IPv6 works only on OpenWrt, but not on LAN

Installing and Using OpenWrt
1

I am trying to setup OpenWrt x86_64 to use ISP line. I struggle with proper IPv6 settings.
Seems like IPv6 works (ping6) Ok on the router, but not on the LAN. Computer connected to LAN gets local-scope address.

I am just learning OpenWrt and would appreciate any advice. ISP gave me some interfaceID value. Should I use it for WAN6 (as ifaceid and ip6ifaceid)?

Here is detailed output from the commands:

ubus call system board; \
uci export network; \
uci export dhcp; uci export firewall; \
head -n -0 /etc/firewall.user; \
ip -6 addr ; ip -6 ro li tab all ; ip -6 ru; ifstatus WAN6

Output:

{
        "kernel": "5.10.176",
        "hostname": "OpenWrt",
        "system": "Intel(R) Xeon(R) CPU E5-2650 v4 @ 2.20GHz",
        "model": "ASUS All Series",
        "board_name": "asus-all-series",
        "rootfs_type": "ext4",
        "release": {
                "distribution": "OpenWrt",
                "version": "22.03.5",
                "revision": "r20134-5f15225c1e",
                "target": "x86/64",
                "description": "OpenWrt 22.03.5 r20134-5f15225c1e"
        }
}
package network

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'fdd2:748b:c42a::/48'

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'eth0'

config interface 'lan'
        option device 'br-lan'
        option proto 'static'
        option ipaddr '192.168.1.1'
        option netmask '255.255.255.0'
        list ip6class 'WAN6'
        option ip6assign '64'
        option ip6ifaceid '::2'

config interface 'WAN'
        option proto 'dhcp'
        option device 'eth1'

config interface 'WAN6'
        option proto 'dhcpv6'
        option device 'eth1'
        option reqaddress 'try'
        option reqprefix 'auto'
        option ifaceid '::006a:b99f:8800:0000'
        list ip6class 'WAN6'
        option ip6assign '64'

package dhcp

config dnsmasq
        option domainneeded '1'
        option boguspriv '1'
        option filterwin2k '0'
        option localise_queries '1'
        option rebind_protection '1'
        option rebind_localhost '1'
        option local '/lan/'
        option domain 'lan'
        option expandhosts '1'
        option nonegcache '0'
        option authoritative '1'
        option readethers '1'
        option leasefile '/tmp/dhcp.leases'
        option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
        option nonwildcard '1'
        option localservice '1'
        option ednspacket_max '1232'

config dhcp 'lan'
        option interface 'lan'
        option start '100'
        option limit '150'
        option leasetime '12h'
        option dhcpv4 'server'
        option ra 'relay'
        option ndp 'relay'
        list dhcp_option '6,8.8.8.8,1.1.1.1'
        option dhcpv6 'relay'

config odhcpd 'odhcpd'
        option maindhcp '0'
        option leasefile '/tmp/hosts/odhcpd'
        option leasetrigger '/usr/sbin/odhcpd-update'
        option loglevel '4'

config dhcp 'WAN'
        option interface 'WAN'
        option ignore '1'

config dhcp 'WAN6'
        option interface 'WAN6'
        option master '1'
        option ra 'relay'
        option dhcpv6 'relay'
        option ndp 'relay'
        option ignore '1'

package firewall

config defaults
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option synflood_protect '1'

config zone
        option name 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        list network 'lan'

config zone
        option name 'wan'
        option output 'ACCEPT'
        option masq '1'
        option mtu_fix '1'
        list network 'WAN'
        list network 'WAN6'
        option input 'ACCEPT'
        option forward 'ACCEPT'

config forwarding
        option src 'lan'
        option dest 'wan'

config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-IGMP'
        option src 'wan'
        option proto 'igmp'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-MLD'
        option src 'wan'
        option proto 'icmp'
        option src_ip 'fe80::/10'
        list icmp_type '130/0'
        list icmp_type '131/0'
        list icmp_type '132/0'
        list icmp_type '143/0'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        list icmp_type 'router-solicitation'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'router-advertisement'
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-IPSec-ESP'
        option src 'wan'
        option dest 'lan'
        option proto 'esp'
        option target 'ACCEPT'

config rule
        option name 'Allow-ISAKMP'
        option src 'wan'
        option dest 'lan'
        option dest_port '500'
        option proto 'udp'
        option target 'ACCEPT'

head: /etc/firewall.user: No such file or directory
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 state UNKNOWN qlen 1000
    inet6 ::1/128 scope host
       valid_lft forever preferred_lft forever
4: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 state UP qlen 1000
    inet6 240b:11:3ec1:a00::1/64 scope global dynamic noprefixroute
       valid_lft 13771sec preferred_lft 11971sec
    inet6 fe80::b696:91ff:fe88:13d8/64 scope link
       valid_lft forever preferred_lft forever
30: br-lan: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 state UP qlen 1000
    inet6 240b:11:3ec1:a01::2/64 scope global dynamic noprefixroute
       valid_lft 13771sec preferred_lft 11971sec
    inet6 fe80::2e56:dcff:fe39:61bb/64 scope link
       valid_lft forever preferred_lft forever
default from 240b:11:3ec1:a00::/56 via fe80::e269:baff:fed4:4c8d dev eth1  metric 512
240b:11:3ec1:a00::/64 dev eth1  metric 256  expires 0sec
240b:11:3ec1:a00::/64 dev eth1  metric 1024
240b:11:3ec1:a01::/64 dev br-lan  metric 256  expires 0sec
240b:11:3ec1:a01::/64 dev br-lan  metric 1024
unreachable 240b:11:3ec1:a00::/56 dev lo  metric 2147483647
unreachable fdd2:748b:c42a::/48 dev lo  metric 2147483647
fe80::/64 dev br-lan  metric 256
fe80::/64 dev eth1  metric 256
local ::1 dev lo table local  metric 0
anycast 240b:11:3ec1:a00:: dev eth1 table local  metric 0
local 240b:11:3ec1:a00::1 dev eth1 table local  metric 0
anycast 240b:11:3ec1:a01:: dev br-lan table local  metric 0
local 240b:11:3ec1:a01::2 dev br-lan table local  metric 0
anycast fe80:: dev br-lan table local  metric 0
anycast fe80:: dev eth1 table local  metric 0
local fe80::2e56:dcff:fe39:61bb dev br-lan table local  metric 0
local fe80::b696:91ff:fe88:13d8 dev eth1 table local  metric 0
multicast ff00::/8 dev br-lan table local  metric 256
multicast ff00::/8 dev eth1 table local  metric 256
0:      from all lookup local
32766:  from all lookup main
4200000000:     from 240b:11:3ec1:a00::1/64 iif eth1 lookup unspec unreachable
4200000000:     from 240b:11:3ec1:a01::2/64 iif br-lan lookup unspec unreachable
{
        "up": true,
        "pending": false,
        "available": true,
        "autostart": true,
        "dynamic": false,
        "uptime": 630,
        "l3_device": "eth1",
        "proto": "dhcpv6",
        "device": "eth1",
        "metric": 0,
        "dns_metric": 0,
        "delegation": true,
        "ipv4-address": [

        ],
        "ipv6-address": [

        ],
        "ipv6-prefix": [
                {
                        "address": "240b:11:3ec1:a00::",
                        "mask": 56,
                        "preferred": 11970,
                        "valid": 13770,
                        "class": "WAN6",
                        "assigned": {
                                "WAN6": {
                                        "address": "240b:11:3ec1:a00::",
                                        "mask": 64
                                },
                                "lan": {
                                        "address": "240b:11:3ec1:a01::",
                                        "mask": 64
                                }
                        }
                }
        ],
        "ipv6-prefix-assignment": [
                {
                        "address": "240b:11:3ec1:a00::",
                        "mask": 64,
                        "preferred": 11970,
                        "valid": 13770,
                        "local-address": {
                                "address": "240b:11:3ec1:a00::1",
                                "mask": 64
                        }
                }
        ],
        "route": [
                {
                        "target": "::",
                        "mask": 0,
                        "nexthop": "fe80::e269:baff:fed4:4c8d",
                        "metric": 512,
                        "valid": 1740,
                        "source": "240b:11:3ec1:a00::/56"
                }
        ],
        "dns-server": [
                "2404:1a8:7f01:a::3",
                "2404:1a8:7f01:b::3"
        ],
        "dns-search": [
                "flets-east.jp",
                "iptvf.jp"
        ],
        "neighbors": [

        ],
        "inactive": {
                "ipv4-address": [

                ],
                "ipv6-address": [

                ],
                "route": [

                ],
                "dns-server": [

                ],
                "dns-search": [

                ],
                "neighbors": [

                ]
        },
        "data": {
                "passthru": "00170020240401a87f01000a0000000000000003240401a87f01000b0000000000000003001800190a666c6574732d65617374026a7000056970747666026a7000001f0020240401a811020000000000000000000b240401a811020000000000000000000a"
        }
}
2

You have combined prefix delegation and NDP proxy.
Since your ISP is delegating a prefix the NDP proxy is not needed.
The default OpenWrt configuration can work fine for your case, so take a backup and reset to defaults.

1 Like
3

Thank you very much! Just for understanding, NDP should be disabled for WAN6 (now it is in 'relay') right? Or reset to defaults is required anyway?

Btw, what is the proper way to reset to defaults for OpenWrt x86_64? The 'firstboot' stops with error, and documentation says it doesn't work on x86_64.

4

Ipv6 needs neighbor discovery protocol otherwise it will not function. NDP is kinda like ARP for IPv4...

5

You can try to flash the same image without keeping the settings.