Client Devices unable to get ipv6 address

Installing and Using OpenWrt Network and Wireless Configuration
1

Hi, I'm pretty new to the whole openwrt ecosystem and still learning. After multiple trial and error i was able to use my second openwrt router as a sort of access point, but the client devices are unable to get an ipv6 address and yes my ISP does support it and connecting to my ISP's router does gives me a ipv6 address and I can't get rid of it because it's an ONT box.
What should i do so that the devices can get ipv6 address? I also want to configure my router so that it acts as a dedicated router itself and not as just a access point. I'm not asking for someone to do everything for me, any sort of guidance is accepted. I'd like to do it on my own and learn stuff.
Here's my current config:

root@OpenWrt:/etc/config# cat dhcp

config dnsmasq
        option domainneeded '1'
        option localise_queries '1'
        option rebind_protection '1'
        option rebind_localhost '1'
        option local '/lan/'
        option domain 'lan'
        option expandhosts '1'
        option cachesize '1000'
        option authoritative '1'
        option readethers '1'
        option leasefile '/tmp/dhcp.leases'
        option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
        option localservice '1'
        option ednspacket_max '1232'

config dhcp 'lan'
        option interface 'lan'
        option start '200'
        option limit '250'
        option leasetime '12h'
        option dhcpv4 'server'
        option dhcpv6 'server'
        option ra 'server'
        list ra_flags 'managed-config'
        list ra_flags 'other-config'

config dhcp 'wan'
        option interface 'wan'
        option ignore '1'
        option start '100'
        option limit '150'
        option leasetime '12h'

config odhcpd 'odhcpd'
        option maindhcp '0'
        option leasefile '/tmp/hosts/odhcpd'
        option leasetrigger '/usr/sbin/odhcpd-update'
        option loglevel '4'

root@OpenWrt:/etc/config# cat firewall

config defaults
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option synflood_protect '1'

config zone
        option name 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        list network 'lan'

config zone
        option name 'wan'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        option mtu_fix '1'
        list network 'wan'
        list network 'wan6'

config forwarding
        option src 'lan'
        option dest 'wan'

config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-IGMP'
        option src 'wan'
        option proto 'igmp'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-MLD'
        option src 'wan'
        option proto 'icmp'
        option src_ip 'fe80::/10'
        list icmp_type '130/0'
        list icmp_type '131/0'
        list icmp_type '132/0'
        list icmp_type '143/0'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        list icmp_type 'router-solicitation'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'router-advertisement'
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-IPSec-ESP'
        option src 'wan'
        option dest 'lan'
        option proto 'esp'
        option target 'ACCEPT'

config rule
        option name 'Allow-ISAKMP'
        option src 'wan'
        option dest 'lan'
        option dest_port '500'
        option proto 'udp'
        option target 'ACCEPT'

root@OpenWrt:/etc/config# cat network

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'fd54:e310:52a2::/48'

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'eth0.1'

config interface 'lan'
        option device 'br-lan'
        option proto 'static'
        option ipaddr '192.168.1.1'
        option netmask '255.255.255.0'
        option ip6assign '60'
        option gateway '192.168.29.1'
        list dns '1.1.1.1'
        list dns '8.8.8.8'

config device
        option name 'eth0.2'
        option macaddr 'xx:xx:xx:xx:xx:xx'

config interface 'wan'
        option device 'eth0.2'
        option proto 'static'
        option ipaddr '192.168.29.250'
        option netmask '255.255.255.0'
        option gateway '192.168.29.1'
        option type 'bridge'

config interface 'wan6'
        option device 'eth0.2'
        option proto 'dhcpv6'
        option type 'bridge'

config switch
        option name 'switch0'
        option reset '1'
        option enable_vlan '0'

config switch
        option name 'switch1'
        option reset '1'
        option enable_vlan '0'
        option enable_vlan4k '1'

config switch_vlan
        option device 'switch1'
        option vlan '1'
        option ports '0 1 2 3 7t'
        option description 'LAN'

config switch_vlan
        option device 'switch1'
        option ports '4 7t'
        option vlan '2'
        option description 'WAN'
2

Can you set the ISP router in bridge mode?

3

unfortunately I can't, my ISP uses it's own proprietary router although there's an option in the router for bridge mode but that doesn't work and it's just for show.

4

Well than you have two choices. Double NAT with IPv4 or the hardcore way.
Does the ONT router have tv and telephone output that you actually use?

There are more or less complicated ways to replace their ONT router with something else, it all depends in how complicated way they have nested the router in their system.

5

Run ifstatus wan6 to see how much IPv6 access you have on the wan side. In particular whether you have a routed prefix, and whether the wan IP is a full /64 or a /128.

6

I only use that router for the internet, no TV or telephone services. I don't really wanna do the NAT config because the ISP already uses NAT on ipv4 addresses and i'd like to host my home server for outside network access.
What do you recommend i should do? I only have basic knowledge in the networking field but i'd also like to try some new stuff.

7 
root@OpenWrt:~# ifstatus wan6
{
        "up": true,
        "pending": false,
        "available": true,
        "autostart": true,
        "dynamic": false,
        "uptime": 81499,
        "l3_device": "eth0.2",
        "proto": "dhcpv6",
        "device": "eth0.2",
        "metric": 0,
        "dns_metric": 0,
        "delegation": true,
        "ipv4-address": [

        ],
        "ipv6-address": [
                {
                        "address": "xxxx:xxx:xxxx:xxxx::xxxx:xxxx",
                        "mask": 128,
                        "preferred": 523294,
                        "valid": 523294
                }
        ],
        "ipv6-prefix": [

        ],
        "ipv6-prefix-assignment": [

        ],
        "route": [
                {
                        "target": "::",
                        "mask": 0,
                        "nexthop": "fe80::96fb:a7ff:fe69:8391",
                        "metric": 384,
                        "valid": 3582,
                        "source": "xxxx:xxx:xxxx:xxxx::xxxx:xxxx/128"
                }
        ],
        "dns-server": [
                "2405:201:4019:793b::c0a8:1d01"
        ],
        "dns-search": [
                "home.arpa"
        ],
        "neighbors": [

        ],
        "inactive": {
                "ipv4-address": [

                ],
                "ipv6-address": [

                ],
                "route": [

                ],
                "dns-server": [

                ],
                "dns-search": [

                ],
                "neighbors": [

                ]
        },
        "data": {
                "passthru": "00170010240502014019793b00000000c0a81d010018000b04686f6d65046172706100"
        }
}

This is the output, seems to be 128 prefix ig (i don't really know much about ipv6 stuff)

8

A /128 is a single endpoint IP. The only way to route out with it is to use NAT. This ends up being effectively like IPv4, it's not good.

Check if there is any way to configure the ISP modem to issue IPv6 differently.

10

The easiest way is if their router only runs on dhcp client from upstream ISP network. Then it is pretty much only get a free standing opto to ethernet converter and remove the isp modem and use your own equipment instead.

They may have mac filtering, in that case you need to spoof the isp router mac in the openwrt router.

They may also have vlan connection, so in that case you need to wireshark the internet line to see what vlan they use.

The problem really arise if they have some kind of crypto connection.

All these methods have been talked about in detail on other forum treads over time.

Have you tried actually asking the ISP for a solution to the problem?

11

I have tried asking the ISP but it's not a local one but a big corporation so all they have is a years old script with no up-to-date info. Many have tried to use their own routers but they never worked ( could be because of the crypto connection). They have a very tight and shitty ecosystem where an average person can't even add a 3d party mesh network, you have to use their own expensive and poor mesh network. The router has even FTP disabled :cry:, it used to work but even for that you'd have to use their own app to access it. Sorry for the rant but it's just so frustrating.
Seems like for now my only easily doable option is to use the second router as an access point and get rid of the ISP when my next recharge date comes.
Anyways, Thanks a lot for the help guys :smile:.