Unable to connect to the IPv6 Internet from ULA addresses

Installing and Using OpenWrt
1

Unable to connect to the IPv6 Internet from ULA addresses

I gleened most of these settings from IPv6 configuration

1. Set the ula_prefix

config globals 'globals'
	option ula_prefix 'fd51:7480:b731::/48'
...

/etc/config/network

I have set the ula_prefix.

This gives us fd51:7480:b731:: for any ULA interfaces.

2. Setting a lan subnet interface:

2.1 Setting a device for the lan interface:

...
config interface 'lan'
	option device 'br-lan'
...

/etc/config/network

2.2 Set a subnet for the lan interface

...
	option ip6hint 'a'
	option ip6assign '64'
...

Now with the ula_prefix, the subnet (ip6hint), and
the subnet mask, we create a ULA Subnet range of:

fd51:7480:b731:a::/64

2.3 Setting an IPv6 address for the LAN Interface:

Now that we have our ULA Subnet range we can set an IP6 address
within it:

...
	option ip6addr 'fd51:7480:b731:a::1'
	option proto 'static'
...

/etc/config/network

2.4 Setting an ip6class:

OpenWRT uses the ip6class option to pick between Global Uniqe AddressesGUA and Unique Local Addresses ULA.

Here I am going to pick ULA, since our ULA subnet falls within that range (fd51:7480:b731:a::/64):

...
	option ip6class 'local'
...

/etc/config/network

2.4 Lastly, I'm going to set a DNS address for the subnet:

...
	option dns '2001:4860:4860::8888'
...

3. Restart the network:

openwrt $ /etc/init.d/network restart

4. Test ping to the DNS from the router:

openwrt $ ping6 2001:4860:4860::8888

(Success)

5. Client Setup with a static IPv6 Address in our ULA subnet

client-on-ula-a-subnet $ nmcli

eth0: connected to NetGear R6260 - LAN Port 1
        "Microchip SMS9512/9514"
        ethernet (smsc95xx), B8:27:EB:B2:DC:1E, hw, mtu 1500
        ipv4 default, ipv6 default
        inet4 192.168.1.7/24
        route4 default via 192.168.1.1 metric 100
        route4 192.168.1.0/24 metric 100
        inet6 fe80::363c:4eaf:b5e9:8e5d/64
        inet6 fd51:7480:b731:a::2/64
        route6 fd51:7480:b731:a::/64 metric 100
        route6 fe80::/64 ,etroc 1024
        route6 default via fd51:7480:b731:a::1 metric 100

6. Client Ping to DNS:

client-on-ula-a-subnet $ ping6 -v 2001:4860:4860::8888

ping6 sock4.fd -1 (socktype: 0), sock6.fd: 3 (socktype: SOCK_DGRAM), hints.ai_family: AF_INET6

ai->ai_family: AF_INET6: ai->ai_connonname: '2001:4860:4860::8888'
PING 2001:4860:4860::8888(2001:4860:4860::8888) 56 data byes
^C
--- 2001:4860:4860::8888 ping statistics ---
4 packets transmitted, 0 received, 100% packet loss, time 3062ms

(Failure to Ping?)

2

My guess is that I need some sort of NAT66 in front of the ULA Subnet:

Here is the configuration in full:


config interface 'loopback'
	option device 'lo'
	option proto 'static'
	list ipaddr '127.0.0.1/8'

config globals 'globals'
	option ula_prefix 'fd51:7480:b731::/48'
	option packet_steering '1'

config device
	option name 'br-lan'
	option type 'bridge'
	list ports 'lan1'
	list ports 'lan4'

config device
	option name 'br-kan'
	option type 'bridge'
	list ports 'lan2'

config interface 'lan'
	option device 'br-lan'
	option proto 'static'
	list ipaddr '192.168.1.1/24'
	option ip6addr 'fd51:7480:b731:a::1'
	option ip6assign '64'
	option multipath 'off'
	option ip6hint 'a'
	option ip6class 'local'
	option dns '2001:4860:4860::8888'

config interface 'kan'
	option device 'br-kan'
	option proto 'static'
	option ipaddr '192.168.13.1/24'

config interface 'wan'
	option device 'wan'
	option proto 'dhcp'

config interface 'wan6'
	option device 'wan'
	option proto 'dhcpv6'
	option reqprefix 'no'
	option reqaddress 'force'

config interface 'jool'
	option proto 'static'
	option device 'jool'
	option ipaddr '192.168.164.1'
	option netmask '255.255.255.0'
	option ip6assign '64'
	option ip6hint '64'

config route6
	option interface 'jool'
	option target '64:ff9b::/96'
	option gateway 'fe80::64'

config interface 'adm'
	option proto 'static'
	option device 'lan2'
	option multipath 'off'

config route6
	option proto 'static'
	option device 'br-lan'
	option gateway 'fd51:7480:a::1'

config route6
	option interface 'wan'
	option target '::/0'
	option gateway 'fe80::fad0:eff:fe72:69ff'

config route6
	option interface 'lan'
	option gateway 'fd51:7480:a::1'
	option target '::/0'

/etc/config/network





config dnsmasq
	option domainneeded '1'
	option boguspriv '1'
	option filterwin2k '0'
	option localise_queries '1'
	option rebind_protection '1'
	option rebind_localhost '1'
	option local '/lan/'
	option domain 'lan'
	option expandhosts '1'
	option nonegcache '0'
	option cachesize '1000'
	option authoritative '1'
	option readethers '1'
	option leasefile '/tmp/dhcp.leases'
	option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
	option nonwildcard '1'
	option localservice '1'
	option ednspacket_max '1232'
	option filter_aaaa '0'
	option filter_a '0'

config dhcp 'lan'
	option interface 'lan'
	option start '100'
	option limit '150'
	option leasetime '12h'
        option dhcp6 'server'
        option ra 'server'
        option ra_management '1'
        option ra_default '1'
        option loglevel '3'
        list dhcp_option '3,fd51:7480:a::1'
        list dns '2001:4860:4860::8888'
	option ra_advrouter '1'
        option dhcpv6_na '1'
        option dhcpv6_pd '0'
        option ra_maxinterval '600'
        option ra_mininterval '100'





config dhcp 'wan'
	option interface 'wan'
	option ignore '1'

config odhcpd 'odhcpd'
	option maindhcp '1'
	option leasefile '/tmp/odhcpd.leases'
	option leasetrigger '/usr/sbin/odhcpd-update'
	option loglevel '7'
	option piodir '/tmp/odhcpd-piodir'
	option hostsdir '/tmp/hosts'
	option dhcpv6 'server'
	option ra 'server'
	option ra_advrouter '1'
	option ra_preference 'high'
	option dhcpv6_pd '0'
	list dns '2001:4860:4860::8888'
	option dhcp6 'server'
	option ra_default '1'
	list ra_flags 'managed-config'
	list ra_flags 'other-config'

config dhcp 'jool'
	option interface 'jool'
	option start '100'
	option end '150'
	option leasetime '12h'
	option ignore '1'
	option ra 'server'
	option ra_default '2'

#config dhcp 'adm'
#	option interface 'adm'
#	option start '100'
#	option limit '150'
#	option leasetime '12h'
#	option dhcpv4 'server'
#	option ipv6_only_preferred '0'
#	option ra 'server'
#	option ra_slaac '0'
#	option ra_preference 'medium'
#	option dhcpv6 'server'

config host
	option name 'pos'
	list duid '00041f66464d5e6462fbcad614fbd6c6aae7%2b506735'
	option hostid '3a9'

/etc/config/dhcp




config defaults
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'ACCEPT'
	option synflood_protect '1'

config zone
	option name 'lan'
	list network 'lan'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'ACCEPT'

config zone
	option name 'wan'
	list network 'wan'
	list network 'wan6'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'DROP'
	option masq '1'
	option mtu_fix '1'

config zone
	option name 'jool'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'REJECT'
	list network 'jool'

config forwarding
	option src 'lan'
	option dest 'wan'

config forwarding
	option src 'jool'
	option dest 'wan'

config forwarding
	option src 'lan'
	option dest 'jool'

config rule
	option name 'Allow-DHCP-Renew'
	option src 'wan'
	option proto 'udp'
	option dest_port '68'
	option target 'ACCEPT'
	option family 'ipv4'
	option enabled '1'

config rule
	option name 'Allow-Ping'
	option src 'wan'
	option proto 'icmp'
	option icmp_type 'echo-request'
	option family 'ipv4'
	option target 'ACCEPT'
	option enabled '1'

config rule
	option name 'Allow-IGMP'
	option src 'wan'
	option proto 'igmp'
	option family 'ipv4'
	option target 'ACCEPT'
	option enabled '1'

config rule
	option name 'Allow-DHCPv6'
	option src 'wan'
	option proto 'udp'
	option dest_port '546'
	option family 'ipv6'
	option target 'ACCEPT'
	option enabled '1'
	option log '1'

config rule
	option name 'Allow-MLD'
	option src 'wan'
	option proto 'icmp'
	option src_ip 'fe80::/10'
	list icmp_type '130/0'
	list icmp_type '131/0'
	list icmp_type '132/0'
	list icmp_type '143/0'
	option family 'ipv6'
	option target 'ACCEPT'
	option enabled '1'

config rule
	option name 'DHCPv6 src546 dst547'
	list proto 'udp'
	option src_port '546'
	option dest_port '547'
	option target 'ACCEPT'
	option family 'ipv6'
	option log '1'
	option enabled '1'
	option src 'lan'
	list dest_ip 'ff02::1:2'

config rule
	option name 'DHCPv6 src547 dst546'
	option src_port '547'
	option dest_port '546'
	option target 'ACCEPT'
	option family 'ipv6'
	option log '1'
	option enabled '1'
	list proto 'udp'
	option dest 'lan'

config rule
	option name 'Allow-ICMPv6-Input'
	option src 'wan'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	list icmp_type 'router-solicitation'
	list icmp_type 'neighbour-solicitation'
	list icmp_type 'router-advertisement'
	list icmp_type 'neighbour-advertisement'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'
	option enabled '1'

config rule
	option name 'Allow-ICMPv6-Forward'
	option src 'wan'
	option dest '*'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'
	option enabled '1'

config rule
	option name 'Allow-IPSec-ESP'
	option src 'wan'
	option dest 'lan'
	option proto 'esp'
	option target 'ACCEPT'
	option enabled '1'

config rule
	option name 'Allow-ISAKMP'
	option src 'wan'
	option dest 'lan'
	option dest_port '500'
	option proto 'udp'
	option target 'ACCEPT'
	option enabled '1'

/etc/config/firewall




config core 'main'
	option lang 'auto'
	option mediaurlbase '/luci-static/bootstrap'
	option resourcebase '/luci-static/resources'
	option ubuspath '/ubus/'

config extern 'flash_keep'
	option uci '/etc/config/'
	option dropbear '/etc/dropbear/'
	option openvpn '/etc/openvpn/'
	option passwd '/etc/passwd'
	option opkg '/etc/opkg.conf'
	option firewall '/etc/firewall.user'
	option uploads '/lib/uci/upload/'

config internal 'languages'

config internal 'sauth'
	option sessionpath '/tmp/luci-sessions'
	option sessiontime '3600'

config internal 'ccache'
	option enable '1'

config internal 'themes'
	option Bootstrap '/luci-static/bootstrap'
	option BootstrapDark '/luci-static/bootstrap-dark'
	option BootstrapLight '/luci-static/bootstrap-light'

config internal 'apply'
	option rollback '90'
	option holdoff '4'
	option timeout '5'
	option display '1.5'

config internal 'diag'
	option dns 'openwrt.org'
	option ping 'openwrt.org'
	option route 'openwrt.org'

/etc/config/luci




config system
	option hostname 'OpenWrt'
	option timezone 'GMT0'
	option zonename 'UTC'
	option ttylogin '0'
	option log_size '128'
	option urandom_seed '0'
	option compat_version '1.1'

config timeserver 'ntp'
	option enabled '1'
	option enable_server '0'
	list server '0.openwrt.pool.ntp.org'
	list server '1.openwrt.pool.ntp.org'
	list server '2.openwrt.pool.ntp.org'
	list server '3.openwrt.pool.ntp.org'

config led 'led_wan'
	option name 'wan'
	option sysfs 'green:wan'
	option trigger 'netdev'
	option mode 'link tx rx'
	option dev 'wan'

/etc/config/system



config unbound 'ub_main'
	option add_extra_dns '0'
	option add_local_fqdn '1'
	option add_wan_fqdn '0'
	option dhcp_link 'none'
	option dhcp4_slaac6 '0'
	option exclude_ipv6_ga '0'
	option dns64 '0'
	option dns64_prefix '64:ff9b::/96'
	option domain 'lan'
	option domain_type 'static'
	option edns_size '1232'
	option extended_stats '0'
	option hide_binddata '1'
	option interface_auto '1'
	option listen_port '53'
	option localservice '1'
	option manual_conf '0'
	option num_threads '1'
	option protocol 'default'
	option query_minimize '0'
	option query_min_strict '0'
	option rate_limit '0'
	option rebind_localhost '0'
	option rebind_protection '1'
	option recursion 'default'
	option resource 'default'
	option root_age '9'
	option ttl_min '120'
	option ttl_neg_max '1000'
	option unbound_control '0'
	option validator '0'
	option validator_ntp '1'
	option verbosity '1'
	list iface_trig 'lan'
	list iface_trig 'wan'
	list iface_wan 'wan'
	#list domain_insecure 'ntp.example.com'

config zone 'auth_icann'
	# cache the root zone all at once to speed up recursion
	option enabled '0'
	option fallback '1'
	option url_dir 'https://www.internic.net/domain/'
	option zone_type 'auth_zone'
	list server 'lax.xfr.dns.icann.org'
	list server 'iad.xfr.dns.icann.org'
	list zone_name '.'
	list zone_name 'arpa.'
	list zone_name 'in-addr.arpa.'
	list zone_name 'ip6.arpa.'

config zone 'fwd_isp'
	# forward ISP account management to DHCP announced DNS servers
	option enabled '0'
	option fallback '1'
	option resolv_conf '1'
	option zone_type 'forward_zone'
	list zone_name 'isp-bill.example.com.'
	list zone_name 'isp-mail.example.net.'

config zone 'fwd_google'
	option enabled '0'
	option fallback '1'
	option tls_index 'dns.google'
	option tls_upstream '1'
	option zone_type 'forward_zone'
	list server '8.8.4.4'
	list server '8.8.8.8'
	list server '2001:4860:4860::8844'
	list server '2001:4860:4860::8888'
	list zone_name '.'

config zone 'fwd_cloudflare'
	option enabled '0'
	option fallback '1'
	option tls_index 'cloudflare-dns.com'
	option tls_upstream '1'
	option zone_type 'forward_zone'
	list server '1.1.1.1'
	list server '1.0.0.1'
	list server '2606:4700:4700::1111'
	list server '2606:4700:4700::1001'
	list zone_name '.'

/etc/config/ubound



3

ULA addresses are intentionally not routed on the public IPv6 Internet, so a client using only fd51:... will not get replies from 2001:4860:4860::8888 unless you add NAT66/NPTv6. The usual OpenWrt approach is to let wan6 receive a delegated GUA prefix and advertise that on lan with ip6assign; keep the ULA prefix for local-only reachability. Also double-check the static routes: fd51:7480:a::1 does not match your fd51:7480:b731:a::/64 prefix, and a default route via the LAN ULA will not make upstream IPv6 work.

4
  • Enable masquerade6 on WAN
5

You probably don't want the LAN default route via the ULA here. ULA is local-only, so without NAT66/NPTv6 the client cannot reach 2001:... through an fd51 source address.

I would first remove the two manual default route6 entries on lan/br-lan (also they use fd51:7480:a::1, which doesn't match fd51:7480:b731:a::/64), then let wan6 request a prefix and advertise that on lan. If you really must keep only ULA on clients, then lleachii's masquerade6/NAT66 suggestion is the workaround, but it is usually the fallback rather than the normal IPv6 setup.

6

You need to set a subnet mask of /64:
option ip6addr 'fd51:7480:b731:a::1/64

7

If you want to route ula to gua, you need a default route with src Parameter, matching the ula prefix otherwise it won't route.

Just as a friendly reminder, using ula can be the only option sometimes. Think of a setup with 2 uplinks and both having only dynamic prefixes.

Then you would probably use NPT to translate ula to gua depending on the uplink interface....

But I agree that if suitable then gua should be used.

8

Yes, fair point. I should have phrased that as the simple/default case, not as the only possible setup. With multiple dynamic prefixes, ULA plus NPT can make sense; I just would not start there for a normal single-WAN home setup unless there is a reason to avoid advertising the delegated GUA on LAN.

9

I've got a NAT6 rule for this (used for my VPN clients that get ULA assigned only, and use NAT6 on egress to the rest of the internet)

/etc/config/firewall:

config nat 'ula_nat6'
	option src 'wan'
	option proto 'all'
	option src_ip 'fc00::/7'
	option target 'MASQUERADE'
	option name 'ULA NAT6 egress'
	option enabled '1'
	option counter '1'