mjhjmtu

Doing Linux/Debian IPV6 Routing from my vendor to a client not working.

IPV4 NAT/routing is reliably working using iptables and dnsmasq, however, even with forwarding enabled on IPv6 I can't make it work.

RADVD is publishing the new network but, I can't access any public IPv6 address.

Simplified diagram

 SW
 | +---------+
 +--->| client |
 PUBLIC PRIVATE | +---------+
 |
 ~/-(PR)-+ +---(ER)---+ | C0 +--(CL)---+
 public |P0 E0 | extender | E1 +--->| client |
 vendor |<----->| router |<------->| +---------+
 | +----------+ |
 ~/---------+ | +---------+
 +--->| client |
 | +---------+

 Where:
 PR ISP Public router
 P0 Public network interface
 ER extender router Debian based, trying to configure
 E0 Public network interface
 E1 Private network interface
 CL Test Client
 C0 Private network interface

Using radvdump, ER shows public route (redacted addresses)

 ...
 route 2600:..:5b10::/60
 
 AdvRoutePreference high;
 AdvRouteLifetime 1209600;
 ; # End of route definition

On ER using radvd I'm publishing a new /64 network on E1 (2600:..:5b11)

CL received the published network and configure itself with a global address on the 2600:..:5b11 network.

ER can ping6 and connect to: ipv6.google.com, P0, E0, E1 and C0

CL can ping6 and connect to: E0 and E1, but ..not.. P0 (nor any public addresses)

On ER->E1 tcpdump shows ER's periodic router advertisement.

When I ping a public address on CL this is the capture on ER-E1:

fe80::..:d477 is ER-E1
fe80::..:dff6 and 2600:..:5b11:..:f48 are CL-C0
fe80::..:f380 is PR-p0
2607:f8b0:4002:c0c::8a is ipv6.google.com

IP6 fe80::..:d477 > ff02::1: ICMP6, router advertisement, length 56
IP6 2600:..:5b11:..:f48 > 2607:f8b0:4002:c0c::8a: ICMP6, echo request, seq 1, length 64
IP6 fe80::..:dff6 > fe80::..:d477: ICMP6, neighbor solicitation, who has fe80::..:d477, length 32
IP6 fe80::..:d477 > fe80::..:dff6: ICMP6, neighbor advertisement, tgt is fe80::..:d477, length 24
IP6 fe80::..:d477 > fe80::..:dff6: ICMP6, neighbor solicitation, who has fe80::..:dff6, length 32
IP6 fe80::..:dff6 > fe80::..:d477: ICMP6, neighbor advertisement, tgt is fe80::..:dff6, length 24
IP6 fe80::..:d477 > ff02::1: ICMP6, router advertisement, length 56

Ping on CL just hung (until timeout) with no message.

On ER->E0 tcpdump (simplified):

IP6 2600:..:5b11:..:f48 > 2607:f8b0:4002:c0c::8a: ICMP6, echo request, seq 1, length 64
IP6 fe80::..:c446 > fe80::19d7:1db3:c381:23a: ICMP6, neighbor advertisement, tgt is fe80::..:c446, length 24
IP6 fe80::..:c446 > fe80::..:f380: ICMP6, neighbor solicitation, who has fe80::..:f380, length 32
IP6 fe80::..:f380 > fe80::..:c446: ICMP6, neighbor advertisement, tgt is fe80::..:f380, length 24
IP6 fe80::..:f380 > fe80::..:c446: ICMP6, neighbor solicitation, who has fe80::..:c446, length 32
IP6 fe80::..:c446 > fe80::..:f380: ICMP6, neighbor advertisement, tgt is fe80::..:c446, length 24

ER routing table (eth0=E0 eth1=E1)

2600:..:5b10::13 dev eth0 proto kernel metric 256 pref medium
2600:..:5b10::/64 dev eth0 proto kernel metric 256 expires 1209445sec pref medium
2600:..:5b10::/64 dev eth0 proto kernel metric 303 mtu 1500 pref medium
2600:..:5b11::/64 dev eth1 proto kernel metric 256 pref medium
fe80::/64 dev eth0 proto kernel metric 256 pref medium
fe80::/64 dev eth1 proto kernel metric 256 pref medium
default via fe80::..:f380 dev eth0 metric 303 mtu 1500 pref medium
default via fe80::..:f380 dev eth0 proto ra metric 1024 expires 1645sec hoplimit 64 pref medium

There are no firewalls involved at this time, not even ip6tables.

On ER I have forwarding=1 and proxy_ndp=1 for all and default.