Ipv6 prefix delegation is not propagated to OpenWrt's LAN

hongquan · May 16, 2023, 9:55am

My network setup is that:

            ISP router
                  |
         OpenWrt router
                  |
          +-------+------+
        Home devices (PC, laptops)

In the admin page of ISP router, it is shown that prefix delegation is enabled. But the OpenWrt router only gets GUA on WAN6 interface. The LAN interface doesn't have GUA. And hence, all home devices don't get IPv6 GUA.

Could you tell me how to debug this, to see if it is ISP router fault or my OpenWrt router fault?

Updated: Replace the screenshots.

lleachii · May 16, 2023, 10:18am

You only receive a /60 from ISP
LAN is set to /60

Suggestion: change LAN to something like /64.

egc · May 16, 2023, 10:41am

I am in the same boat, it looks like my ISP router does not have a DHCPv6 server so it does not hand out a Prefix to my OpenWRT router (my ISP gives me an /56 PD).

I hacked a script together to get my ipv6 WAN6 address, parse that and set that as prefix for my LAN.

But hopefully your ISP routers does give you a Prefix otherwise you can try to set it manually:

config interface 'wan6'
	option device 'wan'
	option proto 'dhcpv6'
	option reqaddress 'try'
	option reqprefix 'auto'
**  option ip6assign '64'**
**  option ip6prefix '2001:xxxx:xxxx:xxxx::/64'**

or use a script like I am doing.

Note: I also had to set a default route manually (well that is also incorporated in my script).

But probably there are smarter ways to do it , I am new to OpenWRT and have a lot to learn.

trendy · May 16, 2023, 11:34am

One question is if the ISP CPE indeed offers delegated prefixes to the lan dhcp clients. This can be examined by inspecting the packets. Install tcpdump and capture DHCPv6. https://openwrt.org/docs/guide-user/network/protocol.dhcp#troubleshooting

The /60 is the maximum lan can get. If the wan6 gets delegated some smaller prefix, it will also allocate something smaller to lan.

You can simply use relay for that.
The problem with PD if the upstream router doesn't delegate it, there is no route to the downstream router. So if you use the ip6prefix, the upstream router must add a static route.

lleachii · May 16, 2023, 11:40am

I'm not implying wan6 be delegated something smaller. It should continue to be issued a /60.

It seems the issue is the OP's system is asking for more than a /60 (i.e. lan wants /60 plus IP on LAN plus IP on wan6 == more than /60) so my suggestion was to lower lan to /64, hence there's enough IPv6 space available - so all interfaces should get an IP, PD, etc.

(Just a suggestion - and depends on if OP can obtain a PD.)

trendy · May 16, 2023, 11:51am

If the ISP CPE is delegated a /60 it will most likely not give out a /60, more like a /61 or /62. And the lan will adjust to that, regardless of the ip6assign being by default /60.
Hence OpenWrt will get a /62 and assign it to the lan. The only problem I see is if the wan6 has a specific reqprefix and not auto.

egc · May 16, 2023, 2:12pm

sure, the upstream router has a static route set

I know about relay (the software I am coming from has IPv6 pass-trough which does something comparable) although I have not tried it yet, but thanks for reminding.

Downside , I think, is that you have one big subnet (although some might consider this an advantage )

hongquan · May 16, 2023, 3:25pm

I changed LAN to /64. Still not get GUA.

mk24 · May 16, 2023, 3:32pm

Run ifstatus wan6 to see what prefix was received. I don't think that Luci shows this.

When you redact IPv6 addresses don't cover up the bits that define your sub-prefix (the bits after the first 48, 56 or 60 and before the last 64), those are important for troubleshooting.

hongquan · May 16, 2023, 4:00pm

Here is the ifstatus result:

{
	"up": true,
	"pending": false,
	"available": true,
	"autostart": true,
	"dynamic": false,
	"uptime": 418,
	"l3_device": "wan",
	"proto": "dhcpv6",
	"device": "wan",
	"metric": 0,
	"dns_metric": 0,
	"delegation": true,
	"ipv4-address": [
		
	],
	"ipv6-address": [
		{
			"address": "2001:xxxx:4f0e:2200:2276:3ff:fe50:3b09",
			"mask": 128,
			"preferred": 70507,
			"valid": 70507
		}
	],
	"ipv6-prefix": [
		
	],
	"ipv6-prefix-assignment": [
		
	],
	"route": [
		{
			"target": "2001:xxx:4f0e:2200::",
			"mask": 64,
			"nexthop": "::",
			"metric": 256,
			"valid": 70506,
			"source": "::/0"
		},
		{
			"target": "::",
			"mask": 0,
			"nexthop": "fe80::1",
			"metric": 512,
			"valid": 1600,
			"source": "2001:xxx:4f0e:2200:2276:3ff:fe50:3b09/128"
		}
	],
	"dns-server": [
		"fe80::1"
	],
	"dns-search": [
		
	],
	"neighbors": [
		
	],
	"inactive": {
		"ipv4-address": [
			
		],
		"ipv6-address": [
			
		],
		"route": [
			
		],
		"dns-server": [
			
		],
		"dns-search": [
			
		],
		"neighbors": [
			
		]
	},
	"data": {
		"passthru": "000600160015001600170018001f003800400043005e005f006000170010fe800000000000000000000000000001"
	}
}

When you redact IPv6 addresses don't cover up the bits that define your sub-prefix (the bits after the first 48, 56 or 60 and before the last 64), those are important for troubleshooting.

Thank you

hongquan · May 16, 2023, 4:11pm

Could you give one example for that static route?

hongquan · May 16, 2023, 4:17pm

Here is the dump result:

root@OpenWrt:~# tcpdump -evni any udp port 547 & \
> sleep 5; \
> killall -SIGUSR1 odhcp6c; \
> sleep 5; \
> killall tcpdump
tcpdump: listening on any, link-type LINUX_SLL (Linux cooked v1), capture size 262144 bytes
23:15:26.518611 Out 20:76:03:50:3b:09 ethertype IPv6 (0x86dd), length 186: (flowlabel 0xdc015, hlim 1, next-header UDP (17) payload length: 130) fe80::2276:3ff:fe50:3b09.546 > ff02::1:2.547: [bad udp cksum 0x5de9 -> 0x6a9b!] dhcp6 renew (xid=2761f9 (elapsed-time 0) (option-request SIP-servers-domain SIP-servers-address DNS-server DNS-search-list SNTP-servers NTP-server AFTR-Name opt_67 opt_94 opt_95 opt_96) (client-ID hwaddr type 1 207603503b09) (server-ID hwaddr type 6 a0cff5ad531a) (Client-FQDN) (IA_NA IAID:1 T1:0 T2:0 (IA_ADDR 2001:xxx:4f0e:2200:2276:3ff:fe50:3b09 pltime:0 vltime:0)))
23:15:26.518684 Out 20:76:03:50:3b:09 ethertype IPv6 (0x86dd), length 186: (flowlabel 0xdc015, hlim 1, next-header UDP (17) payload length: 130) fe80::2276:3ff:fe50:3b09.546 > ff02::1:2.547: [bad udp cksum 0x5de9 -> 0x6a9b!] dhcp6 renew (xid=2761f9 (elapsed-time 0) (option-request SIP-servers-domain SIP-servers-address DNS-server DNS-search-list SNTP-servers NTP-server AFTR-Name opt_67 opt_94 opt_95 opt_96) (client-ID hwaddr type 1 207603503b09) (server-ID hwaddr type 6 a0cff5ad531a) (Client-FQDN) (IA_NA IAID:1 T1:0 T2:0 (IA_ADDR 2001:xxx:4f0e:2200:2276:3ff:fe50:3b09 pltime:0 vltime:0)))
23:15:26.539593  In a0:cf:f5:ad:53:1a ethertype IPv6 (0x86dd), length 160: (hlim 255, next-header UDP (17) payload length: 104) fe80::1.547 > fe80::2276:3ff:fe50:3b09.546: [udp sum ok] dhcp6 reply (xid=2761f9 (client-ID hwaddr type 1 207603503b09) (server-ID hwaddr type 6 a0cff5ad531a) (IA_NA IAID:1 T1:34707 T2:55531 (IA_ADDR 2001:xxx:4f0e:2200:2276:3ff:fe50:3b09 pltime:69414 vltime:69414)) (DNS-server fe80::1))

3 packets captured
3 packets received by filter
0 packets dropped by kernel

trendy · May 16, 2023, 4:26pm

Evidently, no prefix is delegated.

Route the prefix that you'll add to the ip6prefix option via the LL address of the wan6 interface.