I'm trying to solve a weird problem in routing. I've got my router set up (Turris, running customized OpenWRT), with Strongswan tunneling ipv6 connection. This works fine for the router itself, as it's ipv6 connectivity is working fine (via the tunnel, my provider does not offer native ipv6).
TL;DR: Routes are not chosen as I'd expect them, as the most generic one, ::/0 seems to be always preferred, although a /64 match is available.
But when I tried to extend this to my home network, I stumbled on a problem, and I'm unable to find a cause.
Although the ipsec works, I get an ipsec0 interface, and these routes:
Kernel IPv6 routing table Destination Next Hop Flags Metric Ref Use Iface ::/0 :: U 1024 0 2 ipsec0 2a01:490:19:42::/64 :: U 1024 0 0 br-lan
Here, 2a01:490:19:42::/64 is a rank that I dedicated for my local network, 2a01:490:19:42::1 is IP address of the router on that network.
Here are some observations:
1) When I ping 2a01:490:19:42::1 from a computer on my local network, the router responds, but sends the response into the ipsec0 interface. I have no idea why. Should not the more specific prefix, 2a01:490:19:42::/64, on br-lan be favored? It seems to correctly choose the source IP address 2a01:490:19:42::1.
2) The same things happens when I try to send a packet from my local network to some other site, say ping6 stackexchange.com. The packets get on the router, gets forwarded, server sends response, router gets it... and sends it back to the ipsec0 interface.
3) There are no xfrm policies.
ip xfrm pol returns nothing. But Strongswan is running and I was under the impression, that Strongswan always creates some policies. In my previous setup, I had to add some to enable passing packets into the tunnel, but I'm a bit confused about the policy list being empty.
Allright, so what's wrong? Why is the most generic route, ::/0, preferred for my ipv6 packets?