Multi-homed IPv6 with dynamic addresses

I'm currently setting up my OpenWrt router with multiple WAN interfaces: one primary WAN link and a metered one to fall back on if the primary link goes down. Both WAN links feature native IPv4 and IPv6 with prefix delegation and dynamic addresses (including dynamic IPv6 prefixes).

With an IPv4-only setup everything works fine. All I had to do was setting the interface metric correctly, so the correct WAN route gets chosen and I'm done. NAT does the rest.

Now OpenWrt's approach of handling IPv6 using source-based routing doesn't really work for me. By default it announces all available WAN IPv6 prefixes as preferred to the LAN and the clients arbitrarily choose one they like, and therefore choose their favorite WAN interface. Even worse if the dynamic prefix changes, they fall back to IPv4 or to the other WAN link.

What I like to happen instead:

Only one preferred IPv6 prefix should be announced to the LAN: That of the best available WAN route (lowest metric). Once a more preferred WAN link is available, the prefix of all other interfaces should be deprecated (but still be usable). The router should always choose the WAN interface to use, not the clients.

Now dynamic IPv6 prefixes add the challenge that at some time one prefix stops working and gets replaced by a new one: OpenWrt deals with this by deprecating the old prefix and advertising the new one. As a result clients still trying to use the old prefix fall back to IPv4. What should happen instead is that if a client uses an outdated prefix, it should be translated by the router to the correct one using stateless NPTv6.

Is it possible to configure OpenWrt to make this work?

1 Like

Probably not since there is no opkg with the NPTv6 module in the packet repository to my knowledge. I looked for it recently.

1 Like

The NETMAP target is supported and should do the trick using the nat ip6tables.

However I need help with customizing OpenWrt itself, as all that nifty automatic IPv6 stuff doesn't work so well in my scenario.

I'm one step further I wrote a hotplug-script and put it into /etc/hotplug.d/iface to add the a NETMAP translation rule for each IPv6 WAN interface, which has a IPv6 prefix:

#!/bin/sh

. /lib/functions/network.sh

LOG=/dev/null

echo ACTION=$ACTION >> $LOG
echo INTERFACE=$INTERFACE >> $LOG
[ -z "$INTERFACE" ] && exit 0
CHAIN=nptv6_$INTERFACE
echo CHAIN=$CHAIN >> $LOG

network_get_prefix6 prefix6 $INTERFACE
echo prefix6=$prefix6 >> $LOG

if [ "$ACTION" == "ifup" ] || [ "$ACTION" == "ifupdate" ]; then
        network_get_device ifdev $INTERFACE
        echo ifdev=$ifdev >> $LOG
        [ -z "$ifdev" ] && exit 0

        [ -z "$prefix6" ] && exit 0

        ip6tables -t nat -N $CHAIN >> $LOG 2>&1
        ip6tables -t nat -F $CHAIN >> $LOG 2>&1
        ip6tables -t nat -A $CHAIN -o $ifdev -j NETMAP --to $prefix6 >> $LOG 2>&
        ip6tables -t nat -D POSTROUTING -j $CHAIN >> $LOG 2>&1
        ip6tables -t nat -A POSTROUTING -j $CHAIN >> $LOG 2>&1
fi
if [ "$ACTION" == "ifdown" ]; then
        ip6tables -t nat -D POSTROUTING -o -j $CHAIN >> $LOG 2>&1
        ip6tables -t nat -F $CHAIN >> $LOG 2>&1
        ip6tables -t nat -X $CHAIN >> $LOG 2>&1
fi

This way, non source-based IPv6 routing works, as long a there is at least one public prefix announced on the LAN interface. When the prefix used by the clients matches the currently assigned prefix, it's passed through 1:1 otherwise it's translated using a 1:1 suffix mapping. (I have forced IPv6 connection tracking to make the return path work as well.)

Now there there is only one problem left: Correct (default) route selection and preferring/deprecating the right IPv6 prefixes. I know barely anything about how to configure odhcpd to make this work.

1 Like

Suppose you only advertise a ULA and then use npt6 for handling the wan. Then at least the clients aren't renumbering constantly?

Or Maybe Just Advertise your main Prefix until It Needs Replacement, Then Advertise The New One

1 Like

Unique Local Addresses are not usable for accessing the IPv6 Internet. Clients will automatically prefer IPv4 instead.

However the daily or weekly renumbering isn't the issue as long as the router is smart about outdated prefixes. By transparently mapping them to correct prefix (which my script does), it keeps IPv6 connected, even if client applications don't pick the new prefix up. (The default behavior is to null-route the outdated source addresses breaking clients and have them fall back to IPv4.)

Or Maybe Just Advertise your main Prefix until It Needs Replacement, Then Advertise The New One

Getting OpenWrt to announce only one prefix as preferred and route everything through the best/fastest available WAN interface (lowest metric) is my next step in sorting the whole multi-homed setup out. I'm open to suggestions how to achieve this.

1 Like

can you maybe use radvd instead of dnsmasq, and then just rewrite the radvd config with a script, and restart the daemon?

I see there's no radvd package in the package list though...

I guess you could probably just reconfigure the dnsmasq as well and restart it.

1 Like

In my OpenWrt installation, dnsmasq isn't doing any IPv6 router advertisements:

Dnsmasq version 2.73  Copyright (c) 2000-2015 Simon Kelley
Compile time options: IPv6 GNU-getopt no-DBus no-i18n no-IDN DHCP no-DHCPv6 no-Lua TFTP no-conntrack no-ipset no-auth no-DNSSEC loop-detect inotify

That's the task of odhcpd, which seems to be OpenWrt-specific and almost undocumented.

1 Like

Any update on this? I'm worried to face the same issue if any of my 2 ISPs start changing my global prefix, which they don't seem to be doing ATM.

BTW, are you using mwan3?