No IPv6 router advertisement packages on PPPoE connection

Installing and Using OpenWrt
1

Hi,

looking for advice before I start complaining to my ISP, which uses PPPoE over a GPON fiber. I noticed that I lose IPv6 connectivity 30 minutes after connection is established. If I do a tcpdump for RA on the PPPoE interface (below), I can see the initial RA packet when the connection is established, but nothing after that.

I am running OpenWRT 19.07.04 on Linksys WRT1200AC.

Shouldnt I be seeing RA packages regularly on the PPPoE interface to maintain the connection?

$ tcpdump -xXvv -ttt -i pppoe-wan6 icmp6 and 'ip6[40] = 134' -s 65535 
tcpdump: listening on pppoe-wan6, link-type LINUX_SLL (Linux cooked v1), capture size 65535 bytes
 00:00:00.000000 IP6 (class 0xe0, hlim 255, next-header ICMPv6 (58) payload length: 56) fe80::b614:89ff:fe08:5d00 > fe80::7d0b:3f19:91f6:a99d: [icmp6 sum ok] ICMP6, router advertisement, length 56
	hop limit 64, Flags [none], pref medium, router lifetime 1800s, reachable time 0ms, retrans timer 0ms
	  mtu option (5), length 8 (1):  1492
	    0x0000:  0000 0000 05d4
	  prefix info option (3), length 32 (4): 2a02:678:1:c39::/64, Flags [onlink, auto], valid time 2592000s, pref. time 604800s
	    0x0000:  40c0 0027 8d00 0009 3a80 0000 0000 2a02
	    0x0010:  0678 0001 0c39 0000 0000 0000 0000
	0x0000:  6e00 0000 0038 3aff fe80 0000 0000 0000  n....8:.........
	0x0010:  b614 89ff fe08 5d00 fe80 0000 0000 0000  ......].........
	0x0020:  7d0b 3f19 91f6 a99d 8600 4fae 4000 0708  }.?.......O.@...
	0x0030:  0000 0000 0000 0000 0501 0000 0000 05d4  ................
	0x0040:  0304 40c0 0027 8d00 0009 3a80 0000 0000  ..@..'....:.....
	0x0050:  2a02 0678 0001 0c39 0000 0000 0000 0000  *..x...9........
2

Are all the default IPv6 firewall rules that OpenWRT provides enabled? Could you provide the IPv6 DHCP settings for the interface in question?

1 Like
3

Thank you for a quick reply!

Even if the firewall drops the packets, should I not be seeing them in the tcpdump?

This is the WAN6 interface in /etc/config/network:

config interface 'wan6'
	option _orig_ifname 'eth1.10'
	option _orig_bridge 'false'
	option proto 'pppoe'
	option ipv6 'auto'
	option ifname 'eth1'
	option peerdns '0'
	option username 'XXX@ISP.COM'
	option password 'XXXX'

These are the IPv6 rules in /etc/config/firewall:

config rule
	option name 'Allow-DHCPv6'
	option src 'wan'
	option proto 'udp'
	option family 'ipv6'
	option target 'ACCEPT'
	list src_ip 'fc00::/6'
	list dest_ip 'fc00::/6'
	option dest_port '546-547'

config rule
	option name 'Allow-MLD'
	option src 'wan'
	option proto 'icmp'
	option src_ip 'fe80::/10'
	list icmp_type '130/0'
	list icmp_type '131/0'
	list icmp_type '132/0'
	list icmp_type '143/0'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Input'
	option src 'wan'
	option proto 'icmp'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'
	list icmp_type 'destination-unreachable'
	list icmp_type 'echo-reply'
	list icmp_type 'echo-request'
	list icmp_type 'neighbour-advertisement'
	list icmp_type 'neighbour-solicitation'
	list icmp_type 'router-advertisement'
	list icmp_type 'router-solicitation'
	list icmp_type 'time-exceeded'

config rule
	option name 'Allow-ICMPv6-Forward'
	option src 'wan'
	option dest '*'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'
4

How about the following settings in /etc/config/dhcp per (https://openwrt.org/docs/guide-user/network/ipv6/start#router_advertisement_dhcpv6)?

1 Like
5

This is what I have in /etc/config/dhcp for lan and wan:

config dhcp 'lan'
option interface 'lan'
option start '100'
option limit '150'
option leasetime '12h'
option dhcpv6 'server'
option ra 'server'
option ra_management '1'

config dhcp 'wan'
option interface 'wan'
option ignore '1'

When the link is extablished I get a working /64 address and also clients in the LAN have a working IPv6 connection. The problem starts when the original router lifetime of 1800s expires.

$ ifconfig pppoe-wan6
pppoe-wan6 Link encap:Point-to-Point Protocol
inet addr:X.X.X.X P-t-P:X.X.X.X Mask:255.255.255.255
inet6 addr: X:X:1:X:X:X:X:X/64 Scope:Global
inet6 addr: X::x:X:X:X/10 Scope:Link
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1492 Metric:1
RX packets:102867 errors:0 dropped:0 overruns:0 frame:0
TX packets:57602 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:3
RX bytes:144101935 (137.4 MiB) TX bytes:5876789 (5.6 MiB)

6

Hmm, do you see any router solicitation messages heading out from your network, before the time is up? I'm wondering if any extra DHCPv6 options need to be enabled on WAN/WAN6.

7

tcpdump does not show any router solicitation messages going out from my device.

I can see that the default IPv6 routes disappear from the routing table after 30 minutes, if I manually add them back afterwards, IPv6 connection is restored without having to restart the interface.

According to this page, the RA and RS settings are deprecated.

8

I have now monitored the link for a while, and there are no RA or RS packets being sent after the initial DHCPv6 setup.

I am not sure which end is not behaving correctly, my OpenWRT router or the ISP.

Should OpenWRT send a RS instead of just letting the route expire?

Should the ISP be sending regular RA updates to the clients?

Is there a way for me to manually force sending a RS to the ISP to see if I get a response?