Ping6: sendto: Permission denied on some IPv6 addresses

[jamesmacwhite]

Yes it is, highest rule. No traffic is hitting the rule at all, even when 6in4 is working. (I have to disable the wan6 interface and set the default rules to family ipv4 in mwan3 for that though). iptables shows no packets or bytes on the rule when it's active.

At this point I'm going to have to give up with trying to handle IPv6 through mwan3 and just live with it for now, works fine for IPv4, it will have to do. Perhaps it's better if wan6 was native IPv6, maybe less complexity here, but I'm not expert enough and I've been messing around with for the past few days.

I'll revisit it at some point, I've stared at too many config files lately, going crazy!

[jamesmacwhite]

I came across another thread recently, which was identical to this:

Ping and traceroute failing for eth0.3 on IPv6

Something odd is happening, I can't remember what I might have done to cause this. Ping and traceroute are failing with permission denied error, only for eth0.3 on IPv6. I have 2 ISPs in mwan3 load balancing. First time I noticed this issue was when mwan3 started reporting wanb6 as offline, I went to diagnose the cause and discovered that ping is failing. Here's ping under pppoe-wan, note that everything works: root@EdgeOpenWrt:/# ping -c 2 -I pppoe-wan ipv4.google.com PING ipv4.google.com (2…

I've found, adding this route, resolves the permission denied errors from ping6, traceroute6 etc on the wanb6 interface:

config route6
        option interface 'wanb6'
        option target '::/0'

[jamesmacwhite]

Just for other people's benefit, I've also found I may be hitting this bug as well around my wan6 with 6in4:

mwan3: IPv6 address tracking doesn't work for IPv6-in-IPv4 tunnel interfaces

The ping test from mwan3 will always fail because the wrong source address is being used.

Without the source address explicitly defined, the ping test does indeed fail:

ping -I 6in4-wan6 -c 3 2001:4860:4860::8888
PING 2001:4860:4860::8888 (2001:4860:4860::8888): 56 data bytes
^C
--- 2001:4860:4860::8888 ping statistics ---
3 packets transmitted, 0 packets received, 100% packet loss

With source address defined, works fine.

ping -I 2001:470:xxxxx:xx::2 -c 3 2001:4860:4860::8888
PING 2001:4860:4860::8888 (2001:4860:4860::8888) from 2001:470:xxxx:xx::2: 56 data bytes
64 bytes from 2001:4860:4860::8888: seq=0 ttl=58 time=37.825 ms
64 bytes from 2001:4860:4860::8888: seq=1 ttl=58 time=21.830 ms
64 bytes from 2001:4860:4860::8888: seq=2 ttl=58 time=20.996 ms

--- 2001:4860:4860::8888 ping statistics ---
3 packets transmitted, 3 packets received, 0% packet loss
round-trip min/avg/max = 20.996/26.883/37.825 ms

This leads back to the original issue issue with my other wan interface, OpenWrt does not seem to be able to correctly use the source address in some cases, hence the weird behaviour, that's what I've found anyway.

However, installing ping6 from iputils-ping6, pinging the interface name 6in4-wan6 works, but because mwan3 using ping and not ping6 even with the iputils-ping version, this just throws "ping: unknown host 2001:4860:4860::8888"