rigacci.org

User Tools

Site Tools

Trace:
doc:appunti:net:ipv6_on_ppp

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revisionPrevious revision
Next revision		Previous revision
doc:appunti:net:ipv6_on_ppp [2026/09/25 17:08] – [Using a static IPv6 address] niccolodoc:appunti:net:ipv6_on_ppp [2026/10/06 10:34] (current) – [Configuring Shorewall6] niccolo
Line 57: Line 57:
 </code> </code>
  
-This is the reason why the IPv6 global (public) address is propbably not eccepted on that interface. To change (temporary) the ''accept_ra'' option for the ppp0 interface you can use the command:+This is the reason why the IPv6 global (public) address is probably not eccepted on that interface. To change (temporary) the ''accept_ra'' option for the ppp0 interface you can use the command:
  
 <code> <code>
Line 109: Line 109:
 /usr/bin/systemctl restart wide-dhcpv6-client.service /usr/bin/systemctl restart wide-dhcpv6-client.service
 </code> </code>
 +
 +===== Manual configuration of the IPv6 prefix delegation =====
 +
 +If your ISP assigns to you a **Prefix Delegation** (an IPv6 subnet), but it does not offer the **DHCPv6 service**, you need to configure the address manually. In our case the WAN IPv6 address is automatically negotiated on the ppp0 interface, so we manually configure the LAN IPv6 address (the delegated prefix) on the internal interface **br0**.
 +
 +Just add the following section into **/etc/netword/interfaces** file:
 +
 +<file>
 +iface br0 inet6 static
 +        address 2a02:2427:513:1c03::1
 +        netmask 64
 +</file>
 +
  
 ===== DHCPv6 client: the wide-dhcpv6-client.service ===== ===== DHCPv6 client: the wide-dhcpv6-client.service =====
Line 490: Line 503:
 </file> </file>
  
-Like for the IPv4, the **CLAMPMSS=Yes** is often required in **/etc/shorewall/shorewall.conf** (see above):+If you want to forward packets from internal interface to the external one (and vice-versa), you need to enable IP forwarding in **/etc/shorewall6/shorewall6.conf**: 
 + 
 +<file> 
 +IP_FORWARDING=On 
 +</file> 
 + 
 +Like for the IPv4, the **CLAMPMSS=Yes** is often required in **/etc/shorewall6/shorewall6.conf** (see above):
  
 <file> <file>
Line 565: Line 584:
 That IPv6 address is guaranteed to be static and assigned to the firewall, so you can use it for incoming connections and you can register it as an AAAA record in the DNS. But outgoiung IPv6 connections originating from the firewall itself use the ppp0 address, which may be dynamic. That IPv6 address is guaranteed to be static and assigned to the firewall, so you can use it for incoming connections and you can register it as an AAAA record in the DNS. But outgoiung IPv6 connections originating from the firewall itself use the ppp0 address, which may be dynamic.
  
 +Therefore, we need a script that **sets the source IPv6 address** to the static address assigned to the **br0** interface, rather than the one dynamically assigned to the **ppp0** interface. This setting must be applied every time the ppp0 interface is activated, but only after the subnet delegation negotiation has completed.
 +
 +Here is the sample script  **/etc/wide-dhcpv6/dhcp6c-src-route**:
 +
 +<code bash>
 +#!/bin/sh
 +# /etc/wide-dhcpv6/dhcp6c-src-route   (chmod 755)
 +
 +# Execute first the default Debian script (DNS, etc.), if it exists.
 +# We do not need this because the DNS is configured locally, not via DHCPv6.
 +#[ -x /etc/wide-dhcpv6/dhcp6c-script ] && /etc/wide-dhcpv6/dhcp6c-script
 +
 +get_src() {
 +    # Global address of br0, excluding those in DAD or deprecated.
 +    ip -6 addr show dev br0 scope global -tentative -deprecated \
 +        | awk '/inet6/ {sub("/.*","",$2); print $2; exit}'
 +}
 +
 +# It waits up to ~5 s for DAD to complete (a "tentative" address is
 +# not accepted as the source address, and the command would fail).
 +i=0
 +SRC=$(get_src)
 +while [ -z "$SRC" ] && [ $i -lt 10 ]; do
 +    sleep 0.5
 +    i=$((i+1))
 +    SRC=$(get_src)
 +done
 +
 +[ -n "$SRC" ] || { logger -t dhcp6c-src "No valid IPv6 address on br0"; exit 0; }
 +
 +# Replaces (or adds, if it does not already exist) the default route with a metric of 100.
 +ip -6 route replace default dev ppp0 metric 100 src "$SRC" \
 +    && logger -t dhcp6c-src "Default route via ppp0 with src $SRC"
 +exit 0
 +</code>
 +
 +To hook this script to the moment the IPv6 configuration is received, modify the **/etc/wide-dhcpv6/dhcp6c.conf** configuration file by replacing the default value of //script// in the //interface ppp0// section:
 +
 +<file>
 +interface ppp0 {
 +    # Send an option for "Identity Association for Prefix Delegation" with ID=0.
 +    send ia-pd 0;
 +    # Script executed when the daemon receives a reply message.
 +    script "/etc/wide-dhcpv6/dhcp6c-src-route";
 +};
 +</file>
 +
 +If you need to call the default Debian hook script **/etc/wide-dhcpv6/dhcp6c-script** (used mainly to set the DNS nameserver on DHCPv6) you need to uncomment the relevant line in the scrtip above.
 +
 +You can see all the times that the script is executed (because the DHCPv6 lease renews) using the command:
 +
 +<code>
 +journalctl --boot -t dhcp6c-src
 +</code>
 +
 +===== Useful commands =====
 +
 +Mostra la **rotta predefinita** per IPv6:
 +
 +<code>
 +ip -6 route show default
 +</code>
 +<code>
 +default dev ppp0 metric 1024 pref medium
 +default via fe80::be26:c7ff:fe0d:8bc0 dev ppp0 proto ra metric 1024 expires 1775sec hoplimit 64 pref medium
 +</code>
 +
 +La prima riga indica una rotta predefinita verso l'interfaccia ppp0 senza specificare un gateway (non serve per una interfaccia punto-punto). È stata creata insieme all'interfaccia ppp0 grazie al parametro ''defaultroute6'' di pppd. Non scade.
 +
 +La seconda riga viene istanziata durante la negoziazione del Router Advertisement (abbiamo ''accept_ra = 2'' su ppp0), è stata impostata sull'indirizzo IPv6 del gateway e viene rinegoziata periodicamente. Se la rinegoziazione dovesse fallire, la rotta sparisce.
 +
 +Visualizza l'**indirizzo IPv6 globale** per l'interfaccia br0:
 +
 +<code>
 +ip -6 addr show dev br0 scope global
 +</code>
 +<code>
 +5: br0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
 +    inet6 2a02:2420:503:1c03::1/64 scope global 
 +       valid_lft forever preferred_lft forever
 +</code>
 +
 +**Imposta o rimuove manualmente** un indirizzo IPv6 su una interfaccia:
 +
 +<code>
 +ip -6 addr add 2a02:1640:cd04:3::1/64 dev eth1
 +ip -6 addr del 2a02:1640:cd00:41df::1/64 dev eth1
 +</code>
 +
 +Mostra la **rotta selezionata** e **indirizzo sorgente** per un indirizzo IPv6 remoto:
 +
 +<code>
 +ip -6 route get 2a01:4f8:1c17:7636::1
 +</code>
 +<code>
 +2a01:4f8:1c17:7636::1 from :: dev ppp0 src 2a02:2420:105:61::1 metric 1024 pref medium
 +</code>
 +
 +**Imposta la rotta predefinita** IPv6 indicando l'indirizzo origine e una metrica bassa (il valore 100 viene preferito a quello delle rotte predefinite 1024):
 +
 +<code>
 +ip -6 route add default dev ppp0 metric 100 src 2a02:2420:503:1c03::1
 +</code>
 +<code>
 +2a01:4f8:1c17:7636::1 from :: dev ppp0 src 2a02:2420:105:61::1 metric 1024 pref medium
 +</code>
  
-FIXME 
 ===== MRU and MTU for PPPoE ===== ===== MRU and MTU for PPPoE =====
  
doc/appunti/net/ipv6_on_ppp.1790348882.txt.gz · Last modified: by niccolo