How do I get NAT6 to work with openconnect?

Installing and Using OpenWrt
1

I followed all the instructions and I still could not get NAT6 to work with openconnect. IPv4 works fine.

Firewall

config defaults
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'REJECT'

config zone
        option name 'lan'
        list network 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'

config zone
        option name 'openconnect'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'REJECT'
        list network 'openconnect'
        option masq '1'
        option masq6 '1'

config zone
        option name 'wan'
        list network 'wan'
        list network 'wan6'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        option mtu_fix '1'

I even installed ip6tables-mod-nat and used
ip6tables -t nat -A POSTROUTING -o vpn-openconnect -j MASQUERADE
in /etc/firewall.user and still no luck.

2

Does the rule have any hits? Are the IPv6 packets going out of openconnect or are they using the IPv6 they have from wan6 so they will be routed out of wan6?

3

If I use ip6tables -t nat -L -n -v
I get

Chain PREROUTING (policy ACCEPT 249 packets, 52931 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain INPUT (policy ACCEPT 5 packets, 573 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 168 packets, 17025 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain POSTROUTING (policy ACCEPT 346 packets, 26591 bytes)
 pkts bytes target     prot opt in     out     source               destination         
   31  2974 MASQUERADE  all      *      vpn-openconnect  ::/0                 ::/0

I think the rule is getting the hits.

4

Yes, it does. Do a traceroute6 from a client to verify it follows the correct path.