Ipv6 is not connected, I can't ping global ipv6 addresses, ipv4 is working fine though

[pkanko]

Hey guys, I need help with my setup which is
ISP router LAN port => OpenWRT router WAN port
OpenWRT router LAN ports and WIFI => my home devices

I am running default OpenWRT out of the box configuration.
The WAN interface of OpenWRT router gets assigned global ipv6 address by the ISP router.
My devices gets assigned local ipv6 addresses by the OpenWRT router.

The problem is ipv6 is not working in the LAN device (Windows PC).
It means I can't ping an ipv6 global address like google DNS (2001:4860:4860::8888) from my LAN device.

But if I connect my Windows PC directly to ISP router's LAN port then
I can ping the global ipv6 address.

My OpenWRT router is TP-Link MR3420 v5

Does OpenWRT not support ipv6 out of the box?
Do I need to change some configuration?

Kindly help, many thanks

[Borromini]

Of course OpenWrt supports IPv6

I think you need to enable prefix delegation on your ISP's router. You might need to adapt the OpenWrt WAN settings as well (correct prefix etc). I'll leave the exact details to someone more familiar with IPv6 .

[trendy]

Please run the following commands (copy-paste the whole block) and paste the output here, using the "Preformatted text </> " button:

Remember to redact passwords, MAC addresses and any public IP addresses you may have

ubus call system board; \
uci export network;  \
uci export dhcp; uci export firewall; \
head -n -0 /etc/firewall.user; \
ip -6 addr ; ip -6 ro li tab all ; ip -6 ru; \
ls -l  /etc/resolv.* /tmp/resolv.* /tmp/resolv.*/* ; head -n -0 /etc/resolv.* /tmp/resolv.* /tmp/resolv.*/* ; \
ifstatus wan6; ifstatus lan

[pkanko]

So you are saying I can't reach ipv6 internet with local IPv6 addresses?
Shouldn't the router forward the local ipv6 requests to default ipv6 route if the ipv6 Masquerading is enabled?

[pkanko]

That was lot of commands. Here you go..

ubus call system board
======================
{
        "kernel": "5.4.154",
        "hostname": "OpenWrt",
        "system": "MediaTek MT7628AN ver:1 eco:2",
        "model": "TP-Link TL-MR3420 v5",
        "board_name": "tplink,tl-mr3420-v5",
        "release": {
                "distribution": "OpenWrt",
                "version": "21.02.1",
                "revision": "r16325-88151b8303",
                "target": "ramips/mt76x8",
                "description": "OpenWrt 21.02.1 r16325-88151b8303"
        }
}
======================
uci export network
======================
package network

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'fdc2:5f32:1f52::/48'

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'eth0.1'

config interface 'lan'
        option device 'br-lan'
        option proto 'static'
        option ipaddr '192.168.1.1'
        option netmask '255.255.255.0'
        option ip6assign '60'

config device
        option name 'eth0.2'
        option macaddr 'b0:95:75:2b:dc:19'

config interface 'wan'
        option device 'eth0.2'
        option proto 'dhcp'

config interface 'wan6'
        option device 'eth0.2'
        option proto 'dhcpv6'

config switch
        option name 'switch0'
        option reset '1'
        option enable_vlan '1'

config switch_vlan
        option device 'switch0'
        option vlan '1'
        option ports '1 2 3 4 6t'

config switch_vlan
        option device 'switch0'
        option vlan '2'
        option ports '0 6t'

======================
uci export dhcp
======================
package dhcp

config dnsmasq
        option domainneeded '1'
        option boguspriv '1'
        option filterwin2k '0'
        option localise_queries '1'
        option rebind_protection '1'
        option rebind_localhost '1'
        option local '/lan/'
        option domain 'lan'
        option expandhosts '1'
        option nonegcache '0'
        option authoritative '1'
        option readethers '1'
        option leasefile '/tmp/dhcp.leases'
        option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
        option nonwildcard '1'
        option localservice '1'
        option ednspacket_max '1232'

config dhcp 'lan'
        option interface 'lan'
        option start '100'
        option limit '150'
        option leasetime '12h'
        option dhcpv4 'server'
        option dhcpv6 'server'
        option ra 'server'
        option ra_slaac '1'
        list ra_flags 'managed-config'
        list ra_flags 'other-config'

config dhcp 'wan'
        option interface 'wan'
        option ignore '1'

config odhcpd 'odhcpd'
        option maindhcp '0'
        option leasefile '/tmp/hosts/odhcpd'
        option leasetrigger '/usr/sbin/odhcpd-update'
        option loglevel '4'

======================
uci export firewall
======================
package firewall

config defaults
        option syn_flood '1'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'REJECT'

config zone
        option name 'lan'
        list network 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'

config zone
        option name 'wan'
        list network 'wan'
        list network 'wan6'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        option mtu_fix '1'

config forwarding
        option src 'lan'
        option dest 'wan'

config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-IGMP'
        option src 'wan'
        option proto 'igmp'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option src_ip 'fc00::/6'
        option dest_ip 'fc00::/6'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-MLD'
        option src 'wan'
        option proto 'icmp'
        option src_ip 'fe80::/10'
        list icmp_type '130/0'
        list icmp_type '131/0'
        list icmp_type '132/0'
        list icmp_type '143/0'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        list icmp_type 'router-solicitation'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'router-advertisement'
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-IPSec-ESP'
        option src 'wan'
        option dest 'lan'
        option proto 'esp'
        option target 'ACCEPT'

config rule
        option name 'Allow-ISAKMP'
        option src 'wan'
        option dest 'lan'
        option dest_port '500'
        option proto 'udp'
        option target 'ACCEPT'

config rule
        option name 'Support-UDP-Traceroute'
        option src 'wan'
        option dest_port '33434:33689'
        option proto 'udp'
        option family 'ipv4'
        option target 'REJECT'
        option enabled '0'

config include
        option path '/etc/firewall.user'

config rule
        option name 'ipv6fwd1'
        list proto 'all'
        option src 'lan'
        option dest 'wan'
        option target 'ACCEPT'
        option enabled '0'

======================
head -n -0 /etc/firewall.user
======================
# This file is interpreted as shell script.
# Put your custom iptables rules here, they will
# be executed with each firewall (re-)start.

# Internal uci firewall chains are flushed and recreated on reload, so
# put custom rules into the root chains e.g. INPUT or FORWARD or into the
# special user chains, e.g. input_wan_rule or postrouting_lan_rule.

======================
ip -6 addr
======================
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 state UNKNOWN qlen 1000
    inet6 ::1/128 scope host
       valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 state UNKNOWN qlen 1000
    inet6 fe80::b295:75ff:fe2b:dc18/64 scope link
       valid_lft forever preferred_lft forever
5: br-lan: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 state UP qlen 1000
    inet6 fdc2:5f32:1f52::1/60 scope global noprefixroute
       valid_lft forever preferred_lft forever
    inet6 fe80::b295:75ff:fe2b:dc18/64 scope link
       valid_lft forever preferred_lft forever
7: eth0.2@eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 state UP qlen 1000
    inet6 2405:201:5801:229d:b295:75ff:fe2b:dc19/64 scope global dynamic noprefixroute
       valid_lft 3588sec preferred_lft 3588sec
    inet6 fe80::b295:75ff:fe2b:dc19/64 scope link
       valid_lft forever preferred_lft forever
9: wlan0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 state UP qlen 1000
    inet6 fe80::b295:75ff:fe2b:dc18/64 scope link
       valid_lft forever preferred_lft forever

======================
ip -6 ro li tab all 
======================
default from 2405:201:5801:229d::/64 via fe80::7add:12ff:fe32:a8a0 dev eth0.2  metric 384
2405:201:5801:229d::/64 dev eth0.2  metric 256
unreachable 2405:201:5801:229d::/64 dev lo  metric 2147483647
fdc2:5f32:1f52::/64 dev br-lan  metric 1024
unreachable fdc2:5f32:1f52::/48 dev lo  metric 2147483647
fe80::/64 dev eth0  metric 256
fe80::/64 dev eth0.2  metric 256
fe80::/64 dev br-lan  metric 256
fe80::/64 dev wlan0  metric 256
local ::1 dev lo table local  metric 0
anycast 2405:201:5801:229d:: dev eth0.2 table local  metric 0
local 2405:201:5801:229d:b295:75ff:fe2b:dc19 dev eth0.2 table local  metric 0
anycast fdc2:5f32:1f52:: dev br-lan table local  metric 0
local fdc2:5f32:1f52::1 dev br-lan table local  metric 0
anycast fe80:: dev eth0 table local  metric 0
anycast fe80:: dev eth0.2 table local  metric 0
anycast fe80:: dev br-lan table local  metric 0
anycast fe80:: dev wlan0 table local  metric 0
local fe80::b295:75ff:fe2b:dc18 dev eth0 table local  metric 0
local fe80::b295:75ff:fe2b:dc18 dev br-lan table local  metric 0
local fe80::b295:75ff:fe2b:dc18 dev wlan0 table local  metric 0
local fe80::b295:75ff:fe2b:dc19 dev eth0.2 table local  metric 0
multicast ff00::/8 dev eth0 table local  metric 256
multicast ff00::/8 dev br-lan table local  metric 256
multicast ff00::/8 dev eth0.2 table local  metric 256
multicast ff00::/8 dev wlan0 table local  metric 256
======================
ip -6 ru 
======================
0:      from all lookup local
32766:  from all lookup main
4200000001:     from all iif lo lookup unspec 12
4200000005:     from all iif br-lan lookup unspec 12
4200000007:     from all iif eth0.2 lookup unspec 12
4200000007:     from all iif eth0.2 lookup unspec 12
======================
ls -l  /etc/resolv.* /tmp/resolv.* /tmp/resolv.*/* 
======================
lrwxrwxrwx    1 root     root            16 Oct 24 09:01 /etc/resolv.conf -> /tmp/resolv.conf
-rw-r--r--    1 root     root            47 Jan 13 07:15 /tmp/resolv.conf
-rw-r--r--    1 root     root           120 Oct 24 09:02 /tmp/resolv.conf.d/resolv.conf.auto

/tmp/resolv.conf.d:
-rw-r--r--    1 root     root           120 Oct 24 09:02 resolv.conf.auto
======================
head -n -0 /etc/resolv.* /tmp/resolv.* /tmp/resolv.*/* 
======================
==> /etc/resolv.conf <==
search lan
nameserver 127.0.0.1
nameserver ::1

==> /tmp/resolv.conf <==
search lan
nameserver 127.0.0.1
nameserver ::1

==> /tmp/resolv.conf.d <==
head: /tmp/resolv.conf.d: I/O error

==> /tmp/resolv.conf.d/resolv.conf.auto <==
# Interface wan
nameserver 192.168.29.1
search a.b
# Interface wan6
nameserver 2405:201:5801:229d::c0a8:1d01
search a.b
======================
ifstatus wan6
======================
{
        "up": true,
        "pending": false,
        "available": true,
        "autostart": true,
        "dynamic": false,
        "uptime": 99947,
        "l3_device": "eth0.2",
        "proto": "dhcpv6",
        "device": "eth0.2",
        "metric": 0,
        "dns_metric": 0,
        "delegation": true,
        "ipv4-address": [

        ],
        "ipv6-address": [
                {
                        "address": "2405:201:5801:229d:b295:75ff:fe2b:dc19",
                        "mask": 64,
                        "preferred": 3597,
                        "valid": 3597
                }
        ],
        "ipv6-prefix": [

        ],
        "ipv6-prefix-assignment": [

        ],
        "route": [
                {
                        "target": "2405:201:5801:229d::",
                        "mask": 64,
                        "nexthop": "::",
                        "metric": 256,
                        "valid": 3597,
                        "source": "::/0"
                },
                {
                        "target": "::",
                        "mask": 0,
                        "nexthop": "fe80::7add:12ff:fe32:a8a0",
                        "metric": 384,
                        "valid": 3594,
                        "source": "2405:201:5801:229d:b295:75ff:fe2b:dc19/64"
                }
        ],
        "dns-server": [
                "2405:201:5801:229d::c0a8:1d01"
        ],
        "dns-search": [
                "a.b"
        ],
        "neighbors": [

        ],
        "inactive": {
                "ipv4-address": [

                ],
                "ipv6-address": [

                ],
                "route": [

                ],
                "dns-server": [

                ],
                "dns-search": [

                ],
                "neighbors": [

                ]
        },
        "data": {
                "passthru": "00170010240502015801229d00000000c0a81d01001800050161016200"
        }
}
======================
ifstatus lan
======================
{
        "up": true,
        "pending": false,
        "available": true,
        "autostart": true,
        "dynamic": false,
        "uptime": 99985,
        "l3_device": "br-lan",
        "proto": "static",
        "device": "br-lan",
        "updated": [
                "addresses",
                "routes"
        ],
        "metric": 0,
        "dns_metric": 0,
        "delegation": true,
        "ipv4-address": [
                {
                        "address": "192.168.1.1",
                        "mask": 24
                }
        ],
        "ipv6-address": [

        ],
        "ipv6-prefix": [

        ],
        "ipv6-prefix-assignment": [
                {
                        "address": "fdc2:5f32:1f52::",
                        "mask": 60,
                        "local-address": {
                                "address": "fdc2:5f32:1f52::1",
                                "mask": 60
                        }
                }
        ],
        "route": [

        ],
        "dns-server": [

        ],
        "dns-search": [

        ],
        "neighbors": [

        ],
        "inactive": {
                "ipv4-address": [

                ],
                "ipv6-address": [

                ],
                "route": [

                ],
                "dns-server": [

                ],
                "dns-search": [

                ],
                "neighbors": [

                ]
        },
        "data": {

        }
}

[trendy]

The problem is that the ISP router is not delegating a prefix to OpenWrt to assign it to the lan interface. I am not sure if there is some setting to enable it, but it is anyway beyond the scope of this forum. If you cannot fix that, you can use relay as a workaround.

[pkanko]

Here is ISP router ipv6 DHCP settings

[trendy]

You can make the IPv6 Prefix Length 62 or 60 and maybe change Server Mode to Stateful. I see Prefix Delegation is enabled already.

[pkanko]

Ok, I am gonna try this
but whenever I change some setting on this ISP router's page like custom ipv6 DNS servers of google, those custom settings stick for a day then change back to the defaults. It looks like the ISP is using some hidden backdoor to keep my device settings the way they want.
I think the dhcpv6 relay method may be more stable in this case. I am gonna try that first.

Many thanks for all the info. Have a great day. Cheers

[trendy]

Then maybe better call them and sort it out with your ISP. Tell them that prefix delegation with 64 allocated on the lan interface is impossible.

[pkanko]

The relay method worked. IPv6 is connected now.
Many thanks for info.
You are my my hero

[trendy]

You're welcome, however this is not optimal solution, just a workaround when dealing with lazy/ignorant ISPs.