How to filter what odhcpd relays?

Here is my setup in terms of ipv6:

  • Main Router (running DDWRT) using dnsmasq for RA and DHCPV6 advertising as default route (see "anonymized" radvdump below)
interface wlp5s0
{
        AdvSendAdvert on;
        # Note: {Min,Max}RtrAdvInterval cannot be obtained with radvdump
        AdvManagedFlag on;
        AdvOtherConfigFlag on;
        AdvReachableTime 0;
        AdvRetransTimer 0;
        AdvCurHopLimit 64;
        AdvDefaultLifetime 1800;
        AdvHomeAgentFlag off;
        AdvDefaultPreference high;
        AdvLinkMTU 1500;
        AdvSourceLLAddress on;

        prefix 2a02:8428:XXXX:YYYY::/64
        {
                AdvValidLifetime 86400;
                AdvPreferredLifetime 86400;
                AdvOnLink on;
                AdvAutonomous on;
                AdvRouterAddr off;
        }; # End of prefix definition

        prefix fddd::/64
        {
                AdvValidLifetime 86400;
                AdvPreferredLifetime 86400;
                AdvOnLink on;
                AdvAutonomous on;
                AdvRouterAddr off;
        }; # End of prefix definition

        DNSSL me.fr
        {
                AdvDNSSLLifetime 86400;
        }; # End of DNSSL definition

        RDNSS fddd::a
        {
                AdvRDNSSLifetime 86400;
        }; # End of RDNSS definition

}; # End of interface definition
  • my re450v1 as a wireless repeater running openwr 21.02.0:
    WWAN6 is master relaying RA, DHCPV6 and NDP
    lan is slave relaying RA, DHCPDV6 and NDP
config dhcp 'lan'
        option ignore '1'
        option interface 'lan'
        option ra 'relay'
        option dhcpv6 'relay'
        option ndp 'relay'
        list ra_flags 'none'

config dhcp 'wan'
        option ignore '1'

config dhcp 'wan6'
        option ignore '1'
        option interface 'WWAN_IPV6'
        option ra 'relay'
        option dhcpv6 'relay'
        option ndp 'relay'
        option master '1'
        list ra_flags 'none'
  • nest thermostat doing RA of its prefix (yeah they do that by default and I can't stop it) but without a default route (AdvDefaultLifetime 0) see radvdump output
interface wlp5s0
{
        AdvSendAdvert on;
        # Note: {Min,Max}RtrAdvInterval cannot be obtained with radvdump
        AdvManagedFlag off;
        AdvOtherConfigFlag off;
        AdvReachableTime 0;
        AdvRetransTimer 0;
        AdvCurHopLimit 0;
        AdvDefaultLifetime 0;
        AdvHomeAgentFlag off;
        AdvDefaultPreference medium;

        prefix fd52:8961:4db3:1::/64
        {
                AdvValidLifetime 7200;
                AdvPreferredLifetime 7200;
                AdvOnLink on;
                AdvAutonomous on;
                AdvRouterAddr off;
        }; # End of prefix definition

}; # End of interface definition

Now for the issue:

My laptop (Manjaro Linux), pi2 (osmc), phone (LOS 18.1) connected via repeater will obtain a default ipv6 route from the main routers relayed RA going through the repeaters lan link local ipv6 fe80::1ad6:c7ff:fe3d:49ac

>route -n -A inet6
Destination                    Next Hop                   Flag Met Ref Use If
::1/128                        ::                         U    256 2     0 lo
2a02:8428:XXXX:YYYY::/64        ::                         UAe  256 5     0 wlan0
fd52:8961:4db3:1::/64          ::                         UAe  256 1     0 wlan0
fddd::/64                      ::                         UAe  256 7     0 wlan0
fe80::/64                      ::                         U    256 2     0 wlan0
::/0                           fe80::1ad6:c7ff:fe3d:49ac  UGDAe 1024 1     0 wlan0
::1/128                        ::                         Un   0   7     0 lo
...
::/0                           ::                         !n   -1  1     0 lo

...and as soon as they receive the Nest's RA the default ipv6 route is deleted because once relayed the RA also seems to come from the repeaters lan link local ipv6 (fe80::1ad6:c7ff:fe3d:49ac) and because the Nest's RA says there is no default route

>route -n -A inet6
Destination                    Next Hop                   Flag Met Ref Use If
::1/128                        ::                         U    256 2     0 lo
2a02:8428:XXXX:YYYY::/64        ::                         UAe  256 5     0 wlan0
fd52:8961:4db3:1::/64          ::                         UAe  256 1     0 wlan0
fddd::/64                      ::                         UAe  256 7     0 wlan0
fe80::/64                      ::                         U    256 2     0 wlan0
::1/128                        ::                         Un   0   7     0 lo
...
::/0                           ::                         !n   -1  1     0 lo

so my devices connected to the repeater will find no ipv6 route until the next main router RA which brings it back... and the issue will come back with the next Nest RA which removes it again... and so on...

So I'd like to be able to tell odhcpd to filter/choose what to relay from master to slave interface depending on where it is coming from (Nest's link local ipv6 for instance) or what prefix is in it (Nest's RA prefix)...

Is this possible ? If yes how ?

A very very dirty partial solution is to reduce the ra delay of the main router to ~10s which reduces to a few seconds the duration during which the devices lose their default route... but I'd like a clean solution...

How about a firewall rule to drop the RAs from the particular MAC?

2 Likes

Any hints on how would I go about that ?

something like : "ip6tables -A INPUT -i wlan0 -m mac --mac-source AA:BB:CC:DD:EE:FF -p icmpv6 --icmpv6-type router-advertisement -j DROP" ?

1 Like

ip6tables -I INPUT -i wlan0 -m mac --mac-source AA:BB:CC:DD:EE:FF -p icmpv6 --icmpv6-type router-advertisement -j DROP did the trick :wink: !
appending with -A doesn't work as another rule gets applied before so my extra rule is never reached and applied.

Thanks again !!!

1 Like

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.