ISP router gives IPv6 connectivity, OpenWrt client router doesn't

Installing and Using OpenWrt
1

While I have better IT ability than the layman, I'm out of my league with the level of networking knowledge/skill needed here.

I am in Japan. My ISP is enHikari (JPNE). The ISP router (ELECOM WRC-1167GST2) connects to the ISP using IPv6 PLUS (IPv6 IPoE (MAP-E)).

I bought a ELECOM WRC-1750GST2 router, loaded OpenWRT 21.02.2, set up DDNS and OpenVPN and connected it to the ISP router. It is working, but only through IPv4.

If I connect by Wi-Fi to the ISP router and do check with ipv6-test.com, IPv6 connectivity is OK. However, If I connect to to the OpenWRT router, I only get IPv4 connectivity.

The OpenWRT WAN gets an IPv4 address from the ISP router. The WAN6 gets a prefix 64 and a prefix 128 address.

Though I have searched and read for many hours. I haven't found a solution (or at least one I can recognise as such). I have no idea what settings in the WAN, WAN6 and LAN I need to get IPv6 connectivity through the OpenWRT router.

Can anyone help?

2

Please run the following commands (copy-paste the whole block) and paste the output here, using the "Preformatted text </> " button:
grafik
Remember to redact passwords, MAC addresses and any public IP addresses you may have

ubus call system board; \
uci export network; \
uci export dhcp; uci export firewall; \
head -n -0 /etc/firewall.user; \
ifstatus wan6; ifstatus wan_6
3

Thank you for getting back to me so quickly!!
Here is the result:

{
        "kernel": "5.4.179",
        "hostname": "ToshimaVPN",
        "system": "MediaTek MT7621 ver:1 eco:3",
        "model": "ELECOM WRC-1750GST2",
        "board_name": "elecom,wrc-1750gst2",
        "release": {
                "distribution": "OpenWrt",
                "version": "21.02.2",
                "revision": "r16495-bf0c965af0",
                "target": "ramips/mt7621",
                "description": "OpenWrt 21.02.2 r16495-bf0c965af0"
        }
}
package network

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option packet_steering '1'
        option ula_prefix 'fd9c:082f:9c1c::/48'

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'lan1'
        list ports 'lan2'
        list ports 'lan3'
        list ports 'lan4'

config interface 'lan'
        option device 'br-lan'
        option proto 'static'
        option ipaddr '192.168.1.1'
        option netmask '255.255.255.0'
        option ip6assign '60'

config interface 'wan'
        option device 'wan'
        option proto 'dhcp'

config interface 'wan6'
        option device 'wan'
        option proto 'dhcpv6'
        option reqaddress 'try'
        option reqprefix 'auto'

package dhcp

config dnsmasq
        option domainneeded '1'
        option boguspriv '1'
        option filterwin2k '0'
        option localise_queries '1'
        option rebind_protection '1'
        option rebind_localhost '1'
        option local '/lan/'
        option domain 'lan'
        option expandhosts '1'
        option nonegcache '0'
        option authoritative '1'
        option readethers '1'
        option leasefile '/tmp/dhcp.leases'
        option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
        option nonwildcard '1'
        option localservice '1'
        option ednspacket_max '1232'

config dhcp 'lan'
        option interface 'lan'
        option start '100'
        option limit '150'
        option leasetime '12h'
        option dhcpv4 'server'
        option dhcpv6 'server'
        option ra 'server'
        list ra_flags 'managed-config'
        list ra_flags 'other-config'

config dhcp 'wan'
        option interface 'wan'
        option ignore '1'

config odhcpd 'odhcpd'
        option maindhcp '0'
        option leasefile '/tmp/hosts/odhcpd'
        option leasetrigger '/usr/sbin/odhcpd-update'
        option loglevel '4'

config dhcp 'wan6'
        option interface 'wan6'
        option ignore '1'
        list ra_flags 'none'

package firewall

config defaults
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option synflood_protect '1'

config zone 'lan'
        option name 'lan'
        list network 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        list device 'tun+'

config zone 'wan'
        option name 'wan'
        list network 'wan'
        list network 'wan6'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        option mtu_fix '1'
        option input 'REJECT'

config forwarding
        option src 'lan'
        option dest 'wan'

config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-IGMP'
        option src 'wan'
        option proto 'igmp'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'
        list dest_ip 'fc00::/6'
        list src_ip 'fc00::/6'

config rule
        option name 'Allow-MLD'
        option src 'wan'
        option proto 'icmp'
        option src_ip 'fe80::/10'
        list icmp_type '130/0'
        list icmp_type '131/0'
        list icmp_type '132/0'
        list icmp_type '143/0'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        list icmp_type 'router-solicitation'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'router-advertisement'
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-IPSec-ESP'
        option src 'wan'
        option dest 'lan'
        option proto 'esp'
        option target 'ACCEPT'

config rule
        option name 'Allow-ISAKMP'
        option src 'wan'
        option dest 'lan'
        option dest_port '500'
        option proto 'udp'
        option target 'ACCEPT'

config rule
        option name 'Support-UDP-Traceroute'
        option src 'wan'
        option dest_port '33434:33689'
        option proto 'udp'
        option family 'ipv4'
        option target 'REJECT'
        option enabled '0'

config include
        option path '/etc/firewall.user'

config rule
        option name 'Allow-SSH'
        list proto 'tcp'
        option src 'wan'
        option target 'ACCEPT'
        option dest_port '11360'

config rule 'ovpn'
        option name 'Allow-OpenVPN'
        option src 'wan'
        option dest_port '11361'
        option proto 'udp'
        option target 'ACCEPT'

# This file is interpreted as shell script.
# Put your custom iptables rules here, they will
# be executed with each firewall (re-)start.

# Internal uci firewall chains are flushed and recreated on reload, so
# put custom rules into the root chains e.g. INPUT or FORWARD or into the
# special user chains, e.g. input_wan_rule or postrouting_lan_rule.
{
        "up": true,
        "pending": false,
        "available": true,
        "autostart": true,
        "dynamic": false,
        "uptime": 121947,
        "l3_device": "wan",
        "proto": "dhcpv6",
        "device": "wan",
        "metric": 0,
        "dns_metric": 0,
        "delegation": true,
        "ipv4-address": [

        ],
        "ipv6-address": [
                {
                        "address": "240b:10:8942:c600:6ab:18ff:0:111",
                        "mask": 128
                },
                {
                        "address": "240b:10:8942:c600:6ab:18ff:fe20:826c",
                        "mask": 64
                }
        ],
        "ipv6-prefix": [

        ],
        "ipv6-prefix-assignment": [

        ],
        "route": [
                {
                        "target": "240b:10:8942:c600::",
                        "mask": 64,
                        "nexthop": "::",
                        "metric": 256,
                        "source": "::/0"
                },
                {
                        "target": "::",
                        "mask": 0,
                        "nexthop": "fe80::6ab:18ff:fe64:1b77",
                        "metric": 512,
                        "valid": 1647,
                        "source": "240b:10:8942:c600:6ab:18ff:fe20:826c/64"
                },
                {
                        "target": "::",
                        "mask": 0,
                        "nexthop": "fe80::6ab:18ff:fe64:1b77",
                        "metric": 512,
                        "valid": 1647,
                        "source": "240b:10:8942:c600:6ab:18ff:0:111/128"
                }
        ],
        "dns-server": [
                "240b:10:8942:c600:6ab:18ff:fe64:1b77"
        ],
        "dns-search": [
                "flets-east.jp",
                "iptvf.jp"
        ],
        "neighbors": [

        ],
        "inactive": {
                "ipv4-address": [

                ],
                "ipv6-address": [

                ],
                "route": [

                ],
                "dns-server": [

                ],
                "dns-search": [

                ],
                "neighbors": [

                ]
        },
        "data": {
                "passthru": "00170010240b00108942c60006ab18fffe641b77001800190a666c6574732d65617374026a7000056970747666026a7000"
        }
}
{
        "up": true,
        "pending": false,
        "available": true,
        "autostart": true,
        "dynamic": false,
        "uptime": 121947,
        "l3_device": "wan",
        "proto": "dhcpv6",
        "device": "wan",
        "metric": 0,
        "dns_metric": 0,
        "delegation": true,
        "ipv4-address": [

        ],
        "ipv6-address": [
                {
                        "address": "240b:10:8942:c600:6ab:18ff:0:111",
                        "mask": 128
                },
                {
                        "address": "240b:10:8942:c600:6ab:18ff:fe20:826c",
                        "mask": 64
                }
        ],
        "ipv6-prefix": [

        ],
        "ipv6-prefix-assignment": [

        ],
        "route": [
                {
                        "target": "240b:10:8942:c600::",
                        "mask": 64,
                        "nexthop": "::",
                        "metric": 256,
                        "source": "::/0"
                },
                {
                        "target": "::",
                        "mask": 0,
                        "nexthop": "fe80::6ab:18ff:fe64:1b77",
                        "metric": 512,
                        "valid": 1647,
                        "source": "240b:10:8942:c600:6ab:18ff:fe20:826c/64"
                },
                {
                        "target": "::",
                        "mask": 0,
                        "nexthop": "fe80::6ab:18ff:fe64:1b77",
                        "metric": 512,
                        "valid": 1647,
                        "source": "240b:10:8942:c600:6ab:18ff:0:111/128"
                }
        ],
        "dns-server": [
                "240b:10:8942:c600:6ab:18ff:fe64:1b77"
        ],
        "dns-search": [
                "flets-east.jp",
                "iptvf.jp"
        ],
        "neighbors": [

        ],
        "inactive": {
                "ipv4-address": [

                ],
                "ipv6-address": [

                ],
                "route": [

                ],
                "dns-server": [

                ],
                "dns-search": [

                ],
                "neighbors": [

                ]
        },
        "data": {
                "passthru": "00170010240b00108942c60006ab18fffe641b77001800190a666c6574732d65617374026a7000056970747666026a7000"
        }
}
4

If your ISP is not delegating any prefix, then unfortunately the only thing you can do is ipv6 relay.

5

If I connect my laptop to the ISP router, I get full IPv6 connectivity:

Through ISP router
Through ISP router1531×954 103 KB

So, I know IPv6 connectivity is provided by the ISP router to connected devices.

However, if I connect my laptop to the OpenWrt router and then the OpenWrt router to the ISP router, IPv6 connectivity is lost:

Through OpenWrt router
Through OpenWrt router1531×954 95 KB

This indicates that the problem is in the OpenWrt router setup.

Is this logic flawed?

6

Not exactly flawed, but you don't understand the difference between prefix delegation and address assignment.
When you connect a device on the ISP router, the latter is assigning an IP to the device, either directly with DHCPv6 or indirectly by sending Router Advertisements to the network.
When a router (OpenWrt in this case) connects to the ISP router, gets an IP for its wan interface, like any other device would, and additionally requests a prefix to be delegated to it, so that it can use it on the lan interface. In your case the ISP router is not allocating a prefix, so a workaround is the dhcp6 relay I mentioned in my previous post.

7

Thank you for the explanation. You are right, I didn't understand the difference between prefix delegation and address assignment. It's still a bit over my head, but the picture is a bit more clear.

Is it certain that my ISP router isn't allocating a prefix? How did you know?

Also, when you talk about a relay, you mean to setup the WAN6 as a relay, or the IPv6 in the LAN as a relay?
What settings would I use for that?

Forgive my ignorance, but, as you can see, I'm really out of my depth.

8

I don't know if there is some setting in your ISP router blocking the prefix delegation, but you are not the first to only get a /64 prefix from their ISP. You can ask your ISP to clarify it. Usually a /60 or /56 is allocated to the residential customers.
OpenWrt by default will try to get some prefix from upstream and allocate a /60 to the lan interface, so to be able to further delegate a prefix if requested.

Check the link, both wan6 and lan need to be configured as relays.

9

Hello again!

I set up the relays as advised. The ipv6test result, though slightly different, still doesn't achieve IPv6 connectivity:

Post-relay setup
Post-relay setup1531×955 101 KB

10

Did the device get an IPv6? ipconfig /all in windows ip -6 add in linux
Also please run the following commands (copy-paste the whole block) and paste the output here, using the "Preformatted text </> " button:
grafik
Remember to redact passwords, MAC addresses and any public IP addresses you may have

ubus call system board; \
uci export network; uci export dhcp; uci export firewall; \
head -n -0 /etc/firewall.user; \
ip -6 addr ; ip -6 ro li tab all ; ip -6 ru
11

It seems that my Windows 10 laptop did get an IPv6:

Windows IP Configuration

   Host Name . . . . . . . . . . . . : Blade-Stealth
   Primary Dns Suffix  . . . . . . . :
   Node Type . . . . . . . . . . . . : Hybrid
   IP Routing Enabled. . . . . . . . : No
   WINS Proxy Enabled. . . . . . . . : No
   DNS Suffix Search List. . . . . . : flets-east.jp
                                       iptvf.jp

Unknown adapter Local Area Connection:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : TAP-Windows Adapter V9 for OpenVPN Connect
   Physical Address. . . . . . . . . : 00-FF-9F-23-C3-DE
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes

Wireless LAN adapter Local Area Connection* 1:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : Microsoft Wi-Fi Direct Virtual Adapter
   Physical Address. . . . . . . . . : 28-7F-CF-EE-DA-73
   DHCP Enabled. . . . . . . . . . . : Yes
   Autoconfiguration Enabled . . . . : Yes

Wireless LAN adapter Local Area Connection* 2:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : Microsoft Wi-Fi Direct Virtual Adapter #2
   Physical Address. . . . . . . . . : 2A-7F-CF-EE-DA-72
   DHCP Enabled. . . . . . . . . . . : Yes
   Autoconfiguration Enabled . . . . : Yes

Wireless LAN adapter WiFi:

   Connection-specific DNS Suffix  . : lan
   Description . . . . . . . . . . . : Intel(R) Wi-Fi 6 AX201 160MHz
   Physical Address. . . . . . . . . : 28-7F-CF-EE-DA-72
   DHCP Enabled. . . . . . . . . . . : Yes
   Autoconfiguration Enabled . . . . : Yes
   IPv6 Address. . . . . . . . . . . : 240b:10:8942:c600:b81d:180e:dc2b:1071(Preferred)
   Temporary IPv6 Address. . . . . . : 240b:10:8942:c600:d85c:4fe7:6a02:b211(Preferred)
   Link-local IPv6 Address . . . . . : fe80::b81d:180e:dc2b:1071%7(Preferred)
   IPv4 Address. . . . . . . . . . . : 192.168.1.172(Preferred)
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Lease Obtained. . . . . . . . . . : 03 May 2022 00:54:55
   Lease Expires . . . . . . . . . . : 03 May 2022 13:11:53
   Default Gateway . . . . . . . . . : fe80::6ab:18ff:fe20:826b%7
                                       192.168.1.1
   DHCP Server . . . . . . . . . . . : 192.168.1.1
   DHCPv6 IAID . . . . . . . . . . . : 136871887
   DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-28-3A-B5-30-28-7F-CF-EE-DA-72
   DNS Servers . . . . . . . . . . . : 192.168.1.1
   NetBIOS over Tcpip. . . . . . . . : Enabled
   Connection-specific DNS Suffix Search List :
                                       flets-east.jp
                                       iptvf.jp

Ethernet adapter Bluetooth Network Connection:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : Bluetooth Device (Personal Area Network)
   Physical Address. . . . . . . . . : 28-7F-CF-EE-DA-76
   DHCP Enabled. . . . . . . . . . . : Yes
   Autoconfiguration Enabled . . . . : Yes
12

Here is the output from the commands:

{
        "kernel": "5.4.179",
        "hostname": "ToshimaVPN",
        "system": "MediaTek MT7621 ver:1 eco:3",
        "model": "ELECOM WRC-1750GST2",
        "board_name": "elecom,wrc-1750gst2",
        "release": {
                "distribution": "OpenWrt",
                "version": "21.02.2",
                "revision": "r16495-bf0c965af0",
                "target": "ramips/mt7621",
                "description": "OpenWrt 21.02.2 r16495-bf0c965af0"
        }
}
package network

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option packet_steering '1'
        option ula_prefix 'fd9c:082f:9c1c::/48'

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'lan1'
        list ports 'lan2'
        list ports 'lan3'
        list ports 'lan4'

config interface 'lan'
        option device 'br-lan'
        option proto 'static'
        option ipaddr '192.168.1.1'
        option netmask '255.255.255.0'
        option ip6assign '60'

config interface 'wan'
        option device 'wan'
        option proto 'dhcp'

config interface 'wan6'
        option device 'wan'
        option proto 'dhcpv6'
        option reqaddress 'try'
        option reqprefix '60'

package dhcp

config dnsmasq
        option domainneeded '1'
        option boguspriv '1'
        option filterwin2k '0'
        option localise_queries '1'
        option rebind_protection '1'
        option rebind_localhost '1'
        option local '/lan/'
        option domain 'lan'
        option expandhosts '1'
        option nonegcache '0'
        option authoritative '1'
        option readethers '1'
        option leasefile '/tmp/dhcp.leases'
        option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
        option nonwildcard '1'
        option localservice '1'
        option ednspacket_max '1232'

config dhcp 'lan'
        option interface 'lan'
        option start '100'
        option limit '150'
        option leasetime '12h'
        option dhcpv4 'server'
        option ra 'relay'
        list ra_flags 'none'
        option dhcpv6 'relay'
        option ndp 'relay'

config dhcp 'wan'
        option interface 'wan'
        option ignore '1'

config odhcpd 'odhcpd'
        option maindhcp '0'
        option leasefile '/tmp/hosts/odhcpd'
        option leasetrigger '/usr/sbin/odhcpd-update'
        option loglevel '4'

config dhcp 'wan6'
        option interface 'wan6'
        option ignore '1'
        option master '1'
        option ra 'relay'
        list ra_flags 'none'
        option dhcpv6 'relay'
        option ndp 'relay'

package firewall

config defaults
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option synflood_protect '1'

config zone 'lan'
        option name 'lan'
        list network 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        list device 'tun+'

config zone 'wan'
        option name 'wan'
        list network 'wan'
        list network 'wan6'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        option mtu_fix '1'
        option input 'REJECT'

config forwarding
        option src 'lan'
        option dest 'wan'

config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-IGMP'
        option src 'wan'
        option proto 'igmp'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'
        list dest_ip 'fc00::/6'
        list src_ip 'fc00::/6'

config rule
        option name 'Allow-MLD'
        option src 'wan'
        option proto 'icmp'
        option src_ip 'fe80::/10'
        list icmp_type '130/0'
        list icmp_type '131/0'
        list icmp_type '132/0'
        list icmp_type '143/0'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        list icmp_type 'router-solicitation'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'router-advertisement'
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-IPSec-ESP'
        option src 'wan'
        option dest 'lan'
        option proto 'esp'
        option target 'ACCEPT'

config rule
        option name 'Allow-ISAKMP'
        option src 'wan'
        option dest 'lan'
        option dest_port '500'
        option proto 'udp'
        option target 'ACCEPT'

config rule
        option name 'Support-UDP-Traceroute'
        option src 'wan'
        option dest_port '33434:33689'
        option proto 'udp'
        option family 'ipv4'
        option target 'REJECT'
        option enabled '0'

config include
        option path '/etc/firewall.user'

config rule
        option name 'Allow-SSH'
        list proto 'tcp'
        option src 'wan'
        option target 'ACCEPT'
        option dest_port '11360'

config rule 'ovpn'
        option name 'Allow-OpenVPN'
        option src 'wan'
        option dest_port '11361'
        option proto 'udp'
        option target 'ACCEPT'

# This file is interpreted as shell script.
# Put your custom iptables rules here, they will
# be executed with each firewall (re-)start.

# Internal uci firewall chains are flushed and recreated on reload, so
# put custom rules into the root chains e.g. INPUT or FORWARD or into the
# special user chains, e.g. input_wan_rule or postrouting_lan_rule.
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 state UNKNOWN qlen 1000
    inet6 ::1/128 scope host
       valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1504 state UP qlen 1000
    inet6 fe80::6ab:18ff:fe20:826b/64 scope link
       valid_lft forever preferred_lft forever
3: wan@eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 state UP qlen 1000
    inet6 240b:10:8942:c600:6ab:18ff:fe20:826c/64 scope global noprefixroute
       valid_lft forever preferred_lft forever
    inet6 240b:10:8942:c600:6ab:18ff:0:111/128 scope global noprefixroute
       valid_lft forever preferred_lft forever
    inet6 fe80::6ab:18ff:fe20:826c/64 scope link
       valid_lft forever preferred_lft forever
11: tun0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 state UNKNOWN qlen 500
    inet6 fe80::5b63:b334:f20e:ed8a/64 scope link flags 800
       valid_lft forever preferred_lft forever
20: br-lan: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 state UP qlen 1000
    inet6 fd9c:82f:9c1c::1/60 scope global noprefixroute
       valid_lft forever preferred_lft forever
    inet6 fe80::6ab:18ff:fe20:826b/64 scope link
       valid_lft forever preferred_lft forever
21: wlan0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 state UP qlen 1000
    inet6 fe80::6ab:18ff:fe20:826d/64 scope link
       valid_lft forever preferred_lft forever
22: wlan1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 state UP qlen 1000
    inet6 fe80::6ab:18ff:fe20:826e/64 scope link
       valid_lft forever preferred_lft forever
default from 240b:10:8942:c600:6ab:18ff:0:111 via fe80::6ab:18ff:fe64:1b77 dev wan  metric 512
default from 240b:10:8942:c600::/64 via fe80::6ab:18ff:fe64:1b77 dev wan  metric 512
240b:10:8942:c600:6ab:18ff:fe64:1b77 dev wan  metric 1024
240b:10:8942:c600:d1b:fce7:75bc:334 dev br-lan  metric 1024
240b:10:8942:c600:bdbd:827b:ae81:8e99 dev br-lan  metric 1024
240b:10:8942:c600:d85c:4fe7:6a02:b211 dev br-lan  metric 1024
240b:10:8942:c600::/64 dev wan  metric 256
unreachable 240b:10:8942:c600::/64 dev lo  metric 2147483647
fd9c:82f:9c1c:0:44d0:64fe:c55f:b3ea dev br-lan  metric 1024
fd9c:82f:9c1c:0:bdbd:827b:ae81:8e99 dev br-lan  metric 1024
fd9c:82f:9c1c:0:d85c:4fe7:6a02:b211 dev br-lan  metric 1024
fd9c:82f:9c1c::/64 dev br-lan  metric 1024
unreachable fd9c:82f:9c1c::/48 dev lo  metric 2147483647
fe80::/64 dev eth0  metric 256
fe80::/64 dev tun0  metric 256
fe80::/64 dev wan  metric 256
fe80::/64 dev br-lan  metric 256
fe80::/64 dev wlan0  metric 256
fe80::/64 dev wlan1  metric 256
local ::1 dev lo table local  metric 0
anycast 240b:10:8942:c600:: dev wan table local  metric 0
local 240b:10:8942:c600:6ab:18ff:0:111 dev wan table local  metric 0
local 240b:10:8942:c600:6ab:18ff:fe20:826c dev wan table local  metric 0
anycast fd9c:82f:9c1c:: dev br-lan table local  metric 0
local fd9c:82f:9c1c::1 dev br-lan table local  metric 0
anycast fe80:: dev eth0 table local  metric 0
anycast fe80:: dev tun0 table local  metric 0
anycast fe80:: dev wan table local  metric 0
anycast fe80:: dev br-lan table local  metric 0
anycast fe80:: dev wlan0 table local  metric 0
anycast fe80:: dev wlan1 table local  metric 0
local fe80::6ab:18ff:fe20:826b dev eth0 table local  metric 0
local fe80::6ab:18ff:fe20:826b dev br-lan table local  metric 0
local fe80::6ab:18ff:fe20:826c dev wan table local  metric 0
local fe80::6ab:18ff:fe20:826d dev wlan0 table local  metric 0
local fe80::6ab:18ff:fe20:826e dev wlan1 table local  metric 0
local fe80::5b63:b334:f20e:ed8a dev tun0 table local  metric 0
multicast ff00::/8 dev eth0 table local  metric 256
multicast ff00::/8 dev tun0 table local  metric 256
multicast ff00::/8 dev wan table local  metric 256
multicast ff00::/8 dev br-lan table local  metric 256
multicast ff00::/8 dev wlan0 table local  metric 256
multicast ff00::/8 dev wlan1 table local  metric 256
0:      from all lookup local
32766:  from all lookup main
4200000001:     from all iif lo lookup unspec 12
4200000003:     from all iif wan lookup unspec 12
4200000003:     from all iif wan lookup unspec 12
4200000020:     from all iif br-lan lookup unspec 12
13

And what does ping -6 google.com report in windows?

One more thing, don't hardcode the prefix length, leave it to auto.

In the routing table I can see the :b211 IPv6 of windows, but not the :1071
Could you temporarily disable the temporary IPv6 addresses in windows and try again?

14 
ping -6 google.com
PING google.com (2404:6800:4004:823::200e): 56 data bytes
64 bytes from 2404:6800:4004:823::200e: seq=0 ttl=117 time=574.716 ms
64 bytes from 2404:6800:4004:823::200e: seq=1 ttl=117 time=3.586 ms
64 bytes from 2404:6800:4004:823::200e: seq=2 ttl=117 time=4.263 ms
64 bytes from 2404:6800:4004:823::200e: seq=3 ttl=117 time=3.850 ms
64 bytes from 2404:6800:4004:823::200e: seq=4 ttl=117 time=4.250 ms
64 bytes from 2404:6800:4004:823::200e: seq=5 ttl=117 time=4.318 ms
64 bytes from 2404:6800:4004:823::200e: seq=6 ttl=117 time=4.268 ms
64 bytes from 2404:6800:4004:823::200e: seq=7 ttl=117 time=4.267 ms
64 bytes from 2404:6800:4004:823::200e: seq=8 ttl=117 time=4.501 ms
64 bytes from 2404:6800:4004:823::200e: seq=9 ttl=117 time=3.574 ms
64 bytes from 2404:6800:4004:823::200e: seq=10 ttl=117 time=4.507 ms
64 bytes from 2404:6800:4004:823::200e: seq=11 ttl=117 time=3.700 ms
64 bytes from 2404:6800:4004:823::200e: seq=12 ttl=117 time=3.824 ms
64 bytes from 2404:6800:4004:823::200e: seq=13 ttl=117 time=4.347 ms
64 bytes from 2404:6800:4004:823::200e: seq=14 ttl=117 time=3.764 ms
64 bytes from 2404:6800:4004:823::200e: seq=15 ttl=117 time=3.810 ms
64 bytes from 2404:6800:4004:823::200e: seq=16 ttl=117 time=4.760 ms
64 bytes from 2404:6800:4004:823::200e: seq=17 ttl=117 time=4.568 ms
64 bytes from 2404:6800:4004:823::200e: seq=18 ttl=117 time=3.772 ms
64 bytes from 2404:6800:4004:823::200e: seq=19 ttl=117 time=3.517 ms
64 bytes from 2404:6800:4004:823::200e: seq=20 ttl=117 time=4.123 ms
64 bytes from 2404:6800:4004:823::200e: seq=21 ttl=117 time=3.856 ms
64 bytes from 2404:6800:4004:823::200e: seq=22 ttl=117 time=4.273 ms
64 bytes from 2404:6800:4004:823::200e: seq=23 ttl=117 time=4.278 ms
64 bytes from 2404:6800:4004:823::200e: seq=24 ttl=117 time=4.683 ms
64 bytes from 2404:6800:4004:823::200e: seq=25 ttl=117 time=4.161 ms
64 bytes from 2404:6800:4004:823::200e: seq=26 ttl=117 time=3.999 ms
64 bytes from 2404:6800:4004:823::200e: seq=27 ttl=117 time=4.222 ms
64 bytes from 2404:6800:4004:823::200e: seq=28 ttl=117 time=4.512 ms
64 bytes from 2404:6800:4004:823::200e: seq=29 ttl=117 time=4.364 ms
64 bytes from 2404:6800:4004:823::200e: seq=30 ttl=117 time=4.151 ms
64 bytes from 2404:6800:4004:823::200e: seq=31 ttl=117 time=3.331 ms
64 bytes from 2404:6800:4004:823::200e: seq=32 ttl=117 time=3.719 ms
64 bytes from 2404:6800:4004:823::200e: seq=33 ttl=117 time=3.768 ms
64 bytes from 2404:6800:4004:823::200e: seq=34 ttl=117 time=6.597 ms
64 bytes from 2404:6800:4004:823::200e: seq=35 ttl=117 time=4.480 ms
64 bytes from 2404:6800:4004:823::200e: seq=36 ttl=117 time=4.313 ms
64 bytes from 2404:6800:4004:823::200e: seq=37 ttl=117 time=4.430 ms
64 bytes from 2404:6800:4004:823::200e: seq=38 ttl=117 time=4.443 ms
64 bytes from 2404:6800:4004:823::200e: seq=39 ttl=117 time=3.897 ms
64 bytes from 2404:6800:4004:823::200e: seq=40 ttl=117 time=3.798 ms
64 bytes from 2404:6800:4004:823::200e: seq=41 ttl=117 time=3.658 ms
64 bytes from 2404:6800:4004:823::200e: seq=42 ttl=117 time=4.482 ms
64 bytes from 2404:6800:4004:823::200e: seq=43 ttl=117 time=3.689 ms
64 bytes from 2404:6800:4004:823::200e: seq=44 ttl=117 time=3.823 ms
64 bytes from 2404:6800:4004:823::200e: seq=45 ttl=117 time=4.282 ms
64 bytes from 2404:6800:4004:823::200e: seq=46 ttl=117 time=3.759 ms
64 bytes from 2404:6800:4004:823::200e: seq=47 ttl=117 time=4.290 ms
64 bytes from 2404:6800:4004:823::200e: seq=48 ttl=117 time=4.609 ms
64 bytes from 2404:6800:4004:823::200e: seq=49 ttl=117 time=3.744 ms
64 bytes from 2404:6800:4004:823::200e: seq=50 ttl=117 time=4.483 ms
64 bytes from 2404:6800:4004:823::200e: seq=51 ttl=117 time=3.508 ms
64 bytes from 2404:6800:4004:823::200e: seq=52 ttl=117 time=3.829 ms
64 bytes from 2404:6800:4004:823::200e: seq=53 ttl=117 time=3.999 ms
^C
--- google.com ping statistics ---
54 packets transmitted, 54 packets received, 0% packet loss
round-trip min/avg/max = 3.331/14.698/574.716 ms
15

Is this ping from Windows?

16

Set that to auto, as requested.

17

Did that with this result:

ping -6 google.com

Pinging google.com [2404:6800:4004:823::200e] with 32 bytes of data:
Reply from 2404:6800:4004:823::200e: time=15ms
Reply from 2404:6800:4004:823::200e: time=8ms
Reply from 2404:6800:4004:823::200e: time=9ms
Reply from 2404:6800:4004:823::200e: time=9ms

Ping statistics for 2404:6800:4004:823::200e:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 8ms, Maximum = 15ms, Average = 10ms
18

Works fine now!

19

You are right.
After changing the LAN and WAN6 settings to make them IPv6 relays, I applied the changes and restarted those services. The result seemed poor. But, after disabling the temporary IPv6 addresses in Windows, I actually rebooted the router and my laptop. Maybe this had some effect.

Anyway, it seems fine now:

Success
Success1532×956 111 KB

Should I reactivate the temporary IPv6 addresses in Windows now?

20

You could give it a try and see how it works.