First I would like to explain the scenario where this request come. My ISP has enabled IPv6, via 6rd tunnel, but no prefix delegation and most important they give only /64 subnet
There is no room for discussion with them on this topic, neither for me an alternative provider that gives better.
Hurricane or similar tunnels are not an option, due to different geolocalization, and because apparently my ISP is blocking IP proto 41 if originated from a device different than their own gateway
So I have decided to implement a NAT6 masquerade on my gateway running trunk.
I'm ok with the way of configure it as described in the wiki, but I would like to regain the flexibility of the public IPv6 address on my LAN devices, that is lost with the NAT6.
I know that I can use DNAT for standard port forwarding (first question: UCI/LUCI can handle DNAT for IPv6 in trunk?), but I have something different in mind.
My WAN6 in DHCPv6 mode gets a SLAAC IPv6 address from the ISP gateway. The idea is to add more IPv6 address in the same /64 subnet on this interface and set a symmetric SNAT/DNAT rule to map each internal IPv6 address running in LAN to a different public IPv6 address on WAN.
Doing so the assumption is that we can reach from internet the IPv6 address running in LAN from the IPv6 public address on the WAN via the DNAT rules and making the IPv6 address running in LAN appear on internet with their own public IPv6 address from the WAN via SNAT rule.
The goal is:
- Have the LAN address management working with SLAAC and DHCPv6 with no caveat
- Have the LAN device have their own public IPv6 address via SNAT/DNAT
- Protect WAN to LAN access with normal iptables rules
The question: apart from the fact that I know it's way better not use NAT6 at all, does it make sense and is it feasable with modern iptables? Is there any kind of support, even if without LUCI, in UCI to do so, in particular assign more that one IPv6 address to WAN?
Thanks to everybody who would contribute