Hosts via IPv6 not reachable

mirodin · June 10, 2021, 7:14am

I was trying to get my home network to use IPv6 so I can connect via Wireguard from the outside since we are on Dual-Stack Lite. However it seems like I broke something as my hosts can not ping each other any more via IPv6 (IPv4 ping works fine).

My OpenWrt (fd20:cf90:8d13::1/60) router can ping itself and my desktop but not my homeserver
My desktop (fd20:cf90:8d13::816/128) can ping itself and my router but not my homeserver
My homeserver (fd20:cf90:8d13::2/128) can ping itself and the router but not my desktop

/etc/dhcp

config dnsmasq
	option domainneeded '1'
	option localise_queries '1'
	option rebind_protection '1'
	option rebind_localhost '1'
	option expandhosts '1'
	option authoritative '1'
	option readethers '1'
	option leasefile '/tmp/dhcp.leases'
	option localservice '1'
	option domain 'olymp'
	option local '/olymp/'
	option confdir '/tmp/dnsmasq.d'
	option noresolv '1'
	option port '53'
	list server '127.0.0.1#1053'
	list server '::1#1053'

config dhcp 'lan'
	option interface 'lan'
	option start '100'
	option limit '150'
	option leasetime '12h'
	option dhcpv6 'server'
	option ra 'server'
	option ra_management '1'
	list dns 'fd20:cf90:8d13::1'
	list domain 'olymp'

config dhcp 'wan'
	option interface 'wan'
	option ignore '1'

config odhcpd 'odhcpd'
	option maindhcp '0'
	option leasefile '/tmp/hosts/odhcpd'
	option leasetrigger '/usr/sbin/odhcpd-update'
	option loglevel '4'

config host
	option mac 'xx:xx:xx:xx:xx:xx'
	option name 'hades'
	option dns '1'
	option duid 'xxx...'
	option ip '10.100.0.2'
	option hostid '00000002'

trendy · June 10, 2021, 8:09am

The hosts have only a /128 address? They won't be able to communicate like this, there should also be a /64 address.

mirodin · June 10, 2021, 8:49am

My IPv6 knowledge is quite spotty to be honest. How would I set those subnets?

trendy · June 10, 2021, 9:20am

You don't need to set them, they should acquire the settings from the Router Advertisements automatically. However these are ULA addresses, that means private ones, not public. Is there a public prefix?
ifstatus wan_6; ifstatus wan6

mirodin · June 10, 2021, 9:25am

The router has two IPv6 addresses with /64 mask I can ping from the outside. But "ipv6-prefix" is empty when running ifstatus wan6.

trendy · June 10, 2021, 11:00am

Let's have a thorough look at the configuration.

Please run the following commands (copy-paste the whole block) and paste the output here, using the "Preformatted text </> " button:

Remember to redact passwords, MAC addresses and any public IP addresses you may have

ubus call system board; \
uci export network; uci export dhcp; uci export firewall; \
head -n -0 /etc/firewall.user; \
ip -6 addr ; ip -6 ro li tab all ; ip -6 ru; \
ls -l  /etc/resolv.* /tmp/resolv.* /tmp/resolv.*/* ; head -n -0 /etc/resolv.* /tmp/resolv.* /tmp/resolv.*/*

mirodin · June 10, 2021, 11:41am

Boy I hope I did not miss anything

> ubus call system board
{
	"kernel": "4.14.221",
	"hostname": "kerberos",
	"system": "Atheros AR9344 rev 2",
	"model": "NETGEAR WNDR3700v4",
	"board_name": "wndr3700v4",
	"release": {
		"distribution": "OpenWrt",
		"version": "19.07.7",
		"revision": "r11306-c4a6851c72",
		"target": "ar71xx/nand",
		"description": "OpenWrt 19.07.7 r11306-c4a6851c72"
	}
}

> uci export network
package network

config interface 'loopback'
	option ifname 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config globals 'globals'
	option ula_prefix 'fd20:cf90:8d13::/48'

config interface 'lan'
	option type 'bridge'
	option ifname 'eth0.1'
	option proto 'static'
	option netmask '255.255.255.0'
	option ip6assign '60'
	option ipaddr '10.100.0.1'

config device 'lan_eth0_1_dev'
	option name 'eth0.1'
	option macaddr '...'

config interface 'wan'
	option ifname 'eth0.2'
	option proto 'dhcp'

config device 'wan_eth0_2_dev'
	option name 'eth0.2'
	option macaddr '...'

config interface 'wan6'
	option ifname 'eth0.2'
	option proto 'dhcpv6'
	option reqaddress 'try'
	option reqprefix 'auto'

config switch
	option name 'switch0'
	option reset '1'
	option enable_vlan '1'
	option ar8xxx_mib_type '0'
	option ar8xxx_mib_poll_interval '500'

config switch_vlan
	option device 'switch0'
	option vlan '1'
	option ports '1 2 3 4 0t'

config switch_vlan
	option device 'switch0'
	option vlan '2'
	option ports '5 0t'

config interface 'alfred'
	option proto 'static'
	option netmask '255.255.255.0'
	option ipaddr '10.200.0.1'

config interface 'guest'
	option proto 'static'
	option ipaddr '192.168.0.1'
	option netmask '255.255.255.0'
	option type 'bridge'

config interface 'vpn'
	option proto 'wireguard'
	option private_key '...'
	option listen_port '80'
	list addresses '10.52.0.1/24'
	list addresses 'fdf1:e8a1:8d3f:9::1/64'

config wireguard_vpn
	option public_key '...'
	option description '...'
	list allowed_ips '0.0.0.0/0'
	list allowed_ips '::/0'

config wireguard_vpn
	option public_key '...'
	option description '...'
	list allowed_ips '0.0.0.0/0'
	list allowed_ips '::/0

>uci export dhcp
package dhcp

config dnsmasq
	option domainneeded '1'
	option localise_queries '1'
	option rebind_protection '1'
	option rebind_localhost '1'
	option expandhosts '1'
	option authoritative '1'
	option readethers '1'
	option leasefile '/tmp/dhcp.leases'
	option localservice '1'
	option domain 'olymp'
	option local '/olymp/'
	option confdir '/tmp/dnsmasq.d'
	option noresolv '1'
	option port '53'
	list server '127.0.0.1#1053'
	list server '::1#1053'
	list address '/.../10.100.0.2'

config dhcp 'lan'
	option interface 'lan'
	option start '100'
	option limit '150'
	option leasetime '12h'
	option dhcpv6 'server'
	option ra 'server'
	option ra_management '1'
	list dns 'fd20:cf90:8d13::1'
	list domain 'olymp'

config dhcp 'wan'
	option interface 'wan'
	option ignore '1'

config odhcpd 'odhcpd'
	option maindhcp '0'
	option leasefile '/tmp/hosts/odhcpd'
	option leasetrigger '/usr/sbin/odhcpd-update'
	option loglevel '4'

config dhcp 'guest'
	option start '100'
	option limit '150'
	option interface 'guest'
	option force '1'
	option leasetime '30m'

config dhcp 'alfred'
	option start '100'
	option leasetime '12h'
	option limit '150'
	option interface 'alfred'

config host
	option mac '...'
	option name 'hades'
	option dns '1'
	option duid '...'
	option ip '10.100.0.2'
	option hostid '2'

>uci export firewall
package firewall

config defaults
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option synflood_protect '1'

config zone 'lan'
	option name 'lan'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'ACCEPT'
	list network 'lan'
	list network 'vpn'

config zone 'wan'
	option name 'wan'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option masq '1'
	option mtu_fix '1'
	list network 'wan'
	list network 'wan6'

config forwarding
	option src 'lan'
	option dest 'wan'

config rule
	option name 'Allow-DHCP-Renew'
	option src 'wan'
	option proto 'udp'
	option dest_port '68'
	option target 'ACCEPT'
	option family 'ipv4'

config rule
	option name 'Allow-Ping'
	option src 'wan'
	option proto 'icmp'
	option icmp_type 'echo-request'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-IGMP'
	option src 'wan'
	option proto 'igmp'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-DHCPv6'
	option src 'wan'
	option proto 'udp'
	option src_ip 'fc00::/6'
	option dest_ip 'fc00::/6'
	option dest_port '546'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-MLD'
	option src 'wan'
	option proto 'icmp'
	option src_ip 'fe80::/10'
	list icmp_type '130/0'
	list icmp_type '131/0'
	list icmp_type '132/0'
	list icmp_type '143/0'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Input'
	option src 'wan'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	list icmp_type 'router-solicitation'
	list icmp_type 'neighbour-solicitation'
	list icmp_type 'router-advertisement'
	list icmp_type 'neighbour-advertisement'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Forward'
	option src 'wan'
	option dest '*'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-IPSec-ESP'
	option src 'wan'
	option dest 'lan'
	option proto 'esp'
	option target 'ACCEPT'
	option enabled '0'

config rule
	option name 'Allow-ISAKMP'
	option src 'wan'
	option dest 'lan'
	option dest_port '500'
	option proto 'udp'
	option target 'ACCEPT'
	option enabled '0'

config include
	option path '/etc/firewall.user'

config zone 'guestzone'
	option forward 'REJECT'
	option name 'guestzone'
	option output 'ACCEPT'
	list network 'guest'
	option input 'REJECT'

config zone 'alfredzone'
	option input 'ACCEPT'
	option forward 'REJECT'
	option name 'alfredzone'
	option output 'ACCEPT'
	list network 'alfred'

config forwarding
	option dest 'alfredzone'
	option src 'lan'

config forwarding
	option dest 'wan'
	option src 'guestzone'

config rule
	option src 'guestzone'
	option name 'Guest DHCP'
	option target 'ACCEPT'
	list proto 'tcp'
	list proto 'udp'
	option dest_port '67-68'

config rule
	option src 'guestzone'
	option name 'Guest DNS'
	option proto 'tcp udp'
	option target 'ACCEPT'
	option dest_port '53 853 5353'

config redirect 'adblock_dns_53'
	option name 'Adblock DNS, port 53'
	option src 'lan'
	option proto 'tcp udp'
	option src_dport '53'
	option dest_port '53'
	option target 'DNAT'

config redirect 'adblock_dns_853'
	option name 'Adblock DNS, port 853'
	option src 'lan'
	option proto 'tcp udp'
	option src_dport '853'
	option dest_port '853'
	option target 'DNAT'

config redirect 'adblock_dns_5353'
	option name 'Adblock DNS, port 5353'
	option src 'lan'
	option proto 'tcp udp'
	option src_dport '5353'
	option dest_port '5353'
	option target 'DNAT'

config rule
	option dest 'wan'
	option proto 'tcp udp'
	option dest_port '53 853 5353'
	option target 'REJECT'
	option src '*'
	option name 'Block public DNS'

config rule 'wg'
	option name 'Allow WireGuard'
	option src 'wan'
	option dest_port '80'
	option target 'ACCEPT'
	list proto 'udp'

config zone 'lonely'
	option name 'zerotier'
	option input 'ACCEPT'
	option forward 'REJECT'
	option output 'ACCEPT'
	option device 'zt+'
	option masq '1'
	option mtu_fix '1'

config forwording
	option dest 'zerotier'
	option src 'lan'

config forwarding
	option dest 'lan'
	option src 'zerotier'

>head -n -0 /etc/firewall.user
# This file is interpreted as shell script.
# Put your custom iptables rules here, they will
# be executed with each firewall (re-)start.

# Internal uci firewall chains are flushed and recreated on reload, so
# put custom rules into the root chains e.g. INPUT or FORWARD or into the
# special user chains, e.g. input_wan_rule or postrouting_lan_rule.

>ip -6 addr
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 state UNKNOWN qlen 1000
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 state UP qlen 1000
    inet6 fe80::c46b:b4ff:fedb:4efd/64 scope link 
       valid_lft forever preferred_lft forever
5: br-lan: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 state UP qlen 1000
    inet6 fd20:...:1/60 scope global noprefixroute 
       valid_lft forever preferred_lft forever
    inet6 fe80::220c:c8ff:fe46:55c0/64 scope link 
       valid_lft forever preferred_lft forever
7: eth0.2@eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 state UP qlen 1000
    inet6 fd00:.../64 scope global dynamic noprefixroute 
       valid_lft 7014sec preferred_lft 3414sec
    inet6 2001:.../64 scope global dynamic noprefixroute 
       valid_lft 5952sec preferred_lft 2352sec
    inet6 fe80::220c:c8ff:fe46:55c1/64 scope link 
       valid_lft forever preferred_lft forever
8: br-guest: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 state UP qlen 1000
    inet6 fe80::200c:c8ff:fe46:55c2/64 scope link 
       valid_lft forever preferred_lft forever
9: vpn: <POINTOPOINT,NOARP,UP,LOWER_UP> mtu 1420 state UNKNOWN qlen 1000
    inet6 fdf1:e8a1:8d3f:9::1/64 scope global 
       valid_lft forever preferred_lft forever
10: ztzlglkdpr: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 2800 state UNKNOWN qlen 1000
    inet6 fe80:.../64 scope link 
       valid_lft forever preferred_lft forever
11: wlan0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 state UP qlen 1000
    inet6 fe80::220c:c8ff:fe46:55c0/64 scope link 
       valid_lft forever preferred_lft forever
12: wlan1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 state UP qlen 1000
    inet6 fe80::220c:c8ff:fe46:55c2/64 scope link 
       valid_lft forever preferred_lft forever
13: wlan1-1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 state UP qlen 1000
    inet6 fe80::200c:c8ff:fe46:55c2/64 scope link 
       valid_lft forever preferred_lft forever
14: wlan0-1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 state UP qlen 1000
    inet6 fe80::200c:c8ff:fe46:55c0/64 scope link 
       valid_lft forever preferred_lft forever
15: wlan0-2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 state UP qlen 1000
    inet6 fe80::240c:c8ff:fe46:55c0/64 scope link 
       valid_lft forever preferred_lft forever

ip -6 ro li tab all
default from 2001:.../64 via fe80::2e3a:fdff:fed0:c1b9 dev eth0.2 proto static metric 512 pref medium
default from fd00::/64 via fe80::2e3a:fdff:fed0:c1b9 dev eth0.2 proto static metric 512 pref medium
2001:...::/56 from 2001:...::/64 via fe80::2e3a:fdff:fed0:c1b9 dev eth0.2 proto static metric 512 pref medium
2001:...::/56 from fd00::/64 via fe80::2e3a:fdff:fed0:c1b9 dev eth0.2 proto static metric 512 pref medium
2001:...::/64 dev eth0.2 proto static metric 256 pref medium
unreachable 2001:...::/64 dev lo proto static metric 2147483647 error 4294967148 pref medium
fd00::/64 dev eth0.2 proto static metric 256 pref medium
fd00::/64 via fe80::2e3a:fdff:fed0:c1b9 dev eth0.2 proto static metric 512 pref medium
unreachable fd00::/64 dev lo proto static metric 2147483647 error 4294967148 pref medium
fd20:cf90:8d13::/64 dev br-lan proto static metric 1024 pref medium
unreachable fd20:cf90:8d13::/48 dev lo proto static metric 2147483647 error 4294967148 pref medium
fdf1:e8a1:8d3f:9::/64 dev vpn proto kernel metric 256 pref medium
fe80::/64 dev eth0 proto kernel metric 256 pref medium
fe80::/64 dev eth0.2 proto kernel metric 256 pref medium
fe80::/64 dev br-lan proto kernel metric 256 pref medium
fe80::/64 dev ztzlglkdpr proto kernel metric 256 pref medium
fe80::/64 dev wlan1 proto kernel metric 256 pref medium
fe80::/64 dev br-guest proto kernel metric 256 pref medium
fe80::/64 dev wlan0 proto kernel metric 256 pref medium
fe80::/64 dev wlan1-1 proto kernel metric 256 pref medium
fe80::/64 dev wlan0-1 proto kernel metric 256 pref medium
fe80::/64 dev wlan0-2 proto kernel metric 256 pref medium
local ::1 dev lo table local proto kernel metric 0 pref medium
anycast 2001:...:: dev eth0.2 table local proto kernel metric 0 pref medium
local 2001:... dev eth0.2 table local proto kernel metric 0 pref medium
anycast fd00:: dev eth0.2 table local proto kernel metric 0 pref medium
local fd00::220c:c8ff:fe46:55c1 dev eth0.2 table local proto kernel metric 0 pref medium
anycast fd20:cf90:8d13:: dev br-lan table local proto kernel metric 0 pref medium
local fd20:cf90:8d13::1 dev br-lan table local proto kernel metric 0 pref medium
anycast fdf1:e8a1:8d3f:9:: dev vpn table local proto kernel metric 0 pref medium
local fdf1:e8a1:8d3f:9::1 dev vpn table local proto kernel metric 0 pref medium
anycast fe80:: dev br-lan table local proto kernel metric 0 pref medium
anycast fe80:: dev eth0 table local proto kernel metric 0 pref medium
anycast fe80:: dev eth0.2 table local proto kernel metric 0 pref medium
anycast fe80:: dev ztzlglkdpr table local proto kernel metric 0 pref medium
anycast fe80:: dev wlan1 table local proto kernel metric 0 pref medium
anycast fe80:: dev wlan0 table local proto kernel metric 0 pref medium
anycast fe80:: dev br-guest table local proto kernel metric 0 pref medium
anycast fe80:: dev wlan0-1 table local proto kernel metric 0 pref medium
anycast fe80:: dev wlan1-1 table local proto kernel metric 0 pref medium
anycast fe80:: dev wlan0-2 table local proto kernel metric 0 pref medium
local fe80::200c:c8ff:fe46:55c0 dev wlan0-1 table local proto kernel metric 0 pref medium
local fe80::200c:c8ff:fe46:55c2 dev br-guest table local proto kernel metric 0 pref medium
local fe80::200c:c8ff:fe46:55c2 dev wlan1-1 table local proto kernel metric 0 pref medium
local fe80::220c:c8ff:fe46:55c0 dev br-lan table local proto kernel metric 0 pref medium
local fe80::220c:c8ff:fe46:55c0 dev wlan0 table local proto kernel metric 0 pref medium
local fe80::220c:c8ff:fe46:55c1 dev eth0.2 table local proto kernel metric 0 pref medium
local fe80::220c:c8ff:fe46:55c2 dev wlan1 table local proto kernel metric 0 pref medium
local fe80::240c:c8ff:fe46:55c0 dev wlan0-2 table local proto kernel metric 0 pref medium
local fe80::5876:edff:fe82:40f4 dev ztzlglkdpr table local proto kernel metric 0 pref medium
local fe80::c46b:b4ff:fedb:4efd dev eth0 table local proto kernel metric 0 pref medium
ff00::/8 dev br-lan table local proto kernel metric 256 pref medium
ff00::/8 dev eth0 table local proto kernel metric 256 pref medium
ff00::/8 dev eth0.2 table local proto kernel metric 256 pref medium
ff00::/8 dev vpn table local proto kernel metric 256 pref medium
ff00::/8 dev ztzlglkdpr table local proto kernel metric 256 pref medium
ff00::/8 dev wlan1 table local proto kernel metric 256 pref medium
ff00::/8 dev br-guest table local proto kernel metric 256 pref medium
ff00::/8 dev wlan0 table local proto kernel metric 256 pref medium
ff00::/8 dev wlan1-1 table local proto kernel metric 256 pref medium
ff00::/8 dev wlan0-1 table local proto kernel metric 256 pref medium
ff00::/8 dev wlan0-2 table local proto kernel metric 256 pref medium

>ip -6 ru
0:	from all lookup local 
32766:	from all lookup main 
4200000001:	from all iif lo failed_policy
4200000005:	from all iif br-lan failed_policy
4200000007:	from all iif eth0.2 failed_policy
4200000007:	from all iif eth0.2 failed_policy
4200000008:	from all iif br-guest failed_policy
4200000009:	from all iif vpn failed_policy
4200000015:	from all iif wlan0-2 failed_policy

>ls -l  /etc/resolv.* /tmp/resolv.* /tmp/resolv.*/*
ls: /tmp/resolv.*/*: No such file or directory
lrwxrwxrwx    1 root     root            16 Feb 15 16:22 /etc/resolv.conf -> /tmp/resolv.conf
lrwxrwxrwx    1 root     root            21 Jun  7 17:58 /tmp/resolv.conf -> /tmp/resolv.conf.auto
-rw-r--r--    1 root     root           112 Jun  7 17:58 /tmp/resolv.conf.auto

>head -n -0 /etc/resolv.* /tmp/resolv.* /tmp/resolv.*/*
==> /etc/resolv.conf <==
# Interface wan
nameserver 192.168.178.1
search fritz.box
# Interface wan6
nameserver fd00::2e3a:fdff:fed0:c1b9

==> /tmp/resolv.conf <==
# Interface wan
nameserver 192.168.178.1
search fritz.box
# Interface wan6
nameserver fd00::2e3a:fdff:fed0:c1b9

==> /tmp/resolv.conf.auto <==
# Interface wan
nameserver 192.168.178.1
search fritz.box
# Interface wan6
nameserver fd00::2e3a:fdff:fed0:c1b9
head: /tmp/resolv.*/*: No such file or directory

trendy · June 10, 2021, 12:31pm

There is typo in forwording
What is the topology here? I can see that there is somewhere a /56 prefix but it doesn't seem to be assigned to the wan interface.Is there another router in front of the OpenWrt?

mirodin · June 10, 2021, 12:34pm

Thanks, fixed the typo. Interestingly enough my Zerotier network works nonetheless^^

Is there another router in front of the OpenWrt?

Yes, I got some Fritzbox as a DSL router from my ISP which serves as my "modem".

trendy · June 10, 2021, 12:37pm

Does it have some option to delegate a prefix to its lan? Currently OpenWrt is trying to get a prefix, but it doesn't get any. It only gets an IPv6 on the wan interface, which is not enough. There is the NDP proxy workaround, but it's better if you managed to delegate a prefix from the Fritzbox.

mirodin · June 10, 2021, 1:07pm

I set my fritzbox to delegate its network following the manual. Now I get these addresses:

ip -6 a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 state UNKNOWN qlen 1000
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 state UP qlen 1000
    inet6 fe80::c46b:b4ff:fedb:4efd/64 scope link 
       valid_lft forever preferred_lft forever
5: br-lan: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 state UP qlen 1000
    inet6 2001:...::1/62 scope global dynamic noprefixroute 
       valid_lft 7106sec preferred_lft 3506sec
    inet6 fd20:cf90:8d13::1/60 scope global noprefixroute 
       valid_lft forever preferred_lft forever
    inet6 fe80::220c:c8ff:fe46:55c0/64 scope link 
       valid_lft forever preferred_lft forever
7: eth0.2@eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 state UP qlen 1000
    inet6 fd00::220c:c8ff:fe46:55c1/64 scope global dynamic noprefixroute 
       valid_lft 7104sec preferred_lft 3504sec
    inet6 2001:.../128 scope global dynamic noprefixroute 
       valid_lft 7106sec preferred_lft 3506sec
    inet6 fe80::220c:c8ff:fe46:55c1/64 scope link 
       valid_lft forever preferred_lft forever
8: br-guest: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 state UP qlen 1000
    inet6 fe80::200c:c8ff:fe46:55c2/64 scope link 
       valid_lft forever preferred_lft forever
9: vpn: <POINTOPOINT,NOARP,UP,LOWER_UP> mtu 1420 state UNKNOWN qlen 1000
    inet6 fdf1:e8a1:8d3f:9::1/64 scope global 
       valid_lft forever preferred_lft forever
10: ztzlglkdpr: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 2800 state UNKNOWN qlen 1000
    inet6 fe80::5876:edff:fe82:40f4/64 scope link 
       valid_lft forever preferred_lft forever
11: wlan0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 state UP qlen 1000
    inet6 fe80::220c:c8ff:fe46:55c0/64 scope link 
       valid_lft forever preferred_lft forever
12: wlan1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 state UP qlen 1000
    inet6 fe80::220c:c8ff:fe46:55c2/64 scope link 
       valid_lft forever preferred_lft forever
13: wlan1-1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 state UP qlen 1000
    inet6 fe80::200c:c8ff:fe46:55c2/64 scope link 
       valid_lft forever preferred_lft forever
14: wlan0-1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 state UP qlen 1000
    inet6 fe80::200c:c8ff:fe46:55c0/64 scope link 
       valid_lft forever preferred_lft forever
15: wlan0-2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 state UP qlen 1000
    inet6 fe80::240c:c8ff:fe46:55c0/64 scope link 
       valid_lft forever preferred_lft forever

trendy · June 10, 2021, 1:14pm

Looks better now from what I can see. Your lan hosts must have a public IPv6 now and they should be able to communicate to the internet.

mirodin · June 10, 2021, 1:21pm

Oh reaching the internet was never an issue, the problem was that my hosts could not reach each other.

This is what my homeserver gets:

enp2s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
    link/ether 50:e5:49:5a:bb:74 brd ff:ff:ff:ff:ff:ff
    inet 10.100.0.2/24 brd 10.100.0.255 scope global dynamic noprefixroute enp2s0
       valid_lft 43147sec preferred_lft 37747sec
    inet6 fd20:cf90:8d13::2/128 scope global noprefixroute 
       valid_lft forever preferred_lft forever
    inet6 fd20:cf90:8d13:0:ab7e:37e:8e91:6994/64 scope global mngtmpaddr noprefixroute 
       valid_lft forever preferred_lft forever
    inet6 2001:.../64 scope global dynamic mngtmpaddr noprefixroute 
       valid_lft 6251sec preferred_lft 2651sec
    inet6 fe80::e0b:39d9:8228:b3ec/64 scope link 
       valid_lft forever preferred_lft forever

trendy · June 10, 2021, 1:25pm

Much better now, your lan host has a ULA /64 and a GUA also /64, so they can communicate. Give it a try!

mirodin · June 10, 2021, 1:32pm

I did and I can ping the 2001::... address. But when I try to use the hostname they still use the fd20:... address with no answer:

> ping hades
PING hades(hades.olymp (fd20:cf90:8d13::2)) 56 data bytes

trendy · June 10, 2021, 1:58pm

Are you trying to ping from the OpenWrt or from one host to another?
I was able to ping from OpenWrt and a lan host to another lan host.
One tricky thing is that if you don't specify the source address, the echo request might have the GUA as source IP and some distros might not accept that.

mirodin · June 10, 2021, 2:16pm

OpenWrt to

Server via 2001:.../64 works
Server via fd20:cf90:8d13::2/128 does not work
Desktop via 2001:.../64 works
Desktop via fd20:cf90:8d13::600/128 works

Desktop to

OpenWrt via 2001:.../62 works
OpenWrt via fd20:cf90:8d13::1/60 works
Server via 2001:.../64 works
Server via fd20:cf90:8d13::2/128 does not work

Server to

OpenWrt via 2001:.../62 works
OpenWrt via fd20:cf90:8d13::1/60 works
Desktop via 2001:.../64 works
Desktop via fd20:cf90:8d13:0:4493:14e0:11b3:8987/64 does not work

So it looks like I screwed something up when I tried to get a static IP for my server. My plan was to use a domain I purchased to point to the IP of my server and since I would connect to Wireguard on my router any of my client would have access to that server via Wireguard:

Client ---wg VPN--> OpenWrt -----> Server

trendy · June 10, 2021, 3:02pm

I don't see why this won't work. I still believe it is an issue of mixing ULA and GUA in the pings. You can verify that with a packet capture. like wireshark or tcpdump.

mirodin · June 11, 2021, 11:35am

Well it seems once again that pinging issue did resolve itself overnight. I think some caching was the culprit here since this morning everything works like a charm. Thank you so much for your patience and help

system · June 21, 2021, 11:35am

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.