Sinds maart afnemer van internet van Freedom i.c.m. een eigen modem. Eerst een Fortigate 60D, nu met een OpenWRT router (TP-Link Archer C5 v1.2); deze is voorzien van versie 19.07.7 en vanuit de standaard configuratie verder aangepast. We hebben hier een VDSL2-lijn, dus ik heb voor de OpenWRT router een Draytek 165 staan. IPv4 werkt goed, maar met IPv6 heb ik problemen. Vanaf de router zelf kan ik netjes pingen naar bijvoorbeeld freedom.nl, maar vanaf elk apparaat op het LAN lukt dit met IPv6 niet.
Dit is de relevante configuratie in /etc/config/network:
config device
option name 'eth0'
option mtu '1508'
config interface 'lan'
option type 'bridge'
option ifname 'eth1.1'
option mtu '1500'
option proto 'static'
option ipaddr '10.109.0.1'
option netmask '255.255.255.0'
option ip6assign '60'
option igmp_snooping '1'
config interface 'wan'
option proto 'pppoe'
option mtu '1508'
option username 'fake@freedom.nl'
option ifname 'eth0.6'
option ipv6 'auto'
option password '1234'
option pppd_options 'debug'
config interface 'wan6'
option ifname 'eth0.6'
option proto 'dhcpv6'
De router komt netjes met een IPv4- en IPv6 adres in de lucht en ieder apparaat op het LAN wordt ook voorzien van een IPv6 adres. Maar vanaf het LAN is het maar mogelijk een paar apparaten te pingen (dit is vanaf een Linuxdoos op het LAN):
alexanderl@zfs-nas: ~ $ ip -6 route show
::1 dev lo proto kernel metric 256 pref medium
2a10:3781:XXX::/64 dev enp2s0 proto kernel metric 256 pref medium
fd53:d58d:dc92:1::/64 dev enp2s0 proto kernel metric 256 expires 7108sec pref medium
fd8d:474b:28ea::/64 dev enp2s0 proto kernel metric 256 pref medium
fe80::/64 dev enp2s0 proto kernel metric 256 pref medium
default via fe80::32b5:c2ff:fe9b:4fc2 dev enp2s0 proto ra metric 1024 expires 1415sec hoplimit 64 pref medium
Het is mogelijk om de br-lan interface van de router te pingen op zijn fe80 adres:
alexanderl@zfs-nas: ~ $ ping6 fe80::32b5:c2ff:fe9b:4fc2
PING fe80::32b5:c2ff:fe9b:4fc2(fe80::32b5:c2ff:fe9b:4fc2) 56 data bytes
64 bytes from fe80::32b5:c2ff:fe9b:4fc2%enp2s0: icmp_seq=1 ttl=64 time=0.357 ms
64 bytes from fe80::32b5:c2ff:fe9b:4fc2%enp2s0: icmp_seq=2 ttl=64 time=0.319 ms
64 bytes from fe80::32b5:c2ff:fe9b:4fc2%enp2s0: icmp_seq=3 ttl=64 time=0.305 ms
64 bytes from fe80::32b5:c2ff:fe9b:4fc2%enp2s0: icmp_seq=4 ttl=64 time=0.306 ms
64 bytes from fe80::32b5:c2ff:fe9b:4fc2%enp2s0: icmp_seq=5 ttl=64 time=0.331 ms
^C
--- fe80::32b5:c2ff:fe9b:4fc2 ping statistics ---
5 packets transmitted, 5 received, 0% packet loss, time 80ms
rtt min/avg/max/mdev = 0.305/0.323/0.357/0.027 ms
Pingen van br-lan op zijn global adres lukt niet:
alexanderl@zfs-nas: ~ $ ping6 2a10:3781:XXXX::1
PING 2a10:3781:cc9::1(2a10:3781:XXXX::1) 56 data bytes
From 2a10:3781:XXXX:0:ea39:35ff:feee:2b2d: icmp_seq=1 Destination unreachable: Address unreachable
From 2a10:3781:XXXX:0:ea39:35ff:feee:2b2d: icmp_seq=2 Destination unreachable: Address unreachable
From 2a10:3781:XXXX:0:ea39:35ff:feee:2b2d: icmp_seq=3 Destination unreachable: Address unreachable
^C
--- 2a10:3781:XXXX::1 ping statistics ---
6 packets transmitted, 0 received, +3 errors, 100% packet loss, time 118ms
pipe 4
De neigbours table op deze machine:
alexanderl@zfs-nas: ~ $ ip -6 nei
fd8d:474b:28ea:0:6db9:3bd0:f20a:f9ff dev enp2s0 lladdr 3c:22:fb:5a:b0:53 STALE
2a10:3781:XXXX::1 dev enp2s0 FAILED
fe80::1cb6:3116:d7cb:956f dev enp2s0 lladdr 3c:22:fb:5a:b0:53 STALE
2a10:3781:XXXX:0:8027:7f5c:bfe2:7d72 dev enp2s0 lladdr 3c:22:fb:5a:b0:53 STALE
fe80::32b5:c2ff:fe9b:4fc2 dev enp2s0 lladdr 30:b5:c2:9b:4f:c2 router STALE
Dit router heeft dit adres echter wel op zijn br-lan interface staan:
root@router:~# ifconfig br-lan
br-lan Link encap:Ethernet HWaddr 30:B5:C2:9B:4F:C2
inet addr:10.109.0.1 Bcast:10.109.0.255 Mask:255.255.255.0
inet6 addr: 2a10:3781:XXXX::1/60 Scope:Global
inet6 addr: fe80::32b5:c2ff:fe9b:4fc2/64 Scope:Link
inet6 addr: fd8d:474b:28ea::1/60 Scope:Global
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:81392 errors:0 dropped:3401 overruns:0 frame:0
TX packets:275005 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:12100770 (11.5 MiB) TX bytes:156164168 (148.9 MiB)
Waarom loopt dropped op?
Om het nog gekker te maken: dit gebeurt er als je freedom.nl pingt vanaf het LAN (op de router werkt dat dus gewoon):
alexanderl@zfs-nas: ~ $ ping6 freedom.nl
PING freedom.nl(freedom.nl (2a10:3780:2:53:185:232:98:8)) 56 data bytes
^C
--- freedom.nl ping statistics --
5 packets transmitted, 0 received, 100% packet loss, time 104ms
Dit gaat gewoon de WAN interface op de router uit:
root@router:~# tcpdump -ni pppoe-wan | grep 2a10:3780:2:53:185:232:98:8
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on pppoe-wan, link-type LINUX_SLL (Linux cooked v1), capture size 262144 bytes
18:46:00.237033 IP6 2a10:3781:cc9:0:ea39:35ff:feee:2b2d > 2a10:3780:2:53:185:232:98:8: ICMP6, echo request, seq 45, length 64
18:46:00.248313 IP6 2a10:3780:2:53:185:232:98:8 > 2a10:3781:cc9:0:ea39:35ff:feee:2b2d: ICMP6, echo reply, seq 45, length 64
18:46:01.260972 IP6 2a10:3781:cc9:0:ea39:35ff:feee:2b2d > 2a10:3780:2:53:185:232:98:8: ICMP6, echo request, seq 46, length 64
18:46:01.272094 IP6 2a10:3780:2:53:185:232:98:8 > 2a10:3781:cc9:0:ea39:35ff:feee:2b2d: ICMP6, echo reply, seq 46, length 64
18:46:02.284997 IP6 2a10:3781:cc9:0:ea39:35ff:feee:2b2d > 2a10:3780:2:53:185:232:98:8: ICMP6, echo request, seq 47, length 64
18:46:02.296542 IP6 2a10:3780:2:53:185:232:98:8 > 2a10:3781:cc9:0:ea39:35ff:feee:2b2d: ICMP6, echo reply, seq 47, length 64
18:46:03.308992 IP6 2a10:3781:cc9:0:ea39:35ff:feee:2b2d > 2a10:3780:2:53:185:232:98:8: ICMP6, echo request, seq 48, length 64
18:46:03.320117 IP6 2a10:3780:2:53:185:232:98:8 > 2a10:3781:cc9:0:ea39:35ff:feee:2b2d: ICMP6, echo reply, seq 48, length 64
18:46:04.332986 IP6 2a10:3781:cc9:0:ea39:35ff:feee:2b2d > 2a10:3780:2:53:185:232:98:8: ICMP6, echo request, seq 49, length 64
18:46:04.343890 IP6 2a10:3780:2:53:185:232:98:8 > 2a10:3781:cc9:0:ea39:35ff:feee:2b2d: ICMP6, echo reply, seq 49, length 64
^C66 packets captured
73 packets received by filter
0 packets dropped by kernel
Dit gebeurt er op interface br-lan van de router:
root@router:~# tcpdump -ni br-lan ip6
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on br-lan, link-type EN10MB (Ethernet), capture size 262144 bytes
18:49:35.281227 IP6 2a10:3781:XXXX:0:ea39:35ff:feee:2b2d > 2a10:3780:2:53:185:232:98:8: ICMP6, echo request, seq 255, length 64
18:49:35.308702 IP6 fe80::32b5:c2ff:fe9b:4fc2 > ff02::1:ffee:2b2d: ICMP6, neighbor solicitation, who has 2a10:3781:XXXX:0:ea39:35ff:feee:2b2d, length 32
^C
2 packets captured
2 packets received by filter
0 packets dropped by kernel
5 packets dropped by interface
Op de machine op het LAN zie ik die neigbour sollicitation echter niet aankomen:
alexanderl@zfs-nas:~$ sudo tcpdump -ni enp2s0 ip6
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on enp2s0, link-type EN10MB (Ethernet), capture size 262144 bytes
18:55:44.008620 IP6 2a10:3781:XXXX:0:ea39:35ff:feee:2b2d > 2001:888:0:5::1: ICMP6, echo request, seq 53, length 64
18:55:44.589096 IP6 fd8d:474b:28ea:0:ef18:3b3f:de9d:7936 > ff02::1:ff00:1: ICMP6, neighbor solicitation, who has fd8d:474b:28ea::1, length 32
18:55:45.032528 IP6 2a10:3781:XXXX:0:ea39:35ff:feee:2b2d > 2001:888:0:5::1: ICMP6, echo request, seq 54, length 64
^C
3 packets captured
8 packets received by filter
0 packets dropped by kernel
Ik denk dat die neighbour sollicitation van fd8d:474b:28ea:0:ef18:3b3f:de9d:7936 er niks mee te maken heeft. Op de router heeft br-lan dat adres niet, maar fd8d:474b:28ea::1/60
Heeft iemand misschien enig idee wat hier aan de hand is of mogelijk tips geven? Ik kom er niet uit…