I've got a 6in4 tunnel from Hurricane Electric at home which gives me IPv6 connectivity one interface, br0. I'd like to offer IPv6 connectivity on a separate interface as well, br1. How do I enable IPv6 on both interfaces (br0 and br1) without bridging the two interfaces together (they're guest and home VLAN bridges)?

I'm running radvd right now for br0. Its configuration follows:

interface br0
 IgnoreIfMissing on;
 AdvSendAdvert on;
 MaxRtrAdvInterval 60;
 AdvHomeAgentFlag off;
 AdvManagedFlag off;
 AdvLinkMTU 1480;
 prefix 2001:xxxx:xxxx::/64
  AdvOnLink on;
  AdvAutonomous on;
 RDNSS 2001:xxxx:xxxx::1 {};

If it matters: br0 bridges an Ethernet vlan (vlan0) to an 802.11 radio (eth0). br1 bridges an Ethernet vlan (vlan2) to an 802.11 radio (wl0.1). vlan1 is connected to my ISP and has a public IPv4 address. NAT is being used to provide IPv4 access to br0 and br1, but br0 and br1 do not have routes advertising each other.

For Tomato Linux (Shibby 1.28), even if you specify the address as /48 in the GUI, the address assigned to the bridge is a /64. This simplifies the solution slightly.


Once you register a tunnel with Hurricane Electric, they allocate two /64s to you. One is assigned to the tunnel interface, the other you can advertise to a LAN on your own network.

Since the default routed prefix is only /64, you can only have a single LAN in that configuration.

However you can request another routed prefix from Hurricane Electric, which will be a /48. That other prefix can be split into 65536 separate /64s, which should be plenty.

Once you have registered a /48 and decided which /64 to use for your second LAN, you can simply copy your configuration for br0 and change the interface name and prefix to produce one for br1.

You may also need to create an unreachable route for the /48. Without it, there is a risk that packets to the unused parts of your /48 enter a routing loop, which makes your tunnel an easy target for DoS attacks.

  • Is there no additional routing configuration required, beyond what's necessary to configure radvd? – user314104 Jan 21 '15 at 15:18
  • @user314104 Before you configure radvd for the interface, you need to assign an address to the interface. Assigning an address to the interface will also create the necessary route to subnet on that interface. And assuming your previous configuration is working, then you already have the default route througih the tunnel. You do need to enable forwarding on the new interface, the same way you did it for the previously existing interface. – kasperd Jan 21 '15 at 16:15
  • Thanks, I will give that a try. I'm sure I'll have more questions later. – user314104 Jan 23 '15 at 18:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.