IPv6 Guest network on dumb AP

snevas · April 19, 2021, 6:35pm

Hi all,

I've been playing with my Mikrotik hAP AC2 which has just recently became OpenWrt (snapshot) compatible.

What I've already accomplished:

Switch all the ports together and disable DHCP on LAN
Made a WPA3 wireless that adds clients to this network
Followed this guide to make a second Guest wireless network with DHCP
I've made a DHCPv6 client interface that gets a public delegated IPv6 prefix (PD) from my router

The only thing I can't get to work is to get a IPv6 address from the LAN > Guest network through the correct icmp traffic rules or through DHCPv6 relay with a delegated address.
The LAN wireless clients do get a IPv6 address. I also tried to use the predefined traffic rules for obtaining WAN IPv6 addresses to get to propagate them to the Guest network, with no success.

Maybe somebody wants to look through my configuration with me on a voice chat with my screen shared? In return I can add the solution we've found to above mentioned guide or a new one.
Of course the solution will also be shared here.

I'm available for the next few hours. If someone is interested, let me know. Else we can of course also do it the old-fashioned way in the thread below

trendy · April 19, 2021, 7:16pm

Please run the following commands (copy-paste the whole block) and paste the output here, using the "Preformatted text </> " button:

Remember to redact passwords, MAC addresses and any public IP addresses you may have

ubus call system board; \
uci export network; uci export wireless; \
uci export dhcp; uci export firewall; \
head -n -0 /etc/firewall.user; \
ip -6 addr ; ip -6 ro li tab all ; ip -6 ru

snevas · April 19, 2021, 7:32pm

I've removed a lot of clutter from my configuration that could act distracting:

root@openwrt:~# ubus call system board; \
> uci export network; uci export wireless; \
> uci export dhcp; uci export firewall; \
> head -n -0 /etc/firewall.user; \
> ip -6 addr ; ip -6 ro li tab all ; ip -6 ru
{
	"kernel": "5.4.110",
	"hostname": "openwrt",
	"system": "ARMv7 Processor rev 5 (v7l)",
	"model": "MikroTik hAP ac2",
	"board_name": "mikrotik,hap-ac2",
	"release": {
		"distribution": "OpenWrt",
		"version": "SNAPSHOT",
		"revision": "r16516-e6d66375cb",
		"target": "ipq40xx/mikrotik",
		"description": "OpenWrt SNAPSHOT r16516-e6d66375cb"
	}
}
package network

config interface 'loopback'
	option ifname 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config globals 'globals'
	option ula_prefix 'fd63:d979:c917::/48'

config interface 'lan'
	option type 'bridge'
	option proto 'static'
	option netmask '255.255.255.0'
	option ifname 'eth0 eth1'
	option ipaddr '192.168.178.254'
	option gateway '192.168.178.1'
	option delegate '0'
	list dns '192.168.178.1'

config device 'lan_eth0_dev'
	option name 'eth0'
	option macaddr 'xx:xx:xx:xx:0e:5b'

config device 'wan_eth1_dev'
	option name 'eth1'
	option macaddr 'xx:xx:xx:xx:0e:5a'

config switch
	option name 'switch0'
	option reset '1'
	option enable_vlan '1'

config switch_vlan
	option device 'switch0'
	option vlan '1'
	option ports '1 2 3 4 0'

config interface 'lan6'
	option proto 'dhcpv6'
	option ifname 'br-lan'
	option reqaddress 'try'
	option reqprefix '60'
	option delegate '0'

config interface 'guest'
	option proto 'static'
	option ipaddr '192.168.254.1'
	option netmask '255.255.255.0'
	list ip6class 'lan6'
	option ip6assign '64'

package wireless

config wifi-device 'radio0'
	option type 'mac80211'
	option hwmode '11g'
	option path 'platform/soc/a000000.wifi'
	option htmode 'HT40'
	option channel 'auto'
	option cell_density '0'

config wifi-iface 'default_radio0'
	option device 'radio0'
	option mode 'ap'
	option ssid 'lan wifi'
	option encryption 'sae'
	option key 'password'
	option ieee80211w '2'
	option network 'lan'

config wifi-device 'radio1'
	option type 'mac80211'
	option hwmode '11a'
	option path 'platform/soc/a800000.wifi'
	option htmode 'VHT80'
	option channel 'auto'
	option cell_density '0'

config wifi-iface 'default_radio1'
	option device 'radio1'
	option mode 'ap'
	option encryption 'sae'
	option key 'password'
	option ieee80211w '2'
	option network 'lan'
	option ssid 'lan wifi'

config wifi-iface 'wifinet2'
	option device 'radio0'
	option mode 'ap'
	option ssid 'guestwifi'
	option encryption 'sae-mixed'
	option key 'password'
	option ieee80211w '1'
	option network 'guest'

package dhcp

config dnsmasq
	option domainneeded '1'
	option boguspriv '1'
	option filterwin2k '0'
	option localise_queries '1'
	option rebind_protection '1'
	option rebind_localhost '1'
	option local '/lan/'
	option domain 'lan'
	option expandhosts '1'
	option nonegcache '0'
	option authoritative '1'
	option readethers '1'
	option leasefile '/tmp/dhcp.leases'
	option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
	option nonwildcard '1'
	option localservice '1'
	option ednspacket_max '1232'

config dhcp 'lan'
	option interface 'lan'
	option dhcpv4 'server'
	option ra_slaac '1'
	list ra_flags 'managed-config'
	list ra_flags 'other-config'
	option ignore '1'

config dhcp 'wan'
	option interface 'wan'
	option ignore '1'

config odhcpd 'odhcpd'
	option maindhcp '0'
	option leasefile '/tmp/hosts/odhcpd'
	option leasetrigger '/usr/sbin/odhcpd-update'
	option loglevel '4'

config dhcp 'guest'
	option interface 'guest'
	option start '100'
	option limit '150'
	option leasetime '12h'

config dhcp 'test'
	option interface 'test'
	option start '100'
	option limit '150'
	option leasetime '12h'

package firewall

config defaults
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option synflood_protect '1'

config zone
	option name 'lan'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'ACCEPT'
	option masq '1'
	list network 'lan'
	list network 'lan6'

config zone
	option input 'REJECT'
	option output 'ACCEPT'
	option name 'guest'
	option forward 'REJECT'
	list network 'guest'

config rule
	option name 'Allow-DHCP-Renew'
	option proto 'udp'
	option target 'ACCEPT'
	option family 'ipv4'
	option src 'guest'
	option dest_port '67-68'

config rule
	option name 'Allow-Ping'
	option proto 'icmp'
	option icmp_type 'echo-request'
	option family 'ipv4'
	option target 'ACCEPT'
	option src 'guest'

config rule
	option name 'Allow-IGMP'
	option proto 'igmp'
	option family 'ipv4'
	option target 'ACCEPT'
	option src 'guest'

config rule
	option name 'Allow-DHCPv6'
	option proto 'udp'
	option src_ip 'fc00::/6'
	option dest_ip 'fc00::/6'
	option dest_port '546'
	option family 'ipv6'
	option target 'ACCEPT'
	option src 'guest'

config rule
	option name 'Allow-MLD'
	option proto 'icmp'
	option src_ip 'fe80::/10'
	list icmp_type '130/0'
	list icmp_type '131/0'
	list icmp_type '132/0'
	list icmp_type '143/0'
	option family 'ipv6'
	option target 'ACCEPT'
	option src 'guest'

config rule
	option name 'Allow-ICMPv6-Input'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	list icmp_type 'router-solicitation'
	list icmp_type 'neighbour-solicitation'
	list icmp_type 'router-advertisement'
	list icmp_type 'neighbour-advertisement'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'
	option src 'guest'

config rule
	option name 'Allow-ICMPv6-Forward'
	option dest '*'
	option proto 'icmp'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'
	option src 'guest'
	list icmp_type 'destination-unreachable'
	list icmp_type 'echo-reply'
	list icmp_type 'echo-request'
	list icmp_type 'neighbour-advertisement'
	list icmp_type 'neighbour-solicitation'
	list icmp_type 'packet-too-big'
	list icmp_type 'router-advertisement'
	list icmp_type 'router-solicitation'
	list icmp_type 'time-exceeded'

config include
	option path '/etc/firewall.user'

config forwarding
	option src 'guest'
	option dest 'lan'

config rule
	option name 'Guest-DNS'
	option src 'guest'
	option dest_port '53'
	option target 'ACCEPT'

config rule
	option name 'Guest-DHCP6'
	option family 'ipv6'
	list proto 'udp'
	option src 'guest'
	option dest '*'
	option dest_port '546'
	option target 'ACCEPT'

config rule
	option name 'Guest-Block'
	option src 'guest'
	option dest 'lan'
	list dest_ip '192.168.178.0/24'
	option target 'DROP'

# This file is interpreted as shell script.
# Put your custom iptables rules here, they will
# be executed with each firewall (re-)start.

# Internal uci firewall chains are flushed and recreated on reload, so
# put custom rules into the root chains e.g. INPUT or FORWARD or into the
# special user chains, e.g. input_wan_rule or postrouting_lan_rule.
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 state UNKNOWN qlen 1000
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
6: br-lan: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 state UP qlen 1000
    inet6 xxxx:xx:xx:ce01:76xx:xxxx:xxxx:e5b/64 scope global dynamic noprefixroute 
       valid_lft 6971sec preferred_lft 3112sec
    inet6 fe80::76xx:xxxx:xxxx:e5b/64 scope link 
       valid_lft forever preferred_lft forever
10: wlan1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 state UP qlen 1000
    inet6 fe80::76xx:xxxx:xxxx:e60/64 scope link 
       valid_lft forever preferred_lft forever
13: wlan0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 state UP qlen 1000
    inet6 fe80::76xx:xxxx:xxxx:e5f/64 scope link 
       valid_lft forever preferred_lft forever
14: wlan0-1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 state UP qlen 1000
    inet6 fe80::74xx:xxxx:xxxx:e5f/64 scope link 
       valid_lft forever preferred_lft forever
default from xxxx:xx:xx:ce01::/64 via fe80::eadf:70ff:fe3a:883c dev br-lan  metric 512 
default from xxxx:xx:xx:cef0::/60 via fe80::eadf:70ff:fe3a:883c dev br-lan  metric 512 
xxxx:xx:xx:ce00::/56 from xxxx:xx:xx:ce01::/64 via fe80::eadf:70ff:fe3a:883c dev br-lan  metric 512 
xxxx:xx:xx:ce00::/56 from xxxx:xx:xx:cef0::/60 via fe80::eadf:70ff:fe3a:883c dev br-lan  metric 512 
xxxx:xx:xx:ce01::/64 dev br-lan  metric 256 
unreachable xxxx:xx:xx:ce01::/64 dev lo  metric 2147483647 
unreachable xxxx:xx:xx:cef0::/60 dev lo  metric 2147483647 
unreachable fd63:d979:c917::/48 dev lo  metric 2147483647 
fe80::/64 dev br-lan  metric 256 
fe80::/64 dev wlan1  metric 256 
fe80::/64 dev wlan0  metric 256 
fe80::/64 dev wlan0-1  metric 256 
local ::1 dev lo table local  metric 0 
anycast xxxx:xx:xx:ce01:: dev br-lan table local  metric 0 
local xxxx:xx:xx:ce01:76xx:xxxx:xxxx:e5b dev br-lan table local  metric 0 
anycast fe80:: dev br-lan table local  metric 0 
anycast fe80:: dev wlan1 table local  metric 0 
anycast fe80:: dev wlan0 table local  metric 0 
anycast fe80:: dev wlan0-1 table local  metric 0 
local fe80::74xx:xxxx:xxxx:e5f dev wlan0-1 table local  metric 0 
local fe80::76xx:xxxx:xxxx:e5b dev br-lan table local  metric 0 
local fe80::76xx:xxxx:xxxx:e5f dev wlan0 table local  metric 0 
local fe80::76xx:xxxx:xxxx:e60 dev wlan1 table local  metric 0 
multicast ff00::/8 dev br-lan table local  metric 256 
multicast ff00::/8 dev wlan1 table local  metric 256 
multicast ff00::/8 dev wlan0 table local  metric 256 
multicast ff00::/8 dev wlan0-1 table local  metric 256 
0:	from all lookup local 
32766:	from all lookup main 
4200000001:	from all iif lo lookup unspec 12
4200000006:	from all iif br-lan lookup unspec 12
4200000006:	from all iif br-lan lookup unspec 12
4200000014:	from all iif wlan0-1 lookup unspec 12

trendy · April 20, 2021, 10:01am

uci del network.lan6.delegate ; uci commit network ; ifup lan6

snevas · April 20, 2021, 10:51am

Great, this gets a ::1 address with the prefix on the interface. But still clients do not get a prefix address when RA and DHCPv6 are in server mode. Is my firewall too strict?
Wireshark on a wireless client shows no responses on solicits.

trendy · April 20, 2021, 11:05am

snevas:

config rule
	option name 'Allow-DHCPv6'
	option proto 'udp'
	option src_ip 'fc00::/6'
	option dest_ip 'fc00::/6'
	option dest_port '546'
	option family 'ipv6'
	option target 'ACCEPT'
	option src 'guest'

Wrong port, must be 547

snevas · April 20, 2021, 1:01pm

Thanks for your responses @trendy , but sadly this still does not fix it. Do you have time for a remote troubleshoot session? Of course I'll report back here if we solve it.

trendy · April 20, 2021, 1:23pm

Change guest zone input to accept, to verify that firewall is the culprit.

snevas · April 20, 2021, 3:15pm

Nothing, even after reboot router.

vgaetera · April 20, 2021, 4:25pm

uci set network.lan6.ifname="@lan"
uci commit network
/etc/init.d/network restart
sleep 10
ifstatus lan6

snevas · April 20, 2021, 7:28pm

That's a much better device to use! But unfortunately this does not change the behavior:

snevas · April 21, 2021, 8:55am

{
	"up": true,
	"pending": false,
	"available": true,
	"autostart": true,
	"dynamic": false,
	"uptime": 48529,
	"l3_device": "br-lan",
	"proto": "dhcpv6",
	"device": "br-lan",
	"metric": 0,
	"dns_metric": 0,
	"delegation": true,
	"ipv4-address": [
		
	],
	"ipv6-address": [
		{
			"address": "2a02:xx:xx:xxxx:xxxx:xxxx:xxxx:e5b",
			"mask": 64,
			"preferred": 3029,
			"valid": 6629
		}
	],
	"ipv6-prefix": [
		{
			"address": "2a02:xx:xx:xxf0::",
			"mask": 60,
			"preferred": 1922,
			"valid": 5522,
			"class": "lan6",
			"assigned": {
				"guest": {
					"address": "2a02:xx:xx:xxf0::",
					"mask": 64
				}
			}
		}
	],
	"ipv6-prefix-assignment": [
		
	],
	"route": [
		{
			"target": "2a02:xx:xx:xx01::",
			"mask": 64,
			"nexthop": "::",
			"metric": 256,
			"valid": 6629,
			"source": "::/0"
		},
		{
			"target": "2a02:xx:xx:xx00::",
			"mask": 56,
			"nexthop": "fe80::xxxx:xxxx:xxxx:883c",
			"metric": 512,
			"valid": 1578,
			"source": "2a02:xx:xx:xxf0::/60"
		},
		{
			"target": "2a02:xx:xx:xx00::",
			"mask": 56,
			"nexthop": "fe80::xxxx:xxxx:xxxx:883c",
			"metric": 512,
			"valid": 1578,
			"source": "2a02:xx:xx:xxxx:xxxx:xxxx:xxxx:e5b/64"
		},
		{
			"target": "::",
			"mask": 0,
			"nexthop": "fe80::xxxx:xxxx:xxxx:883c",
			"metric": 512,
			"valid": 1578,
			"source": "2a02:xx:xx:xxf0::/60"
		},
		{
			"target": "::",
			"mask": 0,
			"nexthop": "fe80::xxxx:xxxx:xxxx:883c",
			"metric": 512,
			"valid": 1578,
			"source": "2a02:xx:xx:xxxx:xxxx:xxxx:xxxx:e5b/64"
		}
	],
	"dns-server": [
		"fd00::xxxx:xxxx:xxxx:883c"
	],
	"dns-search": [
		
	],
	"neighbors": [
		
	],
	"inactive": {
		"ipv4-address": [
			
		],
		"ipv6-address": [
			
		],
		"route": [
			
		],
		"dns-server": [
			
		],
		"dns-search": [
			
		],
		"neighbors": [
			
		]
	},
	"data": {
		"passthru": "00380014xxxxxxxxxxxxxxxxxxxxxxxxxxxxxe3a883c00170010fd00000000000000eadf70fffe3a883c005600102a0200580093ce01eadf70fffe3a883c"
	}
}

trendy · April 21, 2021, 9:36am

uci set dhcp.guest.ra='server'
uci set dhcp.guest.dhcpv6='server'
uci set dhcp.guest.ra_management='1'
uci commit dhcp
/etc/init.d/odhcpd restart
ifup guest

snevas · April 21, 2021, 9:41am

Already the case:

root@openwrt:~# uci show dhcp.guest
dhcp.guest=dhcp
dhcp.guest.interface='guest'
dhcp.guest.start='100'
dhcp.guest.limit='150'
dhcp.guest.leasetime='12h'
dhcp.guest.ra='server'
dhcp.guest.ra_maxinterval='600'
dhcp.guest.ra_mininterval='200'
dhcp.guest.ra_lifetime='1800'
dhcp.guest.ra_mtu='0'
dhcp.guest.ra_hoplimit='0'
dhcp.guest.ra_management='1'
dhcp.guest.dhcpv6='server'

Should I still commit this?

trendy · April 21, 2021, 9:46am

It doesn't hurt.
Afterwards post again the configuration to see what might be missing:

uci export network; uci export dhcp; uci export firewall; \
head -n -0 /etc/firewall.user; \
ip6tables-save -c -t filter; \
ip -6 addr ; ip -6 ro li tab all ; ip -6 ru

Also have a look at this.

hnyman · April 21, 2021, 9:49am

Remove these, unless you explicitly want them.

Especially ra_mtu='0' may possibly cause problems.

The possible issue in LuCI has already been fixed, but you need to upgrade luci-mod-network to at least git-21.110.xxxxx

snevas · April 21, 2021, 10:14am

Thanks all, it was indeed these options! Couldn't pinpoint it as I figured something else was probably wrong.
In my package manager latest I can get is git-21.091.72214-504bdb2 for luci-mod-network, so I'll stick to manually configuring these with uci until the gets in the prod repo.

system · May 1, 2021, 10:15am

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.