brian A. Plencner>

While it looks like everything should be working, I cannot get to IPv6 only sites either. I tried in both IE 9 x64 and Waterfox. The sites I tested (and could not get to) are below

• »ipv6.google.com/
• »ipv6.speedtest.comcast.net/

Finally, I did some specific tests with google. It appears I'm getting a mix of both IPv4 and IPv6.

 
Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation.  All rights reserved.
 
C:\Users\Brian A. Plencner>nslookup www.google.com
DNS request timed out.
    timeout was 2 seconds.
Server:  UnKnown
Address:  2601:d:4c00:68::1
 
DNS request timed out.
    timeout was 2 seconds.
DNS request timed out.
    timeout was 2 seconds.
DNS request timed out.
    timeout was 2 seconds.
DNS request timed out.
    timeout was 2 seconds.
*** Request to UnKnown timed-out
 
C:\Users\Brian A. Plencner>ping www.google.com
 
Pinging www.google.com [74.125.225.210] with 32 bytes of data:
Reply from 74.125.225.210: bytes=32 time=34ms TTL=51
Reply from 74.125.225.210: bytes=32 time=33ms TTL=51
Reply from 74.125.225.210: bytes=32 time=34ms TTL=51
Reply from 74.125.225.210: bytes=32 time=65ms TTL=51
 
Ping statistics for 74.125.225.210:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 33ms, Maximum = 65ms, Average = 41ms
 
C:\Users\Brian A. Plencner>tracert www.google.com
 
Tracing route to www.google.com [74.125.225.210]
over a maximum of 30 hops:
 
  1    <1 ms    <1 ms    <1 ms  pfSense.localdomain [192.168.1.1]
  2    24 ms    11 ms    27 ms  24.13.16.1
  3    10 ms     9 ms    11 ms  te-9-1-ur04.algonquin.il.chicago.comcast.net [68.87.229.189]
  4    15 ms    15 ms    15 ms  te-0-3-0-2-ar01.area4.il.chicago.comcast.net [68.86.189.229]
  5    25 ms    22 ms    24 ms  he-3-10-0-0-cr01.350ecermak.il.ibone.comcast.net [68.86.93.181]
  6    13 ms    15 ms    13 ms  pos-1-8-0-0-pe01.350ecermak.il.ibone.comcast.net [68.86.87.166]
  7    14 ms    13 ms    14 ms  66.208.228.202
  8    13 ms    13 ms    29 ms  209.85.254.120
  9    13 ms    14 ms    12 ms  72.14.237.108
 10    22 ms    24 ms    24 ms  209.85.241.22
 11    50 ms    34 ms    45 ms  72.14.239.49
 12    36 ms    33 ms    64 ms  216.239.46.149
 13    34 ms    34 ms    33 ms  209.85.251.111
 14    36 ms    34 ms    35 ms  den03s06-in-f18.1e100.net [74.125.225.210]
 
Trace complete.
 
C:\Users\Brian A. Plencner>

Could this maybe point to a bad DNS server?

--Brian

--
============================
--Brian Plencner

E-Mail: CoasterBrian72Cancer@gmail.com
Note: Kill Cancer to Reply via e-mail

to forum · permalink · 2012-12-09 15:59:59 ·

NetFixer
From my cold dead hands
Premium
join:2004-06-24
The Boro

Reviews:

·Vonage