TTR Networks

Beginner · IPv6 on VyOS: setup and routing · section 4 of 8

Handing a /56 to another router

✓ Lab-tested 17 October 2026 on VyOS 2026.10.16-0024-rolling

Now hand part of the /48 to another router. R2 sits behind R1 on a transit link, and gets 2001:db8:1000:100::/56 to number its own LANs from. Three pieces have to agree:

  1. The transit link, so R1 and R2 can reach each other: 2001:db8:1000:ff::/64.
  2. On R2: a default route back to R1, the first /64 of its /56 on LAN2 with Router Advertisements, and a blackhole for its whole /56, for the same reason R1 has one for the /48.
  3. On R1: a route for the /56 pointing at R2.

Configure R2 first, and the client on LAN2 gets an address straight away and can reach R2. But it can't reach the internet. Its packets go out fine; the replies come back to R1, and R1 has no route to 2001:db8:1000:100::/56 except the /48 blackhole. This is the most common IPv6 handover mistake, and the blackhole makes it fail fast and visibly, rather than looping.

Add the route on R1, and everything works. The traceroute shows the full path: R2, R1, the ISP, the server. The server's log shows client2's own address: no NAT anywhere.

R1: the transit link
set interfaces ethernet eth2 address '2001:db8:1000:ff::1/64'
set interfaces ethernet eth2 description 'TRANSIT-R2'
  • Lines 1–2: R1 is ::1 on the transit /64.
R2: everything for its side of the handover
set system host-name 'R2'
set interfaces ethernet eth0 address '2001:db8:1000:ff::2/64'
set interfaces ethernet eth0 description 'TRANSIT-R1'
set interfaces ethernet eth1 address '2001:db8:1000:100::1/64'
set interfaces ethernet eth1 description 'LAN2'
set protocols static route6 ::/0 next-hop 2001:db8:1000:ff::1
set protocols static route6 2001:db8:1000:100::/56 blackhole
set service router-advert interface eth1 prefix 2001:db8:1000:100::/64
set service router-advert interface eth1 name-server '2001:db8:f000::53'
  • Lines 2–3: R2's transit address.
  • Lines 4–5: LAN2: the first /64 of R2's /56.
  • Line 6: Default route back to R1.
  • Line 7: Blackhole for R2's whole /56.
  • Lines 8–9: RAs on LAN2.
client2 before R1 has a route (real output)
root@client2:~# ip -6 addr show dev eth0 scope global
2: eth0@if606: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default  link-netnsid 0
    inet6 2001:db8:1000:100:e41b:1ff:fef2:b011/64 scope global dynamic mngtmpaddr
       valid_lft 2591990sec preferred_lft 14390sec
root@client2:~# ping -6 -c 2 2001:db8:1000:100::1
PING 2001:db8:1000:100::1(2001:db8:1000:100::1) 56 data bytes
64 bytes from 2001:db8:1000:100::1: icmp_seq=1 ttl=64 time=8.54 ms
64 bytes from 2001:db8:1000:100::1: icmp_seq=2 ttl=64 time=1.62 ms

--- 2001:db8:1000:100::1 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1011ms
rtt min/avg/max/mdev = 1.619/5.077/8.535/3.458 ms
root@client2:~# ping -6 -c 2 -W 2 2001:db8:f000::10
PING 2001:db8:f000::10(2001:db8:f000::10) 56 data bytes

--- 2001:db8:f000::10 ping statistics ---
2 packets transmitted, 0 received, 100% packet loss, time 1045ms
  • Line 3: SLAAC worked on LAN2.
  • Line 7: R2 answers…
  • Line 17: …but the internet doesn't.
Why: R1's view of client2's address (real output)
vyos@R1:~$ show ipv6 route 2001:db8:1000:100::1
Routing entry for 2001:db8:1000::/48
  Known via "static", distance 1, metric 0, best
  Last update 00:01:30 ago
  Flags: Recursion Selected RR Distance
  Status: Installed
  * unreachable (blackhole), weight 1
  • Line 2: Only the /48 matches…
  • Line 7: …so replies to client2 are dropped by R1's blackhole.
R1: the missing route
set protocols static route6 2001:db8:1000:100::/56 next-hop 2001:db8:1000:ff::2
  • Line 1: Send R2's /56 to R2.
R1's routes now (real output)
vyos@R1:~$ show ipv6 route 2001:db8:1000:100::1
Routing entry for 2001:db8:1000:100::/56
  Known via "static", distance 1, metric 0, best
  Last update 00:00:04 ago
  Flags: Recursion Selected RR Distance
  Status: Installed
  * 2001:db8:1000:ff::2, via eth2, weight 1

vyos@R1:~$ show ipv6 route static
Codes: K - kernel route, C - connected, L - local, S - static,
       R - RIPng, O - OSPFv3, I - IS-IS, B - BGP, N - NHRP,
       T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR,
       f - OpenFabric, t - Table-Direct,
       > - selected route, * - FIB route, q - queued, r - rejected, b - backup
       t - trapped, o - offload failure

IPv6 unicast VRF default:
S>* ::/0 [1/0] via 2001:db8:ffff:1::1, eth0, weight 1, 00:01:49
S>* 2001:db8:1000::/48 [1/0] unreachable (blackhole), weight 1, 00:01:49
S>* 2001:db8:1000:100::/56 [1/0] via 2001:db8:1000:ff::2, eth2, weight 1, 00:00:05
  • Lines 2–7: The /56 is more specific than the /48 blackhole, so it wins.
  • Lines 18–20: Default, /48 blackhole, and the handover.
client2 now works (real output)
root@client2:~# ping -6 -c 2 2001:db8:f000::10
PING 2001:db8:f000::10(2001:db8:f000::10) 56 data bytes
64 bytes from 2001:db8:f000::10: icmp_seq=1 ttl=61 time=8.11 ms
64 bytes from 2001:db8:f000::10: icmp_seq=2 ttl=61 time=5.78 ms

--- 2001:db8:f000::10 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1009ms
rtt min/avg/max/mdev = 5.777/6.941/8.105/1.164 ms
root@client2:~# traceroute -6 -n 2001:db8:f000::10
traceroute to 2001:db8:f000::10 (2001:db8:f000::10), 30 hops max, 80 byte packets
 1  2001:db8:1000:100::1  5.327 ms  5.593 ms  8.330 ms
 2  2001:db8:1000:ff::1  12.852 ms  12.837 ms  15.329 ms
 3  2001:db8:ffff:1::1  15.596 ms  15.592 ms  15.578 ms
 4  2001:db8:f000::10  16.077 ms  16.165 ms  16.184 ms
root@client2:~# curl -sS -m 5 http://[2001:db8:f000::10]/
hello from server
root@server:~# cat /tmp/http.log
2001:db8:1000:100:e41b:1ff:fef2:b011 - - [17/Oct/2026 01:05:34] "GET / HTTP/1.1" 200 -
  • Lines 11–14: R2, R1, the ISP, the server.
  • Line 18: The server sees client2's own address: no NAT.

Check your understanding

client2 can ping R2 but not the internet. R2's config looks right. What do you check first?

  • R1's route to R2's prefix
  • client2's DNS server
  • R2's Router Advertisements
  • NAT on R1