OpenWrt does not allow IPv6 ping to be forwarded to WAN

cc672012 · October 9, 2022, 1:48pm

Hi,
I'm trying to learn some network stuff with OpenWRT on a virtual machine setup (VirtualBox two Internal Networks + NAT for Main Router)

My current setup is

OpenWRT Router Main
      |
OpenWRT Router Secondary
      |
Client Linux

I can ping the Main Router from Secondary Router using the address fd5f:a:a::1 just fine. Also, I can ping the Secondary Router from the client Linux using the address fd5f:a:a:1::1.

However, I cannot ping the main router from the client linux. I tried tcpdump on the secondary router on br-lan and it finds the packets with:

13:42:16.756117 IP6 alpine.lan > ff02::1:ff00:1: ICMP6, neighbor solicitation, who has fd5f:a:a::1, length 32

but for some reason, this does not get passed to the wlan6 interface. From the routing table below, it seems that the ICMP packet should be forwarded to the Main router but this does not happen. Using tcpdump on the wlan6 interface or the Main router does not yield results. So the packet simply stops at the secondary router. What could be the problem and how do I fix this? Thanks! I've listed more information about my setup below.

They have the following IP-Addresses:

Main Router:

eth1 (wlan6):
    inet6 fd17:625c:f037:2:a00:27ff:fe48:b381/64 scope global noprefixroute
    inet6 fe80::a00:27ff:fe48:b381/64 scope link

br-lan:
    inet6 fd5f:a:a::1/56 scope global noprefixroute 
    inet6 fe80::a00:27ff:fe14:7d36/64 scope link

Secondary Router:

eth1 (wlan6): 
    inet6 fd5f:a:a:0:a00:27ff:fee8:3aa/64 scope global noprefixroute
    inet6 fd5f:a:a::62a/128 scope global dynamic noprefixroute
    inet6 fe80::a00:27ff:fee8:3aa/64 scope link
br-lan:
    inet6 fd5f:a:a:1::1/64 scope global dynamic noprefixroute
    inet6 fd5f:a:a:b::1/64 preferred_lft 42597sec
    inet6 fe80::a00:27ff:fec8:1aa7/64 scope link

and my client PC has the IP addresses of:

eth0:
    inet6 fd5f:a:a:b::5e1/128 scope global dynamic noprefixroute
    inet6 fd5f:a:a:1::5e1/128 scope global dynamic noprefixroute
    inet6 fd5f:a:a:b:f6de:baa1:3265:49f0/64 scope global noprefixroute flags 100
    inet6 fd5f:a:a:1:30c0:ffaf:5135:196b/64 scope global dyamic noprefixroute flags 100
    inet6 fe80::37da:cba7:ca37:554b/64 scope link

Main Router ifstatus lan:

{
	"up": true,
	"pending": false,
	"available": true,
	"autostart": true,
	"dynamic": false,
	"uptime": 1340,
	"l3_device": "br-lan",
	"proto": "static",
	"device": "br-lan",
	"updated": [
		"addresses"
	],
	"metric": 0,
	"dns_metric": 0,
	"delegation": true,
	"ipv4-address": [
		{
			"address": "192.168.1.1",
			"mask": 24
		}
	],
	"ipv6-address": [
		
	],
	"ipv6-prefix": [
		
	],
	"ipv6-prefix-assignment": [
		{
			"address": "fd5f:a:a::",
			"mask": 56,
			"local-address": {
				"address": "fd5f:a:a::1",
				"mask": 56
			}
		}
	],
	"route": [
		
	],
	"dns-server": [
		
	],
	"dns-search": [
		
	],
	"neighbors": [
		
	],
	"inactive": {
		"ipv4-address": [
			
		],
		"ipv6-address": [
			
		],
		"route": [
			
		],
		"dns-server": [
			
		],
		"dns-search": [
			
		],
		"neighbors": [
			
		]
	},
	"data": {
		
	}
}

Secondary Router (ifstatus wan6)

{
	"up": true,
	"pending": false,
	"available": true,
	"autostart": true,
	"dynamic": false,
	"uptime": 1258,
	"l3_device": "eth1",
	"proto": "dhcpv6",
	"device": "eth1",
	"metric": 0,
	"dns_metric": 0,
	"delegation": true,
	"ipv4-address": [
		
	],
	"ipv6-address": [
		{
			"address": "fd5f:a:a::62a",
			"mask": 128,
			"preferred": 41940,
			"valid": 41940
		},
		{
			"address": "fd5f:a:a:0:a00:27ff:fee8:3aa",
			"mask": 64
		}
	],
	"ipv6-prefix": [
		{
			"address": "fd5f:a:a:1::",
			"mask": 64,
			"preferred": 41940,
			"valid": 41940,
			"class": "wan6",
			"assigned": {
				"lan": {
					"address": "fd5f:a:a:1::",
					"mask": 64
				}
			}
		}
	],
	"ipv6-prefix-assignment": [
		
	],
	"route": [
		{
			"target": "fd5f:a:a::",
			"mask": 64,
			"nexthop": "::",
			"metric": 256,
			"source": "::/0"
		},
		{
			"target": "fd5f:a:a::",
			"mask": 48,
			"nexthop": "fe80::a00:27ff:fe14:7d36",
			"metric": 512,
			"valid": 1529,
			"source": "fd5f:a:a:0:a00:27ff:fee8:3aa/64"
		},
		{
			"target": "fd5f:a:a::",
			"mask": 48,
			"nexthop": "fe80::a00:27ff:fe14:7d36",
			"metric": 512,
			"valid": 1529,
			"source": "fd5f:a:a:1::/64"
		},
		{
			"target": "fd5f:a:a::",
			"mask": 48,
			"nexthop": "fe80::a00:27ff:fe14:7d36",
			"metric": 512,
			"valid": 1529,
			"source": "fd5f:a:a::62a/128"
		}
	],
	"dns-server": [
		"fd5f:a:a::1"
	],
	"dns-search": [
		
	],
	"neighbors": [
		
	],
	"inactive": {
		"ipv4-address": [
			
		],
		"ipv6-address": [
			
		],
		"route": [
			
		],
		"dns-server": [
			
		],
		"dns-search": [
			
		],
		"neighbors": [
			
		]
	},
	"data": {
		"passthru": "00170010fd5f000a000a00000000000000000001"
	}
}

Secondary router (ifstatus lan):

{
	"up": true,
	"pending": false,
	"available": true,
	"autostart": true,
	"dynamic": false,
	"uptime": 1250,
	"l3_device": "br-lan",
	"proto": "static",
	"device": "br-lan",
	"updated": [
		"addresses"
	],
	"metric": 0,
	"dns_metric": 0,
	"delegation": true,
	"ipv4-address": [
		{
			"address": "192.168.2.1",
			"mask": 24
		}
	],
	"ipv6-address": [
		{
			"address": "fd5f:a:a:b::1",
			"mask": 64
		}
	],
	"ipv6-prefix": [
		
	],
	"ipv6-prefix-assignment": [
		{
			"address": "fd5f:a:a:1::",
			"mask": 64,
			"preferred": 41954,
			"valid": 41954,
			"local-address": {
				"address": "fd5f:a:a:1::1",
				"mask": 64
			}
		}
	],
	"route": [
		
	],
	"dns-server": [
		
	],
	"dns-search": [
		
	],
	"neighbors": [
		
	],
	"inactive": {
		"ipv4-address": [
			
		],
		"ipv6-address": [
			
		],
		"route": [
			
		],
		"dns-server": [
			
		],
		"dns-search": [
			
		],
		"neighbors": [
			
		]
	},
	"data": {
		
	}
}

Main router configs:

#/etc/config/network
config interface 'loopback'
	option device 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config globals 'globals'
	option ula_prefix 'fd5f:a:a::/48'

config device
	option name 'br-lan'
	option type 'bridge'
	list ports 'eth0'

config interface 'lan'
	option device 'br-lan'
	option proto 'static'
	option ipaddr '192.168.1.1'
	option netmask '255.255.255.0'
	list ip6class 'local'
	option ip6assign '56'

config interface 'wan'
	option device 'eth1'
	option proto 'dhcp'

config interface 'wan6'
	option device 'eth1'
	option proto 'dhcpv6'

Secondary router configs:

#/etc/config/network
config interface 'loopback'
	option device 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

#config globals 'globals'
#	option ula_prefix 'fd5f:a:a::/48'

config device
	option name 'br-lan'
	option type 'bridge'
	list ports 'eth0'

config interface 'lan'
	option device 'br-lan'
	option proto 'static'
	option netmask '255.255.255.0'
	#option ip6assign '60'
	option ipaddr '192.168.2.1'
	option ip6addr 'fd5f:a:a:b::1/64'
	option ip6assign '64'

config interface 'wan'
	option device 'eth1'
	option proto 'dhcp'

config interface 'wan6'
	option device 'eth1'
	option proto 'dhcpv6'
	option reqaddress 'try'
	option defaultroute '0'
	option reqprefix '64'

#/etc/config/firewall
config defaults
	option syn_flood	1
	option input		ACCEPT
	option output		ACCEPT
	option forward		REJECT
# Uncomment this line to disable ipv6 rules
#	option disable_ipv6	1

config zone
	option name		lan
	list   network		'lan'
	option input		ACCEPT
	option output		ACCEPT
	option forward		ACCEPT

config zone
	option name		wan
	list   network		'wan'
	list   network		'wan6'
	option input		REJECT
	option output		ACCEPT
	option forward		REJECT
	option masq		1
	option mtu_fix		1

config forwarding
	option src		lan
	option dest		wan

# We need to accept udp packets on port 68,
# see https://dev.openwrt.org/ticket/4108
config rule
	option name		Allow-DHCP-Renew
	option src		wan
	option proto		udp
	option dest_port	68
	option target		ACCEPT
	option family		ipv4

# Allow IPv4 ping
config rule
	option name		Allow-Ping
	option src		wan
	option proto		icmp
	option icmp_type	echo-request
	option family		ipv4
	option target		ACCEPT

config rule
	option name		Allow-IGMP
	option src		wan
	option proto		igmp
	option family		ipv4
	option target		ACCEPT

# Allow DHCPv6 replies
# see https://github.com/openwrt/openwrt/issues/5066
config rule
	option name		Allow-DHCPv6
	option src		wan
	option proto		udp
	option dest_port	546
	option family		ipv6
	option target		ACCEPT

config rule
	option name		Allow-MLD
	option src		wan
	option proto		icmp
	option src_ip		fe80::/10
	list icmp_type		'130/0'
	list icmp_type		'131/0'
	list icmp_type		'132/0'
	list icmp_type		'143/0'
	option family		ipv6
	option target		ACCEPT

# Allow essential incoming IPv6 ICMP traffic
config rule
	option name		Allow-ICMPv6-Input
	option src		wan
	option proto	icmp
	list icmp_type		echo-request
	list icmp_type		echo-reply
	list icmp_type		destination-unreachable
	list icmp_type		packet-too-big
	list icmp_type		time-exceeded
	list icmp_type		bad-header
	list icmp_type		unknown-header-type
	list icmp_type		router-solicitation
	list icmp_type		neighbour-solicitation
	list icmp_type		router-advertisement
	list icmp_type		neighbour-advertisement
	option limit		1000/sec
	option family		ipv6
	option target		ACCEPT

# Allow essential forwarded IPv6 ICMP traffic
config rule
	option name		Allow-ICMPv6-Forward
	option src		wan
	option dest		*
	option proto		icmp
	list icmp_type		echo-request
	list icmp_type		echo-reply
	list icmp_type		destination-unreachable
	list icmp_type		packet-too-big
	list icmp_type		time-exceeded
	list icmp_type		bad-header
	list icmp_type		unknown-header-type
	option limit		1000/sec
	option family		ipv6
	option target		ACCEPT

config rule
	option name		Allow-IPSec-ESP
	option src		wan
	option dest		lan
	option proto		esp
	option target		ACCEPT

config rule
	option name		Allow-ISAKMP
	option src		wan
	option dest		lan
	option dest_port	500
	option proto		udp
	option target		ACCEPT

The secondary router has the following routing table:

fd5f:a:a::/48 from fd5f:a:a::62a via fe80::a00:27ff:fe14:7d36 dev eth1  metric 512 
fd5f:a:a::/48 from fd5f:a:a::/64 via fe80::a00:27ff:fe14:7d36 dev eth1  metric 512 
fd5f:a:a::/48 from fd5f:a:a:1::/64 via fe80::a00:27ff:fe14:7d36 dev eth1  metric 512 
fd5f:a:a::/64 dev eth1  metric 256 
unreachable fd5f:a:a::/64 dev lo  metric 2147483647 
fd5f:a:a:1::/64 dev br-lan  metric 1024 
unreachable fd5f:a:a:1::/64 dev lo  metric 2147483647 
fd5f:a:a:b::/64 dev br-lan  metric 256 
fe80::/64 dev eth1  metric 256 
fe80::/64 dev br-lan  metric 256 
anycast fd5f:a:a:: dev eth1  metric 0 
anycast fd5f:a:a:1:: dev br-lan  metric 0 
anycast fd5f:a:a:b:: dev br-lan  metric 0 
anycast fe80:: dev eth1  metric 0 
anycast fe80:: dev br-lan  metric 0 
multicast ff00::/8 dev br-lan  metric 256 
multicast ff00::/8 dev eth1  metric 256

DGdodo · October 9, 2022, 5:57pm

cc672012,

Welcome to this forum.

Did you also checked your firewall settings from wan to lan?
There should be an option: Allow Ping
In: Network / Firewall / Traffic Rules

The second should be enabled? On both OpenWrt routers? First try only on second router.
Although you ping lan to lan (through wan, tho).

DG.

trendy · October 9, 2022, 6:52pm

It is not clear if you are using ndp proxy or not on the second router.
Another mistake is that you have assigned an IPv6 on the lan of router 2, which is not advertised as a static route to router 1. Instead you should let router 2 get a delegated prefix from router 1.
Basically this whole thing can work with default settings for both routers. Then you can remove ULA from the second and adjust the ULA of the first. Finally you can use ip6hint to adjust the delegated prefix to second router.

_bernd · October 9, 2022, 8:19pm

Typo: up6hint should be ip6hint

cc672012 · October 10, 2022, 12:50am

Thanks.

I restored everything to their defaults and updated just the ULA from the first and second routers, as you said.

Router 1 now has a ULA of fd5f:a:a::/48 and an IPv6 of fd5f:a:a::1/60 using option ipv6assign 60.

Router 2 also has option ipv6assign 60 and has the following IPv6 addresses

wlan6:
    IPv6: fdf5:a:a::c56/128
    IPv6: fdf5:a:a:0:a00:27ff:fea7:5525/64
    IPv6-PD: fdf5:a:a:4::/62
lan:
    IPv6: fdf5:a:a:4::1/62

which is confusing because I do not know where the prefix length 62 came from. This leads to the main router being non-routable from the secondary router's Linux client since it is not on the ip -6 route.

Client:~$ ip -6 route
fd5f:a:a:4::/64 dev eth0 proto ra metric 1002 mtu 1500 pref medium
fe80::/64 dev eth0 proto kernel metric 256 pref medium

The client's routing table does not include fdf5:a:a::/48 dev eth0 so I had to manually add that. But this could also mean that there's something wrong with what I did with the secondary router's prefix delegation.
ICMPv6 RA is only announced via the LAN. From my understanding, fdxx:: is unique local so it should be able to go upstream to WAN (which is in the same unique local address).

I am not really sure what I am doing wrong here.

cc672012 · October 10, 2022, 2:09am

I've managed to make it work by adding uci set dhcp.lan.ra_default='1'. The problem is I'm not sure why this added a default in the routing table of the client... but thanks for pushing me in the right direction

How does setting ra_default='1' allow packets to be forwarded from the secondary router to the main router? The odhcpd documentation does not clarify this for me

trendy · October 10, 2022, 10:24am

router 1 is not allocating all of its available prefixes to router 2. If you want to allocate a /60 to router 2, then make ip6assign in router 1 lan bigger than /60.

Regarding the other issue with the missing /48, you can check with ifstatus wlan6 on router 2 that there is a field "route": containing it. Then you can verify that the RAs of router 2 include that. opkg update; opkg install tcpdump; tcpdump -i br-lan -vn ip6[40] == 134
The ra_default=1 will advertise the default route in the RA. It works as a workaround but you might want to avoid that if the default gateway should be some other router.

cc672012 · October 10, 2022, 2:53pm

Thanks a lot @trendy

This solved my problem.

So from my understanding, ra_default should be set to 1 if you want to advertise a router as the default route if that router has no GUA on its defaults?

I tried setting the Main router to a global address and set its ra_default to 1, then the downstream routers to 0 and it works just as well.

trendy · October 10, 2022, 9:02pm

If you already have a GUA, then the ra_default is not needed.
If you don't, then the RAs should carry the whole /48. If it is missing, there is an issue and possibly a bug.

system · October 20, 2022, 9:03pm

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.