0

I run my network off a x86 box running Ubuntu 18.04, firewalld (UFW is unsuitable for use as a router), /networks/interfaces (netplan had a bug that made it unfit for purpose) and dnsmasq for DHCP and DNS.

I had an ISP that ran ipv6 with PD and I used the setup here. My current ISP dosen't support IPV6 so I've gotten a tunnel set up to my router through hurricane electric - this is set up, and presumably works since I can ping .

I have enp1s0 as the external interface, and all other interfaces bridged together serving the rest of the network as br0. Also have he-ipv6 as the tunnel, not bridged to anything

At the moment the router is sitting behind an ISP router, with two different network segments - 192.168.1.x for everyone else, and my own test network in 192.168.2.x, with the router in a DMZ. This shouldn't be a problem.

The problem is I'd like to stick with dnsmasq, and I'm having trouble funding documentation on how to set it.

Here's what I have right now

  • I've set up ipv6 to my router as per the instructions on hurricane electric's web page including the below on my /etc/networks/interfaces
auto he-ipv6
iface he-ipv6 inet6 v4tunnel
        address 2001:470:YY:YYYY::2
        netmask 64
        endpoint 216.218.221.6
        local xxx.xxx.x.xxx
        ttl 255
        gateway 2001:470:YY:YYYY::1

This works. I can ping ipv6.google.com and other known ipv6 sites. I just don't seem to be able to get IPs for anything else.

I tried

##For HE
enable-ra
dhcp-range = 2001:470:YY:YYYY::
dhcp-option=option6:dns-server,[2001:470:20::2],[2001:4860:4860::8888]

But apparently the syntax is wrong.

How do I get an IPv6 address for clients getting IPs from the router, as well as for br0?

2

Before everything else:

Just as in IPv4, each link needs its own subnet prefix. The 2001:470:YY:YYYY::/64 "tunnel endpoint" is specifically for the link between you and Hurricane (i.e. it's for your "WAN address" in IPv4 terms) – it cannot be reused for any of your LANs. For the latter you need one of the "Routed IPv6 prefixes" found in the tunnel settings page – this will be the equivalent of a DHCPv6-PD delegated prefix.

Normally each LAN has a /64-sized subnet prefix, to allow for standard-SLAAC-based address assignment to work (many clients, especially Android, do not support DHCPv6-based address assignment). So if you plan on multiple subnets, choose "Assign /48" to get a prefix with a decent amount (64ki) of /64's.

(You don't need to use "Assign /64" if you have already assigned a /48. If you did use "Assign /64", note that the prefix is slightly different from the "tunnel endpoints" prefix; they're often confused.)


Once you have your own range, say 2001:470:ZZ::/48, pick a /64 out of it (ranging from 0 to ffff, such as 2001:470:ZZ:1::/64) and use that for your br0 interface as well as for dnsmasq configuration.

enable-ra
dhcp-range = 2001:470:ZZ:1::, ra-stateless
dhcp-option = option6:dns-server, [2001:470:20::2], [2001:4860:4860::8888]

As previously mentioned, many clients (notably Android) do not support address assignment via DHCPv6. They require SLAAC, so you need at least one of slaac or ra-stateless in the 'dhcp-range' config. (The mode 'ra-stateless' additionally tells SLAAC clients that they can still get DNS settings from DHCPv6, which is useful for Windows. Regardless of selection, dnsmasq will also automatically provide DNS servers via SLAAC-RDNSS for Android.)

However, for br0 (or whatever the LAN interface is) you should assign an IP address statically – I'm not sure whether the kernel receives its own multicasts, nor whether it pays attention to them. In any case, I suspect dnsmasq itself might refuse to run on an interface that lacks a matching address (like it already does for IPv4)...

iface br0 inet6 static
    address 2001:470:ZZ:1::1/64

iface br1 inet6 static
    address 2001:470:ZZ:2::1/64

Once you have dnsmasq running, use rdisc6 eth0 from another Linux system to solicit and show the contents of a Router Advertisement. Make sure it has a non-zero "Router lifetime"; at least one "Prefix" (which needs to be a /64, on-link, autonomous, non-zero valid time); and that it comes from a link-local fe80::* address and not from a global address.

  • I'll review the actual dnsmasq.conf syntax once I have returned to the computer that actually has a working configuration from earlier... – grawity May 27 at 8:31
  • Annnd, it works. I only have a br1 - and having the /64 is probably the bit I missed. – Journeyman Geek May 27 at 9:10
  • actually something else seems broken. erf. I do get an IP, and I can ping google, but nothing else seems to work – Journeyman Geek May 27 at 9:50
  • Use tcpdump to see where things go (or don't go). Do a DNS query, make sure it arrives at br1 and exits at he-ipv6 and the response comes back. (e.g. if you see a large packet being re-sent over and over, consider lowering the advertised MTU and making sure you don't block ICMPv6.) – grawity May 27 at 9:55
  • I worked out it was my firewall rules - I run firewalld but had to do the equivilent of FORWARD 0 -i he-ipv6 -o br0 -m state --state RELATED,ESTABLISHED -j ACCEPT and FORWARD 0 -i br0 -o he-ipv6 -j ACCEPT amusingly, this happened the last time I set up ipv6 on this thing too and I had it documented >< – Journeyman Geek May 27 at 10:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.