IPv6 DNS Filter

Installing and Using OpenWrt
1

Hello. I'll start by totally admitting that I'm not very familiar with IPv6. So I apologize in advance for that. Very honestly, I searched the forums for topics like this and found several that seem to be about more or less the same question, but I could not quite follow the discussion/advice.

I recently switched from cable internet to fiber optic - whether due to the ISP change or the technology change, IPv6 seems to actually work on my home network now.

I have a network wide ad-blocking (DNS filter) device on my network to which I wish to direct all DNS traffic. I've set the desired DNS server in OpenWrt (I use Luci) and set which DNS it should advertise to clients for IPv4. The ad-blocker is set with a static IPv4 address (DHCP reservation). I've also set up this config to catch hard-coded DNS entries: https://jeff.vtkellers.com/posts/technology/force-all-dns-queries-through-pihole-with-openwrt

But traffic that should be very obviously getting blocked still isn't (e.g. I have reddit blocked both on the ad-blocker and on the upstream DNS that it points to, but I can still access it on the home network). When I do an ipconfig on my machine, the IPv6 DNS shows first. And when I run a tracert, it shows all IPv6 addresses.

I would like to learn how to assign my ad-blocker a static IPv6 address and advertise that to clients (bonus points if there's a way to catch any hard-coded IPv6 traffic as well).

Points of confusion:
The devices in the active IPv6 leases on the Status>Overview list seem to show 2 IPv6 addresses.
When I try to "Set Static" for the ad-blocker device, it sets an entry with a DUID instead of an IPv6 address in the static leases.
Can I just add an IPv6 address after a comma to the Network>Interfaces>lan>DHCP Server>Advanced Settings>DHCP-Options? For example: 6,IPv4address,IPv6address.

If possible, I'd prefer not to just simply disable IPv6 entirely, since I understand it's more efficient. Any help would be greatly appreciated.

2

No, go to the lan interface / DHCP Server / IPv6 Settings / Announced IPv6 DNS servers and add the device’s ULA address (starts with fd usually, won’t change as your public prefix changes).

For an IPv6 DNS intercept (update the dest_ip):

uci add firewall redirect
uci set firewall.@redirect[-1].target='DNAT'
uci set firewall.@redirect[-1].name='IPv6 intercept'
uci set firewall.@redirect[-1].family='ipv6'
uci set firewall.@redirect[-1].src='lan'
uci set firewall.@redirect[-1].src_dport='53'
uci set firewall.@redirect[-1].dest_ip='fd…'

I’ve not played with static IPv6 addresses, so I’ll let someone else help you there.

3

Thanks!
Just for my knowledge, what's the difference between the IPv6 address that starts with fd and the one that starts with 26? Why do all the devices have 2?

4

The 26 addresses originate from the IPv6 prefix your ISP gives you, and is subject to change if the router or modem reboots, or the prefix delegation expires, etc.

The ULA fd prefix is generated locally by OpenWrt on first boot and won’t change unless you change it, or reset to factory defaults. Think of it as the IPv6 equivalent of private IPv4 addresses. Not able to route to the Internet, but good for internal LAN communication.

Since you don’t want to worry about your DHCPv6 configuration having to change if the ISP prefix changes, the ULA is a safer choice in my opinion.

The router’s DHCPv6 server odhcpd serves IPv6 addresses from both prefixes assigned to your LAN interface.

1 Like
5

Ah, interesting.
Hopefully that means I'll be alright, even if no one chimes in with a way to effectively set a static IPv6 lease.