Interim IPv6 ULA & ISP /64

Installing and Using OpenWrt Network and Wireless Configuration
1

Hello all,
I just tried to find something to this topic, but I couldnt find actual info for the latest openwrt.

wan6: get a IPv6 /64 from ISP. prefix-delegation is set off. Literally everything is set off, regarding to ipv6. Curiously there seem to be a IPv6 adress announced by wan6 interface.

lan: get a static ULA-Prefix, delegation is set off. All the devices behind lan get a ipv6 ULA-adress correctly, it seems. RA lifetime is set to 0 manually.

Still I recieve messages like:

[27.05.2026, 10:19:51 MESZ] daemon.warn: odhcpd[1895]: A default route is present but there is no public prefix on lan thus we announce no default route by setting ra_lifetime to 0!

Cant get rid of them and would like to. I think there is something wrong with the configs.

2

Are you saying something is broken, or that you intended to disable IPv6. The wording of your post isn't clear.

Get rid of the messages, or get rid of the IPv6 addresses?

Are you willing to share the configs (i.e., network, dhcp, firewall)?

Also, you may want to clarify you desires.

3

I disabled IPv6 on wan6.

The messages.

Yes, network dhcp. Firewall is set off at the moment.

/ # cat /etc/config/network

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        list ipaddr '127.0.0.1/8'

config globals 'globals'
        option dhcp_default_duid '000405a025cc49b1ba509b4d81c524c0'
        option packet_steering '1'
        option ula_prefix 'fdff:1e9:7b12:abcd::/64'

config device
        option name 'br-lan'
        option type 'bridge'
        option ipv6 '1'
        list ports 'lan1'
        list ports 'lan2'
        list ports 'lan3'
        list ports 'lan4'
        list ports 'lan5'

config interface 'lan'
        option device 'br-lan'
        option proto 'static'
        option multipath 'off'
        list ipaddr '192.168.100.1/24'
        list ip6class 'local'
        option delegate '0'
        list ip6addr 'fd12:3456:789a::1/64'

config interface 'wan'
        option device 'eth1'
        option proto 'dhcp'
        option peerdns '0'
        option multipath 'off'
        option broadcast '1'
        option delegate '0'
        option hostname '*'

config interface 'wan6'
        option device 'eth1'
        option proto 'dhcpv6'
        option reqaddress 'none'
        option norelease '1'
        option peerdns '0'
        option multipath 'off'
        option reqprefix 'no'
        option force_link '1'
        option sourcefilter '0'
        option delegate '0'

config interface 'wifiintern'
        option proto 'static'
        option multipath 'off'
        list ipaddr '192.168.200.1/24'

config interface 'wifiextern'
        option proto 'static'
        option multipath 'off'
        list ipaddr '192.168.225.1/24'
        option delegate '0'
        option force_link '0'

config dnsmasq
        option domainneeded '1'
        option localise_queries '1'
        option rebind_protection '1'
        option rebind_localhost '1'
        option local '/lan/'
        option domain 'lan'
        option cachesize '10000'
        option readethers '1'
        option leasefile '/tmp/dhcp.leases'
        option localservice '1'
        option ednspacket_max '1232'
        option noresolv '1'
        option min_cache_ttl '3600'
        option max_cache_ttl '86400'
        list server '127.0.0.1#5354'
        list server '::1#5354'
        option stripmac '1'
        option stripsubnet '1'
        option nonegcache '1'
        list address '/ams1.dns4all.eu/'
        option logdhcp '1'
        list listen_address '192.168.100.1'
        option authoritative '1'
        list interface 'lan'
        list interface 'wifiextern'

config dhcp 'lan'
        option interface 'lan'
        option start '100'
        option limit '150'
        option leasetime '12h'
        option dhcpv4 'server'
        option dhcpv6 'server'
        option ra 'server'
        option ra_preference 'medium'
        option dns_service '0'
        list ra_flags 'managed-config'
        list ra_flags 'other-config'
        option ra_lifetime '0'

config dhcp 'wan'
        option interface 'wan'
        option ignore '1'

config odhcpd 'odhcpd'
        option leasefile '/tmp/odhcpd.leases'
        option leasetrigger '/usr/sbin/odhcpd-update'
        option loglevel '5'
        option piodir '/tmp/odhcpd-piodir'
        option hostsdir '/tmp/hosts'

config dhcp 'wifiextern'
        option interface 'wifiextern'
        option start '100'
        option limit '150'
        option leasetime '12h'
        option dhcpv4 'server'

My desire is:

I would like to have an internal network where devices can communicate with ipv4 oder ipv6. The long run requires ISP to offer IPv6 lower than /64 and then NPT/NT66 the internal ULA-Adresses to the global adresses. Because its more privacy friendly when my ISP cannot see behind the wan-port of the router.

But for that, I need to have a good config that is not throwing out messages in the logs.

4

That triggers the warning and it should be as there is no public prefix.

The best approach is to ignore it.

You can change the settings to announce default route in the DHCP settings

5

TBH, if you enable masquerade6 on a default configuration, everything should work as you desire. I'm not sure why you decided to "disable" IPv6 in this interim config (BTW, I fixed the title).

Disable ULA :man_shrugging:

Or proced to setup masq6 on WAN, route the ULA, etc.

(The message is self explanatory.)

6

I read that this requires PD to all downstream devices. I "have" no default route of ISP Prefixes at the moment. The goal is to seperate the lan-network from the global/routable IPv6 of wan6.

7

You only need PD on downstream routers.

Because you've altered your configurations (I'm guessing you're aware of this).

  • To be clear, this can be done with a /64.
  • It's not clear if you've tested requesting an appropriate delegation as of yet
8

ok guys,

how would you doing this:

make LAN devices communicate via ULA (only non-routable, private adresses) and SEPARATE the global WAN IPv6 from lan?

9

It might help to clarify why you're making an "interim configuration".

Clarify this phease. WAN and LAN are already separate interfaces. It's not clear what you mean here.

You want to perform NAT for IPv6 like IPv4 (even though a firewall makes this unnecessary), instead of having GUAs assigned directly to LAN clients, correct?

10

Yes.

Would you pls explain this? What do I need to do, that my ISP can only see to the wan-door and not behind it?

11

What do you think your isp would be able to see if you gave devices globally addressable ipv6 addresses?

12

With a default configuration, all one needs to do is:

  • Enable IPv6 masquerade on the WAN interface

Test and let us know.

(That should be it, but you may have to create a route for the ULA to use WAN. Test first and report the result.)

13
  • IPv6 is end to end adressing. It looks through routers.

What do you think ISPs can see then? Probably not the pictures of my mum showering, right? Phew!

Its about a little bit more privacy. Since someone is using DoT or DoH this would be a bit more private surfing, too. If someone is using VPN, this probably would be the best to keep out the ISPs gaining knowledge of someones online-behavior or topology.

14

I'll do and come back here! Thanks!

15

This statement is very...non-technical.

You do realize your public IPv6 subnet/PD is still the same source router, hence still identifying the source of the traffic nonetheless. Since it's opposite of usual in the IPv6 world, that behavior is easily identified.

NAT was never a privacy or firewalling invention (originally), it was designed to damper or slow exhaustion of public IPv4 addresses. Unless you're suggesting security through obscurity - most engineers reject that as false.

16

If you really want only ula on lan, but still be able to reach global IPv6 wan then you need network prefix translation (npt) configured.

17

And so does ipv4! It was only the introduction of NAT in 1995 because even back then we would have run out of global ipv4 addresses....

18

But here today now I'm adressing my devices with 192.168.x.x and the isp is not able to see which adress is initializing a connection, is not able to make a topology, because of natting. Thats definitely a privacy enhancer, if only a little, but it is. You probably know Amazons Eeco? ISP are selling our data like every companies which want to make money do likely, and the main reason I'm doing all this router-s*** is because I dont want to be spied on. It grows me grey hairs honestly.

If we have more and more IPv6 in future: I dont want its features. I want all this crap behaves privacy by default, no compromises, no technically bla bla. Call me idealist.

:slight_smile:

19

GrapheneOS is never invented for degoogling, but makes a great job on it!

20

Yes recommend to use that, just as an adblocking package

Yes if you do not trust your ISP I would certainly recommend it

But not using GUA's does not add much as the Masquerading will show your GUA anyway so that is just tin foil hat stuff :wink: