Sorry for the very late reply. I have literally been busy re-arranging my new DIY desk and re-cabling that and my server rack.
I've managed to get IPv6 working but it's not what I was expecting and there are some things I'm unsure of or I can't get to work. If I'm honest all of this IPv6 stuff is confusing. I've been on this for months trying to get my head around it all, even to the point I actually wrote a quite in-depth draft forum post with my frustration and confusion with IPv6 in OpenWrt but I haven't posted it yet...
To get things working I created a DHCPv6 client interface on OpenWrt and attached it to my VLAN, VLAN 20 which is an untagged port that physically connects to one of the LAN ports on the BT router.
To allow the pass through of the public prefix to my other VLANs/interfaces I had check the Delegate IPv6 prefixes box under Interfaces > WAN > Advanced.
Under Interfaces > WAN6 > DHCP > IPv6 I have enabled Designated maser and set everything to Relay mode.
On the LAN side of things for example using my private LAN I created a local, static IPv6 address. Now I've discovered a couple of ways of defining this, one is setting a manual interface IP address on the General Settings tab or using the IPv6 assignment length, IPv6 assignment hint and IPv6 suffix. They both produce the same interface IP address except for the latter prefixes the IP address using the IPv6 ULA-Prefix found under the Global network options tab. However, what's the difference? I have noticed that if I enable the IPv6 assignment length under Interfaces > Private > Advanced Settings tab the IPv6 settings disappear from the General Settings tab.
If I've understood prefix delegation (also written as PD) correctly, this is a set range of the public IPv6 address provided by the ISP that prefixes the overall IPv6 address? From my understanding of IPv6, every interface has it's own 64-bit address which means there are 18,446,744,073,709,551,616 unique client IP address combinations available. My ISP provides a /56 prefix which leaves me 256 VLANs (subnets) and so I've tried to take advantage of this by using the IPv6 assignment hint parameter.
If you've guessed, my private VLAN has the ID 5! You can see this number in the 3rd octet of the IPv4 address as well as the IPv6 address. Additionally the network address is 1 in the IPv4's 4th octet and this is uniform with the IPv6 address' interface where I have used ::1 in the IPv6 suffix parameter.
When I could connect my OpenWrt router directly to the internet without piggybacking through my ISP's router, I used to be able to see the 8-bit subnet from my varying VLANs in online IPv6 tests. Now that I'm behind the ISP router the IPv6 assignment hint parameter doesn't appear to work and now it just shows as 01 no matter what VLAN I'm doing a IPv6 test from.
Using the annotated IPv6 breakdown diagram below, say I have a VLAN with the ID 12 and it's local IPv4 address is 172.16.12.1 and the local IPv6 address is fdb0:dc72:61cd:12::1/64 taking the IPv6 ULA-Prefix from Network > Global network options on LuCI which is fdb0:dc72:61cd::/48,
this would usually give me an global unicast address like the below.
My final questions bring me to firewalling and updating DDNS. If I wanted to host something on my computer/server and access it via from outside my LAN in the public IP address space how would I do this with IPv6? I'm aware there is no NAT with IPv6 like there is with IPv4 which is where some of the confusion may be. Typically with IPv4 I would assign a static IP address with DHCP to the device I want to provide access to and create a traffic rule/port forward to allow access.
I have noticed with the IPv6 tests I've been doing through my web browser that the interface ID (the last 64-bits) keep changing from the computer that is initiating the test. I do remember reading briefly about RFC 4941, Privacy Extensions for Stateless Address Autoconfiguration in IPv6 such as in this IBM documentation here. With no NAT and the vast number a 128-bit IPv6 holds, there is enough IP addresses for every device in the world to do peer to peer connectivity. Obviously from a security standpoint that would be a nightmare if everyone could connect to one another! I'm assuming by default there are firewall rules in place on all operating systems, routers etc that stop unauthorized IPv6 access? I can see why the privacy extensions are used because unlike with EUI-64, the interface ID originates from the interface's/device's MAC address with FFFE stamped into the middle and the 7th-bit flipped.
This makes me question how do you implement firewall traffic rules for an interface that keeps changing? My computer has the following IP addresses but non of them match the IPv6 address seen on the online IPv6 tests.
Get-NetIPAddress -InterfaceAlias "WiFi" | Format-Table -AutoSize -Property IPAddress, PrefixOrigin, PrefixLength
IPAddress PrefixLength PrefixOrigin
--------- ------------ ------------
fe80::c72:2288:d15:a5b3%5 64 WellKnown
fd76:92b8:37a:0:b595:6b59:cd48:800a 128 RouterAdvertisement
fd76:92b8:37a:0:c72:2288:d15:a5b3 64 RouterAdvertisement
2a00:dead:beef:ab01:b595:6b59:cd48:800a 128 RouterAdvertisement
2a00:dead:beef:ab01:c72:2288:d15:a5b3 64 RouterAdvertisemenk
192.168.5.145 24 Dhcp
Looking at the table above, straight away I noticed the DHCPv6 wasn't working on my OpenWrt Private interface and instead was showing the IPv6 ULA prefix from my BT router. I fixed this by enabling the Delegate IPv6 prefixes checkbox. Let's try that again.
Get-NetIPAddress -InterfaceAlias "WiFi" | Format-Table -AutoSize -Property IPAddress, PrefixOrigin, PrefixLength
IPAddress PrefixOrigin PrefixLength
--------- ------------ ------------
fe80::c72:2288:d15:a5b3%5 WellKnown 64
fdb0:dc72:61cd:5::b60 Dhcp 128
fd76:92b8:37a:0:f805:f787:9f06:3759 RouterAdvertisement 128
fd76:92b8:37a:0:c72:2288:d15:a5b3 RouterAdvertisement 64
2a00:dead:beef:ab01:f805:f787:9f06:3759 RouterAdvertisement 128
2a00:dead:beef:ab01:c72:2288:d15:a5b3 RouterAdvertisement 64
192.168.5.145 Dhcp 24
In regards to DDNS, putting aside how the allowed firewall traffic rule is implemented, a domain name can only be registered to a single IP address. With IPv4 you can host multiple things behind a single WAN IP entry point and using network address translation specifically DNAT to rewrite outside ports to internal ports. However, there is no NAT with IPv6 as far as I'm aware. After reading this article DNS AAAA records can only be registered to a single interface on the internal network as IPv6 is a direct connection. "If you run a dynamic DNS client on the router, then only the router's DNS record is updated, and there is still no way to access home PCs".
In my case the ISP delegation prefix would dynamically change but the interface ID would always stay fixed. Therefore this would mean I would need multiple domains/subdomains all with their respective interfaces tied to. DuckDNS only allows a-z, 0-9 and - so this would mean if I wanted to reach my VPN endpoint for example I would need something like vpn-example.duckdns.org with a DDNS update script to update the prefix + interface ID to this domain name. At the same time, if I wanted to reach my Plex server as this has a different interface ID but shares the same dynamic prefix delegation this would need a domain like plex-example.duckdns.org.
Luckily enough there is a site called https://dynv6.com/ that allows you to update the ISP prefix whilst holding DNS records for all of the interfaces which are accessible via sub, sub-domain. You specify and update your ISP prefix like any DDNS updater, register the A and AAAA records to domain names using your device's interface IDs and then it marries up the dynamic prefix with the static interface IDs.
