I have set up a Raspberry Pi with an OpenThread RadioCoprocessor to run as a OpenThread Border router. This works, but I am having trouble reaching the NAT64 interface from the Thread network.
At home, I have a router which created a local IPv6 network. The Pi gets assigned two IPv6 ip address, and the routes to these addresses propagate to the RadioCoprocessor. Here I can add routes to the well-known-prefix and the NAT64 interface and use the NAT64 interface as DNS Server to resolve hostnames to well-known-prefix addresses and ping these addresses.
However at work, the local network does not have IPv6. The Pi does not get assigned a IPv6 address. At work I am unable to ping any well-known-prefix addresses from the OpenThread network, but I am able to ping from the Pi.
Am I missing a route?
Routing table at Home
pi@raspberrypi:~ $ route -6 -n
Kernel IPv6 routing table
Destination Next Hop Flag Met Ref Use If
::1/128 :: U 256 3 0 lo
64:ff9b::/96 :: U 1024 1 0 nat64
2002:1111:1111:1111::/64 :: UAe 256 1 0 eth0 <<< Router ipv6 network
fd11:db8:1::/64 :: U 256 1 0 otbr0
fd35:ad25:a99f:8c75::/64 :: U 256 2 0 wpan0
fdaa:bb:1::2/128 :: U 256 3 0 nat64
fdb5:d386:5ef5::/64 :: UAe 256 1 0 eth0 <<< Router ipv6 network
fdbb:9fbb:e58b:f471::/64 :: U 256 2 0 wpan0
fe80::/64 :: U 256 2 0 eth0
fe80::/64 :: U 256 1 0 nat64
fe80::/64 :: U 256 1 0 wpan0
fe80::/64 :: U 256 1 0 otbr0
fe80::/64 :: U 256 1 0 vethdbec410
fe80::/64 :: U 256 1 0 docker0
::/0 fe80::ee3e:b3ff:fe63:1320 UGDAe 1024 1 0 eth0
::1/128 :: Un 0 7 0 lo
2002:1111:1111:1111::/128 :: Un 0 3 0 eth0 <<< Router ipv6 network
2002:1111:1111:1111:ba27:ebff:fe6f:9215/128 :: <<< Router ipv6 network
Un 0 3 0 eth0
fd35:ad25:a99f:8c75::/128 :: Un 0 3 0 wpan0
fd35:ad25:a99f:8c75:a9c8:521f:d197:eca5/128 ::
Un 0 3 0 wpan0
fdaa:bb:1::2/128 :: Un 0 4 0 nat64
fdb5:d386:5ef5::/128 :: Un 0 3 0 eth0 <<< Router ipv6 network
fdb5:d386:5ef5:0:ba27:ebff:fe6f:9215/128 :: Un 0 3 0 eth0 <<< Router ipv6 network
fdbb:9fbb:e58b:f471::/128 :: Un 0 6 0 wpan0
fdbb:9fbb:e58b:f471:0:ff:fe00:e800/128 :: Un 0 3 0 wpan0
fdbb:9fbb:e58b:f471:0:ff:fe00:fc00/128 :: Un 0 4 0 wpan0
fdbb:9fbb:e58b:f471:0:ff:fe00:fc10/128 :: Un 0 3 0 wpan0
fdbb:9fbb:e58b:f471:0:ff:fe00:fc11/128 :: Un 0 2 0 wpan0
fdbb:9fbb:e58b:f471:0:ff:fe00:fc38/128 :: Un 0 2 0 wpan0
fdbb:9fbb:e58b:f471:f21d:c077:3438:5937/128 ::
Un 0 2 0 wpan0
fe80::/128 :: Un 0 6 0 eth0
fe80::/128 :: Un 0 3 0 nat64
fe80::/128 :: Un 0 3 0 wpan0
fe80::/128 :: Un 0 3 0 vethdbec410
fe80::/128 :: Un 0 3 0 docker0
fe80::42:23ff:fee8:b3c/128 :: Un 0 2 0 docker0
fe80::858:1860:afaa:fde9/128 :: Un 0 2 0 wpan0
fe80::3024:2fff:fe63:1c/128 :: Un 0 2 0 vethdbec410
fe80::3cd7:afb4:fc53:bc71/128 :: Un 0 3 0 nat64
fe80::ba27:ebff:fe6f:9215/128 :: Un 0 4 0 eth0
ff00::/8 :: U 256 7 0 eth0
ff00::/8 :: U 256 1 0 nat64
ff00::/8 :: U 256 1 0 wpan0
ff00::/8 :: U 256 5 0 vethdbec410
ff00::/8 :: U 256 5 0 docker0
::/0 :: !n -1 1 0 lo
Routing table at Work
pi@raspberrypi:~ $ route -6 -n
Kernel IPv6 routing table
Destination Next Hop Flag Met Ref Use If
::1/128 :: U 256 2 0 lo
64:ff9b::/96 :: U 1024 1 0 nat64
fd11:db8:1::/64 :: U 256 1 0 otbr0
fdaa:bb:1::2/128 :: U 256 3 0 nat64
fdbb:9fbb:e58b:f471::/64 :: U 256 2 0 wpan0
fe80::/64 :: U 256 2 0 wlan0
fe80::/64 :: U 256 1 0 nat64
fe80::/64 :: U 256 1 0 wpan0
fe80::/64 :: U 256 1 0 otbr0
fe80::/64 :: U 256 1 0 veth89bb918
fe80::/64 :: U 256 1 0 docker0
::/0 :: !n -1 1 0 lo
::1/128 :: Un 0 5 0 lo
fdaa:bb:1::2/128 :: Un 0 5 0 nat64
fdbb:9fbb:e58b:f471::/128 :: Un 0 5 0 wpan0
fdbb:9fbb:e58b:f471:0:ff:fe00:e800/128 :: Un 0 3 0 wpan0
fdbb:9fbb:e58b:f471:0:ff:fe00:fc00/128 :: Un 0 4 0 wpan0
fdbb:9fbb:e58b:f471:0:ff:fe00:fc10/128 :: Un 0 3 0 wpan0
fdbb:9fbb:e58b:f471:0:ff:fe00:fc11/128 :: Un 0 3 0 wpan0
fdbb:9fbb:e58b:f471:0:ff:fe00:fc38/128 :: Un 0 2 0 wpan0
fdbb:9fbb:e58b:f471:f21d:c077:3438:5937/128 :: Un 0 2 0 wpan0
fe80::/128 :: Un 0 8 0 wlan0
fe80::/128 :: Un 0 3 0 nat64
fe80::/128 :: Un 0 3 0 wpan0
fe80::/128 :: Un 0 3 0 docker0
fe80::/128 :: Un 0 3 0 veth89bb918
fe80::42:7dff:fece:4ad4/128 :: Un 0 2 0 docker0
fe80::858:1860:afaa:fde9/128 :: Un 0 2 0 wpan0
fe80::1450:5aff:feb6:879f/128 :: Un 0 2 0 veth89bb918
fe80::5227:2e50:3570:ab37/128 :: Un 0 2 0 nat64
fe80::ba27:ebff:fe3a:c740/128 :: Un 0 2 0 wlan0
ff00::/8 :: U 256 7 0 wlan0
ff00::/8 :: U 256 1 0 nat64
ff00::/8 :: U 256 1 0 wpan0
ff00::/8 :: U 256 5 0 veth89bb918
ff00::/8 :: U 256 5 0 docker0
::/0 :: !n -1 1 0 lo
Update
I was missing the default route from the OT-RCP to the eth/wlan interface on the Pi.
I manually added an IPv6 address and added a default route with: "prefix add 2001:470:6c92:1::/64 paros med"
Now I can ping the NAT64 at FDAA:BB:1::2 But resolving DNS gives me an error 8 with description Security.
Update 2 tcpdump logs:
tcpdump: listening on wpan0, link-type LINUX_SLL (Linux cooked v1), snapshot length 262144 bytes
***DNS request from ot-cli thread device "ot dns resolve ing.nl fdaa:bb:1::2 53 1000 2 1"***
19:54:30.284814 IP6 (hlim 64, next-header UDP (17) payload length: 32) 2001:470:6c92:1:8196:1c3f:41ed:fed.49153 > fdaa:bb:1::2.53: [udp sum ok] 11238+ AAAA? ing.nl. (24)
19:54:30.285478 IP6 (flowlabel 0x3bd7d, hlim 64, next-header UDP (17) payload length: 32) fdaa:bb:1::2.53 > 2001:470:6c92:1:8196:1c3f:41ed:fed.49153: [udp sum ok] 11238 Refused- 0/0/0 (24)
19:54:30.302290 IP6 (hlim 64, next-header UDP (17) payload length: 32) 2001:470:6c92:1:8196:1c3f:41ed:fed.49153 > fdaa:bb:1::2.53: [udp sum ok] 34254+ A? ing.nl. (24)
19:54:30.303347 IP6 (flowlabel 0x3bd7d, hlim 64, next-header UDP (17) payload length: 32) fdaa:bb:1::2.53 > 2001:470:6c92:1:8196:1c3f:41ed:fed.49153: [udp sum ok] 34254 Refused- 0/0/0 (24)
***Successful Ping from ot-cli thread device "ot ping 64:ff9b::9765:818c"***
20:51:46.076737 IP6 (hlim 64, next-header ICMPv6 (58) payload length: 16) 2001:470:6c92:1:8196:1c3f:41ed:fed > 64:ff9b::9765:818c: [icmp6 sum ok] ICMP6, echo request, id 6, seq 6
20:51:46.088699 IP6 (hlim 56, next-header ICMPv6 (58) payload length: 16) 64:ff9b::9765:818c > 2001:470:6c92:1:8196:1c3f:41ed:fed: [icmp6 sum ok] ICMP6, echo reply, id 6, seq 6
***Successful Ping from ot-cli thread device "ot ping fdaa:bb:1::2"***
20:53:27.162740 IP6 (hlim 64, next-header ICMPv6 (58) payload length: 16) 2001:470:6c92:1:8196:1c3f:41ed:fed > fdaa:bb:1::2: [icmp6 sum ok] ICMP6, echo request, id 7, seq 7
20:53:27.162871 IP6 (flowlabel 0x9a0cc, hlim 64, next-header ICMPv6 (58) payload length: 16) fdaa:bb:1::2 > 2001:470:6c92:1:8196:1c3f:41ed:fed: [icmp6 sum ok] ICMP6, echo reply, id 7, seq 7