IPv6 WAN Access only Accessible from LAN (not other subnets)

Installing and Using OpenWrt Network and Wireless Configuration
1

Hello,
I am setting up OpenWRT for the first time, and I am working on setting up IPv6 for each of the subnets in my home. Currently all interfaces are receiving IPv6 addresses, and handing them out properly with DHCPv6. On the LAN subnet I am able to ping ipv6.google.com sucessfully, however on seperate subnet called home, I am unable to do so with my current firewall settings. It does however work if I change the home firewall zone to accept input and forward, however I would like this disabled as the home zone is for wired/wireless devices that are my own but that I want to segment from the rest of the network.

Here is my /etc/config/network:


config interface 'loopback'
	option device 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config globals 'globals'
	option ula_prefix 'REDACTED'

config device
	option name 'br-lan'
	option type 'bridge'
	option bridge_empty '1'
	list ports 'eth0.1'

config interface 'lan'
	option device 'br-lan'
	option proto 'static'
	option netmask '255.255.255.0'
	option ipaddr '192.168.0.1'
	list ip6class 'LAN6'
	option ip6assign '64'

config interface 'wan'
	option device 'eth0.2'
	option proto 'dhcp'

config interface 'wan6'
	option device 'eth0.2'
	option proto 'dhcpv6'
	option reqprefix 'no'
	option reqaddress 'try'

config switch
	option name 'switch0'
	option reset '1'
	option enable_vlan '1'

config switch_vlan
	option device 'switch0'
	option vlan '1'
	option ports '0t 2t 3 4 5'
	option vid '1'
	option description 'LAN'

config switch_vlan
	option device 'switch0'
	option vlan '2'
	option ports '0t 1'
	option vid '2'

config switch_vlan
	option device 'switch0'
	option vlan '3'
	option vid '10'
	option description 'Home'
	option ports '0t 2t'

config switch_vlan
	option device 'switch0'
	option vlan '4'
	option vid '20'
	option description 'Guest'
	option ports '0t 2t'

config switch_vlan
	option device 'switch0'
	option vlan '5'
	option vid '99'
	option description 'IoT'
	option ports '0t 2t'

config device
	option type 'bridge'
	option name 'br-home'
	list ports 'eth0.10'
	option bridge_empty '1'
	option macaddr 'REDACTED'
	option mtu '1500'
	option txqueuelen '1000'
	option mtu6 '1500'

config interface 'br_home'
	option proto 'static'
	option device 'br-home'
	option ipaddr '192.168.10.1'
	option netmask '255.255.255.0'
	list ip6class 'HOME6'
	option ip6assign '64'

config device
	option name 'eth0.10'
	option type '8021q'
	option ifname 'eth0'
	option vid '10'
	option macaddr 'REDACTED'

config device
	option type 'macvlan'
	option ifname 'eth0.2'
	option name 'macvlan_lan'
	option macaddr 'REDACTED'
	option mode 'private'

config device
	option type 'macvlan'
	option ifname 'eth0.2'
	option name 'macvlan_home'
	option macaddr 'REDACTED'
	option mode 'private'

config interface 'LAN6'
	option proto 'dhcpv6'
	option device 'macvlan_lan'
	option reqprefix '64'
	option reqaddress 'none'

config interface 'HOME6'
	option proto 'dhcpv6'
	option device 'macvlan_home'
	option reqprefix '64'
	option reqaddress 'none'
	option type 'bridge'

Here is the /etc/config/firewall:


config defaults
	option input 'ACCEPT'
	option output 'ACCEPT'
	option synflood_protect '1'
	option flow_offloading '1'
	option flow_offloading_hw '1'
	option forward 'REJECT'

config zone
	option name 'lan'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'ACCEPT'
	list network 'LAN6'
	list network 'lan'

config zone
	option name 'wan'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option masq '1'
	option mtu_fix '1'
	list network 'wan'
	list network 'wan6'

config forwarding
	option src 'lan'
	option dest 'wan'

config rule
	option name 'Allow-DHCP-Renew'
	option src 'wan'
	option proto 'udp'
	option dest_port '68'
	option target 'ACCEPT'
	option family 'ipv4'

config rule
	option name 'Allow-Ping'
	option src 'wan'
	option proto 'icmp'
	option icmp_type 'echo-request'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-IGMP'
	option src 'wan'
	option proto 'igmp'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-DHCPv6'
	option src 'wan'
	option proto 'udp'
	option dest_port '546'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-MLD'
	option src 'wan'
	option proto 'icmp'
	option src_ip 'fe80::/10'
	list icmp_type '130/0'
	list icmp_type '131/0'
	list icmp_type '132/0'
	list icmp_type '143/0'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Input'
	option proto 'icmp'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'
	list icmp_type 'bad-header'
	list icmp_type 'destination-unreachable'
	list icmp_type 'echo-reply'
	list icmp_type 'echo-request'
	list icmp_type 'neighbour-advertisement'
	list icmp_type 'neighbour-solicitation'
	list icmp_type 'packet-too-big'
	list icmp_type 'router-advertisement'
	list icmp_type 'router-solicitation'
	list icmp_type 'time-exceeded'
	list icmp_type 'unknown-header-type'
	option src 'wan'

config rule
	option name 'Allow-ICMPv6-Forward'
	option dest '*'
	option proto 'icmp'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'
	list icmp_type 'bad-header'
	list icmp_type 'destination-unreachable'
	list icmp_type 'echo-reply'
	list icmp_type 'echo-request'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'unknown-header-type'
	option src 'wan'

config rule
	option name 'Allow-IPSec-ESP'
	option src 'wan'
	option dest 'lan'
	option proto 'esp'
	option target 'ACCEPT'

config rule
	option name 'Allow-ISAKMP'
	option src 'wan'
	option dest 'lan'
	option dest_port '500'
	option proto 'udp'
	option target 'ACCEPT'

config rule
	option name 'Support-UDP-Traceroute'
	option src 'wan'
	option dest_port '33434:33689'
	option proto 'udp'
	option family 'ipv4'
	option target 'REJECT'

config include
	option path '/etc/firewall.user'

config zone
	option name 'home'
	option output 'ACCEPT'
	list network 'HOME6'
	list network 'br_home'
	option input 'REJECT'
	option forward 'REJECT'

config forwarding
	option src 'home'
	option dest 'wan'

config rule
	option name 'Home DHCP and DNS'
	option src 'home'
	option target 'ACCEPT'
	option dest_port '53 67 68'

config rule
	option name 'Home DHCPv6'
	option family 'ipv6'
	list proto 'udp'
	option src 'home'
	option src_port '546'
	option dest_port '547'
	option target 'ACCEPT'

config forwarding
	option src 'lan'
	option dest 'home'

Here is the /etc/config/dhcp:


config dnsmasq
	option domainneeded '1'
	option boguspriv '1'
	option filterwin2k '0'
	option localise_queries '1'
	option rebind_protection '1'
	option rebind_localhost '1'
	option local '/lan/'
	option domain 'lan'
	option expandhosts '1'
	option nonegcache '0'
	option authoritative '1'
	option readethers '1'
	option leasefile '/tmp/dhcp.leases'
	option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
	option nonwildcard '1'
	option localservice '1'
	option ednspacket_max '1232'

config dhcp 'lan'
	option interface 'lan'
	option start '100'
	option limit '150'
	option leasetime '12h'
	option dhcpv4 'server'
	option ra 'server'
	option dhcpv6 'server'
	list ra_flags 'managed-config'
	list ra_flags 'other-config'

config dhcp 'wan'
	option interface 'wan'
	option ignore '1'

config odhcpd 'odhcpd'
	option maindhcp '0'
	option leasefile '/tmp/hosts/odhcpd'
	option leasetrigger '/usr/sbin/odhcpd-update'
	option loglevel '4'

config dhcp 'LAN6'
	option interface 'LAN6'
	option ignore '1'
	list ra_flags 'none'

config dhcp 'wan6'
	option interface 'wan6'
	option ignore '1'
	list ra_flags 'none'

config dhcp 'br_home'
	option interface 'br_home'
	option start '100'
	option limit '150'
	option leasetime '12h'
	option ra 'server'
	option dhcpv6 'server'
	list ra_flags 'managed-config'
	list ra_flags 'other-config'

I feel like I am missing something quite simple but I just can't seem to figure it out. Thanks for the help!