Proxy ndp not working (for wireguard)

To connect me in a wireguard 'road warrior' szeanrio to my home net, I have an OpenWRT box behind my router, where the wireguard port is opened to. Thereby I use fdaa:: prefixes within my lan, as my provider changes ipv6 prefixes quite often. For assigning a ipv6 to a road warrior laptop I use proxy ndp via ndppd.

ndppd.conf

route-ttl 30000
proxy br-lan {
   router yes
   timeout 500   
   rule fdaa:aaaa:aaaa:aaaa::/64 {
      iface wg0
   }
}

However, after updating to 21.02.x (I believe) I cannot use ipv6 to access a service on a lan computer from the laptop any more. The laptop gets assigned a fdaa::/128 but, e.g., (after staring the tunnel) a ping -6 to an exisitng fdaa... times out. Even accessing a website via ipv6 and such an address fails. Executing the following on the OpenWRT box (after installing the ip-full package) fixes that:

wireguard-proxyndp.sh

#!/bin/sh

for addr in 200 206; do
  /sbin/ip neigh add proxy fdaa:aaaa:aaaa:aaaa::$addr dev br-lan
done

The latter was not necessary with 19.07.x, because imho ndppd did its job as it should (OT: I think it was also not necessary to install ip-full for alternatively executing wireguard-proxyndp.sh).

Below you can find my (network) config, if this should be of interest.

Thanks,
Chris

config/network

config interface 'loopback'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'
	option device 'lo'

config globals 'globals'
	option ula_prefix 'fdaa:aaaa:aaaa:aaaa::/64'

config atm-bridge 'atm'
	option vpi '1'
	option vci '32'
	option encaps 'llc'
	option payload 'bridged'
	option nameprefix 'dsl'

config dsl 'dsl'
	option tone 'av'
	option ds_snr_offset '0'
	option annex 'j'

config interface 'lan'
	option proto 'static'
	option netmask '255.255.255.0'
	option gateway '10.0.0.4'
	list dns 'router.xxx.lan'
	list dns '2001:4860:4860::8844'
	list dns '8.8.4.4'
	option ipaddr '10.0.0.23'
	option ip6ifaceid '::23'
	option ip6assign '60'
	option device 'br-lan'

config interface 'lan6'
	option proto 'dhcpv6'
	option reqaddress 'try'
	option reqprefix 'no'
	option device '@lan'

config device 'lan_eth0_1_dev'
	option name 'eth0.1'
	option macaddr 'C5:5E:97:3C:D0:8E'

config interface 'wan'
	option proto 'pppoe'
	option username 'username'
	option password 'password'
	option ipv6 '1'
	option device 'dsl0'

config device 'wan_dsl0_dev'
	option name 'dsl0'
	option macaddr 'C5:5E:97:3C:D0:8E'

config interface 'wan6'
	option proto 'dhcpv6'
	option device '@wan'

config switch
	option name 'switch0'
	option reset '1'
	option enable_vlan '1'

config switch_vlan
	option device 'switch0'
	option vlan '1'
	option ports '0 1 2 4 6t'

config interface 'wg0'
	option proto 'wireguard'
	option private_key 'xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx'
	option listen_port '39385'

config wireguard_wg0
	option public_key 'xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx'
	option description 'hans.yyy.de'
	list allowed_ips '10.0.0.200/32'
	list allowed_ips 'fdaa:aaaa:aaaa:aaaa::200/128'
	option private_key 'xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx'
	option persistent_keepalive '25'
	option route_allowed_ips '1'

config wireguard_wg0
	option public_key 'xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx'
	option description 'gretel.xxx.lan'
	list allowed_ips '10.0.0.206/32'
	list allowed_ips 'fdaa:aaaa:aaaa:aaaa::206/128'
	option private_key 'xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx'
	option persistent_keepalive '25'
	option route_allowed_ips '1'

config device
	option name 'br-lan'
	option type 'bridge'
	list ports 'eth0.1'
	list ports 'tap0'

sysctl.conf

# We need ProxyARP and ProxyNDP for Wireguard VPN.
net.ipv4.conf.default.proxy_arp=1
net.ipv4.conf.all.proxy_arp=1
net.ipv6.conf.default.proxy_ndp=1
net.ipv6.conf.all.proxy_ndp=1

config/firewall

config defaults
	option syn_flood '1'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'REJECT'

config zone
	option name 'lan'
	list network 'lan'
	list network 'lan6'
	list network 'wg0'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'ACCEPT'

config zone
	option name 'wan'
	list network 'wan'
	list network 'wan6'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option masq '1'
	option mtu_fix '1'

config forwarding
	option src 'lan'
	option dest 'wan'

config rule
	option name 'Allow-DHCP-Renew'
	option src 'wan'
	option proto 'udp'
	option dest_port '68'
	option target 'ACCEPT'
	option family 'ipv4'

config rule
	option name 'Allow-Ping'
	option src 'wan'
	option proto 'icmp'
	option icmp_type 'echo-request'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-IGMP'
	option src 'wan'
	option proto 'igmp'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-DHCPv6'
	option src 'wan'
	option proto 'udp'
	option src_ip 'fc00::/6'
	option dest_ip 'fc00::/6'
	option dest_port '546'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-MLD'
	option src 'wan'
	option proto 'icmp'
	option src_ip 'fe80::/10'
	list icmp_type '130/0'
	list icmp_type '131/0'
	list icmp_type '132/0'
	list icmp_type '143/0'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Input'
	option src 'wan'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	list icmp_type 'router-solicitation'
	list icmp_type 'neighbour-solicitation'
	list icmp_type 'router-advertisement'
	list icmp_type 'neighbour-advertisement'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Forward'
	option src 'wan'
	option dest '*'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-IPSec-ESP'
	option src 'wan'
	option dest 'lan'
	option proto 'esp'
	option target 'ACCEPT'

config rule
	option name 'Allow-ISAKMP'
	option src 'wan'
	option dest 'lan'
	option dest_port '500'
	option proto 'udp'
	option target 'ACCEPT'

config rule
	option name 'Allow-OpenVPN'
	option src 'wan'
	option dest_port '1194'
	option proto 'udp'
	option target 'ACCEPT'

config include
	option path '/etc/firewall.user'

config/dhcp

config dnsmasq
	option domainneeded '1'
	option localise_queries '1'
	option rebind_protection '1'
	option rebind_localhost '1'
	option expandhosts '1'
	option authoritative '1'
	option readethers '1'
	option leasefile '/tmp/dhcp.leases'
	option localservice '1'
	option domain 'xxx.lan'
	option local '/local/'
	option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'

config dhcp 'lan'
	option interface 'lan'
	option ignore '1'

config dhcp 'wan'
	option interface 'wan'
	option ignore '1'

config odhcpd 'odhcpd'
	option maindhcp '0'
	option leasefile '/tmp/hosts/odhcpd'
	option leasetrigger '/usr/sbin/odhcpd-update'
	option loglevel '4'

$ opkg list-installed

base-files - 1434-r16325-88151b8303
br2684ctl - 2.5.2-7
bspatch - 4.3-1
busybox - 1.33.1-6
ca-bundle - 20210119-1
cgi-io - 2021-09-08-98cef9dd-20
dnsmasq - 2.85-8
dropbear - 2020.81-2
dsl-vrx200-firmware-xdsl-a - 05.08.01.08.01.06_05.08.00.0B.01.01_osc-1
dsl-vrx200-firmware-xdsl-b-patch - 05.08.01.08.01.06_05.08.00.0B.01.01_osc-1
etherwake - 1.09-5
firewall - 2021-03-23-61db17ed-1
fritz-tffs - 1
fstools - 2021-01-04-c53b1882-1
fwtool - 2019-11-12-8f7fe925-1
getrandom - 2020-10-25-9ef88681-2
glib2 - 2.66.4-1
hostapd-common - 2020-06-08-5a8b3662-35
ip-full - 5.11.0-3
ip6tables - 1.8.7-1
iptables - 1.8.7-1
iw - 5.9-8fab0c9e-1
iwinfo - 2021-04-30-c45f0b58-2.1
jshn - 2021-05-16-b14c4688-2
jsonfilter - 2018-02-04-c7e938d6-1
kernel - 5.4.154-1-6c4f0e9c788ce61f99a25ae84a2dd0ac
kmod-ath - 5.4.154+5.10.68-1-1
kmod-ath9k - 5.4.154+5.10.68-1-1
kmod-ath9k-common - 5.4.154+5.10.68-1-1
kmod-atm - 5.4.154-1
kmod-cfg80211 - 5.4.154+5.10.68-1-1
kmod-crypto-hash - 5.4.154-1
kmod-crypto-kpp - 5.4.154-1
kmod-crypto-lib-blake2s - 5.4.154-1
kmod-crypto-lib-chacha20 - 5.4.154-1
kmod-crypto-lib-chacha20poly1305 - 5.4.154-1
kmod-crypto-lib-curve25519 - 5.4.154-1
kmod-crypto-lib-poly1305 - 5.4.154-1
kmod-gpio-button-hotplug - 5.4.154-3
kmod-ip6tables - 5.4.154-1
kmod-ipt-conntrack - 5.4.154-1
kmod-ipt-core - 5.4.154-1
kmod-ipt-nat - 5.4.154-1
kmod-ipt-offload - 5.4.154-1
kmod-leds-gpio - 5.4.154-1
kmod-lib-crc-ccitt - 5.4.154-1
kmod-ltq-atm-vr9 - 5.4.154-3
kmod-ltq-ifxos - 5.4.154+1.5.19-4
kmod-ltq-ptm-vr9 - 5.4.154-3
kmod-ltq-vdsl-vr9 - 5.4.154+4.17.18.6-4
kmod-ltq-vdsl-vr9-mei - 5.4.154+1.5.17.6-4
kmod-mac80211 - 5.4.154+5.10.68-1-1
kmod-nf-conntrack - 5.4.154-1
kmod-nf-conntrack6 - 5.4.154-1
kmod-nf-flow - 5.4.154-1
kmod-nf-ipt - 5.4.154-1
kmod-nf-ipt6 - 5.4.154-1
kmod-nf-nat - 5.4.154-1
kmod-nf-reject - 5.4.154-1
kmod-nf-reject6 - 5.4.154-1
kmod-nls-base - 5.4.154-1
kmod-owl-loader - 5.4.154+5.10.68-1-1
kmod-ppp - 5.4.154-1
kmod-pppoa - 5.4.154-1
kmod-pppoe - 5.4.154-1
kmod-pppox - 5.4.154-1
kmod-slhc - 5.4.154-1
kmod-tun - 5.4.154-1
kmod-udptunnel4 - 5.4.154-1
kmod-udptunnel6 - 5.4.154-1
kmod-usb-core - 5.4.154-1
kmod-usb-dwc2 - 5.4.154-1
kmod-wireguard - 5.4.154-1
libattr - 2.4.48-2
libblkid1 - 2.36.1-2
libblobmsg-json20210516 - 2021-05-16-b14c4688-2
libbpf0 - 5.10.10-2
libbz2-1.0 - 1.0.8-1
libc - 1.1.24-3
libelf1 - 0.180-1
libffi - 3.3-2
libgcc1 - 8.4.0-3
libip4tc2 - 1.8.7-1
libip6tc2 - 1.8.7-1
libiwinfo-data - 2021-04-30-c45f0b58-2.1
libiwinfo-lua - 2021-04-30-c45f0b58-2.1
libiwinfo20210430 - 2021-04-30-c45f0b58-2.1
libjson-c5 - 0.15-2
libjson-script20210516 - 2021-05-16-b14c4688-2
liblua5.1.5 - 5.1.5-9
liblucihttp-lua - 2021-06-11-3dc89af4-1
liblucihttp0 - 2021-06-11-3dc89af4-1
liblzo2 - 2.10-4
libmnl0 - 1.0.4-2
libmount1 - 2.36.1-2
libncurses6 - 6.2-3
libnl-tiny1 - 2020-08-05-c291088f-2
libopenssl-conf - 1.1.1l-1
libopenssl1.1 - 1.1.1l-1
libpthread - 1.1.24-3
librt - 1.1.24-3
libssh2-1 - 1.9.0-2
libubox20210516 - 2021-05-16-b14c4688-2
libubus-lua - 2021-06-30-4fc532c8-2
libubus20210630 - 2021-06-30-4fc532c8-2
libuci20130104 - 2020-10-06-52bbc99f-5
libuclient20201210 - 2021-05-14-6a6011df-1
libustream-wolfssl20201210 - 2020-12-10-68d09243-1
libuuid1 - 2.36.1-2
libwolfssl4.8.1.66253b90 - 4.8.1-stable-4
libxtables12 - 1.8.7-1
linux-atm - 2.5.2-7
logd - 2020-10-25-9ef88681-2
ltq-dsl-base - 3
ltq-vdsl-app - 4.17.18.6-8
ltq-vdsl-vr9-vectoring-fw-installer - 6.8.6-3
lua - 5.1.5-9
luci - git-20.074.84698-ead5e81
luci-app-firewall - git-21.295.66767-8eceb63
luci-app-openvpn - git-21.188.55022-d943037
luci-app-opkg - git-21.079.58598-6639e31
luci-app-uhttpd - git-20.202.77895-d662f3c
luci-app-wireguard - git-20.244.42172-21563a2
luci-app-wol - git-21.163.62608-7d7df07
luci-base - git-21.295.67054-13df80d
luci-compat - git-21.099.45066-7bb2fc4
luci-lib-base - git-20.232.39649-1f6dc29
luci-lib-ip - git-20.250.76529-62505bd
luci-lib-jsonc - git-19.317.29469-8da8f38
luci-lib-nixio - git-20.234.06894-c4a4e43
luci-mod-admin-full - git-19.253.48496-3f93650
luci-mod-network - git-21.295.67048-4d3de0e
luci-mod-status - git-21.295.66779-853a128
luci-mod-system - git-21.295.66903-8acd0d7
luci-proto-ipv6 - git-21.148.49484-14511e5
luci-proto-ppp - git-21.163.64918-6c6559a
luci-proto-wireguard - git-21.243.21928-71fe35c
luci-ssl - git-20.244.36115-e10f954
luci-theme-bootstrap - git-21.298.68362-d24760e
mc - 4.8.27-2
mtd - 26
ndppd - 0.2.5-1
netifd - 2021-07-26-440eb064-1
odhcp6c - 2021-01-09-53f07e90-16
odhcpd-ipv6only - 2021-07-18-bc9d317f-3
openssl-util - 1.1.1l-1
openvpn-openssl - 2.5.3-3
openwrt-keyring - 2021-02-20-49283916-2
opkg - 2021-06-13-1bf042dd-1
ppp - 2.4.8.git-2020-10-03-3
ppp-mod-pppoa - 2.4.8.git-2020-10-03-3
ppp-mod-pppoe - 2.4.8.git-2020-10-03-3
procd - 2021-02-23-37eed131-1
px5g-wolfssl - 3
rpcd - 2021-03-11-ccb75178-1
rpcd-mod-file - 2021-03-11-ccb75178-1
rpcd-mod-iwinfo - 2021-03-11-ccb75178-1
rpcd-mod-luci - 20210614
rpcd-mod-rrdns - 20170710
swconfig - 12
terminfo - 6.2-3
ubi-utils - 2.1.2-1
ubox - 2020-10-25-9ef88681-2
ubus - 2021-06-30-4fc532c8-2
ubusd - 2021-06-30-4fc532c8-2
uci - 2020-10-06-52bbc99f-5
uclibcxx - 0.2.5-3
uclient-fetch - 2021-05-14-6a6011df-1
uhttpd - 2021-03-21-15346de8-2
uhttpd-mod-ubus - 2021-03-21-15346de8-2
urandom-seed - 3
urngd - 2020-01-21-c7f7b6b6-1
usign - 2020-05-23-f1f65026-1
wireguard-tools - 1.0.20210223-2
wireless-regdb - 2021.04.21-1
wpad-basic-wolfssl - 2020-06-08-5a8b3662-35
zlib - 1.2.11-3