Differences

This shows you the differences between two versions of the page.

--- doc:appunti:net:ipv6_on_ppp [2024/07/05 15:31] – [Troubleshooting IPv6 problems] niccolo
+++ doc:appunti:net:ipv6_on_ppp [2026/10/06 10:34] (current) – [Configuring Shorewall6] niccolo
@@ Line 57: / Line 57: @@
 </code>
-This is the reason why the IPv6 global (public) address is propbably not eccepted on that interface. To change (temporary) the ''accept_ra'' option for the ppp0 interface you can use the command:
+This is the reason why the IPv6 global (public) address is probably not eccepted on that interface. To change (temporary) the ''accept_ra'' option for the ppp0 interface you can use the command:
 <code>
@@ Line 73: / Line 73: @@
 We need to hook a script to the **ppp0 up event** and configure the options there. Because we are using the Shorewall firewall it is possibile to set the required actions into the Shorewall configuration and simply restart the Shorewall service on the ppp0 interface up event. See below an example of a **/etc/ppp/ipv6-up.d/ipv6-addresses-up** script.
+==== Static vs dynamic address ====
+A very common scenario is that the Internet provider **assigns a /64 prefix to the PPP interface** and delegates an **additional prefix** to be used **for the local LAN**, generally a /56. The prefix assigned to the PPP interface is often not guaranteed to remain the same over time and should therefore be considered **dynamic**. If you have negotiated **static IPv6 addresses** with the provider, they are very likely part of this additional delegated prefix.
@@ Line 106: / Line 109: @@
 /usr/bin/systemctl restart wide-dhcpv6-client.service
 </code>
+===== Manual configuration of the IPv6 prefix delegation =====
+If your ISP assigns to you a **Prefix Delegation** (an IPv6 subnet), but it does not offer the **DHCPv6 service**, you need to configure the address manually. In our case the WAN IPv6 address is automatically negotiated on the ppp0 interface, so we manually configure the LAN IPv6 address (the delegated prefix) on the internal interface **br0**.
+Just add the following section into **/etc/netword/interfaces** file:
+<file>
+iface br0 inet6 static
+        address 2a02:2427:513:1c03::1
+        netmask 64
+</file>
 ===== DHCPv6 client: the wide-dhcpv6-client.service =====
@@ Line 487: / Line 503: @@
 </file>
-Like for the IPv4, the **CLAMPMSS=Yes** is often required in **/etc/shorewall/shorewall.conf** (see above):
+If you want to forward packets from internal interface to the external one (and vice-versa), you need to enable IP forwarding in **/etc/shorewall6/shorewall6.conf**:
+<file>
+IP_FORWARDING=On
+</file>
+Like for the IPv4, the **CLAMPMSS=Yes** is often required in **/etc/shorewall6/shorewall6.conf** (see above):
 <file>
@@ Line 548: / Line 570: @@
 FIXME: What to do to protect LAN hosts from the internet?
+===== Using a static IPv6 address =====
+You may need a **static IPv6 address** on your firewall for both incoming and outgoing connections:
+  * **Incoming connections:** to allow hosts on the Internet to reach the firewall at a known IPv6 address.
+  * **Outgoing connections:** to use a static IPv6 source address when accessing services on the Internet, allowing the remote server to filter incoming connections based on that address.
+As stated above, the address autoamtically assigned to the **ppp0** interface may be **dynamic**, so we must use one of the addresses from the **delegated /56 prefix**.
+In the configuration file **/etc/wide-dhcpv6/dhcp6c.conf** shown above we already defined the site-level aggregator ID 3 (**sla-id**) to be appended to the /56 prefix and the interface ID 1 (**ifid**) to obtain the full IPv6 address **2a02:2427:513:1c03::1** that is assigned to the **br0** interface.
+That IPv6 address is guaranteed to be static and assigned to the firewall, so you can use it for incoming connections and you can register it as an AAAA record in the DNS. But outgoiung IPv6 connections originating from the firewall itself use the ppp0 address, which may be dynamic.
+Therefore, we need a script that **sets the source IPv6 address** to the static address assigned to the **br0** interface, rather than the one dynamically assigned to the **ppp0** interface. This setting must be applied every time the ppp0 interface is activated, but only after the subnet delegation negotiation has completed.
+Here is the sample script  **/etc/wide-dhcpv6/dhcp6c-src-route**:
+<code bash>
+#!/bin/sh
+# /etc/wide-dhcpv6/dhcp6c-src-route   (chmod 755)
+# Execute first the default Debian script (DNS, etc.), if it exists.
+# We do not need this because the DNS is configured locally, not via DHCPv6.
+#[ -x /etc/wide-dhcpv6/dhcp6c-script ] && /etc/wide-dhcpv6/dhcp6c-script
+get_src() {
+    # Global address of br0, excluding those in DAD or deprecated.
+    ip -6 addr show dev br0 scope global -tentative -deprecated \
+        | awk '/inet6/ {sub("/.*","",$2); print $2; exit}'
+}
+# It waits up to ~5 s for DAD to complete (a "tentative" address is
+# not accepted as the source address, and the command would fail).
+i=0
+SRC=$(get_src)
+while [ -z "$SRC" ] && [ $i -lt 10 ]; do
+    sleep 0.5
+    i=$((i+1))
+    SRC=$(get_src)
+done
+[ -n "$SRC" ] || { logger -t dhcp6c-src "No valid IPv6 address on br0"; exit 0; }
+# Replaces (or adds, if it does not already exist) the default route with a metric of 100.
+ip -6 route replace default dev ppp0 metric 100 src "$SRC" \
+    && logger -t dhcp6c-src "Default route via ppp0 with src $SRC"
+exit 0
+</code>
+To hook this script to the moment the IPv6 configuration is received, modify the **/etc/wide-dhcpv6/dhcp6c.conf** configuration file by replacing the default value of //script// in the //interface ppp0// section:
+<file>
+interface ppp0 {
+    # Send an option for "Identity Association for Prefix Delegation" with ID=0.
+    send ia-pd 0;
+    # Script executed when the daemon receives a reply message.
+    script "/etc/wide-dhcpv6/dhcp6c-src-route";
+};
+</file>
+If you need to call the default Debian hook script **/etc/wide-dhcpv6/dhcp6c-script** (used mainly to set the DNS nameserver on DHCPv6) you need to uncomment the relevant line in the scrtip above.
+You can see all the times that the script is executed (because the DHCPv6 lease renews) using the command:
+<code>
+journalctl --boot -t dhcp6c-src
+</code>
+===== Useful commands =====
+Mostra la **rotta predefinita** per IPv6:
+<code>
+ip -6 route show default
+</code>
+<code>
+default dev ppp0 metric 1024 pref medium
+default via fe80::be26:c7ff:fe0d:8bc0 dev ppp0 proto ra metric 1024 expires 1775sec hoplimit 64 pref medium
+</code>
+La prima riga indica una rotta predefinita verso l'interfaccia ppp0 senza specificare un gateway (non serve per una interfaccia punto-punto). È stata creata insieme all'interfaccia ppp0 grazie al parametro ''defaultroute6'' di pppd. Non scade.
+La seconda riga viene istanziata durante la negoziazione del Router Advertisement (abbiamo ''accept_ra = 2'' su ppp0), è stata impostata sull'indirizzo IPv6 del gateway e viene rinegoziata periodicamente. Se la rinegoziazione dovesse fallire, la rotta sparisce.
+Visualizza l'**indirizzo IPv6 globale** per l'interfaccia br0:
+<code>
+ip -6 addr show dev br0 scope global
+</code>
+<code>
+: br0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
+    inet6 2a02:2420:503:1c03::1/64 scope global
+       valid_lft forever preferred_lft forever
+</code>
+**Imposta o rimuove manualmente** un indirizzo IPv6 su una interfaccia:
+<code>
+ip -6 addr add 2a02:1640:cd04:3::1/64 dev eth1
+ip -6 addr del 2a02:1640:cd00:41df::1/64 dev eth1
+</code>
+Mostra la **rotta selezionata** e **indirizzo sorgente** per un indirizzo IPv6 remoto:
+<code>
+ip -6 route get 2a01:4f8:1c17:7636::1
+</code>
+<code>
+a01:4f8:1c17:7636::1 from :: dev ppp0 src 2a02:2420:105:61::1 metric 1024 pref medium
+</code>
+**Imposta la rotta predefinita** IPv6 indicando l'indirizzo origine e una metrica bassa (il valore 100 viene preferito a quello delle rotte predefinite 1024):
+<code>
+ip -6 route add default dev ppp0 metric 100 src 2a02:2420:503:1c03::1
+</code>
+<code>
+a01:4f8:1c17:7636::1 from :: dev ppp0 src 2a02:2420:105:61::1 metric 1024 pref medium
+</code>
 ===== MRU and MTU for PPPoE =====
@@ Line 582: / Line 724: @@
 <code>
-ping -6 2a01:4f8:1c17:7636::1
+# ping -6 2a01:4f8:1c17:7636::1
 </code>
@@ Line 588: / Line 730: @@
 <code>
-ip -6 address show dev enp0s7
+# ip -6 address show dev enp0s7
 </code>
@@ Line 603: / Line 745: @@
 In the example above the interface have two **global** scope addresses, one assigned via DHCPv6 and the other obtained via SLAAC. The first one has the **dadfailed** flag, which means that the **duplicate address detection** has detected a conflict in the network. This means that the IP address in question will not be used as the source address and it does not even respond to a self-ping.
-If you have only one global IP address which is **dadfailed**, you cannot reach remote hosts on IPv6. It may be a difficult situation to diagnose, because using the simple **ifconfig** command you see the assigned IPv6 address and default route is OK:
+If you have only one global IP address which is **dadfailed**, you cannot reach remote hosts on IPv6. It may be a difficult situation to diagnose, because using the simple **ifconfig** command you see the assigned IPv6 address and the **default route** is OK:
-<code>
-ip -6 route show
-</code>
 <code>
+# ip -6 route show
 a02:2420:503:1c03::2 dev enp0s7 proto kernel metric 256 pref medium
 a02:2420:503:1c03::/64 dev enp0s7 proto kernel metric 256 expires 86387sec pref medium
@@ Line 616: / Line 755: @@
 </code>
-**NOTICE**: The default router can be reached via its **link** scope address (as above) or via its **global** scope address, both can be used.
+**NOTICE**: The default router can be reached via its **link** scope address (as seen above) or via its **global** scope address: both can be used.
-If you sniff the ping request on the router, you can see the problem:
+If you sniff the ping request on the router, you can see the problem more clearly:
 <code>
+# tcpdump -i eth0 -n 'icmp6'
+...
 IP6 fe80::225:22ff:fedd:4598 > 2a01:4f8:1c17:7636::1: ICMP6, echo request,
     id 56698, seq 1, length 64
@@ Line 627: / Line 768: @@
 </code>
-the client uses its link scope address as source address, which causes the **beyond scope** error. You can confirm this problem on the client using the ''ip route get'' command:
+The client uses its link scope address as source address, which causes the **beyond scope** error. You can confirm this problem on the client using the ''ip route get'' command:
 <code>
-ip -6 route get 2a01:4f8:1c17:7636::1
+# ip -6 route get 2a01:4f8:1c17:7636::1
 a01:4f8:1c17:7636::1 from ::
     via 2a02:2420:503:1c03::1
@@ Line 642: / Line 783: @@
 <code>
-ip -6 route get 2a01:4f8:1c17:7636::1
+# ip -6 route get 2a01:4f8:1c17:7636::1
 a01:4f8:1c17:7636::1 from ::
     via fe80::d003:a6ff:fef2:6fe8
@@ Line 650: / Line 791: @@
 </code>
-In the first case the **src** address is the **link scope** one, not suitable for routing. In the second case it is the one received via SLAAC, which has a **global scope** and indeed it is working. Notice that the address of the router (shown as the **via** address) is not releveant, the //link scope// one does work.
+In the first case the **src** address is the **link scope** one, not suitable for routing. In the second case it is the one received via SLAAC, which has a **global scope** and indeed it is working. Notice that the address of the router (shown as the **via** address) is not releveant, even the //link scope// one does work.