IPv6 discussions

[xiaofan]

Or using nft command.

root@OpenWrt:~# nft list ruleset
table inet fw4 {
        chain input {
                type filter hook input priority filter; policy drop;
                iifname "lo" accept comment "!fw4: Accept traffic from loopback"
                ct state established,related accept comment "!fw4: Allow inbound established and related flows"
                tcp flags syn / fin,syn,rst,ack jump syn_flood comment "!fw4: Rate limit TCP syn packets"
                iifname { "eth2", "br-lan", "wg_lan" } jump input_lan comment "!fw4: Handle lan IPv4/IPv6 input traffic"
                iifname "eth1" jump input_wan comment "!fw4: Handle wan IPv4/IPv6 input traffic"
                jump handle_reject
        }

        chain forward {
                type filter hook forward priority filter; policy drop;
                ct state established,related accept comment "!fw4: Allow forwarded established and related flows"
                iifname { "eth2", "br-lan", "wg_lan" } jump forward_lan comment "!fw4: Handle lan IPv4/IPv6 forward traffic"
                iifname "eth1" jump forward_wan comment "!fw4: Handle wan IPv4/IPv6 forward traffic"
                jump handle_reject
        }

        chain output {
                type filter hook output priority filter; policy accept;
                oifname "lo" accept comment "!fw4: Accept traffic towards loopback"
                ct state established,related accept comment "!fw4: Allow outbound established and related flows"
                oifname { "eth2", "br-lan", "wg_lan" } jump output_lan comment "!fw4: Handle lan IPv4/IPv6 output traffic"
                oifname "eth1" jump output_wan comment "!fw4: Handle wan IPv4/IPv6 output traffic"
        }

        chain prerouting {
                type filter hook prerouting priority filter; policy accept;
                iifname { "eth2", "br-lan", "wg_lan" } jump helper_lan comment "!fw4: Handle lan IPv4/IPv6 helper assignment"
        }

        chain handle_reject {
                meta l4proto tcp reject with tcp reset comment "!fw4: Reject TCP traffic"
                reject comment "!fw4: Reject any other traffic"
        }

        chain syn_flood {
                limit rate 25/second burst 50 packets return comment "!fw4: Accept SYN packets below rate-limit"
                drop comment "!fw4: Drop excess packets"
        }

        chain input_lan {
                ct status dnat accept comment "!fw4: Accept port redirections"
                jump accept_from_lan
        }

        chain output_lan {
                jump accept_to_lan
        }

        chain forward_lan {
                tcp dport 853 counter packets 668 bytes 46488 jump handle_reject comment "!fw4: ubus:adblock-fast[main] rule 1"
                udp dport 853 counter packets 0 bytes 0 jump handle_reject comment "!fw4: ubus:adblock-fast[main] rule 1"
                tcp dport 853 counter packets 0 bytes 0 jump handle_reject comment "!fw4: ubus:https-dns-proxy[instance1] rule 1"
                udp dport 853 counter packets 0 bytes 0 jump handle_reject comment "!fw4: ubus:https-dns-proxy[instance1] rule 1"
                jump accept_to_wan comment "!fw4: Accept lan to wan forwarding"
                ct status dnat accept comment "!fw4: Accept port forwards"
                jump accept_to_lan
        }

        chain helper_lan {
        }

        chain accept_from_lan {
                iifname { "eth2", "br-lan", "wg_lan" } counter packets 137658 bytes 11106459 accept comment "!fw4: accept lan IPv4/IPv6 traffic"
        }

        chain accept_to_lan {
                oifname { "eth2", "br-lan", "wg_lan" } counter packets 10887 bytes 814895 accept comment "!fw4: accept lan IPv4/IPv6 traffic"
        }

        chain input_wan {
                meta nfproto ipv4 udp dport 68 counter packets 0 bytes 0 accept comment "!fw4: Allow-DHCP-Renew"
                icmp type echo-request counter packets 123 bytes 5527 accept comment "!fw4: Allow-Ping"
                meta nfproto ipv4 meta l4proto igmp counter packets 1004 bytes 32128 accept comment "!fw4: Allow-IGMP"
                meta nfproto ipv6 udp dport 546 counter packets 1 bytes 209 accept comment "!fw4: Allow-DHCPv6"
                ip6 saddr fe80::/10 icmpv6 type . icmpv6 code { mld-listener-query . no-route, mld-listener-report . no-route, mld-listener-done . no-route, mld2-listener-report . no-route } counter packets 1004 bytes 76304 accept comment "!fw4: Allow-MLD"
                icmpv6 type { destination-unreachable, time-exceeded, echo-request, echo-reply, nd-router-solicit, nd-router-advert } limit rate 1000/second counter packets 52 bytes 3328 accept comment "!fw4: Allow-ICMPv6-Input"
                icmpv6 type . icmpv6 code { packet-too-big . no-route, parameter-problem . no-route, nd-neighbor-solicit . no-route, nd-neighbor-advert . no-route, parameter-problem . admin-prohibited } limit rate 1000/second counter packets 2524 bytes 181728 accept comment "!fw4: Allow-ICMPv6-Input"
                udp dport 51820 counter packets 0 bytes 0 accept comment "!fw4: Allow-WireGuard-lan"
                jump reject_from_wan
        }

        chain output_wan {
                jump accept_to_wan
        }

        chain forward_wan {
                icmpv6 type { destination-unreachable, time-exceeded, echo-request, echo-reply } limit rate 1000/second counter packets 0 bytes 0 accept comment "!fw4: Allow-ICMPv6-Forward"
                icmpv6 type . icmpv6 code { packet-too-big . no-route, parameter-problem . no-route, parameter-problem . admin-prohibited } limit rate 1000/second counter packets 0 bytes 0 accept comment "!fw4: Allow-ICMPv6-Forward"
                meta l4proto esp counter packets 0 bytes 0 jump accept_to_lan comment "!fw4: Allow-IPSec-ESP"
                udp dport 500 counter packets 0 bytes 0 jump accept_to_lan comment "!fw4: Allow-ISAKMP"
                jump reject_to_wan
        }

        chain accept_to_wan {
                meta nfproto ipv4 oifname "eth1" ct state invalid counter packets 1010 bytes 46198 drop comment "!fw4: Prevent NAT leakage"
                oifname "eth1" counter packets 86305 bytes 22440542 accept comment "!fw4: accept wan IPv4/IPv6 traffic"
        }

        chain reject_from_wan {
                iifname "eth1" counter packets 12771 bytes 817150 jump handle_reject comment "!fw4: reject wan IPv4/IPv6 traffic"
        }

        chain reject_to_wan {
                oifname "eth1" counter packets 0 bytes 0 jump handle_reject comment "!fw4: reject wan IPv4/IPv6 traffic"
        }

        chain dstnat {
                type nat hook prerouting priority dstnat; policy accept;
                iifname { "eth2", "br-lan", "wg_lan" } jump dstnat_lan comment "!fw4: Handle lan IPv4/IPv6 dstnat traffic"
        }

        chain srcnat {
                type nat hook postrouting priority srcnat; policy accept;
                oifname "eth1" jump srcnat_wan comment "!fw4: Handle wan IPv4/IPv6 srcnat traffic"
        }

        chain srcnat_wan {
                meta nfproto ipv4 masquerade comment "!fw4: Masquerade IPv4 wan traffic"
        }

        chain raw_prerouting {
                type filter hook prerouting priority raw; policy accept;
        }

        chain raw_output {
                type filter hook output priority raw; policy accept;
        }

        chain mangle_prerouting {
                type filter hook prerouting priority mangle; policy accept;
        }

        chain mangle_postrouting {
                type filter hook postrouting priority mangle; policy accept;
        }

        chain mangle_input {
                type filter hook input priority mangle; policy accept;
        }

        chain mangle_output {
                type route hook output priority mangle; policy accept;
        }

        chain mangle_forward {
                type filter hook forward priority mangle; policy accept;
                iifname "eth1" tcp flags syn tcp option maxseg size set rt mtu comment "!fw4: Zone wan IPv4/IPv6 ingress MTU fixing"
                oifname "eth1" tcp flags syn tcp option maxseg size set rt mtu comment "!fw4: Zone wan IPv4/IPv6 egress MTU fixing"
        }

        chain dstnat_lan {
                tcp dport 53 counter packets 2572 bytes 154320 redirect to :53 comment "!fw4: ubus:adblock-fast[main] redirect 0"
                udp dport 53 counter packets 123984 bytes 9683892 redirect to :53 comment "!fw4: ubus:adblock-fast[main] redirect 0"
                tcp dport 53 counter packets 0 bytes 0 redirect to :53 comment "!fw4: ubus:https-dns-proxy[instance1] redirect 0"
                udp dport 53 counter packets 0 bytes 0 redirect to :53 comment "!fw4: ubus:https-dns-proxy[instance1] redirect 0"
        }
}
table ip ts-test-nat {
}

 

[astones153]

Called up M1 technical support today and asked if they were able to assign /60 or /56 IPv6 prefixes for customers if we asked for it. They said they weren't able to, and the excuse given was that "they dynamically assign IPv6 delegations", which sounds like boilerplate rubbish . Since when got dynamic prefix size assignment?

 

[sglandscape]

Called up M1 technical support today and asked if they were able to assign /60 or /56 IPv6 prefixes for customers if we asked for it. They said they weren't able to, and the excuse given was that "they dynamically assign IPv6 delegations", which sounds like boilerplate rubbish . Since when got dynamic prefix size assignment?

Likely vendor default configuration. You may better luck writing to their NOC team to better understand why, if they even reply. Based on my experience dealing with weird latency issues in the past, the NOC team mainly staffed with China Chinese who used to work for Huawei, and they do know their stuff if you can identify the specific concern you have rather quickly.

 

[astones153]

Likely vendor default configuration. You may better luck writing to their NOC team to better understand why, if they even reply. Based on my experience dealing with weird latency issues in the past, the NOC team mainly staffed with China Chinese who used to work for Huawei, and they do know their stuff if you can identify the specific concern you have rather quickly.

How were you able to reach out to an ISP NOC previously?

 

[sglandscape]

How were you able to reach out to an ISP NOC previously?

send an email via their feedback form, and cc their noc team email address (which is public if you know where to look)

 

[bert64]

Called up M1 technical support today and asked if they were able to assign /60 or /56 IPv6 prefixes for customers if we asked for it. They said they weren't able to, and the excuse given was that "they dynamically assign IPv6 delegations", which sounds like boilerplate rubbish . Since when got dynamic prefix size assignment?

Yeah that's a canned excuse to try to get you to go away and stop asking...
Assigning a dynamic range has nothing to do with the prefix size, many ISPs assign dynamic /56 delegations, even singtel do now and many providers in other countries such as british telecom or verizon.

They also provide static legacy assignments, so no reason they couldn't provide static v6 too. They are just doing the bare minimum to comply with the IMDA rules and would rather you didn't use v6 at all.

 

[astones153]

Yea I basically gave up on Starhub ever resolving my issue, I think I've given up on Singapore ISPs ever being amenable to more enthusiast requests. I've gone and set up an IPv6 tunnel with HE TunnelBroker. Will report back on the experience as and when I run into any issues.

 

[Mach3.2]

Yea I basically gave up on Starhub ever resolving my issue, I think I've given up on Singapore ISPs ever being amenable to more enthusiast requests. I've gone and set up an IPv6 tunnel with HE TunnelBroker. Will report back on the experience as and when I run into any issues.

google search is basically broken for traffic originating from 2001:470::/32

Netflix won't work also

 

[astones153]

google search is basically broken for traffic originating from 2001:470::/32

Netflix won't work also

It's because Google and Netflix both behave as if the HE IPv6 tunnel is a VPN.

 

[bert64]

It's because Google and Netflix both behave as if the HE IPv6 tunnel is a VPN.

It basically is, you sign up for the tunnel service and use one of the foreign tunnel servers and geoip services will peg you in that location. Because it's free many people have abused it for this purpose.

Another option btw is to get your own address space (maybe S$140/yr or so for a /48) and then route it through a VPS yourself such as Vultr. There are a number of VPS providers which will route your own address space, or even let you host your own BGP.

This way the address space is exclusively yours and doesn't belong to any ISP.

 

[astones153]

It basically is, you sign up for the tunnel service and use one of the foreign tunnel servers and geoip services will peg you in that location. Because it's free many people have abused it for this purpose.

Another option btw is to get your own address space (maybe S$140/yr or so for a /48) and then route it through a VPS yourself such as Vultr. There are a number of VPS providers which will route your own address space, or even let you host your own BGP.

This way the address space is exclusively yours and doesn't belong to any ISP.

I've already implemented a workaround for the Netflix problem. My opnsense has firewall rules that force all DNS requests from client devices in the LAN to use the Unbound DNS resolver, regardless of what Android wants to use for DNS. I've also configured Unbound DNS to filter all AAAA records for Netflix and associated websites, so now Netflix works perfectly fine even with the HE tunnel enabled.

 

[tomb]

need advice on setting up wireguard vpn on a openwrt 5g sim router (ezr34t-5g) with m1 5g sim.

I am able to establish connection to the router on a client using its local IP (ipv4 and ipv6) as endpoint. but it does not work if I use the ipv6 address of the router as an endpoint.

 

[bert64]

need advice on setting up wireguard vpn on a openwrt 5g sim router (ezr34t-5g) with m1 5g sim.

I am able to establish connection to the router on a client using its local IP (ipv4 and ipv6) as endpoint. but it does not work if I use the ipv6 address of the router as an endpoint.

What do you mean by "ipv6 address of the router"? and how is this different from "its local ip"?
Also are you using the router as a client or server? and where is the respective other device located?

Will probably better if you explain exactly what you're trying to achieve...

 

[tomb]

What do you mean by "ipv6 address of the router"? and how is this different from "its local ip"?
Also are you using the router as a client or server? and where is the respective other device located?

Will probably better if you explain exactly what you're trying to achieve...

the router is acting as a server. the client is a remote device.
ipv6 address: the one from the router wan interface
local ip: local ip of router

my aim is to remotely access devices connected to this 5g sim router.

 

[kindredSG]

ipv6 address: the one from the router wan interface

Did you add inbound firewall rules for the WAN interface?

 

[bert64]

the router is acting as a server. the client is a remote device.
ipv6 address: the one from the router wan interface
local ip: local ip of router

my aim is to remotely access devices connected to this 5g sim router.

Where are your clients connecting from? are they connected to the router directly, or you're connecting from a completely different connection?

Is the WAN address in the same /64 prefix as the LAN address (ie the first half of the address will be the same)? Does the address start with 2 or f?

It's not necessary to have a WAN address assigned to the router so you might not have one, if the reported address starts fe80: that means it's not globally routable. Even if you have a 2xxx: address the ISP might choose not to route it if it's just used for interconnects between routers.
The LAN prefix is globally routable, so no reason you can't use the LAN address for connecting to even from outside subject to your firewall rules allowing it.

As far as i'm aware M1 only provide routable v6, and legacy IP goes through NAT so if you're connecting to this router from outside it will be necessary to use the v6 address.

 

[tomb]

Did you add inbound firewall rules for the WAN interface?

yes wireguard interface was added to the lan zone and the port was opened.

Where are your clients connecting from? are they connected to the router directly, or you're connecting from a completely different connection?

Is the WAN address in the same /64 prefix as the LAN address (ie the first half of the address will be the same)? Does the address start with 2 or f?

It's not necessary to have a WAN address assigned to the router so you might not have one, if the reported address starts fe80: that means it's not globally routable. Even if you have a 2xxx: address the ISP might choose not to route it if it's just used for interconnects between routers.
The LAN prefix is globally routable, so no reason you can't use the LAN address for connecting to even from outside subject to your firewall rules allowing it.

As far as i'm aware M1 only provide routable v6, and legacy IP goes through NAT so if you're connecting to this router from outside it will be necessary to use the v6 address.

IPs of router and 2 PCs from router page

Wireguard configuration
Server
[Interface]
PrivateKey = <Server private key>
Address = 10.5.0.1/24
ListenPort = 51820

[Peer]
PublicKey =  <Client public key>
AllowedIPs = 10.5.0.2/32

Client
[Interface]
PrivateKey = <Client private key>
Address = 10.5.0.2/24, ::ffff:10.5.0.2/64
DNS = 8.8.8.8, 2001:4860:4860::8888

[Peer]
PublicKey =  <Server public key>
AllowedIPs = 0.0.0.0/0, ::/0
Endpoint = [2401:7400:7000:6a11::###]:51820

some progress today. I setup the wireguard 'server' on a Windows PC instead of the router and managed to establish a connection from another Windows PC using the public IPv6 address of the server as an Endpoint. However, the second PC is connected to the same router so I am unsure if it really works. The connection fails when using an IPv4 client (using my phone and also connecting second PC to another network). At this moment I am unable to use an IPv6 client on another network to try. Also, I have enabled internet sharing to the wireguard network on the server but the client is not able to access the internet when connected.

Any advice?

 

[xiaofan]

Testing 6rd IPv6 performance with a 1Gbps Fibre internet connection with Singtel 6rd Internet.

Virtual OpenWRT with Singtel 6rd (1Gbps connection to upstream Singtel ONR) --> Ubuntu 22.04 LxC container, both running on Intel N100 CPU running Proxmox PVE 8.2, both assigned two virutal CPU core.

Using crusader to test both speed and latency.
https://github.com/Zoxc/crusader/

Crusader server: 4Gbps capable, on Linode Singapore, supports IPv4 and IPv6
https://github.com/Zoxc/crusader/issues/9
Last time I got similar results using IPv4 and IPv6, with native Singtel IPv6 connection on a Ubuntu 24.04 Linux physical machine with Intel N100 CPU. Okay you can say IPv6 result is slightly lower but no big difference.

Crusader v0.3.2 client: the above Ubuntu 22.04 LxC container.

From the below results, 6rd does have a bit of degradation, 900Mbps vs 940Mbps, about 5% performance loss with this 1Gbps connection, not too bad.

1) IPv6 test result

root@ubuntu2204ct11:~/crusader_bin/v0.3.2# ./crusader test --load-duration 60 --streams 8 --stream-stagger 4 singapore.starlink.taht.net
[2024-11-21 11:42:23] Client version 0.3.2 running
[2024-11-21 11:42:23] Connected to server [2600:3c15::f03c:95ff:fe7e:75a2]:35481
[2024-11-21 11:42:25] Idle latency to server 3.53 ms
[2024-11-21 11:42:27] Testing download...
[2024-11-21 11:43:57] Testing upload...
[2024-11-21 11:45:27] Testing both download and upload...

-- Download test --
          Throughput: 902.59 Mbps
             Latency: 42.5 ms (40.5 ms down, 2.0 ms up)
         Packet loss: 0%

-- Upload test --
          Throughput: 902.50 Mbps
             Latency: 13.6 ms (1.1 ms down, 12.4 ms up)
         Packet loss: 0% down, 0.01% up

-- Bidirectional test --
          Throughput: 1497.84 Mbps (894.39 Mbps down, 603.45 Mbps up)
             Latency: 41.0 ms (38.9 ms down, 2.2 ms up)
         Packet loss: 0% down, 0.03% up

[2024-11-21 11:47:01] Writing data...
[2024-11-21 11:47:01] Saved raw data as crusader-results/test 2024-11-21 11.47.01.crr
[2024-11-21 11:47:01] Saved plot as crusader-results/test 2024-11-21 11.47.01.png

2) IPv4 results of the same LxC container with IPv6 disabled --> it can basically run at more or less the full bandwidth.

root@ubuntu2204ct11:~/crusader_bin/v0.3.2# ./crusader test --load-duration 60 --streams 8 --stream-stagger 4 singapore.starlink.taht.net
[2024-11-21 11:49:33] Client version 0.3.2 running
[2024-11-21 11:49:33] Connected to server 172.236.148.60:35481
[2024-11-21 11:49:35] Idle latency to server 2.49 ms
[2024-11-21 11:49:37] Testing download...
[2024-11-21 11:51:07] Testing upload...
[2024-11-21 11:52:37] Testing both download and upload...

-- Download test --
          Throughput: 941.28 Mbps
             Latency: 47.7 ms (46.2 ms down, 1.5 ms up)
         Packet loss: 0%

-- Upload test --
          Throughput: 941.11 Mbps
             Latency: 181.6 ms (1.0 ms down, 180.5 ms up)
         Packet loss: 0% down, 0.03% up

-- Bidirectional test --
          Throughput: 1713.35 Mbps (816.72 Mbps down, 896.63 Mbps up)
             Latency: 72.1 ms (3.2 ms down, 68.9 ms up)
         Packet loss: 0.04% down, 0.02% up

[2024-11-21 11:54:11] Writing data...
[2024-11-21 11:54:11] Saved raw data as crusader-results/test 2024-11-21 11.54.11.crr
[2024-11-21 11:54:11] Saved plot as crusader-results/test 2024-11-21 11.54.11.png

3) OOkla SpeedTest (IPv4) as a reference. The speed is higher than Crusader which I attribute to difference in implementation.

root@ubuntu2204ct11:~/ookla# ./speedtest -s 13623

   Speedtest by Ookla

      Server: Singtel - Singapore (id: 13623)
         ISP: Singtel Fibre
Idle Latency:     1.45 ms   (jitter: 0.18ms, low: 1.09ms, high: 1.55ms)
    Download:   950.19 Mbps (data used: 428.8 MB)                                                   
                  7.65 ms   (jitter: 0.43ms, low: 1.50ms, high: 8.89ms)
      Upload:   948.67 Mbps (data used: 430.3 MB)                                                   
                 34.20 ms   (jitter: 2.16ms, low: 2.23ms, high: 36.83ms)
 Packet Loss:     0.0%
  Result URL: https://www.speedtest.net/result/c/5d3ee5f4-ebef-4a9a-a401-d2a5dbfad593

 

[xiaofan]

I will try to test with 2.5Gbe connection as well later: to see if Singtel 6rd IPv6 has higher penalty in this case compared with native IPv6 and IPv4.

I have not set up Singtel 6rd IPv6 on the 5Gbe connection yet.

[To be updated]

 

[bert64]

yes wireguard interface was added to the lan zone and the port was opened.



IPs of router and 2 PCs from router page

Wireguard configuration
Server
[Interface]
PrivateKey = <Server private key>
Address = 10.5.0.1/24
ListenPort = 51820

[Peer]
PublicKey =  <Client public key>
AllowedIPs = 10.5.0.2/32

Client
[Interface]
PrivateKey = <Client private key>
Address = 10.5.0.2/24, ::ffff:10.5.0.2/64
DNS = 8.8.8.8, 2001:4860:4860::8888

[Peer]
PublicKey =  <Server public key>
AllowedIPs = 0.0.0.0/0, ::/0
Endpoint = [2401:7400:7000:6a11::###]:51820

some progress today. I setup the wireguard 'server' on a Windows PC instead of the router and managed to establish a connection from another Windows PC using the public IPv6 address of the server as an Endpoint. However, the second PC is connected to the same router so I am unsure if it really works. The connection fails when using an IPv4 client (using my phone and also connecting second PC to another network). At this moment I am unable to use an IPv6 client on another network to try. Also, I have enabled internet sharing to the wireguard network on the server but the client is not able to access the internet when connected.

Any advice?

Can you try using your phone on its own mobile data as a client? (is the phone also using M1?)

You have fully routable addressing with v6, so it should be able to connect from anywhere so long as the router doesn't have firewall rules to block it. If it's not working then most likely your rules are incorrect.

If you don't have anywhere outside to test from, there are various ipv6 portscan sites eg http://www.ipv6scanner.com, you will find that tcp scanning is more reliable than udp (which wireguard uses) but you can set up some tcp test service to verify that your rules are correct first, and then switch them to udp for wireguard.

As far as i know M1 uses CGNAT for legacy traffic - ie does your legacy wan address start 100.x or 10.x? do a whois lookup and see if it actually belongs to M1 or if its reserved address space. In this scenario you won't be able to use legacy ip for any kind of server hosted there, v6 is your only option.

Also you've not assigned any v6 address range for inside the tunnel.