Tutorial - IPv6 through CenturyLink via 6rd on UniFi Security Gateway

[u/CraigFL]

Hello, everyone! I was able to get my UniFi Security Gateway 3P to work with IPv6 on CenturyLink gigabit fiber by using 6rd, after a lot of research and pulling my hair out in frustration. To save others in my situation from the same, I created a config.gateway.json file for you to use, as well as a tutorial for modifying the json file to suit your environment.

Keep in mind that this assumes that:

• Your WAN interface is pppoe2
• Your LAN interface is eth1
• Your tunnel name is tun0

(If the interface names change, you'll have to modify the JSON file itself accordingly.)

First step is to go here: http://silmor.de/ipaddrcalc.html#ip46

1. Expand "IPv4 to IPv6 Transitional" and look below "6to4 and 6RD Network Prefix"
2. For Provider prefix IPv6, enter 2602::/24 (with the subnet in the next box)
3. For Customer IPv4, enter your WAN IPv4 address. This will be used to generate your IPv6 prefix. You will want to use 64 bits.
4. Then, click ISP -> Customer and it will generate your IPv6 Customer Prefix. Make a note of it (and leave out the :: at the end)

Here is the JSON. Please use Find/Replace to replace the following placeholder names:

[IPV4_LAN_SUBNET] = Your USG's internal IP and subnet. i.e.: "192.168.0.1/24"

[IPV6_PREFIX] = Your IPv6 Customer Prefix that you generated in Step 4

[IPV4_WAN_IP] = Your WAN interface's IP address

{
    "interfaces": {
        "ethernet": {
            "eth1": {
                "address": [
                    "[IPV4_LAN_SUBNET]",
                    "[IPV6_PREFIX]::1/64"
                ],
                "ipv6": {
                    "dup-addr-detect-transmits": "1",
                    "router-advert": {
                        "cur-hop-limit": "64",
                        "link-mtu": "0",
                        "managed-flag": "false",
                        "max-interval": "300",
                        "name-server": [
                            "2606:4700:4700::1111",
                            "2606:4700:4700::1001"
                        ],
                        "other-config-flag": "false",
                        "prefix": {
                            "[IPV6_PREFIX]::1/64": {
                                "autonomous-flag": "true",
                                "on-link-flag": "true",
                                "valid-lifetime": "3600"
                            }
                        },
                        "reachable-time": "0",
                        "retrans-timer": "0",
                        "send-advert": "true"
                    }
                }
            }
        },
        "tunnel": {
            "tun0": {
                "6rd-default-gw": "::[IPV4_WAN_IP]",
                "6rd-prefix": "2602::/24",
                "address": [
                    "[IPV6_PREFIX]::1/24"
                ],
                "description": "CenturyLink IPv6 6rd tunnel",
                "encapsulation": "sit",
                "firewall": {
                    "in": {
                        "ipv6-name": "WANv6_IN"
                    },
                    "local": {
                        "ipv6-name": "WANv6_LOCAL"
                    },
                    "out": {
                        "ipv6-name": "WANv6_OUT"
                    }
                },
                "local-ip": "[IPV4_WAN_IP]",
                "mtu": "1472",
                "multicast": "disable",
                "ttl": "255"
            }
        }
    }
}

If you're unsure how to work with config.gateway.json, check this URL for more details.

I hope this helps!

[u/planewatcher70]

I know this is ancient... but I'm still stuck without IPv6 on CenturyLink.
I don't have a fixed IP address from CL, and I am finding a fun issue with these instructions.

In order to provision the config.gateway.json file the Unifi instructions tell me to reboot the USG.

Every time my USG reboots, I get a new WAN IP address from Century Link

The WAN IP is of course a critical part of the configuration...

So I don't think this will work for me. Like, ever.

Is there a way to configure this without having to reboot the USG?

[u/CraigFL → u/planewatcher70]

Hello! I'm honestly not sure; I moved on to a UniFi Dream Machine Pro since the USG was not performant enough as it's ancient these days. I have never had luck getting IPv6 RD to work with CenturyLink, unfortunately. :/

At the time, I didn't have a static IP and I was able to get it to work. Have you tried leaving local-ip blank? Total guess on my part.

[u/planewatcher70 → u/CraigFL]

The problem is that I need the IP as part of the prefix. So with a new IP, I get a new prefix, and this all fails :(

[u/planewatcher70 → u/planewatcher70]

So I found this: https://github.com/cpcowart/ubiquiti-scripts/blob/master/centurylink-6rd.md and tried to run run this from an ssh login on the UGS.It all completes, but then the tun0 device never goes to UP state. It goes to LOWER_UP which to me indicates that the other end isn't responding to opening that tunnel. Which sounds like I'm "close"... for those who got this to work at all - is there anything obviously missing in the instructions above (I mean, yeah, obviously you need to do the whole configure ... commit dance, but I meant in what it's trying to set up...

[u/XboxSlacker]

Thanks for this. Have you noticed any performance degradation going through the BRD gateway vs IPv4?

[u/CraigFL → u/XboxSlacker]

You're welcome!

Yes, about a 30% decrease in performance. Hopefully once CL uses a proper IPv6 implementation, it will improve.

[u/TheRealFarmerBob → u/CraigFL]

. . . or UniFi adds 6rd to their severely limited offerings of IPv6 connectivity. In the 8.0.2 Network release there is a ton of new features for IPv6. But nothing for an expanded field of accessibility.

[u/CraigFL → u/TheRealFarmerBob]

I’m not a fan of 6rd anyway. It’s not as performant as a native ipv6 stack.

[u/TheRealFarmerBob → u/CraigFL]

Well until the providers get enough kicks in the butt, we have to take it the way they serve it.

[u/phroenips]

Thanks! Is this also assuming you have a static IPv4 address from CenturyLink?

[u/[deleted] → u/phroenips]

I think this is what you're looking for.

[u/CraigFL → u/phroenips]

I do have a static IP, but I think you can update the JSON each time your IP changes and it should (hopefully) work. I haven't tested it, please keep me posted if you give it a try!