Odhcpd relayed RA DNS options causing ipv6 connection drop

Installing and Using OpenWrt Network and Wireless Configuration
1

My OpenWRT router is within a university network which only support SLAAC and NDP for ipv6 configuration (does not support DHCPv6 things). The router gets ipv6 /64 prefix through a router advertisement message (captured by wireshark, decoded package info shown below):

Internet Control Message Protocol v6
Type: Router Advertisement (134)
Code: 0
...
Flags: 0x08, Prf (Default Router Preference): High
Router lifetime (s): 1800
Reachable time (ms): 0
Retrans timer (ms): 0
ICMPv6 Option (Source link-layer address : xx:xx:xx:xx:xx:xx)
ICMPv6 Option (MTU : 1500)
ICMPv6 Option (Prefix information : 2001:da8:xxxx:xxxx::/64)
Type: Prefix information (3)
Length: 4 (32 bytes)
Prefix Length: 64
Flag: 0xc0, On-link flag(L), Autonomous address-configuration flag(A)
Valid Lifetime: 2592000
Preferred Lifetime: 604800
Reserved
Prefix: 2001:da8:xxxx:xxxx::

and gets DNS information through another router advertisement message with DNS options:

Internet Control Message Protocol v6
  Type: Router Advertisement (134)
  Code: 0
  Checksum: 0xec64 [correct]
  Checksum Status: Good
  Cur hop limit: 64
  Flags: 0x08, Prf (Default Router Preference): High
    0... .... = Managed address configuration: Not set
    .0.. .... = Other configuration: Not set
    ..0. .... = Home Agent: Not set
    ...0 1... = Prf (Default Router Preference): High (1)
    .... .0.. = Proxy: Not set
    .... ..0. = Reserved: 0
  Router lifetime (s): 0
  Reachable time (ms): 0
  Retrans timer (ms): 0
...
  ICMPv6 Option (Recursive DNS Server fe80::d6da:21ff:fe05:c14d)
    Type: Recursive DNS Server (25)
    Length: 3 (24 bytes)
    Reserved
    Lifetime: 1200
    Recursive DNS Servers: fe80::d6da:21ff:fe05:c14d

finally, the gateway information is given by a Neighbor Advertisement message:

Internet Control Message Protocol v6
Type: Neighbor Advertisement (136)
Code: 0
Checksum: 0x7438 [correct]
Checksum Status: Good
Flags: 0xe0000000, Router, Solicited, Override
1... .... .... .... .... .... .... .... = Router: Set
.1.. .... .... .... .... .... .... .... = Solicited: Set
..1. .... .... .... .... .... .... .... = Override: Set
...0 0000 0000 0000 0000 0000 0000 0000 = Reserved: 0
Target Address: fe80::7279:b3ff:fe99:bf40

and the router itself have no problem connecting to the ipv6 internet.

Everything looks just fine now. I configured dhcp (/etc/config/dhcp) to the relay mode as follows (dhcpv6 is disabled because it is not supported by my ISP):

config dhcp 'lan'                                              
        option interface 'lan'                                 
        option start '100'                                     
        option limit '150'                                     
        option leasetime '12h'                                 
        option dhcpv4 'server'                                 
        option ra_slaac '1'                                    
        option ra 'relay'                                      
        list ra_flags 'none'                                   
        option ndp 'relay'                                     
                                                               
                                                               
config dhcp 'wan'                                              
        option interface 'wan'                                 
        option ignore '1'                                      
                                                               
config dhcp 'wan6'                                             
        option interface 'wan6'                                
        option master '1'      
        option ndp 'relay'     
        option ra 'relay'      
        option dhcpv6 'disabled'

and now my LAN hosts can all receive the relayed RA and NDP messages, get public ipv6 addresses, and could have ipv6 connection (passed test-ipv6.com test), but the connection is soon interrupted by the relayed (proxied) RA DNS message (the following package is sent from the br-lan interface of openwrt, and received from a windows LAN desktop):

Internet Protocol Version 6
  0110 .... = Version: 6
  .... 0000 0000 .... .... .... .... .... = Traffic Class: 0x00 (DSCP: CS0, ECN: Not-ECT)
    .... 0000 00.. .... .... .... .... .... = Differentiated Services Codepoint: Default (0)
    .... .... ..00 .... .... .... .... .... = Explicit Congestion Notification: Not ECN-Capable Transport (0)
  .... 0001 0000 0100 1100 1101 = Flow Label: 0x104cd
  Payload Length: 56
  Next Header: ICMPv6 (58)
  Hop Limit: 255
  Source Address: fe80::2f1:f3ff:fe17:439a
  Destination Address: ff02::1
  Source SLAAC MAC: xx:xx:xx:17:43:9a (xx:xx:xx:17:43:9a)
Internet Control Message Protocol v6
  Type: Router Advertisement (134)
  Code: 0
  Checksum: 0xeb75 [correct]
  Checksum Status: Good
  Cur hop limit: 64
  Flags: 0x0c, Prf (Default Router Preference): High, Proxy
    0... .... = Managed address configuration: Not set
    .0.. .... = Other configuration: Not set
    ..0. .... = Home Agent: Not set
    ...0 1... = Prf (Default Router Preference): High (1)
    .... .1.. = Proxy: Set
    .... ..0. = Reserved: 0
  Router lifetime (s): 0
  Reachable time (ms): 0
  Retrans timer (ms): 0
...
  ICMPv6 Option (Recursive DNS Server fe80::d6da:21ff:fe05:c14d)
    Type: Recursive DNS Server (25)
    Length: 3 (24 bytes)
    Reserved
    Lifetime: 1200
    Recursive DNS Servers: fe80::d6da:21ff:fe05:c14d

This package directly cause the "ipv6 default gateway" configuration of the network interface to be removed, and then the ipv6 internet connection dropped. This connection can not be restored until a Neighbor Advertisement package with Flags: 0xe0000000 (Router, Solicited, Override) (The package is also sent from the openwrt's br-lan interface) that refill the gateway configuration.

So, hilariously, my LAN hosts now have "intermittent" ipv6 access, as the loop goes:
RA prefix info+ NA router info -> connected -> RA DNS info -> disconnected -> NA router info -> connected -> ...

If I directly plug my desktop to the ISP, the desktop can have ipv6 access just like the router. It receives unproxied RA DNS messages, and it does not wipe the ipv6 default gateway config. So I'm sure that the proxied RA DNS message caused the disconnection.

I have figured out 2 potential ways to solve the problem, but both doesn't work:

  1. block the RA DNS package by adding a rule in ip6tables:
    ip6tables -A OUTPUT -p icmpv6 --icmpv6-type router-advertisement -i br-lan -d ff02::1 -m u32 --u32 “0x53 & 0xff = 0x19” -j DROP
    I was trying to match the DNS option (0x19) in specific location (byte 86, aka 0x56) of the package. In fact, even I tried to drop all RA package by the following rule, it still failed:
    ip6tables -A OUTPUT -p icmpv6 --icmpv6-type router-advertisement -i br-lan -d ff02::1 -j DROP
    This also does not work:
    ip6tables -A OUTPUT -p icmpv6 --icmpv6-type router-advertisement -j DROP
    Nor this:
    ip6tables -A FORWARD -p icmpv6 --icmpv6-type router-advertisement -j DROP
    I'm new to ip(6)tables and are confused why those rules cannot block package sent from br-lan address. Maybe odhcpd overrided those rules?
  2. tell odhcpd not to relay RA DNS message by modifing /etc/config/dhcp:
config dhcp 'lan'                                              
        option interface 'lan'                                 
        option start '100'                                     
        option limit '150'                                     
        option leasetime '12h'                                 
        option dhcpv4 'server'                                 
        option ra_slaac '1'                                    
        option ra 'relay'                                      
        list ra_flags 'none'                                   
        option ndp 'relay' 
        option ra_dns '0' # added this line

The ra_dns option seems not effective in the relay mode. The LAN hosts still receives RA DNS messages. Also added this line in the wan6 section, not working.

I'm now at my wit's end. Please help.