IPv6 source address change - can't ping from router

tristancollins · January 23, 2025, 3:31pm

I have a problem with IPv6 traffic initiated from my router. My ISP (YouFibre in the UK) run a dual stack network. I have a static IPv4 address, a /56 PD IPv6 and an additional /64 IPv6 address assigned.

Devices connect to the LAN interface all work (10/10 on test-ipv6). Ie, I can ping ipv6 addresses and be pinged on my wifi-connected laptop. All good.

The router itself (a Pi5 running a recent snapshot) can't ping or be pinged so services running on the router don't / can't use IPv6.

As a summary:

The PD /64 address given to the LAN interface (a:b:c:d:e::1) on the router is pingable from outside
The assigned /64 given to the WAN (via DHCP?) it not reachable
I can't ping from the router
However, 'ping6 -I PD/64 google.com' works from the router.

I've checked with the ISP support and everything is fine their end, and they've been helpful pointing me in the right direction given they don't support non-Eero equipment. Lots of searching reveals PFsense users need to alter their configurations to get things working too.

So, how do I set the source address of traffic to be the PD /64 assigned address (a:b:c:d:e::1) instead of the IPv6 address on the WAN?

Is this the correct way to deal with this situation?

Config details:

config/network

config interface 'loopback'
	option device 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config globals 'globals'
	option ula_prefix 'fdff:ffde:acf2::/48'

config device
	option name 'br-lan'
	option type 'bridge'
	list ports 'eth0'

config interface 'lan'
	option device 'br-lan'
	option proto 'static'
	option ipaddr '192.168.1.1'
	option netmask '255.255.255.0'
	option delegate '0'
	option ip6assign '64'
	list ip6class 'wan6'

config interface 'wan'
	option proto 'dhcp'
	option device 'eth1'

config interface 'wan6'
	option proto 'dhcpv6'
	option device 'eth1'
	option reqaddress 'none'
	option reqprefix 'auto'
	option norelease '1'

config interface 'tailscale'
	option proto 'none'
	option device 'tailscale0'

config/dhcp

config dnsmasq
	option domainneeded '1'
	option localise_queries '1'
	option rebind_protection '0'
	option local '/lan/'
	option domain 'lan'
	option expandhosts '1'
	option cachesize '1000'
	option authoritative '1'
	option readethers '1'
	option leasefile '/tmp/dhcp.leases'
	option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
	option localservice '1'
	option ednspacket_max '1232'
	option port '54'
	list server '192.168.1.1'

config dhcp 'lan'
	option interface 'lan'
	option start '50'
	option limit '150'
	option leasetime '2h'
	option dhcpv4 'server'
	list dhcp_option '6,192.168.1.1'
	list dhcp_option '3,192.168.1.1'
	option ra 'server'
	list ra_flags 'managed-config'
	list ra_flags 'other-config'
	option dhcpv6 'server'
	option ra_useleasetime '1'
	list dns '2a0e::::8d00::1'
	option ndp 'hybrid'

config dhcp 'wan'
	option interface 'wan'
	option ignore '1'

config odhcpd 'odhcpd'
	option maindhcp '0'
	option leasefile '/tmp/hosts/odhcpd'
	option leasetrigger '/usr/sbin/odhcpd-update'
	option loglevel '4'

config/firewall

config defaults
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option synflood_protect '1'

config zone
	option name 'lan'
	list network 'lan'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'ACCEPT'

config zone
	option name 'wan'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option masq '1'
	option mtu_fix '1'
	list network 'wan'
	list network 'wan6'

config forwarding
	option src 'lan'
	option dest 'wan'

config rule
	option name 'Allow-DHCP-Renew'
	option src 'wan'
	option proto 'udp'
	option dest_port '68'
	option target 'ACCEPT'
	option family 'ipv4'

config rule
	option name 'Allow-Ping'
	option src 'wan'
	option proto 'icmp'
	option icmp_type 'echo-request'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-IGMP'
	option src 'wan'
	option proto 'igmp'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-IPSec-ESP'
	option src 'wan'
	option dest 'lan'
	option proto 'esp'
	option target 'ACCEPT'

config rule
	option name 'Allow-ISAKMP'
	option src 'wan'
	option dest 'lan'
	option dest_port '500'
	option proto 'udp'
	option target 'ACCEPT'

config rule
	option name 'Allow-DHCPv6'
	option src 'wan'
	option proto 'udp'
	option dest_port '546'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-MLD'
	option src 'wan'
	option proto 'icmp'
	option family 'ipv6'
	option target 'ACCEPT'
	option src_ip 'fe80::/10'

config rule
	option name 'Allow-ICMPv6-Input'
	option src 'wan'
	option proto 'icmp'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'
	list icmp_type 'bad-header'
	list icmp_type 'destination-unreachable'
	list icmp_type 'echo-reply'
	list icmp_type 'echo-request'
	list icmp_type 'neighbour-advertisement'
	list icmp_type 'neighbour-solicitation'
	list icmp_type 'packet-too-big'
	list icmp_type 'router-advertisement'
	list icmp_type 'router-solicitation'
	list icmp_type 'time-exceeded'
	list icmp_type 'unknown-header-type'

config rule
	option name 'Allow-ICMPv6-Forward'
	option src 'wan'
	option dest '*'
	option proto 'icmp'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'
	list icmp_type 'bad-header'
	list icmp_type 'destination-unreachable'
	list icmp_type 'echo-reply'
	list icmp_type 'echo-request'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'unknown-header-type'

config zone
	option name 'tailscale'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'ACCEPT'
	option masq '1'
	option mtu_fix '1'
	list network 'tailscale'

config forwarding
	option src 'tailscale'
	option dest 'lan'

config forwarding
	option src 'lan'
	option dest 'tailscale'

config forwarding
	option src 'tailscale'
	option dest 'wan'

config rule
	option name 'Allow Tailscale Control'
	option src 'tailscale'
	option dest 'wan'
	option dest_port '41641'
	option target 'ACCEPT'

config rule
	option name 'Allow Tailscale Incoming'
	option src 'tailscale'
	option dest 'lan'
	option target 'ACCEPT'

Here's a similar discussion for EdgeOS.
And here is further discussion on reddit.

The only mention of something similar in the wiki is here.

All help greatly appreciated.

egc · January 23, 2025, 3:57pm

Use: option reqaddress 'try'

mk24 · January 23, 2025, 3:58pm

On the wan6 interface do use reqaddress none (since apparently the ISP is broken and they give out an address that does not work), but also add ip6assign 64 so it gets a /64 out of your prefix. That may require an alias interface:

config interface 'wan6_s'
   option device '@wan6'
   option proto 'static'
   option ip6assign '64'

tristancollins · January 23, 2025, 4:43pm

@mk24 Genius!

That seems to have worked. I get another IP (1::1/64) which is reachable from outside and I can ping from the router.

Do I need to assign the alias interface to the 'wan' firewall zone?

Thanks for your help - this has had me stuck for quite a while!

mk24 · January 23, 2025, 4:53pm

Yes it should be in the wan zone. I don't know if aliases automatically go with their parent but it would not hurt to add it explicitly.

tristancollins · January 24, 2025, 9:12pm

One minor issue I'm still having is with my ISP's assigned DNS server on IPv6.

My ISP likely filters access to those PD addresses assigned. However, DNS tools running on the router (Adguard, e.g.) fail to access them unless I explicitly bind to one of those PD addresses...

e.g.:

dig @<DNS server address given> google.com AAAA doesn't work

dig -b <PD address of LAN or WAN> @<DNS server address given> google.com AAAA works fine

I know it's a minor thing, but I was hoping to have a minimal set of custom config options to get things working as they should, and DNS would hopefully Just Work.

Any ideas?

And to clarify, LAN-connected devices work fine using dig @<DNS server address given> google.com AAAA.

tristancollins · January 24, 2025, 10:11pm

A bit of googling and chatGPT led me to a cludge:

config nat
	option name 'DNS fudge'
	option family 'ipv6'
	list proto 'tcp'
	list proto 'udp'
	option src 'wan'
	option dest_port '53'
	option target 'SNAT'
	option snat_ip '<PD address on LAN>::1'

Not ideal to have a hardcoded IP in there - but it seems to make dig and adguard access the ISP's DNS servers. Perhaps there's a way to ge the snat_ip from the wan6_s interface via UCI rather than an additional script?

system · February 3, 2025, 10:11pm

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.