IPv6 configuration for mobile sim router

Installing and Using OpenWrt
1

Hi. I have been unable to get Wireguard to work with OpenWrt using an IPv6 endpoint. The sim card is assigned a /64 address. Devices connected to the Outdoor Router EZR34T-5G router are able to obtain public IPv6 addresses. The port has been opened in the traffic rules page. It seems that inbound IPv6 traffic is not getting routed. I have verified that it is not a sim card issue as I could set up a Wireguard connection using a Telit router that is not on OpenWrt and using a PC as a server (also tried this with the other router). Hope to get some advice on this issue.

Hp[

**cat /etc/config/network**

config interface 'loopback'
        option ifname 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'fdd2:7f55:a6d7::/48'

config interface 'lan'
        option type 'bridge'
        option proto 'static'
        option ipaddr '192.168.30.1'
        option netmask '255.255.255.0'
        option ip6assign '64'
        option ifname 'eth0.1'

config device 'lan_dev'
        option name 'eth0.1'
        option macaddr '50:b3:b4:25:41:e0'

config interface 'wan'
        option ifname 'eth0.2'
        option proto 'dhcpv6'
        option reqaddress 'try'
        option reqprefix 'auto'
        option peerdns '0'
        option dns '2001:4860:4860::8888'

config device 'wan_dev'
        option name 'eth0.2'
        option macaddr '50:b3:b4:25:41:e1'

config interface 'MOBILE'
        option proto 'modemmanager'
        option device '/sys/devices/platform/1e1c0000.xhci/usb2/2-1'
        option simauto '0'
        option apn1 'sunsurf'
        option iptype1 'ipv4v6'
        option forbid_roaming1 '0'
        option forbid_roaming2 '0'
        option support_modes '3g|4g|5g'
        option perfer_mode '5g'
        option metric '3'
        option apn 'sunsurf'
        option iptype 'ipv4v6'
        option forbid_roaming '0'
        option support_bands 'utran-1|utran-4|utran-6|utran-5|utran-8|utran-2|eutran-1|eutran-2|eutran-3|eutran-4|eutran-5|eutran-7|eutran-8|eutran-12|eutran-13|eutran-14|eutran-17|eutran-18|eutran-19|eutran-20|eutran-25|eutran-26|eutran-28|eutran-29|eutran-30|eutran-32|eutran-34|eutran-38|eutran-39|eutran-40|eutran-41|eutran-42|eutran-43|eutran-46|eutran-48|eutran-66|eutran-71|utran-19|ngran-1|ngran-2|ngran-3|ngran-5|ngran-7|ngran-8|ngran-12|ngran-13|ngran-14|ngran-18|ngran-20|ngran-25|ngran-26|ngran-28|ngran-29|ngran-30|ngran-38|ngran-40|ngran-41|ngran-48|ngran-66|ngran-70|ngran-71|ngran-75|ngran-76|ngran-77|ngran-78|ngran-79'
        option allow_roaming1 '0'
        option allowedmode 'any'
        option preferredmode '5g'

config switch
        option name 'switch0'
        option reset '1'
        option enable_vlan '1'

config switch_vlan
        option device 'switch0'
        option vlan '1'
        option ports '0 1 2 3 6t'

config switch_vlan
        option device 'switch0'
        option vlan '2'
        option ports '4 6t'

config interface 'wg0'
        option proto 'wireguard'
        option private_key '<private key>'
        option listen_port '51820'
        list addresses '10.8.0.1/24'
        list addresses 'fe80::1/64'

config wireguard_wg0
        option route_allowed_ips '1'
        option persistent_keepalive '25'
        option description 'Client 1'
        option public_key '<public key>'
        option endpoint_port '51820'
        list allowed_ips '10.8.0.2/32'
        list allowed_ips 'fe80::2/128'

config route6

**cat /etc/config/firewall**

config defaults
        option input 'ACCEPT'
        option output 'ACCEPT'
        option fullcone '0'
        option forward 'ACCEPT'
        option syn_flood '1'

config zone
        option name 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        option network 'lan yyy'

config zone
        option name 'wan'
        option output 'ACCEPT'
        option mtu_fix '1'
        option input 'ACCEPT'
        option forward 'ACCEPT'
        option masq6 '1'
        option masq '1'
        option network 'MOBILE wan'

config zone
        option name 'guest'
        option forward 'ACCEPT'
        option output 'ACCEPT'
        option input 'ACCEPT'
        option network 'guest'

config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-IGMP'
        option src 'wan'
        option proto 'igmp'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option src_ip 'fc00::/6'
        option dest_ip 'fc00::/6'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-MLD'
        option src 'wan'
        option proto 'icmp'
        option src_ip 'fe80::/10'
        list icmp_type '130/0'
        list icmp_type '131/0'
        list icmp_type '132/0'
        list icmp_type '143/0'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'
        option icmp_type 'echo-reply destination-unreachable echo-request router-advertisement router-solicitation time-exceeded'
        option dest 'lan'

config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-IPSec-ESP'
        option src 'wan'
        option dest 'lan'
        option proto 'esp'
        option target 'ACCEPT'

config rule
        option name 'Allow-ISAKMP'
        option src 'wan'
        option dest 'lan'
        option dest_port '500'
        option proto 'udp'
        option target 'ACCEPT'

config include
        option path '/etc/firewall.user'

config rule
        option target 'ACCEPT'
        option src 'guest'
        option name 'DHCP'
        option proto 'udp'
        option dest_port '67-68'

config rule
        option target 'ACCEPT'
        option src 'guest'
        option name 'DNS'
        option proto 'udp'
        option dest_port '53'

config rule
        option target 'ACCEPT'
        option src 'wan'
        option proto 'tcp'
        option name 'ssh'
        option dest_port '22'
        option extra '-m conntrack --ctstate DNAT'

config redirect
        option target 'DNAT'
        option src 'wan'
        option dest 'lan'
        option src_dport '880'
        option dest_ip '192.168.30.1'
        option dest_port '80'
        option name 'http'
        option proto 'tcp udp'

config redirect
        option target 'DNAT'
        option src 'wan'
        option dest 'lan'
        option proto 'tcp'
        option src_dport '22222'
        option dest_ip '192.168.30.1'
        option dest_port '22'
        option name 'ssh'

config rule
        option target 'ACCEPT'
        option proto 'tcp'
        option dest_port '80'
        option name 'http'
        option extra '-m conntrack --ctstate DNAT'
        option src '*'
        option dest 'lan'

config include 'pbridge'
        option type 'script'
        option path '/tmp/pbridge/pbridge_firewall.sh'
        option family 'any'
        option reload '1'

config redirect
        option target 'DNAT'
        option src 'wan'
        option dest 'lan'
        option proto 'tcp udp'
        option src_dport '1234'
        option dest_ip '192.168.30.196'
        option dest_port '1234'
        option name 'camera'

config rule
        option target 'ACCEPT'
        option name 'Allow-Wireguard-Inbound'
        option proto 'udp'
        option dest_port '51820'
        option family 'ipv6'
        option src 'wan'
        option dest 'lan'

config rule
        option target 'ACCEPT'
        option proto 'tcp udp'
        option dest_port '1234'
        option name 'Open1234'
        option src 'wan'
        option dest '*'
        option enabled '0'

config include 'miniupnpd'
        option type 'script'
        option path '/usr/share/miniupnpd/firewall.include'
        option family 'any'
        option reload '1'

config zone
        option input 'ACCEPT'
        option forward 'ACCEPT'
        option output 'ACCEPT'
        option name 'wg_fw'
        option masq '1'
        option mtu_fix '1'
        option network 'wg0'

config forwarding
        option dest 'wg_fw'
        option src 'lan'

config forwarding
        option dest 'wan'
        option src 'lan'

config forwarding
        option dest 'wan'
        option src 'wg_fw'

config forwarding
        option dest 'lan'
        option src 'wan'

config forwarding
        option dest 'wg_fw'
        option src 'wan'


**cat /etc/config/dhcp**

config dnsmasq
        option localise_queries '1'
        option rebind_protection '1'
        option rebind_localhost '1'
        option local '/lan/'
        option domain 'lan'
        option expandhosts '1'
        option readethers '1'
        option leasefile '/tmp/dhcp.leases'
        option resolvfile '/tmp/resolv.conf.auto'
        option nonwildcard '1'
        option domainneeded '1'
        option authoritative '1'
        option localservice '1'

config dhcp 'lan'
        option interface 'lan'
        option start '100'
        option limit '150'
        option leasetime '12h'
        option ra 'server'
        option dhcpv6 'server'
        option ra_management '1'
        option ra_default '1'

config dhcp 'wan'
        option interface 'wan'
        option ignore '1'

config dhcp 'guest'
        option interface 'guest'
        option start '100'
        option limit '150'
        option leasetime '12h'

config odhcpd 'odhcpd'
        option maindhcp '0'
        option leasefile '/tmp/hosts/odhcpd'
        option leasetrigger '/usr/sbin/odhcpd-update'
        option loglevel '4'

config dhcp 'LAN6'
        option start '100'
        option leasetime '12h'
        option limit '150'
        option interface 'LAN6'

Wireguard client configuration

**Client 1**
PrivateKey = <key>
ListenPort = 51820
Address = 10.8.0.2/24, fe80::2/64
DNS = 8.8.8.8, 2001:4860:4860::8888

[Peer]
PublicKey = <Server public key>
AllowedIPs = 0.0.0.0/0, ::/0
Endpoint = [2401:7400:6017:xxxx:xxxx:xxxx:xxxx:xxxx]:51820 Note: Router IP
2

which openwrt version would that be, considering zero Telit devices are supported ?

3

The Telit one is not using OpenWrt. I have edited the post to make it clearer.

4

ok, then what device are you using for openwrt ?

post ubus call system bus output.

5

This model from Outdoor Router.

I will post the output tomorrow when I have access.

6

EZR34T-5G is also unsupported, unless sold under a different name.

7

And it has fw3 which is barely remembered.

no nat66 in fw3/iptables, you have to get a subnet delegation

8

this is the output

 "kernel": "4.14.171",
        "hostname": "OutdoorRouter",
        "system": "MediaTek MT7621 ver:1 eco:4",
        "model": "EZENOS EZR4XT",
        "board_name": "ezr4xt",
        "release": {
                "distribution": "EZR34T-5G",
                "version": "EV4052",
                "revision": "r7676-cddd7b4c77",
                "target": "ramips\/mt7621",
                "description": "EV4052"
9

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.