Interface with GUA but not ULA; possible?

Installing and Using OpenWrt Network and Wireless Configuration
1

I think I have exactly the same problem as described here. But I need my ULA-Prefix (for evil NAT6 purposes since Mullvad only give me a /128). I'm thinking about moving my Nests to an interface which assigns GUAs but not ULAs. Is this achievable? I guess something like this would work; whereby ip6class is used:

config globals 'globals'
	option ula_prefix 'fdf3:e716:6c30::/48'

config interface 'wan'
	option proto 'pppoe'
	option ifname 'eth0'
	option ipv6 'auto'
	option peerdns '0'
	option dns '185.228.168.9 185.228.169.9'
	option username '...'
	option password '...'

config interface 'wan6'
	option ifname '@wan'
	option proto 'dhcpv6'
	option reqaddress 'try'
	option reqprefix 'auto'
	option peerdns '0'
	option dns '2a0d:2a00:1::2 2a0d:2a00:2::2'

config interface 'iot'
	option type 'bridge'
	option proto 'static'
	option ip6assign '64'
    option ip6hint 'BB'
    list ip6class 'wan6 wan'
	option ipaddr '192.168.20.1'
	option netmask '255.255.255.0'
	option ifname 'eth1.20'
2

Very possible if you use this option.

3 Likes
3

oddly, the 'iot' interface stopped dishing-out GUAs and ULAs with list ip6class 'wan6 wan' added. Must be something simple (syntax error) so will dig deeper.

4

If must be:

list ip6class wan
list ip6class wan6
3 Likes
5

that's done the trick. Thanks!

6

I don't see why you need to add the wan interface there. IPv6 is handled by wan6 anyway.

3 Likes
7

oops..yes, you're correct. Changed to:

list ip6class wan6
list ip6class wan_6
1 Like
8

It turns out ULA had nothing to do with the issue Nest Protect disassociated due to inactivity

1 Like
9

thanks, @jbrossard; appreciate the extra info. Conincidentally, I was having trouble adding a new protect to my Nest account earlier today but was able to resolve it by changing DNS Servers. I'll do similarly (turning off DNSSEC) and keep an eye on it over the next few days.

10

What did you change from/to?

11

I temporarily switched from CleanBrowsing.org to Google (8.8.8.8). When I've got a bit of time at the weekend, I'll probably switch to NextDNS; will let you know how it goes.

12

My Nest Protect has been trouble free since turning off DNSSEC at the router.

I'm using Quad9 but have switched to Quad9 with ECS (dns11.quad9.com) to see if streaming lag when starting streaming a video will improve. Does Quad9 implement DNSSEC and What is EDNS Client-Subnet

I am also running stubby for DoT. That pretty much sums up my DNS setup.

1 Like
13

thanks. That's really helpful. Very similar to my set-up: Stubby for DoT but with Cleanbrowing's DNS servers. I've turned DNSSEC off on the router now, so hopefully that'll sort it out!

Thanks, again!

14

I see cleanbrowsing.org also enforces DNSSEC so doing it at the router is redundant, just like my setup with DNSSEC enabled was redundant when using Quad9.

I hope the Nest Protects stay online! I've been working on this issue for a week!

1 Like
15

Just to close-off this topic:

Everything is running perfectly since turning-off DNSSEC on the router, as suggested by @jbrossard. My Nest Protects have remained online.

I've also susbcribed to NextDNS which enforces DNSSEC and provides some additional really neat features.

Job done, I think!

1 Like
16

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.