IPv6 Setup Help!

develerans · January 16, 2025, 4:55pm

Good afternoon, comrades.

Help with IPv6 configuration

My device has received IPv6 and is knocking on the open network, but local devices receive IPv6 but there is no access to the Internet.

I have studied a lot of articles on the Internet and nothing has not worked for me(

Here is what I have configured, attach the configuration below

OpenWrt SNAPSHOT r28605-9decfc82dc

network

config interface 'loopback'
option device 'lo'
option proto 'static'
option ipaddr '127.0.0.1'
option netmask '255.0.0.0'

config globals 'globals'
option ula_prefix 'fd6c:d231:1d1::/48'

config device
option name 'br-lan'
option type 'bridge'
list ports 'lan1'
list ports 'lan2'
option ip6segmentrouting '1'

config interface 'lan'
option device 'br-lan'
option proto 'static'
option ipaddr '192.168.1.1'
option netmask '255.255.255.0'
option ip6assign '64'
option delegate '0'

config interface 'wan'
option device 'wan'
option proto 'static'
option ipaddr '10.10.200.190'
option netmask '255.255.255.0'
option gateway '10.10.200.2'
list dns '10.10.200.2'

config device
option name 'wan'
option ip6segmentrouting '1'

config device
option name 'eth0'
option ip6segmentrouting '1'

config interface 'wan6'
option proto 'dhcpv6'
option device 'wan'
option reqaddress 'try'
option reqprefix 'auto'
option norelease '1'
option extendprefix '1'
option ip6assign '64'
option delegate '0'

firewall

config defaults
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'REJECT'
option synflood_protect '1'

config zone
option name 'lan'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'ACCEPT'
list network 'lan'

config zone
option name 'wan'
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
option masq '1'
option mtu_fix '1'
list network 'wan'
list network 'wan6'
option masq6 '1'

config forwarding
option dest 'wan'
option src 'lan'

config rule
option name 'Allow-DHCP-Renew'
option src 'wan'
option proto 'udp'
option dest_port '68'
option target 'ACCEPT'
option family 'ipv4'

config rule
option name 'Allow-Ping'
option src 'wan'
option proto 'icmp'
option icmp_type 'echo-request'
option family 'ipv4'
option target 'ACCEPT'

config rule
option name 'Allow-IGMP'
option src 'wan'
option proto 'igmp'
option family 'ipv4'
option target 'ACCEPT'

config rule
option name 'Allow-DHCPv6'
option src 'wan'
option proto 'udp'
option dest_port '546'
option family 'ipv6'
option target 'ACCEPT'

config rule
option name 'Allow-MLD'
option src 'wan'
option proto 'icmp'
option src_ip 'fe80::/10'
list icmp_type '130/0'
list icmp_type '131/0'
list icmp_type '132/0'
list icmp_type '143/0'
option family 'ipv6'
option target 'ACCEPT'

config rule
option name 'Allow-ICMPv6-Input'
option src 'wan'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
list icmp_type 'router-solicitation'
list icmp_type 'neighbour-solicitation'
list icmp_type 'router-advertisement'
list icmp_type 'neighbour-advertisement'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'

config rule
option name 'Allow-ICMPv6-Forward'
option src 'wan'
option dest '*'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'

config rule
option name 'Allow-IPSec-ESP'
option src 'wan'
option dest 'lan'
option proto 'esp'
option target 'ACCEPT'

config rule
option name 'Allow-ISAKMP'
option src 'wan'
option dest 'lan'
option dest_port '500'
option proto 'udp'
option target 'ACCEPT'

dhcp

config dnsmasq
option domainneeded '1'
option boguspriv '1'
option filterwin2k '0'
option localise_queries '1'
option rebind_protection '1'
option rebind_localhost '1'
option local '/lan/'
option domain 'lan'
option expandhosts '1'
option nonegcache '0'
option cachesize '1000'
option authoritative '1'
option readethers '1'
option leasefile '/tmp/dhcp.leases'
option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
option nonwildcard '1'
option localservice '1'
option ednspacket_max '1232'
option filter_aaaa '0'
option filter_a '0'

config dhcp 'lan'
option interface 'lan'
option start '100'
option limit '150'
option leasetime '12h'
option dhcpv4 'server'
option dhcpv6 'relay'
option ra 'relay'
option ndp 'relay'
option ndproxy_slave '1'
option ra_default '0'

config dhcp 'wan'
option interface 'wan'
option ignore '1'
option start '100'
option limit '150'
option leasetime '12h'

config dhcp 'wan6'
option interface 'wan6'
option master '1'
option dhcpv6 'relay'
option ra 'relay'
option ndp 'relay'
option ignore '1'

config odhcpd 'odhcpd'
option maindhcp '0'
option leasefile '/tmp/hosts/odhcpd'
option leasetrigger '/usr/sbin/odhcpd-update'
option loglevel '4'

Maybe someone has encountered this problem?

_bernd · January 16, 2025, 5:06pm

Just use the defaults on wan and wan6 and do not fiddle around. The default just works fine.
If that runs feel free to modify but start with a sane and working default first.

mk24 · January 16, 2025, 5:07pm

Yes and if it doesn't work with everything at defaults, run ifstatus wan6 and ifstatus lan to start investigating. If it turns out that you do need a non-default configuration, it has to be based on what kind of v6 service the ISP is actually supplying. Your configuration has many many things changed with no clear reason why.

_bernd · January 16, 2025, 6:23pm

This.
Sometimes, for instance, if you want to have a /56, you have to ask explicit for it. Sometimes, its the default; sometimes all you can get is a /60.

So in that sense:

Remove all the delegate. EVERYWHERE!
Think twice, if you need a prefix out of your Prefix Delegation for the wan interface. IF --- AND ONLY IF!! --- your wan6 interface don't get an Global Unique Address (GUA) (which comes from - per design - a total different prefix; then you maybe need to use one prefix for the wan6 interface.
Please take your time and read: https://openwrt.org/docs/guide-user/network/ipv6/configuration Yes. Top to Bottom. Yes. Twice. If something is not clear to you, or you struggle with the content, feel free and be encouraged to ask. But please, read it first.
Check for yourself if you have understood ip6assign and ip6hint! And apply it to your network.