PPPoE IPv6 to Lan

Rob_87 · October 11, 2024, 3:43am

Hi,

I have a PPPoe Internet access with IPv6 Prefix delegration and I can ping an open IPv6 internet address via SSH on the OpenWRT.

But I can access to the IPv6 via PC. The PC gets an IPv6 address by OpenWRT.

What do I have to do to access to the IPv6 address in the internet from my PC?

Thanks.

fakemanhk · October 11, 2024, 6:02am

You need to post your config in order for others to help.

evs · October 12, 2024, 12:59am

So you want to change the firewall so people from the public internet can get to the publicly routable IPv6 address on your PC that is behind your OpenWRT Router?

Rob_87 · October 17, 2024, 7:51pm

Any more Information needed?

_bernd · October 18, 2024, 8:45am

Please do not "quote" code snippets. Please use "preformat"/"code". In the editor menu its </> or use markdown notation "```" (3 backticks) before and after the snippet.
Remove your t-online pppoe credentials from the wan interface in your post!
Remove option defaultroute '0' from all your local network interfaces. It's useless here.
In your dhcp config: Each local network should include

option dhcpv4 'server'
option dhcpv6 'server'
option ra     'server'
list ra_flags 'managed-config'
list ra_flags 'other-config'

I assume you messed something up during your initial configuration, because an OpenWrt stock configuration just does want you want. The wan6 interface is using proto dhcpv6, receives a prefix and delegates this to local network interfaces.

Rob_87 · November 28, 2024, 4:56am

Sure:
cat /etc/config/network

 config interface 'loopback'
 option device 'lo'
 option proto 'static'
 option ipaddr '127.0.0.1'
 option netmask '255.0.0.0'



 config globals 'globals'
 option packet_steering '1'
 option ula_prefix 'fd38:22a7:9124::/48'



 config device
 option name 'br-lan'
 option type 'bridge'
 list ports 'eth0'
 list ports 'eth1'
 list ports 'eth2'
 list ports 'eth3'
 list ports 'eth4'



 config interface 'lan'
 option proto 'static'
 option ipaddr '192.168.1.1'
 option netmask '255.255.255.0'
 option ip6assign '60'
 option device 'br-lan.2'



 config interface 'wan'
 option proto 'pppoe'
 option device 'eth5.7'
 option ipv6 'auto'
 option username '***@t-online.de'
 option password '***'



 config device
 option type '8021q'
 option ifname 'eth5'
 option vid '7'
 option name 'eth5.7'



 config bridge-vlan
 option device 'br-lan'
 option vlan '2'
 list ports 'eth0'
 list ports 'eth4:t'



 config bridge-vlan
 option device 'br-lan'
 option vlan '22'
 list ports 'eth3:u*'
 list ports 'eth4:t'



 config interface 'Homenet'
 option device 'br-lan.22'
 option proto 'static'
 option ipaddr '10.25.22.1'
 option netmask '255.255.255.0'



 config bridge-vlan
 option device 'br-lan'
 option vlan '20'
 list ports 'eth1'
 list ports 'eth2'
 list ports 'eth4:t'



 config interface 'Homeint'
 option proto 'static'
 option device 'br-lan.20'
 option ipaddr '10.25.20.1'
 option netmask '255.255.255.0'
 option defaultroute '0'
 option delegate '0'
 option ip6assign '64'



 config interface 'WAN6'
 option proto 'dhcpv6'
 option device '@wan'
 option reqaddress 'try'
 option reqprefix 'auto'

root@OpenWrt:~# cat /etc/config/dhcp

 config dnsmasq
 option domainneeded '1'
 option localise_queries '1'
 option rebind_protection '1'
 option rebind_localhost '1'
 option local '/lan/'
 option domain 'lan'
 option expandhosts '1'
 option authoritative '1'
 option readethers '1'
 option leasefile '/tmp/dhcp.leases'
 option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
 option localservice '1'
 option ednspacket_max '1232'



 config dhcp 'lan'
 option interface 'lan'
 option start '100'
 option limit '150'
 option leasetime '12h'
 option dhcpv4 'server'
 option dhcpv6 'server'
 option ra 'server'
 list ra_flags 'managed-config'
 list ra_flags 'other-config'



 config dhcp 'wan'
 option interface 'wan'
 option ignore '1'



 config odhcpd 'odhcpd'
 option maindhcp '0'
 option leasefile '/tmp/hosts/odhcpd'
 option leasetrigger '/usr/sbin/odhcpd-update'
 option loglevel '4'



 config dhcp 'Homenet'
 option interface 'Homenet'
 option leasetime '12h'
 option start '220'
 option limit '15'
 option master '1'



 config dhcp 'Homeint'
 option interface 'Homeint'
 option leasetime '12h'
 option start '200'
 option limit '19'
 option ra 'server'
 list ra_flags 'managed-config'
 list ra_flags 'other-config'
 option dhcpv6 'server'



 config host
 option name 'WiHome216'
 option dns '1'
 option mac '24:5E:BE:2C:C5:89'
 option ip '10.25.20.216'
 option leasetime '12m'



 config host
 option name 'HomeSams'
 option dns '1'
 option mac '30:CD:A7:B2:57:E0'
 option ip '10.25.20.215'
 option leasetime '5m'

root@OpenWrt:~# cat /etc/config/firewall

 config defaults
 option input 'ACCEPT'
 option output 'ACCEPT'
 option forward 'REJECT'
 option synflood_protect '1'



 config zone
 option name 'lan'
 option input 'ACCEPT'
 option output 'ACCEPT'
 option forward 'ACCEPT'
 list network 'lan'



 config zone
 option name 'wan'
 option input 'REJECT'
 option output 'ACCEPT'
 option forward 'REJECT'
 option masq '1'
 option mtu_fix '1'
 list network 'wan'
 list network 'WAN6'



 config forwarding
 option src 'lan'
 option dest 'wan'



 config rule
 option name 'Allow-DHCP-Renew'
 option src 'wan'
 option proto 'udp'
 option dest_port '68'
 option target 'ACCEPT'
 option family 'ipv4'



 config rule
 option name 'Allow-Ping'
 option src 'wan'
 option proto 'icmp'
 option icmp_type 'echo-request'
 option family 'ipv4'
 option target 'ACCEPT'



 config rule
 option name 'Allow-IGMP'
 option src 'wan'
 option proto 'igmp'
 option family 'ipv4'
 option target 'ACCEPT'



 config rule
 option name 'Allow-DHCPv6'
 option src 'wan'
 option proto 'udp'
 option dest_port '546'
 option family 'ipv6'
 option target 'ACCEPT'



 config rule
 option name 'Allow-MLD'
 option src 'wan'
 option proto 'icmp'
 option src_ip 'fe80::/10'
 list icmp_type '130/0'
 list icmp_type '131/0'
 list icmp_type '132/0'
 list icmp_type '143/0'
 option family 'ipv6'
 option target 'ACCEPT'



 config rule
 option name 'Allow-ICMPv6-Input'
 option src 'wan'
 option proto 'icmp'
 list icmp_type 'echo-request'
 list icmp_type 'echo-reply'
 list icmp_type 'destination-unreachable'
 list icmp_type 'packet-too-big'
 list icmp_type 'time-exceeded'
 list icmp_type 'bad-header'
 list icmp_type 'unknown-header-type'
 list icmp_type 'router-solicitation'
 list icmp_type 'neighbour-solicitation'
 list icmp_type 'router-advertisement'
 list icmp_type 'neighbour-advertisement'
 option limit '1000/sec'
 option family 'ipv6'
 option target 'ACCEPT'



 config rule
 option name 'Allow-ICMPv6-Forward'
 option src 'wan'
 option dest '*'
 option proto 'icmp'
 list icmp_type 'echo-request'
 list icmp_type 'echo-reply'
 list icmp_type 'destination-unreachable'
 list icmp_type 'packet-too-big'
 list icmp_type 'time-exceeded'
 list icmp_type 'bad-header'
 list icmp_type 'unknown-header-type'
 option limit '1000/sec'
 option family 'ipv6'
 option target 'ACCEPT'



 config rule
 option name 'Allow-IPSec-ESP'
 option src 'wan'
 option dest 'lan'
 option proto 'esp'
 option target 'ACCEPT'



 config rule
 option name 'Allow-ISAKMP'
 option src 'wan'
 option dest 'lan'
 option dest_port '500'
 option proto 'udp'
 option target 'ACCEPT'



 config zone
 option name 'zHomenet'
 list network 'Homenet'
 option output 'ACCEPT'
 option input 'ACCEPT'
 option forward 'REJECT'
 option masq '1'



 config forwarding
 option src 'zHomenet'
 option dest 'wan'



 config rule
 option src 'zHomenet'
 option target 'ACCEPT'
 option dest_port '67 68'
 option name 'rHomenet-DHCP'



 config rule
 option src 'zHomenet'
 option dest_port '53'
 option target 'ACCEPT'
 option name 'rHomenet-DNS'



 config zone
 option name 'zHomeint'
 option input 'ACCEPT'
 option output 'ACCEPT'
 list network 'Homeint'
 option forward 'ACCEPT'
 option masq '1'



 config forwarding
 option src 'zHomeint'
 option dest 'zHomenet'



 config forwarding
 option src 'zHomenet'
 option dest 'zHomeint'



 config rule
 option name 'rHomeint-DNS'
 option src 'zHomeint'
 option dest '*'
 option dest_port '53'
 option target 'ACCEPT'



 config rule
 option name 'rHomeint-DHCP'
 option src 'zHomeint'
 option dest_port '67 68'
 option target 'ACCEPT'

Rob_87 · November 28, 2024, 4:58am

I'll Test your solutions.

-> I Use Luci for Config, so may some Configs a little bit overloaded.

Rob_87 · November 29, 2024, 6:22am

Hi, I tried your tips, but no sucess:

Ping via SSH works fine, via PC in Homenet-Interface not.

cat /etc/config/network


config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option packet_steering '1'
        option ula_prefix 'fd38:22a7:9124::/48'

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'eth0'
        list ports 'eth1'
        list ports 'eth2'
        list ports 'eth3'
        list ports 'eth4'

config interface 'lan'
        option proto 'static'
        option ipaddr '192.168.1.1'
        option netmask '255.255.255.0'
        option ip6assign '60'
        option device 'br-lan.2'

config interface 'wan'
        option proto 'pppoe'
        option device 'eth5.7'
        option ipv6 'auto'
        option username '002687042565551140114349#0001@t-online.de'
        option password 'Rob#7866e'

config device
        option type '8021q'
        option ifname 'eth5'
        option vid '7'
        option name 'eth5.7'

config bridge-vlan
        option device 'br-lan'
        option vlan '2'
        list ports 'eth0'
        list ports 'eth4:t'

config bridge-vlan
        option device 'br-lan'
        option vlan '22'
        list ports 'eth3:u*'
        list ports 'eth4:t'

config interface 'Homenet'
        option device 'br-lan.22'
        option proto 'static'
        option ipaddr '10.25.22.1'
        option netmask '255.255.255.0'

config bridge-vlan
        option device 'br-lan'
        option vlan '20'
        list ports 'eth1'
        list ports 'eth2'
        list ports 'eth4:t'

config interface 'Homeint'
        option proto 'static'
        option device 'br-lan.20'
        option ipaddr '10.25.20.1'
        option netmask '255.255.255.0'
        option delegate '0'
        option ip6assign '64'

config interface 'WAN6'
        option proto 'dhcpv6'
        option device '@wan'
        option reqaddress 'try'
        option reqprefix 'auto'

cat /etc/config/dhcp

cat /etc/config/dhcp

config dnsmasq
        option domainneeded '1'
        option localise_queries '1'
        option rebind_protection '1'
        option rebind_localhost '1'
        option local '/lan/'
        option domain 'lan'
        option expandhosts '1'
        option authoritative '1'
        option readethers '1'
        option leasefile '/tmp/dhcp.leases'
        option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
        option localservice '1'
        option ednspacket_max '1232'

config dhcp 'lan'
        option interface 'lan'
        option start '100'
        option limit '150'
        option leasetime '12h'
        option dhcpv4 'server'
        option dhcpv6 'server'
        option ra 'server'
        list ra_flags 'managed-config'
        list ra_flags 'other-config'

config dhcp 'wan'
        option interface 'wan'
        option ignore '1'

config odhcpd 'odhcpd'
        option maindhcp '0'
        option leasefile '/tmp/hosts/odhcpd'
        option leasetrigger '/usr/sbin/odhcpd-update'
        option loglevel '4'

config dhcp 'Homenet'
        option interface 'Homenet'
        option leasetime '12h'
        option start '220'
        option limit '15'
        option master '1'
        option dhcpv4 'server'
        option dhcpv6 'server'
        option ra     'server'
        list ra_flags 'managed-config'
        list ra_flags 'other-config'

config dhcp 'Homeint'
        option interface 'Homeint'
        option leasetime '12h'
        option start '200'
        option limit '19'
        option ra 'server'
        list ra_flags 'managed-config'
        list ra_flags 'other-config'
        option dhcpv6 'server'

config host
        option name 'WiHome216'
        option dns '1'
        option mac '24:5E:BE:2C:C5:89'
        option ip '10.25.20.216'
        option leasetime '12m'

config host
        option name 'HomeSams'
        option dns '1'
        option mac '30:CD:A7:B2:57:E0'
        option ip '10.25.20.215'
        option leasetime '5m'

Unfortionally I can't reconfig my router because, I can't miss one day of internet an have no 2. router to test.

Has anyone a working config of [WAN6] ?

Thanks

_bernd · November 29, 2024, 6:53pm

Just a wild guess but maybe your vlan assignment is broken but if your v4 is working then I should not be the case....
On a Telekom Line you get an wan address via dhcpv6 and in addition a /56. No extra config needed besides the vlan and pppoe for wan....