[VF West] IPv6 Konfiguration OpenWRT hinter VF Station ohne Bridge Mode

[Gasp0de]

Hi!
Ich habe einen CableMax 1000 Anschluss mit Dual Stack. An meiner Vodafone Station betreibe ich einen Server und einen OpenWRT 22.03 Router als Access Point. Ich versuche nun seit einigen Tagen die IPv6 Einstellungen im OpenWRT Router so hinzukriegen, dass meine WLan clients auch IPv6 Addressen zugeteilt bekommen, aber es funktioniert einfach nicht. Hat hier schonmal jemand Erfahrung damit gemacht? Soweit ich weiß unterstützt die VF Station keine prefix delegation, weshalb ich den OpenWRT Router im relay modus betreiben muss, das funktioniert aber bisher nicht.

[Flole]

Betreibst du den Access Point wirklich als Access Point oder doch als Router? Wenn's wirklich ein Access Point ist schalte alles was nach IPv6 klingt aus (DHCP Server, Router Advertisements usw.) und es sollte funktionieren.

[Gasp0de]

Nein, ich betreibe den OpenWRT Router als Router und nicht als access point.

[cooper2k4]

Hallo

Ich habe es bei mir mit folgender Empfehlung via Subnetting hinbekommen. Meine Netzwerkkonfiguration habe ich als Beispiel angehängt.

Einziges Problem: Das IPv6-Präfix muss ich im OpenWrt alle paar Monate einmal manuel anpassen, wenn Vodafone es wechselt. Ich habe noch keine automatische Lösung dafür gefunden.

IPv6 subnetting a /64

There are a few hacks you can use to stretch a single /64 to a lot of hosts.

Turning a link prefix into a routed prefix
If you have a single /64 on the WAN link but no prefix routed to your LAN, you can turn that /64 into a routed prefix with a few steps. Configure the WAN interface on your router as a /126 rather than a /64. Install a neighbor advertisement daemon (such as ndppd) on the router to advertise its own MAC address for every address in the /64 except from the 4 addresses in the /126. With those two steps you will have a routed /64 which you can use on your LAN with the exception of the 4 addresses used for the WAN link.
A modified version of this hack can share the link /64 across multiple routers. The link prefix will then have to be a bit shorter than /126 to accommodate for an IP address to each router, a /120 would be short enough to allow for up to 254 routers. Each router will obviously only get a prefix which will be longer than /64. I recommend you make the prefix for each router as long as you can while still having enough IP addresses for the LAN on that router. A /112 or /120 for each router would likely be suitable. Each router responds with its own MAC address for neighbor discovery of anything within that router's prefix. In this variant each router will have identical prefixes configured on their WAN side and will be responding to neighbor discovery requests for the prefix assigned to their LAN side. Obviously none of the LAN prefixes may overlap each other and none of them may overlap the prefix you configured on the WAN side.
So if the ISP router acting as your gateway is on address 2001:db8::1/64, then you can use 2001:db8::/120 as your WAN and you can assign 2001:db8::1:0/112 to the first router, 2001:db8::2:0/112 to the second router, etc. On the LAN you can stretch a /64 to a lot of hosts either by subnetting or by bridging. You'll have to work out which of the two works best for you.

Subnetting
If you do subnet the /64 you may as well go to the longest prefixes which still have enough addresses for the hosts you need. Don't subnet into /80 prefixes, rather go with /116, /120, or /124 per subnet. Things that do break if you don't use /64 are unlikely to care and by going with /116 or longer you will reduce the impact of certain neighbor discovery DoS attacks (if present in any of your systems). In such a subnetting configuration you will break SLAAC, so you need a DHCPv6 server to respond on each segment and static IPv6 addresses configured on all devices without DHCPv6 support.

Bridging
Bridging is the other alternative. It essentially means you don't subnet but run your entire LAN as a single IPv6 segment with a /64 prefix. (Should you need to, that /64 can span both LAN and WAN.)
IPv6 is designed to allow bridges to recognize which of the bridged networks each anycast addresses need to be forwarded to. That way you avoid having to broadcast packets across every physical link on your LAN. Bridges can also apply firewalls and protection against neighbor discovery spoofing on the LAN. With sufficient intelligence on the bridges there is in principle no limit to how many switches you can bridge a single /64 across.

Quelle: https://serverfault.com/questions/71489 ... -around-it