No more ipv6 in Singtel home 1G fibre broadband?

Henry Ng

Henry Ng

Arch-Supremacy Member
Joined
Aug 9, 2011
Messages
13,505
Reaction score
110
xiaofan said:
OpenWRT WAN6 status:
Code: 
Protocol: DHCPv6 client
Uptime: 4h 2m 45s
MAC: xx:xx:xx:xx:xx:xx
RX: 5.59 GB (3915466 Pkts.)
TX: 3.45 GB (3695034 Pkts.)
IPv6: 2400:d802:xxxx::1:6250/128
IPv6-PD: 2400:d802:yyyy:zzzz::/56

OpenWRT LAN status:
Code: 
Protocol: Static address
Uptime: 4h 4m 59s
MAC: xx:xx:xx:xx:xx:xx
RX: 1.01 GB (1137992 Pkts.)
TX: 1.91 GB (1646273 Pkts.)
IPv4: 192.168.28.1/24
IPv6: 2400:d802:yyyy:zzzz::1/60

OpenWRT default Firewall rules have IPv6 related settings.

Code: 
root@OpenWrt:/etc/config# cat firewall

config defaults
        option syn_flood '1'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'

config zone 'lan'
        option name 'lan'
        option network 'lan wg_lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'

config zone 'wan'
        option name 'wan'
        list network 'wan'
        list network 'wan6'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        option mtu_fix '1'

config forwarding
        option src 'lan'
        option dest 'wan'

config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-IGMP'
        option src 'wan'
        option proto 'igmp'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-MLD'
        option src 'wan'
        option proto 'icmp'
        option src_ip 'fe80::/10'
        list icmp_type '130/0'
        list icmp_type '131/0'
        list icmp_type '132/0'
        list icmp_type '143/0'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        list icmp_type 'router-solicitation'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'router-advertisement'
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-IPSec-ESP'
        option src 'wan'
        option dest 'lan'
        option proto 'esp'
        option target 'ACCEPT'

config rule
        option name 'Allow-ISAKMP'
        option src 'wan'
        option dest 'lan'
        option dest_port '500'
        option proto 'udp'
        option target 'ACCEPT'
Click to expand...
Hi,
You are using 10Gbps network or 1Gbps only?
 
X

xiaofan

Arch-Supremacy Member
Joined
Sep 16, 2018
Messages
16,410
Reaction score
2,197
This is another IPv4 Double NAT case, OpenWRT router behind Asus RT-AX86U.

Asus RT-AX86U router -- OpenWRT 23.05 VM (Intel N100 mini PC, PVE 8.0) -- OpenWRT dumb AP (Linksys EA7500 v2).

OpenWRT 23.05 VM settings: WAN6 will have /64 IPv6 allocation but not LAN.

Code: 
root@OpenWrt:/etc/config# cat network

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'fdae:4ff6:d9f5::/48'

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'eth0'

config interface 'lan'
        option device 'br-lan'
        option proto 'static'
        option ipaddr '192.168.60.1'
        option netmask '255.255.255.0'
        option dhcpv6 'relay'
        option ra 'relay'
        option ndp 'relay'

config interface 'wan'
        option device 'eth1'
        option proto 'dhcp'
        option peerdns '0'
        option delegate '0'

config interface 'wan6'
        option device 'eth1'
        option proto 'dhcpv6'
        option dhcpv6 'relay'
        option ra 'relay'
        option ndp 'relay'
        option master '1'
        option interface 'wan6'
        option reqaddress 'try'
        option reqprefix 'auto'
    
root@OpenWrt:/etc/config# cat dhcp

config dnsmasq
        option domainneeded '1'
        option boguspriv '1'
        option filterwin2k '0'
        option localise_queries '1'
        option rebind_protection '1'
        option rebind_localhost '1'
        option local '/lan/'
        option domain 'lan'
        option expandhosts '1'
        option nonegcache '0'
        option cachesize '1000'
        option authoritative '1'
        option readethers '1'
        option leasefile '/tmp/dhcp.leases'
        option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
        option nonwildcard '1'
        option localservice '1'
        option ednspacket_max '1232'
        option filter_aaaa '0'
        option filter_a '0'
        list server '/mask.icloud.com/'
        list server '/mask-h2.icloud.com/'
        list server '/use-application-dns.net/'
        list server '127.0.0.1#5053'
        list server '127.0.0.1#5054'
        list server '127.0.0.1#5055'
        option doh_backup_noresolv '-1'
        option noresolv '1'
        list doh_backup_server '/mask.icloud.com/'
        list doh_backup_server '/mask-h2.icloud.com/'
        list doh_backup_server '/use-application-dns.net/'
        list doh_backup_server '127.0.0.1#5053'
        list doh_backup_server '127.0.0.1#5054'
        list doh_server '127.0.0.1#5053'
        list doh_server '127.0.0.1#5054'
        list doh_server '127.0.0.1#5055'
        option serversfile '/var/run/adblock-fast/dnsmasq.servers'

config dhcp 'lan'
        option interface 'lan'
        option start '100'
        option limit '150'
        option leasetime '12h'
        option dhcpv4 'server'
        option ra 'relay'
        option dhcpv6 'relay'
        option ndp 'relay'

config dhcp 'wan'
        option interface 'wan'
        option ignore '1'

config odhcpd 'odhcpd'
        option maindhcp '0'
        option leasefile '/tmp/hosts/odhcpd'
        option leasetrigger '/usr/sbin/odhcpd-update'
        option loglevel '4'

config dhcp 'wan6'
        option interface 'wan6'
        option ra 'relay'
        option dhcpv6 'relay'
        option ndp 'relay'
        option master '1'
        option ignore '1'

Wireless client of the OpenWRT AP has IPv6: Acer Windows 11 laptop in this test.

Code: 
PS C:\work> ping ipv6.google.com

Pinging ipv6.l.google.com [2404:6800:4003:c06::71] with 32 bytes of data:
Reply from 2404:6800:4003:c06::71: time=8ms
Reply from 2404:6800:4003:c06::71: time=6ms
Reply from 2404:6800:4003:c06::71: time=6ms
Reply from 2404:6800:4003:c06::71: time=7ms

Ping statistics for 2404:6800:4003:c06::71:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 6ms, Maximum = 8ms, Average = 6ms
 
Last edited:
Mach3.2

Mach3.2

Great Supremacy Member
Joined
Apr 8, 2011
Messages
71,164
Reaction score
1,150
X

xiaofan

Arch-Supremacy Member
Joined
Sep 16, 2018
Messages
16,410
Reaction score
2,197
Mach3.2 said:
Not sure if this option is available in your Asus router settings, if you route a prefix shorter than /64 (e.g. /63 for 2 /64 subnets) to the upstream LAN, you can route additional /64 subnet(s) to your downstream router.

See DHCPv6 Prefix Delegation.
https://docs.netgate.com/pfsense/en/latest/services/dhcp/ipv6.html
Click to expand...

Supposedly it is automatically done by enabling DHCP-PD.

If I do not enable DHCP-PD, then I can set up LAN Prefix Length to be between /56 to /64. However, then it asks me to set a valid LAN IPv6 Address which I can not do (dynamic IPv6 address).

Asus IPv6 settings are a bit limited.
https://www.asus.com/support/FAQ/113990

So far I find out OpenWRT to have the most comprehensive IPv6 settings, beating pfSense. But still I feel none of them have very good IPv6 documentations.
https://openwrt.org/docs/guide-user/network/ipv6/configuration
https://docs.netgate.com/pfsense/en/latest/interfaces/configure-ipv6.html

mFMP1Cl.png
 
Mach3.2

Mach3.2

Great Supremacy Member
Joined
Apr 8, 2011
Messages
71,164
Reaction score
1,150
xiaofan said:
Supposedly it is automatically done by enabling DHCP-PD.

If I do not enable DHCP-PD, then I can set up LAN Prefix Length to be between /56 to /64. However, then it asks me to set a valid LAN IPv6 Address which I can not do (dynamic IPv6 address).

Asus IPv6 settings are a bit limited.
https://www.asus.com/support/FAQ/113990

So far I find out OpenWRT to have the most comprehensive IPv6 settings, beating pfSense. But still I feel none of them have very good IPv6 documentations.
https://openwrt.org/docs/guide-user/network/ipv6/configuration
https://docs.netgate.com/pfsense/en/latest/interfaces/configure-ipv6.html

mFMP1Cl.png
Click to expand...

It might be under stateful configuration.
 
X

xiaofan

Arch-Supremacy Member
Joined
Sep 16, 2018
Messages
16,410
Reaction score
2,197
Mach3.2 said:
Not sure if this option is available in your Asus router settings, if you route a prefix shorter than /64 (e.g. /63 for 2 /64 subnets) to the upstream LAN, you can route additional /64 subnet(s) to your downstream router.

See DHCPv6 Prefix Delegation.
https://docs.netgate.com/pfsense/en/latest/services/dhcp/ipv6.html
Click to expand...

The best what I can achieve now is using OpenWRT.
OpenWRT main router + OpenWRT secondary router (Double NAT for IPv4).

Main router IPv6: WAN /56; LAN /60
Secondary router IPv6: WAN: /62, LAN /64

1) Main router (Open WRT 23.05 VM under PVE8.0, Intel N100 mini PC)
Hw1uEM4.png



2) Secondary router, OpenWRT 22.03.5, Linksys WRT1900AC v1.

c4LlzjU.png



3) Wireless client of WRT1900AC V1 -- Acer Windows 11 laptop.

Code: 
PS C:\work> tracert ipv6.google.com

Tracing route to ipv6.l.google.com [2404:6800:4003:c00::71]
over a maximum of 30 hops:

  1     1 ms     1 ms     1 ms  2400:d802:xxxx:xx04::1 (Linksys WRT1900AC OpenWRT)
  2     3 ms     2 ms     2 ms  2400:d802:xxxx:xx00::1 (Intel N100 OpenWRT VM)
  3     7 ms     5 ms     5 ms  2400:d802:1:606:: (Singtel IPv6 gateway)
  4    41 ms    36 ms    36 ms  2001:c20:3c00::6
  5     5 ms     3 ms     3 ms  2001:c20:3c00::7
  6    17 ms     4 ms     4 ms  2001:c20:0:3::35
  7     4 ms     4 ms     4 ms  2001:c20:0:3::a
  8     6 ms     4 ms     4 ms  2001:c10:80:2::a21
  9     6 ms     8 ms     4 ms  2001:c10:80:2::915
 10    22 ms    10 ms    67 ms  2001:c10:80:1::a75
 11     6 ms     5 ms     5 ms  2001:4860:1:1:0:1d31:0:20
 12    14 ms     4 ms     5 ms  2001:4860:0:f90::9
 13    25 ms     4 ms     4 ms  2001:4860::c:4003:1c92
 14    33 ms     6 ms     5 ms  2001:4860::cc:4000:fa62
 15     8 ms     6 ms     6 ms  2001:4860:0:1::1201
 16     *        *        *     Request timed out.
 17     *        *        *     Request timed out.
 18     *        *        *     Request timed out.
 19     *        *        *     Request timed out.
 20     *        *        *     Request timed out.
 21     *        *        *     Request timed out.
 22     *        *        *     Request timed out.
 23     *        *        *     Request timed out.
 24     *        *        *     Request timed out.
 25    46 ms     6 ms     4 ms  sa-in-x71.1e100.net [2404:6800:4003:c00::71]

Trace complete.
 
Mach3.2

Mach3.2

Great Supremacy Member
Joined
Apr 8, 2011
Messages
71,164
Reaction score
1,150
xiaofan said:
The best what I can achieve now is using OpenWRT.
OpenWRT main router + OpenWRT secondary router (Double NAT for IPv4).

Main router IPv6: WAN /56; LAN /60
Secondary router IPv6: WAN: /62, LAN /64

1) Main router (Open WRT 23.05 VM under PVE8.0, Intel N100 mini PC)
Hw1uEM4.png



2) Secondary router, OpenWRT 22.03.5, Linksys WRT1900AC v1.

c4LlzjU.png



3) Wireless client of WRT1900AC V1 -- Acer Windows 11 laptop.

Code: 
PS C:\work> tracert ipv6.google.com

Tracing route to ipv6.l.google.com [2404:6800:4003:c00::71]
over a maximum of 30 hops:

  1     1 ms     1 ms     1 ms  2400:d802:xxxx:xx04::1 (Linksys WRT1900AC OpenWRT)
  2     3 ms     2 ms     2 ms  2400:d802:xxxx:xx00::1 (Intel N100 OpenWRT VM)
  3     7 ms     5 ms     5 ms  2400:d802:1:606:: (Singtel IPv6 gateway)
  4    41 ms    36 ms    36 ms  2001:c20:3c00::6
  5     5 ms     3 ms     3 ms  2001:c20:3c00::7
  6    17 ms     4 ms     4 ms  2001:c20:0:3::35
  7     4 ms     4 ms     4 ms  2001:c20:0:3::a
  8     6 ms     4 ms     4 ms  2001:c10:80:2::a21
  9     6 ms     8 ms     4 ms  2001:c10:80:2::915
 10    22 ms    10 ms    67 ms  2001:c10:80:1::a75
 11     6 ms     5 ms     5 ms  2001:4860:1:1:0:1d31:0:20
 12    14 ms     4 ms     5 ms  2001:4860:0:f90::9
 13    25 ms     4 ms     4 ms  2001:4860::c:4003:1c92
 14    33 ms     6 ms     5 ms  2001:4860::cc:4000:fa62
 15     8 ms     6 ms     6 ms  2001:4860:0:1::1201
 16     *        *        *     Request timed out.
 17     *        *        *     Request timed out.
 18     *        *        *     Request timed out.
 19     *        *        *     Request timed out.
 20     *        *        *     Request timed out.
 21     *        *        *     Request timed out.
 22     *        *        *     Request timed out.
 23     *        *        *     Request timed out.
 24     *        *        *     Request timed out.
 25    46 ms     6 ms     4 ms  sa-in-x71.1e100.net [2404:6800:4003:c00::71]

Trace complete.
Click to expand...
Nice.

That's also a lot of hops before the traffic finally leaves their network :spin:

Bash: 
tracert -4 sc-in-f94.1e100.net

Tracing route to sc-in-f94.1e100.net [74.125.68.94]
over a maximum of 30 hops:

  1    <1 ms    <1 ms    <1 ms  10.80.30.1
  2     2 ms     2 ms     2 ms  1.64.156.175.unknown.m1.com.sg [175.156.64.1]
  3     3 ms     2 ms     2 ms  204.246.65.202.unknown.m1.com.sg [202.65.246.204]
  4     2 ms     3 ms     2 ms  205.246.65.202.unknown.m1.com.sg [202.65.246.205]
  5     3 ms     3 ms     3 ms  159.245.65.202.unknown.m1.com.sg [202.65.245.159] < Final M1 router
  6     4 ms     3 ms     3 ms  72.14.222.186 < Google's network
  7     4 ms     4 ms     4 ms  108.170.240.225
  8     3 ms     3 ms     3 ms  108.170.240.241
  9     5 ms     5 ms     5 ms  209.85.255.43
 10    21 ms    10 ms     5 ms  216.239.56.38
 11     4 ms     5 ms     4 ms  216.239.35.145
 12     *        *        *     Request timed out.
 13     *        *        *     Request timed out.
 14     *        *        *     Request timed out.
 15     *        *        *     Request timed out.
 16     *        *        *     Request timed out.
 17     *        *        *     Request timed out.
 18     *        *        *     Request timed out.
 19     *        *        *     Request timed out.
 20     *        *        *     Request timed out.
 21     *        *        *     Request timed out.
 22     *        *        *     Request timed out.
 23     4 ms     4 ms     4 ms  sc-in-f94.1e100.net [74.125.68.94]

Trace complete.

Bash: 
tracert -6 sc-in-f94.1e100.net

Tracing route to sc-in-f94.1e100.net [2404:6800:4003:c02::5e]
over a maximum of 30 hops:

  1    <1 ms    <1 ms    <1 ms  0.0.4.7.1.0.4.2.ip6.arpa [2401:7400:c80b:xxxx:xxxx:xxxx:xxxx:xxxx]
  2     *        *        *     Request timed out.
  3     3 ms     3 ms     2 ms  0.0.4.7.1.0.4.2.ip6.arpa [2401:7400:800:2a::]
  4     4 ms     3 ms     3 ms  0.0.4.7.1.0.4.2.ip6.arpa [2401:7400:800:2a::1]
  5     4 ms     4 ms     4 ms  2401:7400:0:8::1 < Final M1 router
  6     4 ms     4 ms     4 ms  2001:4860:1:1::1a4c < Google's network
  7     4 ms     4 ms     4 ms  2404:6800:8341:40::1
  8     5 ms     4 ms     4 ms  2001:4860:0:1::77ba
  9     5 ms     5 ms     5 ms  2001:4860:0:f90::9
 10    36 ms     8 ms     4 ms  2001:4860::c:4003:1c92
 11     4 ms     5 ms     4 ms  2001:4860::cc:4000:fa62
 12     6 ms     5 ms     5 ms  2001:4860:0:1::1201
 13     *        *        *     Request timed out.
 14     *        *        *     Request timed out.
 15     *        *        *     Request timed out.
 16     *        *        *     Request timed out.
 17     *        *        *     Request timed out.
 18     *        *        *     Request timed out.
 19     *        *        *     Request timed out.
 20     *        *        *     Request timed out.
 21     *        *        *     Request timed out.
 22     *        *        *     Request timed out.
 23     *        *        *     Request timed out.
 24     5 ms     4 ms     4 ms  sc-in-x5e.1e100.net [2404:6800:4003:c02::5e]

Trace complete.
 
X

xiaofan

Arch-Supremacy Member
Joined
Sep 16, 2018
Messages
16,410
Reaction score
2,197
Main OpenWRT router configuration.
Code: 
root@OpenWrt:~# cat /etc/config/network

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'fd50:64a0:e3e0::/48'

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'eth0'

config interface 'lan'
        option device 'br-lan'
        option proto 'static'
        option ipaddr '192.168.28.1'
        option netmask '255.255.255.0'
        option ip6assign '60'
        list ip6class 'wan6'
        list dns '1.1.1.3'
        list dns '1.0.0.3'
        list dns '9.9.9.9'
        list dns '9.9.9.10'

config interface 'wan'
        option device 'eth1'
        option proto 'dhcp'
        option peerdns '0'
        list dns '1.1.1.3'
        list dns '1.0.0.3'
        list dns '9.9.9.9'
        list dns '9.9.9.10'

config interface 'wan6'
        option device 'eth1'
        option proto 'dhcpv6'
        option reqaddress 'try'
        option reqprefix '56'
        option peerdns '0'
        list dns '2606:4700:4700::1113'
        list dns '2606:4700:4700::1003'
        list dns '2620:fe::fe'
        list dns '2620:fe::10'
        list dns '1.1.1.3'
        list dns '1.0.0.3'
        list dns '9.9.9.9'
        list dns '9.9.9.10'
        
    root@OpenWrt:~# cat /etc/config/dhcp

config dnsmasq
        option domainneeded '1'
        option localise_queries '1'
        option rebind_protection '1'
        option rebind_localhost '1'
        option local '/lan/'
        option domain 'lan'
        option expandhosts '1'
        option cachesize '1000'
        option authoritative '1'
        option readethers '1'
        option leasefile '/tmp/dhcp.leases'
        option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
        option localservice '1'
        option ednspacket_max '1232'
        list server '/mask.icloud.com/'
        list server '/mask-h2.icloud.com/'
        list server '/use-application-dns.net/'
        option serversfile '/var/run/adblock-fast/dnsmasq.servers'

config dhcp 'lan'
        option interface 'lan'
        option start '100'
        option limit '150'
        option leasetime '12h'
        option dhcpv4 'server'
        option dhcpv6 'server'
        option ra 'server'
        list ra_flags 'managed-config'
        list ra_flags 'other-config'

config dhcp 'wan'
        option interface 'wan'
        option ignore '1'

config odhcpd 'odhcpd'
        option maindhcp '0'
        option leasefile '/tmp/hosts/odhcpd'
        option leasetrigger '/usr/sbin/odhcpd-update'
        option loglevel '4'
 
X

xiaofan

Arch-Supremacy Member
Joined
Sep 16, 2018
Messages
16,410
Reaction score
2,197
Secondary router OpenWRT 22.03.5 configuration -- Linksys WRT1900 AC V1

Code: 
root@OpenWrt:~# cat /etc/config/network

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'fd99:c359:f0c9::/48'

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'lan1'
        list ports 'lan2'
        list ports 'lan3'
        list ports 'lan4'

config device
        option name 'lan1'
        option macaddr 'xx:xx:xx:xx:xx:xx'

config device
        option name 'lan2'
        option macaddr 'xx:xx:xx:xx:xx:xx'

config device
        option name 'lan3'
        option macaddr 'xx:xx:xx:xx:xx:xx'

config device
        option name 'lan4'
        option macaddr 'xx:xx:xx:xx:xx:xx'

config interface 'lan'
        option device 'br-lan'
        option proto 'static'
        option ipaddr '192.168.1.1'
        option netmask '255.255.255.0'
        option ip6assign '64'
        list ip6class 'wan6'

config device
        option name 'wan'
         option macaddr 'xx:xx:xx:xx:xx:xx'

config interface 'wan'
        option device 'wan'
        option proto 'dhcp'

config interface 'wan6'
        option device 'wan'
        option proto 'dhcpv6'
        option reqaddress 'try'
        option reqprefix 'auto'

root@OpenWrt:~# cat /etc/config/dhcp

config dnsmasq
        option domainneeded '1'
        option boguspriv '1'
        option filterwin2k '0'
        option localise_queries '1'
        option rebind_protection '1'
        option rebind_localhost '1'
        option local '/lan/'
        option domain 'lan'
        option expandhosts '1'
        option nonegcache '0'
        option authoritative '1'
        option readethers '1'
        option leasefile '/tmp/dhcp.leases'
        option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
        option nonwildcard '1'
        option localservice '1'
        option ednspacket_max '1232'

config dhcp 'lan'
        option interface 'lan'
        option start '100'
        option limit '150'
        option leasetime '12h'
        option dhcpv4 'server'
        option ra 'server'
        list ra_flags 'managed-config'
        list ra_flags 'other-config'
        option dhcpv6 'server'

config dhcp 'wan'
        option interface 'wan'
        option ignore '1'

config odhcpd 'odhcpd'
        option maindhcp '0'
        option leasefile '/tmp/hosts/odhcpd'
        option leasetrigger '/usr/sbin/odhcpd-update'
        option loglevel '4'

config dhcp 'wan6'
        option interface 'wan6'
        option ignore '1'
        option master '1'
        option ra 'relay'
        option dhcpv6 'relay'
        option ndp 'relay'
 
X

xiaofan

Arch-Supremacy Member
Joined
Sep 16, 2018
Messages
16,410
Reaction score
2,197
Mach3.2 said:
Not sure if this option is available in your Asus router settings, if you route a prefix shorter than /64 (e.g. /63 for 2 /64 subnets) to the upstream LAN, you can route additional /64 subnet(s) to your downstream router.

See DHCPv6 Prefix Delegation.
https://docs.netgate.com/pfsense/en/latest/services/dhcp/ipv6.html
Click to expand...

It turns out Merlin FW (official Merlin FW or gnuton fork) has that setting.

This is from my Asus RT-AX82U running gnuton fork of merlin. It is behind the OpenWRT 23.05 virtual router.

9T1vV6Z.png


Just for fun, the following is with triple-NAT for IPv6 (typo, should be IPv4).

Main OpenWRT 23.05 VM router -- Asus RT-AX82U gnuton Merlin FW -- OpenWRT 22.03.5 Linksys WRT1900AC -- Acer Windows 11 laptop wireless client

Code: 
PS C:\work> tracert ipv6.google.com

Tracing route to ipv6.l.google.com [2404:6800:4003:c00::65]
over a maximum of 30 hops:

  1    29 ms    18 ms    17 ms  2400:d802:xxxx:xx08:xxxx:xxxx:xxxx:xxxx (Linksys WRT1900AC v1)
  2    30 ms    17 ms    17 ms  RT-AX82U-83E0 [2400:d802:xxxx:xx08::1] (RT=AX82U gnuton Merlin)
  3    26 ms    16 ms    37 ms  2400:d802:xxxx:xx00::1 (OpenWRT 23.05 VM)
  4    35 ms    37 ms    17 ms  2400:d802:1:606:: (Singtel gateway)
  5    33 ms    16 ms    16 ms  2001:c20:3c00::6
  6    19 ms    18 ms    15 ms  2001:c20:3c00::7
  7    26 ms    17 ms    16 ms  2001:c20:0:3::35
  8    32 ms    57 ms    16 ms  2001:c20:0:3::a
  9    26 ms    17 ms    17 ms  2001:c10:80:2::a21
 10    19 ms    77 ms    16 ms  2001:c10:80:2::915
 11    58 ms    57 ms    16 ms  2001:c10:80:1::a75
 12    33 ms    38 ms    57 ms  2001:4860:1:1:0:1d31:0:20
 13    53 ms    16 ms    17 ms  2001:4860:0:1008::10
 14    23 ms    33 ms    18 ms  2001:4860::c:4003:1c93
 15    67 ms    17 ms    36 ms  2001:4860::cc:4000:fa63
 16    62 ms    37 ms    77 ms  2001:4860:0:1::d9
 17     *        *        *     Request timed out.
 18     *        *        *     Request timed out.
 19     *        *        *     Request timed out.
 20     *        *        *     Request timed out.
 21     *        *        *     Request timed out.
 22     *        *        *     Request timed out.
 23     *        *        *     Request timed out.
 24     *        *        *     Request timed out.
 25     *        *        *     Request timed out.
 26     *        *        *     Request timed out.
 27     *        *        *     Request timed out.
 28     6 ms     4 ms     5 ms  sa-in-f101.1e100.net [2404:6800:4003:c00::65]

Trace complete.
 
Last edited:
B

bert64

Senior Member
Joined
Jan 20, 2020
Messages
850
Reaction score
328
xiaofan said:
Just for fun, the following is with triple-NAT for IPv6.
Click to expand...

No NAT at all, just pure routing. With a /56 you can create up to 256 VLANs, so you could theoretically make a chain of 200+ devices if you wanted, or setup a pretty complex network.
Everything is directly addressable, and reachable subject to your firewall rules allowing it.
 
X

xiaofan

Arch-Supremacy Member
Joined
Sep 16, 2018
Messages
16,410
Reaction score
2,197
bert64 said:
No NAT at all, just pure routing. With a /56 you can create up to 256 VLANs, so you could theoretically make a chain of 200+ devices if you wanted, or setup a pretty complex network.
Everything is directly addressable, and reachable subject to your firewall rules allowing it.
Click to expand...

Sorry for the typo.
 
X

xiaofan

Arch-Supremacy Member
Joined
Sep 16, 2018
Messages
16,410
Reaction score
2,197
xiaofan said:
It turns out Merlin FW (official Merlin FW or gnuton fork) has that setting.

This is from my Asus RT-AX82U running gnuton fork of merlin. It is behind the OpenWRT 23.05 virtual router.

9T1vV6Z.png
Click to expand...

It turns out this is not useful.

I have installed Merlin FW for my Asus RT-AX86U and it still only gives /64 to the router connects to the LAN port.
 
B

bert64

Senior Member
Joined
Jan 20, 2020
Messages
850
Reaction score
328
xiaofan said:
It turns out this is not useful.

I have installed Merlin FW for my Asus RT-AX86U and it still only gives /64 to the router connects to the LAN port.
Click to expand...
Pfsense/Opnsense can do downstream delegation for sure.
You can also turn off state tracking so your traffic will pass through unfiltered (higher throughput and lower cpu/mem usage). You can leave any filtering to the downstream devices.
 
X

xiaofan

Arch-Supremacy Member
Joined
Sep 16, 2018
Messages
16,410
Reaction score
2,197
bert64 said:
Pfsense/Opnsense can do downstream delegation for sure.
You can also turn off state tracking so your traffic will pass through unfiltered (higher throughput and lower cpu/mem usage). You can leave any filtering to the downstream devices.
Click to expand...

So far I have only got consistent results using OpenWRT and Asus router to get Singtel native IPv6 to work. And only OpenWRT is able to carry out proper downstream delegation.

I have only got pfSense to work once (posted before in this thread) and never got success after that (not able to get IPv6 address). I have never got OPNsense to work at all (not able to get IPv6 address).

I wil try later this week.
 
Mach3.2

Mach3.2

Great Supremacy Member
Joined
Apr 8, 2011
Messages
71,164
Reaction score
1,150
xiaofan said:
I have only got pfSense to work once (posted before in this thread) and never got success after that (not able to get IPv6 address). I have never got OPNsense to work at all (not able to get IPv6 address).
Click to expand...
Perhaps can check the DUID type is set to DUID-LL. It might be set to DUID-LLT by default, and bert64 mentioned having some difficulties with M1 when it's set to DUID-LLT.

System > Advanced > Networking > DHCP Options > DHCP6 DUID
 
X

xiaofan

Arch-Supremacy Member
Joined
Sep 16, 2018
Messages
16,410
Reaction score
2,197
Mach3.2 said:
Perhaps can check the DUID type is set to DUID-LL. It might be set to DUID-LLT by default, and bert64 mentioned having some difficulties with M1 when it's set to DUID-LLT.

System > Advanced > Networking > DHCP Options > DHCP6 DUID
Click to expand...

Unfortunately it does not work.

Then I go back to use 6rd and then it works again.

4iWsIT3.png


6RD Prefix: 2400:d803::/32
6RD Border relay: 202.166.127.6
6RD IPv4 Prefix length: 0

For the LAN interface, IPv4 DHCP is enabled. IPv6 DHCP is disabled (edit: actually disable/enable are both okay) but Router Advertisement needs to be set as Unmanged.
 
Last edited:
Mach3.2

Mach3.2

Great Supremacy Member
Joined
Apr 8, 2011
Messages
71,164
Reaction score
1,150
xiaofan said:
Unfortunately it does not work.

Then I go back to use 6rd and then it works again.

4iWsIT3.png


6RD Prefix: 2400:d803::/32
6RD Border relay: 202.166.127.6
6RD IPv4 Prefix length: 0

For the LAN interface, IPv4 DHCP is enabled. IPv6 DHCP is disabled but Router Advertisement needs to be set as Unmanged.
Click to expand...
I'll also try cloning the DUID and MAC address of your openwrt router, maybe Singtel's DHCPv6 server have some sort of restriction on multiple devices requesting for delegated prefixes.

Setting the DHCP6 client into debug mode should also generate more verbose log that might shed some light on what's going on.

System > Advanced > Networking > DHCP Options > DHCP6 Debug
 
You must log in or register to reply here.
Important Forum Advisory Note
This forum is moderated by volunteer moderators who will react only to members' feedback on posts. Moderators are not employees or representatives of HWZ. Forum members and moderators are responsible for their own posts.

Please refer to our Community Guidelines and Standards, Terms of Service and Member T&Cs for more information.
Top