Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #256935 > unrolled thread

ICMP router advertisement (ipv4)

Back to article view | Back to linux.debian.user

Contents

  ICMP router advertisement (ipv4) Tim Woodall <debianuser@woodall.me.uk> - 2023-04-09 09:40 +0200
    Re: ICMP router advertisement (ipv4) Michel Verdier <mv524@free.fr> - 2023-04-09 10:40 +0200
      Re: ICMP router advertisement (ipv4) Tim Woodall <debianuser@woodall.me.uk> - 2023-04-09 17:30 +0200
        Re: ICMP router advertisement (ipv4) Michel Verdier <mv524@free.fr> - 2023-04-09 21:40 +0200
          Re: ICMP router advertisement (ipv4) Tim Woodall <debianuser@woodall.me.uk> - 2023-04-10 05:10 +0200
            Re: ICMP router advertisement (ipv4) Jeremy Ardley <jeremy@ardley.org> - 2023-04-10 05:20 +0200
              Re: ICMP router advertisement (ipv4) Tim Woodall <debianuser@woodall.me.uk> - 2023-04-10 06:50 +0200
                Re: ICMP router advertisement (ipv4) Jeremy Ardley <jeremy@ardley.org> - 2023-04-10 07:00 +0200
                  Re: ICMP router advertisement (ipv4) Tim Woodall <debianuser@woodall.me.uk> - 2023-04-10 20:30 +0200
                    Re: ICMP router advertisement (ipv4) Jeremy Ardley <jeremy@ardley.org> - 2023-04-11 00:40 +0200
                      Re: ICMP router advertisement (ipv4) Tim Woodall <debianuser@woodall.me.uk> - 2023-04-11 05:50 +0200
                        Re: ICMP router advertisement (ipv4) Jeremy Ardley <jeremy@ardley.org> - 2023-04-11 06:10 +0200
                          Re: ICMP router advertisement (ipv4) debian-user@howorth.org.uk - 2023-04-11 10:30 +0200
                          Re: ICMP router advertisement (ipv4) Anssi Saari <as@sci.fi> - 2023-04-11 13:30 +0200
                            Re: ICMP router advertisement (ipv4) Dan Ritter <dsr@randomstring.org> - 2023-04-11 15:50 +0200
                              Re: ICMP router advertisement (ipv4) Anssi Saari <as@sci.fi> - 2023-04-12 08:50 +0200
                                Re: ICMP router advertisement (ipv4) Dan Ritter <dsr@randomstring.org> - 2023-04-12 12:40 +0200
                Re: ICMP router advertisement (ipv4) Tim Woodall <debianuser@woodall.me.uk> - 2023-04-10 07:00 +0200

#256935 — ICMP router advertisement (ipv4)

They're not causing me any issues but is it expected that the IP address
is reversed in these messages?

Apr  9 06:27:48 ... IN=isp OUT= MAC=... SRC=1.0.168.192 DST=224.0.0.1 ... PROTO=ICMP TYPE=9 CODE=0

These are coming from my ISPs router - there's no obvious way to turn
them off (or to change router or ISP)

Tim.

[toc] | [next] | [standalone]

#256940

Le 9 avril 2023 Tim Woodall a écrit :

> They're not causing me any issues but is it expected that the IP address
> is reversed in these messages?
>
> Apr  9 06:27:48 ... IN=isp OUT= MAC=... SRC=1.0.168.192 DST=224.0.0.1 ... PROTO=ICMP TYPE=9 CODE=0

No IP are never reversed in iptables/nftables logs as effectively it
seems to be in your log. But :

$ host 1.0.168.192
192.168.0.1.in-addr.arpa domain name pointer node-81s.pool-1-0.dynamic.totinternet.net.
$ whois 1.0.168.192
% [whois.apnic.net]
% Whois data copyright terms    http://www.apnic.net/db/dbcopyright.html

% Information related to '1.0.128.0 - 1.0.191.255'

% Abuse contact for '1.0.128.0 - 1.0.191.255' is 'abuse@totisp.net'

inetnum:        1.0.128.0 - 1.0.191.255
netname:        TOTNET
descr:          Dynamic IP Address for residential Broadband Customers

Is this your ISP ?

[toc] | [prev] | [next] | [standalone]

#256974

On Sun, 9 Apr 2023, Michel Verdier wrote:

> Le 9 avril 2023 Tim Woodall a ?crit :
>
>> They're not causing me any issues but is it expected that the IP address
>> is reversed in these messages?
>>
>> Apr  9 06:27:48 ... IN=isp OUT= MAC=... SRC=1.0.168.192 DST=224.0.0.1 ... PROTO=ICMP TYPE=9 CODE=0
>
> No IP are never reversed in iptables/nftables logs as effectively it
> seems to be in your log. But :
>
> $ host 1.0.168.192
> 192.168.0.1.in-addr.arpa domain name pointer node-81s.pool-1-0.dynamic.totinternet.net.
> $ whois 1.0.168.192
> % [whois.apnic.net]
> % Whois data copyright terms    http://www.apnic.net/db/dbcopyright.html
>
> % Information related to '1.0.128.0 - 1.0.191.255'
>
> % Abuse contact for '1.0.128.0 - 1.0.191.255' is 'abuse@totisp.net'
>
> inetnum:        1.0.128.0 - 1.0.191.255
> netname:        TOTNET
> descr:          Dynamic IP Address for residential Broadband Customers
>
> Is this your ISP ?
>
>
>
No. I'm in Ireland. My router's IP is 192.168.0.1. I suspect an
endianness bug.

I don't get a routable IPv4 address at all. My router is doing DS-lite
to emulate IPv4 connectivity.

More annoyingly, there doesn't seem to be any way to tell the router
what the next hop router is for IPv6 and it doesn't forward packets for
any IP it doesn't know about - even with the firewall turned off.

So, even though it advertises a /57 on its internal interface, I'm being
forced to do NAT in order to have a firewall.

I cannot see packets for any address other than those in one /64
although a traceroute shows they're getting to the router.

I even tried advertising a /58 in the hopes that the a shorter prefix
might work but that was to no avail.

Tim.

[toc] | [prev] | [next] | [standalone]

#256986

Le 9 avril 2023 Tim Woodall a écrit :

>>> Apr  9 06:27:48 ... IN=isp OUT= MAC=... SRC=1.0.168.192 DST=224.0.0.1 ... PROTO=ICMP TYPE=9 CODE=0

This log is generated on your host? It comes directly from syslog or from
a reporting tool?

> I don't get a routable IPv4 address at all. My router is doing DS-lite
> to emulate IPv4 connectivity.

your host have ipv6 and ipv4 addresses or only ipv4 ?
on your host can you give
ip route
ip -6 route
ip address

obfuscate if you want but let internal addresses, it's not a security
hole

> More annoyingly, there doesn't seem to be any way to tell the router
> what the next hop router is for IPv6 and it doesn't forward packets for
> any IP it doesn't know about - even with the firewall turned off.

this is correct, it needs to know where you are to send you packets
icmp type 9 are for that

> So, even though it advertises a /57 on its internal interface, I'm being
> forced to do NAT in order to have a firewall.

I don't understand : if it don't forward, where do you do NAT ?

> I cannot see packets for any address other than those in one /64
> although a traceroute shows they're getting to the router.

You mean you have addresses on the /57 but you can't contact other /64 ?
it seems like a subnet restriction set on the router, and rather common
only a configuration point

[toc] | [prev] | [next] | [standalone]

#256994

On Sun, 9 Apr 2023, Michel Verdier wrote:

> Le 9 avril 2023 Tim Woodall a ?crit :
>
>>>> Apr  9 06:27:48 ... IN=isp OUT= MAC=... SRC=1.0.168.192 DST=224.0.0.1 ... PROTO=ICMP TYPE=9 CODE=0
>
> This log is generated on your host? It comes directly from syslog or from
> a reporting tool?
>
>> I don't get a routable IPv4 address at all. My router is doing DS-lite
>> to emulate IPv4 connectivity.
>
> your host have ipv6 and ipv4 addresses or only ipv4 ?
Both. It has a global ipv6 address and a 1918 ipv4 address.

> on your host can you give
> ip route
> ip -6 route
> ip address

This isn't going to be particularly useful on its own as I'm using
policy based routing and iptables marking.

But on the firewall the (a) default route points at 192.168.0.1 which is
acquired via dhcp and one points at the routers link-local address
acquired using SLAAC

default via 192.168.0.1 dev isp
default via fe80::c6eb:39ff:fe4e:c771 dev isp proto ra metric 1024
expires 1713sec hoplimit 64 pref medium

The router itself has a public WAN side IPv6 address (displayed on the
router info page but discoverable by doing a traceroute inbound too) but
no ipv4 address at all other than the internal 192.168.0.1

>
> obfuscate if you want but let internal addresses, it's not a security
> hole
>
>> More annoyingly, there doesn't seem to be any way to tell the router
>> what the next hop router is for IPv6 and it doesn't forward packets for
>> any IP it doesn't know about - even with the firewall turned off.
>
> this is correct, it needs to know where you are to send you packets
> icmp type 9 are for that
>
I'm not using them as I acquire my ipv4 address and next hop via dhcp.

And I'm not trying to get ipv4 working. That is going via CGNAT. It's
ipv6 that I'm trying to make vaguely sane. I have 2**71 addresses that
reach my router, but only one that will cross it.

>> So, even though it advertises a /57 on its internal interface, I'm being
>> forced to do NAT in order to have a firewall.
>
> I don't understand : if it don't forward, where do you do NAT ?
>
My firewall has a single /128 acquired via SLAAC and the RA from the
router. My entire network is masqueraded through that single IP.

I'm also doing the same for ipv4 - but the router is then using DS-lite
to tunnel to the isp where there's CGNAT to a routable address.

>> I cannot see packets for any address other than those in one /64
>> although a traceroute shows they're getting to the router.
>
> You mean you have addresses on the /57 but you can't contact other /64 ?
> it seems like a subnet restriction set on the router, and rather common
> only a configuration point

The router drops everything except the /128s that it knows about. It
does not even try to do neighbour discovery.

[toc] | [prev] | [next] | [standalone]

#256995

On 10/4/23 11:02, Tim Woodall wrote:
> My firewall has a single /128 acquired via SLAAC and the RA from the
> router. My entire network is masqueraded through that single IP.
>
>
What does the RA contain? Typically on connection to an IPv6 capable ISP 
you will get assigned a single /128 from their range and granted a 
complete routable range at least /64 for you to use.

The interface between the router and the ISP will typically use the 
router fe80 to connect upstream but it will also have the /128 to use. 
The router should be able to route the /64 without NAT. If it can't then 
time for a new router.

-- 
Jeremy
(Lists)

[toc] | [prev] | [next] | [standalone]

#256997

On Mon, 10 Apr 2023, Jeremy Ardley wrote:

>
> On 10/4/23 11:02, Tim Woodall wrote:
>> My firewall has a single /128 acquired via SLAAC and the RA from the
>> router. My entire network is masqueraded through that single IP.
>> 
>> 
> What does the RA contain? Typically on connection to an IPv6 capable ISP you 
> will get assigned a single /128 from their range and granted a complete 
> routable range at least /64 for you to use.
>
> The interface between the router and the ISP will typically use the router 
> fe80 to connect upstream but it will also have the /128 to use. The router 
> should be able to route the /64 without NAT. If it can't then time for a new 
> router.
>
>

I want to be able to put a firewall in front of the router. But there's
no way to get any traffic out of the router and into my network other
than that addressed to my firewalls /128

The router doesn't even attempt to see if a host exists if a packet to a
new ip arrives.

I suspect that 'silent' hosts would 'disappear' as far as the router is
concerned.

#
# radvd configuration generated by radvdump 2.18
# based on Router Advertisement from fe80::c6eb:39ff:fe4e:c771
# received by interface isp
#

interface isp
{
         AdvSendAdvert on;
         # Note: {Min,Max}RtrAdvInterval cannot be obtained with radvdump
         AdvManagedFlag off;
         AdvOtherConfigFlag on;
         AdvReachableTime 0;
         AdvRetransTimer 0;
         AdvCurHopLimit 64;
         AdvDefaultLifetime 1800;
         AdvHomeAgentFlag off;
         AdvDefaultPreference medium;
         AdvSourceLLAddress on;

         RDNSS 2001:730:3ec2::10 2001:730:3ec2::11
         {
                 AdvRDNSSLifetime 300;
         }; # End of RDNSS definition


         prefix ****:****:****:**00::/64
         {
                 AdvValidLifetime 604800;
                 AdvPreferredLifetime 604800;
                 AdvOnLink on;
                 AdvAutonomous on;
                 AdvRouterAddr off;
         }; # End of prefix definition


         route ****:****:****:**00::/57
         {
                 AdvRoutePreference medium;
                 AdvRouteLifetime 1800;
         }; # End of route definition

}; # End of interface definition

It's sort of bizarre that the prefix is good for 5 days but the route
for 30 minutes.

[toc] | [prev] | [next] | [standalone]

#256998

On 10/4/23 12:49, Tim Woodall wrote:
>
> And it doesn't forward packets from new ips either, it just silently
> drops them.
>
> I don't know how the router learns ips but I suspect it's something to
> do with DAD,
>
I don't know about your router specifically, but here in Australia the 
Network Termination Device (in my case a cable interface) has a gig 
ethernet port that a conventional 'router' connects to (e.g. the typical 
wifi device usually with some ethernet ports). On the NTD side the 
router sees an ethernet style interface that it can broadcast discovery 
packets onto. The NTD then routes the packets to the ISP via some cable 
protocol.

You can simply plug your computer ethernet direct into the NTD and do 
all the link negotiations you want. No extra hardware required.

In my case I have a dual port armbian device connected to the Network 
Termination Device to act as router to my network.

-- 
Jeremy
(Lists)

[toc] | [prev] | [next] | [standalone]

#257007

On Mon, 10 Apr 2023, Jeremy Ardley wrote:

>
> On 10/4/23 12:49, Tim Woodall wrote:
>> 
>> And it doesn't forward packets from new ips either, it just silently
>> drops them.
>> 
>> I don't know how the router learns ips but I suspect it's something to
>> do with DAD,
>> 
> I don't know about your router specifically, but here in Australia the 
> Network Termination Device (in my case a cable interface) has a gig ethernet 
> port that a conventional 'router' connects to (e.g. the typical wifi device 
> usually with some ethernet ports). On the NTD side the router sees an 
> ethernet style interface that it can broadcast discovery packets onto. The 
> NTD then routes the packets to the ISP via some cable protocol.
>
> You can simply plug your computer ethernet direct into the NTD and do all the 
> link negotiations you want. No extra hardware required.
>
> In my case I have a dual port armbian device connected to the Network 
> Termination Device to act as router to my network.
>
That's how I used to do it when with Andrews and Arnold in the UK.

Unfortunately, I don't seem to have that option any more. My cable modem
appears only to expose a layer 4 connection.

Previous version of my router appear to have a "modem mode" but that
doesn't exist in my version.

[toc] | [prev] | [next] | [standalone]

#257021

[Multipart message — attachments visible in raw view] — view raw

On 11/4/23 02:19, Tim Woodall wrote:
>
> Unfortunately, I don't seem to have that option any more. My cable modem
> appears only to expose a layer 4 connection.
>
> Previous version of my router appear to have a "modem mode" but that
> doesn't exist in my version.
>
>
Here in Australia we have a national operator called NBN that runs its 
own country-wide network and provides the Network Termination Devices to 
every household and business.

Then we have a large number ISPs who connect to NBN and have a virtual 
circuit established between them and each individual customer. It is up 
to each ISP what services they provide. As a customer you are virtually 
connected to an ISP router and have no exposure to the network inbetween 
- which could be DSL or cable or fibre or even wireless.

What you see is what your ISP wants you to see. Some of them add an 
extra box between you and the NTD to make it harder (allegedly easier 
for them to manage it better, actually to lock you in).

You have the option of changing ISP to one that provides correct IP 
services. That may include chucking out any extra box and connecting 
direct to the NTD.

Here is something I found about the UK. OpenReach sounds very similar to NBN

 >>>>>>>>>>

Here's an overview of the broadband options and market structure in the UK:

 1.

    Openreach: Openreach, a subsidiary of BT Group, owns and operates
    the majority of the UK's fixed-line infrastructure, including copper
    lines, fiber-to-the-cabinet (FTTC) connections, and
    fiber-to-the-premises (FTTP) connections. Openreach is regulated to
    provide access to its infrastructure on a wholesale basis to other
    ISPs. This means that multiple ISPs can offer services to consumers
    using Openreach's infrastructure, with virtual circuits connecting
    customers to their chosen ISP. Major ISPs, such as BT, TalkTalk,
    Sky, and Plusnet, use this infrastructure.

 2.

    Virgin Media: Virgin Media is the largest cable broadband provider
    in the UK, operating its own network separate from Openreach's
    infrastructure. Virgin Media's network is based on Hybrid
    Fibre-Coaxial (HFC) technology, which delivers high-speed internet
    using a combination of fiber-optic and coaxial cables. Virgin Media
    is not obligated to provide wholesale access to its network, meaning
    customers can only access services directly from Virgin Media.

 3.

    Smaller ISPs and Alternative Networks: There are also smaller ISPs
    and alternative network providers that offer broadband services,
    including full-fiber networks, fixed wireless access (FWA), and
    satellite broadband. Some of these providers, like CityFibre,
    Hyperoptic, and Gigaclear, have built their own infrastructure in
    certain areas, while others lease capacity from Openreach or other
    network operators.

 4.

    Mobile Broadband: Major mobile network operators, such as EE,
    Vodafone, O2, and Three, offer mobile broadband services using 4G
    and 5G technologies. These services can be used as a primary
    broadband connection, especially in rural areas where fixed-line
    broadband speeds may be limited.

In summary, the UK broadband market is a mix of infrastructure providers 
and ISPs, with Openreach's wholesale model playing a significant role in 
ensuring competition among ISPs. Additionally, Virgin Media, smaller 
ISPs, and mobile network operators provide alternatives to the Openreach 
infrastructure.

 >>>>>>>>>>

-- 
Jeremy
(Lists)

[toc] | [prev] | [next] | [standalone]

#257033

On Tue, 11 Apr 2023, Jeremy Ardley wrote:

>
> On 11/4/23 02:19, Tim Woodall wrote:
>> 
>> Unfortunately, I don't seem to have that option any more. My cable modem
>> appears only to expose a layer 4 connection.
>> 
>> Previous version of my router appear to have a "modem mode" but that
>> doesn't exist in my version.
>> 
>> 
> Here in Australia we have a national operator called NBN that runs its own 
> country-wide network and provides the Network Termination Devices to every 
> household and business.
>
> Then we have a large number ISPs who connect to NBN and have a virtual 
> circuit established between them and each individual customer. It is up to 
> each ISP what services they provide. As a customer you are virtually 
> connected to an ISP router and have no exposure to the network inbetween - 
> which could be DSL or cable or fibre or even wireless.
>
> What you see is what your ISP wants you to see. Some of them add an extra box 
> between you and the NTD to make it harder (allegedly easier for them to 
> manage it better, actually to lock you in).
>
> You have the option of changing ISP to one that provides correct IP services. 
> That may include chucking out any extra box and connecting direct to the NTD.
>
> Here is something I found about the UK. OpenReach sounds very similar to NBN
>
>>>>>>>>>>>
>
> Here's an overview of the broadband options and market structure in the UK:
>

I'm in Dublin, and where I'm living currently my only option is Virgin
cable.

My googling suggests that a superhub or hub 5 can be switched to 'modem
only' mode but I've got a hub 6 which doesn't have that option.

>
>   Virgin Media: Virgin Media is the largest cable broadband provider
>   in the UK, operating its own network separate from Openreach's
>   infrastructure. Virgin Media's network is based on Hybrid
>   Fibre-Coaxial (HFC) technology, which delivers high-speed internet
>   using a combination of fiber-optic and coaxial cables. Virgin Media
>   is not obligated to provide wholesale access to its network, meaning
>   customers can only access services directly from Virgin Media.
>

[toc] | [prev] | [next] | [standalone]

#257034

On 11/4/23 11:40, Tim Woodall wrote:
>
>
> My googling suggests that a superhub or hub 5 can be switched to 'modem
> only' mode but I've got a hub 6 which doesn't have that option.
>
>>
>>   Virgin Media: Virgin Media is the largest cable broadband provider
>>   in the UK, operating its own network separate from Openreach's
>>   infrastructure. Virgin Media's network is based on Hybrid
>>   Fibre-Coaxial (HFC) technology, which delivers high-speed internet
>>   using a combination of fiber-optic and coaxial cables. Virgin Media
>>   is not obligated to provide wholesale access to its network, meaning
>>   customers can only access services directly from Virgin Media.
>>
>
Looks like you have HFC service. In itself that's good, but Virgin don't 
let anyone else on their HFC network which is bad. Worse is that they 
don't use an industry standard modem such as an Arris unit. Instead they 
use a proprietary NTD and router in the same box.

Your only option seems to be to sign up with some external IPv6 
provider. This service (I've never used it so beware) says it gives you 
ipv6 etc for free. What their business model is I'm not sure 
https://tunnelbroker.net/


Jeremy
(Lists)

[toc] | [prev] | [next] | [standalone]

#257037

Jeremy Ardley <jeremy@ardley.org> wrote:
> On 11/4/23 11:40, Tim Woodall wrote:
> >
> >
> > My googling suggests that a superhub or hub 5 can be switched to
> > 'modem only' mode but I've got a hub 6 which doesn't have that
> > option. 
> >>
> >>   Virgin Media: Virgin Media is the largest cable broadband
> >> provider in the UK, operating its own network separate from
> >> Openreach's infrastructure. Virgin Media's network is based on
> >> Hybrid Fibre-Coaxial (HFC) technology, which delivers high-speed
> >> internet using a combination of fiber-optic and coaxial cables.
> >> Virgin Media is not obligated to provide wholesale access to its
> >> network, meaning customers can only access services directly from
> >> Virgin Media. 
> >  
> Looks like you have HFC service. In itself that's good, but Virgin
> don't let anyone else on their HFC network which is bad. Worse is
> that they don't use an industry standard modem such as an Arris unit.
> Instead they use a proprietary NTD and router in the same box.
> 
> Your only option seems to be to sign up with some external IPv6 
> provider. This service (I've never used it so beware) says it gives
> you ipv6 etc for free. What their business model is I'm not sure 
> https://tunnelbroker.net/

Note that Dublin is in Eire and Eire is not part of the UK. The Virgin
company operating in Ireland is different to that operating in the UK.
Pages may help such as 

https://www.havevirginmediaenabledipv6yet.co.uk/
https://community.virginmedia.com/t5/QuickStart-set-up-and/IPv6-support-on-Virgin-media/td-p/35748/page/129
 
> Jeremy
> (Lists)

[toc] | [prev] | [next] | [standalone]

#257043

Jeremy Ardley <jeremy@ardley.org> writes:

> Your only option seems to be to sign up with some external IPv6
> provider. This service (I've never used it so beware) says it gives
> you ipv6 etc for free. What their business model is I'm not sure 
> https://tunnelbroker.net/

I doubt that's going to work for him either due to his peculiar setup
with DS-lite. With a quick look tunnelbroker.net only provides a 6to4
tunnel and that's going to need a public IPv4 address which he doesn't
have.

A WireGuard tunnel from route64.org works through CGNAT. Using that
tunneling setup though... He'd have a wireguard tunnel for IPv6 which
goes through DS-Lite IPv4-in-IPv6 pipe through IPv4 CGNAT to the tunnel
broker? Very cool if it works.

I guess actually contacting Virgin and asking technical questions is not
a possibility?

[toc] | [prev] | [next] | [standalone]

#257045

Anssi Saari wrote: 
> Jeremy Ardley <jeremy@ardley.org> writes:
> 
> > Your only option seems to be to sign up with some external IPv6
> > provider. This service (I've never used it so beware) says it gives
> > you ipv6 etc for free. What their business model is I'm not sure 
> > https://tunnelbroker.net/
> 
> I doubt that's going to work for him either due to his peculiar setup
> with DS-lite. With a quick look tunnelbroker.net only provides a 6to4
> tunnel and that's going to need a public IPv4 address which he doesn't
> have.

Tunnelbroker.net can use a dynamic update feature so that the
static IPv6 address is only momentarily interrupted when the
underlying v4 address is changed out. This is quite reliable if
you hook it to the the DHCP client's post-up function.

I use this in preference to my ISPs native v6 support because
tunnelbroker (Hurricane Electric) supplies static v6
assignments, and my ISP does not.

-dsr-

[toc] | [prev] | [next] | [standalone]

#257083

Dan Ritter <dsr@randomstring.org> writes:

> Tunnelbroker.net can use a dynamic update feature so that the
> static IPv6 address is only momentarily interrupted when the
> underlying v4 address is changed out. This is quite reliable if
> you hook it to the the DHCP client's post-up function.

I don't understand the relevance. Does tunnelbroker.net offer some other
kind of tunnels than 6to4 which, AFAICT, don't work without a public
IPv4 address? Which the OP does not have due to his IPv4-in-IPv6
connection. Same goes for 6in4 tunnels. I can't seem to find out what
Hurricane Electric offers without sigining up though but at least
https://forums.he.net/index.php?topic=4195.0 from last year seems to
indicate WireGuard tunnels are not supported.

If "public IPv4 address" is not understood by you it can also be
formulated as "the OP has an RFC1918 IPv4 address which is not routable
on the public internet and hence a 6to4 tunnel can't work for him."

[toc] | [prev] | [next] | [standalone]

#257086

Anssi Saari wrote: 
> If "public IPv4 address" is not understood by you it can also be
> formulated as "the OP has an RFC1918 IPv4 address which is not routable
> on the public internet and hence a 6to4 tunnel can't work for him."

Oh, it's hidden behind CGNAT. No, that won't work. My mistake.

-dsr-

[toc] | [prev] | [next] | [standalone]

#256999

On Mon, 10 Apr 2023, Tim Woodall wrote:

> On Mon, 10 Apr 2023, Jeremy Ardley wrote:
>
>> 
>> On 10/4/23 11:02, Tim Woodall wrote:
>>> My firewall has a single /128 acquired via SLAAC and the RA from the
>>> router. My entire network is masqueraded through that single IP.
>>> 
>>> 
>> What does the RA contain? Typically on connection to an IPv6 capable ISP 
>> you will get assigned a single /128 from their range and granted a complete 
>> routable range at least /64 for you to use.
>> 
>> The interface between the router and the ISP will typically use the router 
>> fe80 to connect upstream but it will also have the /128 to use. The router 
>> should be able to route the /64 without NAT. If it can't then time for a 
>> new router.
>> 
>> 
>
> I want to be able to put a firewall in front of the router. But there's
> no way to get any traffic out of the router and into my network other
> than that addressed to my firewalls /128
>
> The router doesn't even attempt to see if a host exists if a packet to a
> new ip arrives.

And it doesn't forward packets from new ips either, it just silently
drops them.

I don't know how the router learns ips but I suspect it's something to
do with DAD,

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.user

csiph-web