Wi-Fi bridges with a single IPv6 /64

I have a couple of Wi-Fi bridges set up using relayd¹ and would like to get them working with IPv6.

However, my ISP only provides a /64 through prefix delegation, which I'm aware is not ideal. Here's what my main router (also running OpenWrt) gets, with the cable modem set to bridge mode:

IPv6 Upstream
Protocol: DHCPv6 client
Prefix Delegated: 2804:14d:xxxx:yyyy::/64
Address: 2804:14d:xxxx::zzz/128

The Wi-Fi bridges are set up with everything (Router Advertisement Service, DHCPv6 Service, NDP Proxy) on relay mode on the LAN interface, and with a "WWAN6" interface as a DHCPv6 client. As a result, the WWAN interface gets a /64 address, which is not passed down to the LAN interface because it is not a prefix:

IPv6: 2804:14d:xxxx:yyyy:56e6:fcff:fec7:da6a/64
IPv6: 2804:14d:xxxx:yyyy::293/128

Am I out of options, or is there a way to still get IPv6 over to the bridges?

¹ Switched from an old AP running OpenWrt to a TP-Link EAP245, really starting to miss WDS...

Using relayd is something of a hack, though it does have its place.

First question, do you really need distinct subnets for your IPv6 traffic?

With IPv6, I'd first check to see if your IPS will provide either a wider address space, or multiple /64s. Comcast in the US, for example, will give out a /60 if your DHCPv6 client is capable of requesting it.

Worst case would be "no" and that you need subnets. In that case you can do the "ugly" splitting of the prefix into /68s or the like, depending on how many you need.

As jeff mentioned, IPv6 and relayd doesn't work (there have been a few rejected attempts for adding this functionality to the upstream kernel recently), an easier solution would be switch to WDS/ 4addr (if possible, which means all involved APs need to run OpenWrt), which passes IPv6 traffic through transparently (single subnet for all devices).

@jeff

I don't need distinct subnets, just a way to get the devices behind the bridge on IPv6.

My ISP is known to only provide a /64 no matter what the router requests. They promised they would eventually move to /56, but that was two years ago and it hasn't happened yet.

@slh

Yes, WDS is great. I had it on my previous setup with a cheap TP-Link WR841N as AP. Never had the chance to test it with IPv6 though.

Unfortunately my EAP245 has no OpenWrt port (I would definitely use WDS if there was a port), and its stock firmware uses the Atheros binary driver => no WDS.

Are you getting IPv6-prefix automatically or setting it manually?
I have a similar configuration and can't obtain prefix automatically, only external IPv6-address.

You could in theory make your router into a filtering brouter. Install ebtables, Turn on the bridge iptables syscl and bridge WAN and LAN, then in the brouter ebtable deny ipv4 packets so they get routed.

Edit, brouter link

http://ebtables.netfilter.org/examples/basic.html#ex_brouter

Have you considered Ethernet GRE tunnels over IPv6 (grev6tap) between the wifi bridges and the main router?

@vgaetera

The /64 PD is what my ISP provides through DHCPv6.

@dlakelan

The Wi-Fi bridges or the main router? You can't bridge Wi-Fi interfaces, otherwise I could have just used v6brouter and called it a day.

@mikma

Started looking into this, but I have two concerns:

  1. My bridges are old 4/32 devices from TP-Link still running CC 15.05.1. Flash space is a bit too tight to install the GRE packages.
  2. Is GRE supposed to have a LuCI interface? Not seeing it anywhere.

GRE for tunnels is pretty much a hand-configured thing. If you do decide to go down that route, let me know. There are some tricks in the config, and increasing the 802.11 link's MTU "is a must" to prevent strange connectivity problems, due to how L2 tunnels work, in general. Plenty of MTU on 802.11, so you're not breaking any rules...

Do you use special DHCPv6-options to obtain it?
Could you show:

uci show network.wan6

Thank you.

No special options. Note that I've also tried reqprefix 48, 56 and 60.

root@OpenWrt:~# uci show network.wan6
network.wan6=interface
network.wan6.proto='dhcpv6'
network.wan6.ifname='eth1'
network.wan6.reqaddress='try'
network.wan6.reqprefix='auto'
root@OpenWrt:~#
1 Like

Gotcha, I didn't quite understand that the hangup was the Wifi to Wifi connections, not the /64 address space being distributed to the LAN.

I like cat5e or powerline ethernet for solving this kind of problem. I never found wifi bridges to work that well even with WDS.

WDS has been "OK" for me, but never much impressed. I run backhaul over 802.11s with batman-adv as the higher-level routing protocol these days with good throughput on 5 GHz.

GRE tunnels are perhaps a tad better, but maintaining them as topologies change with five or more nodes here made the "turn-key" nature of batman-adv more attractive. If you only have two end points, it might be worth setting up.

Then again, if a cable or power-line modem does the trick, that's pretty easy to maintain!