[Help Needed] Load balance mwan3 ipv6 dual gpon pppoe not workign

[BobbyBoyGaming]

Hello,

I have two PPPoE WANs which have been successfully load-balanced for IPv4 via mwan3, however ipv6 is particularly tricky to get working it currently says offline on both wan6 and wanb6 virtual interfaces.

The setup I have consist of two ISP-Provided GPON units which provide "triple-play" service, such that I cannot easily just skip those GPONs and plug the Optical cables into my ER605v2 load balancer (doesn't have SPF anyway). The point being that the GPONs are doing the PPPoE negotiation, and are supposed to obtain an IPv6 IP for me.

However my virtual interfaces wan6 and wanb6 don't seem to work properly.
They are both showing a global IPv6 address with a /64 at the end
They both have a ULA. I tried turning ULA off to see if it made any difference and it didnt.

The other caveat is that I cannot seem to simply forward my IPs via the ISP provided GPON. I also couldn't find any "Bridging" option. It can only be used in Router mode.

I tried turning DHCPv6 server off on the GPONs and the mwan3 status showed wan6 and wanb6 as online (green) but when I load an ipv6 test page it still shows ipv6 as not working

[patrakov]

mwan3 does not support IPv6 without custom scripts that implement IPv6 NAT or NPT.

Example of such a custom script: IPv6 WAN fail-over without IPv6 NAT - #66 by patrakov

Or a newer version that was found not to work as intended in some cases: 6in4 and ISP IPv6 with mwan3 load balancing not working - #2 by patrakov

Also, in the LAN, you have to configure ip6class to only contain local, i.e., use only ULAs. In some cases (depending on the script), disabling of the source-based routing is needed.

In short, load-balancing or even fail-over with multiple IPv6 uplink is not a solved problem in OpenWrt. My recommendation these days (especially after talking to cybersecurity auditors) is to disable IPv6 altogether.

[BobbyBoyGaming]

That is unfortunate but not unexpected. The openwrt documentation does seem to suggest something is off with NAT6 and mwan3, but there is no definitive statement out there like this about it, so I appreciate the conciseness of your response.

I hope it gets supported in a future update soon.

[patrakov]

Well, I would rather reset your expectations. The topic that mwan3, for its IPv6 fail-over support, depends on something which is not in OpenWrt (unless you are OK with NATing everything to a single IPv6 address) has been raised before, but this did not lead to an understanding of a definite way forward. Please check these topics:

NPT6 as a core feature

The official mwan3 documentation says: Using mwan3 with IPv6 requires additional configuration such as IPv6 masquerading through methods like NETMAP or NAT6. This is currently not implemented in mwan3 directly and requires additional configuration. ... This is something that needs to be configured outside of mwan3 itself. Currently, what's expressible using the core firewall features is NAT6, where all LAN hosts are masqueraded behind the router IPv6 address, just like it is done with IPv4. …

and

IPv6 WAN fail-over without IPv6 NAT

The current recommendation for WAN fail-over is to use mwan3. However, for IPv6, it needs NAT or NPT. This is understandable: mwan3 deals not only with fail-over, but also with load-balancing, and for load-balancing the decision regarding the choice of the source address must be delegated to the router on a per-connection basis, and therefore the originating host in the LAN must use a dummy temporary source address that will be replaced as needed. However, none of that should be necessary if th…

[BobbyBoyGaming]

So are you saying that the only way to get ipv6 load balancing working is if it behave like ipv4 which inherently beats the purpose of ipv6, since the whole point of ipv6 is to avoid NAT overhead? Do I understand you correctly?

I don't have issue with having to implement NAT6 so that everything on the LAN gets sent to a single IPv6 (per load-balanced WAN interface), especially if it is the only way to make load-balancing work for IPv6, the problem is that I don't know how to do it on my own.