Asking for a prefix
Three changes on the router, all in files it already has.
The WAN: ask for a prefix
10-wan.network gains a fixed IPv6 address and gateway on the ISP link, and DHCP=ipv6. The [DHCPv6] section shapes the request:
WithoutRA=solicit: start DHCPv6 straight away. Normally a router waits for the ISP's router advertisement to tell it to use DHCPv6; this ISP doesn't send one. On a real ISP that does, leave this out and setIPv6AcceptRA=yesinstead, which also gives you the default route.UseAddress=no: the router already has a fixed address on the link; it only wants the prefix.PrefixDelegationHint=::/56: ask for a /56. The ISP decides what you actually get.
The VLANs: one /64 each
Each VLAN's .network file gets three lines. DHCPPrefixDelegation=yes takes a /64 from the delegated prefix; SubnetId picks which one. Using the VLAN number in hex (0x10 for VLAN 10) makes addresses easy to read: staff's /64 is …:x10::/64. Token=::1 makes the router's own address on each VLAN end in ::1, like the .1 in IPv4. IPv6SendRA=yes then announces the prefix to the VLAN.
Forwarding
IPv6 forwarding is a separate switch: net.ipv6.conf.all.forwarding = 1 joins the IPv4 line in 99-router.conf.
The first attempt fails
With those files loaded and the previous lesson's firewall still in place, no prefix arrives. The capture on the WAN shows why. The router sends its DHCPv6 solicit, and the ISP's router wants to answer, but first it has to find the router's MAC address: it sends an ICMPv6 neighbour solicitation, "who has fe80::ff:fe00:100?". The router's input chain allows only ICMP for IPv4, so it drops the question, never answers, and the ISP's reply never leaves the ISP. (Each solicit appears twice in the router's capture. A capture on the ISP's side saw each one once, so that's the lab's network, not the router sending twice.)
IPv6 has no ARP. Finding neighbours, finding routers, and reporting that a packet is too big are all ICMPv6, which is why the next step is the firewall.
# The internet side: fixed addresses from the ISP, and an IPv6 prefix by DHCPv6.
[Match]
Name=eth0
[Network]
Address=203.0.113.2/24
Gateway=203.0.113.1
Address=2001:db8:f::2/64
Gateway=2001:db8:f::1
DHCP=ipv6
IPv6AcceptRA=no
[DHCPv6]
# This ISP sends no router advertisements: ask for a prefix straight away.
WithoutRA=solicit
UseAddress=no
PrefixDelegationHint=::/56- Lines 8–9: A fixed IPv6 address and gateway on the link to the ISP.
- Lines 10–11: DHCPv6 on, router advertisements from the ISP ignored.
- Line 15: Start DHCPv6 without waiting for a router advertisement (this ISP doesn't send them).
- Lines 16–17: Only a prefix, please: a /56 if possible.
[Match]
Name=staff
[Network]
Address=10.10.10.1/24
# IPv6: a /64 from the ISP's prefix, announced to the VLAN by router advertisements.
DHCPPrefixDelegation=yes
IPv6SendRA=yes
[DHCPPrefixDelegation]
UplinkInterface=eth0
SubnetId=0x10
Token=::1- Lines 7–8: Take a /64 from the delegated prefix, and announce it to the VLAN.
- Lines 10–13: From the WAN's prefix: subnet 0x10, with the router at ::1.
[Match]
Name=guest
[Network]
Address=10.10.20.1/24
# IPv6: a /64 from the ISP's prefix, announced to the VLAN by router advertisements.
DHCPPrefixDelegation=yes
IPv6SendRA=yes
[DHCPPrefixDelegation]
UplinkInterface=eth0
SubnetId=0x20
Token=::1[Match]
Name=servers
[Network]
Address=10.10.30.1/24
# IPv6: a /64 from the ISP's prefix, announced to the VLAN by router advertisements.
DHCPPrefixDelegation=yes
IPv6SendRA=yes
[DHCPPrefixDelegation]
UplinkInterface=eth0
SubnetId=0x30
Token=::1# /etc/sysctl.d/99-router.conf: route between the WAN and the VLANs.
net.ipv4.ip_forward = 1
net.ipv6.conf.all.forwarding = 1- Line 3: IPv6 forwarding is a separate switch from IPv4's.
root@router:~# ip -6 -br addr show
lo UNKNOWN ::1/128
eth0@if5289 UP fe80::ff:fe00:100/64
staff@eth1 UP fe80::ff:fe00:101/64
guest@eth1 UP fe80::ff:fe00:101/64
servers@eth1 UP fe80::ff:fe00:101/64
root@staff:~# ip -6 -br addr show eth0.10; ip -6 route
eth0.10@eth0 UP fe80::ff:fe00:1020/64
fe80::/64 dev eth0 proto kernel metric 256 pref medium
fe80::/64 dev eth0.10 proto kernel metric 256 pref medium- Lines 1–6: The router has only fe80:: link-local addresses, which every IPv6 interface has.
- Lines 8–11: So does the staff PC, and it has no default route.
root@router:~# timeout 6 tcpdump -lnni eth0 -c 6 "udp port 546 or udp port 547 or icmp6"
tcpdump: verbose output suppressed, use -v[v]... for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), snapshot length 262144 bytes
22:14:09.611418 IP6 fe80::ff:fe00:100.546 > ff02::1:2.547: dhcp6 solicit
22:14:09.611441 IP6 fe80::ff:fe00:100.546 > ff02::1:2.547: dhcp6 solicit
22:14:09.611901 IP6 fe80::5422:cfff:fe35:379b > ff02::1:ff00:100: ICMP6, neighbor solicitation, who has fe80::ff:fe00:100, length 32
22:14:10.619272 IP6 fe80::5422:cfff:fe35:379b > ff02::1:ff00:100: ICMP6, neighbor solicitation, who has fe80::ff:fe00:100, length 32
22:14:10.671246 IP6 fe80::ff:fe00:100.546 > ff02::1:2.547: dhcp6 solicit
22:14:10.671272 IP6 fe80::ff:fe00:100.546 > ff02::1:2.547: dhcp6 solicit
6 packets captured
6 packets received by filter
0 packets dropped by kernel
root@router:~# ip -6 -br addr show; nft list chain inet filter input | grep everything
lo UNKNOWN ::1/128
eth0@if5289 UP 2001:db8:f::2/64 fe80::ff:fe00:100/64
staff@eth1 UP fe80::ff:fe00:101/64
guest@eth1 UP fe80::ff:fe00:101/64
servers@eth1 UP fe80::ff:fe00:101/64
counter packets 2 bytes 144 comment "everything else to the router"- Lines 4–5: The router asks for a prefix (DHCPv6 solicit, to the all-DHCP-servers multicast address).
- Lines 6–7: The ISP's router wants to answer, but first asks who has the router's link-local address.
- Lines 14–19: No answer from the router, so no prefix: the VLANs still have only link-local addresses.
- Line 20: The input chain dropped the neighbour solicitations.
Check your understanding
Why did the ISP's DHCPv6 answer never arrive at the router?
- The router's firewall dropped the ISP's neighbour solicitation, so the ISP couldn't find the router's MAC address to send it.
- The ISP's DHCPv6 server was down.
- DHCPv6 needs a router advertisement first.
- The router has no IPv6 address on the WAN.