WAN, default route and blackhole
Start with R1's WAN and LAN1 addresses, a default route to the ISP, and one route that's easy to forget: a blackhole for the whole /48.
The ISP routes all of 2001:db8:1000::/48 to R1. Any part of it that R1 doesn't have a more specific route for (a /64 you haven't deployed yet, or a /56 for a router that's offline) would otherwise match R1's default route and be sent straight back to the ISP, which sends it back to R1, and so on until the hop limit runs out. The blackhole drops it at R1 instead. Longest prefix wins, so every real LAN and handover still works.
show ipv6 route also lists a fe80::/64 on every interface: link-local addresses. Every IPv6 interface has one, whether you configure it or not, and routers use them for talking to their neighbours, including, as you'll see next, as the default gateway for hosts.
R1 can now reach the internet. The client on LAN1 can't: all it has is a link-local address, and no route.
set system host-name 'R1'
set interfaces ethernet eth0 address '2001:db8:ffff:1::2/64'
set interfaces ethernet eth0 description 'WAN'
set interfaces ethernet eth1 address '2001:db8:1000:1::1/64'
set interfaces ethernet eth1 description 'LAN1'
set protocols static route6 ::/0 next-hop 2001:db8:ffff:1::1
set protocols static route6 2001:db8:1000::/48 blackhole- Lines 2–3: The WAN address, in the ISP's link prefix.
- Lines 4–5: LAN1: the first /64 of our /48. R1 takes ::1.
- Line 6: Everything not local goes to the ISP.
- Line 7: Anything in our /48 without a more specific route is dropped here, not bounced back to the ISP.
vyos@R1:~$ show interfaces
Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down
Interface IP Address MAC VRF MTU S/L Description
----------- --------------------- ----------------- ------- ----- ----- -------------
eth0 2001:db8:ffff:1::2/64 52:54:00:01:00:01 default 1500 u/u WAN
eth1 2001:db8:1000:1::1/64 52:54:00:01:01:01 default 1500 u/u LAN1
eth2 - 52:54:00:01:02:01 default 1500 u/u
lo 127.0.0.1/8 00:00:00:00:00:00 default 65536 u/u
::1/128
vyos@R1:~$ show ipv6 route
Codes: K - kernel route, C - connected, L - local, S - static,
R - RIPng, O - OSPFv3, I - IS-IS, B - BGP, N - NHRP,
T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR,
f - OpenFabric, t - Table-Direct,
> - selected route, * - FIB route, q - queued, r - rejected, b - backup
t - trapped, o - offload failure
IPv6 unicast VRF default:
S>* ::/0 [1/0] via 2001:db8:ffff:1::1, eth0, weight 1, 00:00:11
S>* 2001:db8:1000::/48 [1/0] unreachable (blackhole), weight 1, 00:00:11
C>* 2001:db8:1000:1::/64 is directly connected, eth1, weight 1, 00:00:16
L>* 2001:db8:1000:1::1/128 is directly connected, eth1, weight 1, 00:00:16
C>* 2001:db8:ffff:1::/64 is directly connected, eth0, weight 1, 00:00:13
L>* 2001:db8:ffff:1::2/128 is directly connected, eth0, weight 1, 00:00:13
C * fe80::/64 is directly connected, eth2, weight 1, 00:01:14
C * fe80::/64 is directly connected, eth0, weight 1, 00:01:20
C * fe80::/64 is directly connected, eth1, weight 1, 00:01:26
C>* fe80::/64 is directly connected, lo, weight 1, 00:01:31
vyos@R1:~$ ping 2001:db8:f000::10 count 2
PING 2001:db8:f000::10(2001:db8:f000::10) 56 data bytes
64 bytes from 2001:db8:f000::10: icmp_seq=1 ttl=63 time=4.20 ms
64 bytes from 2001:db8:f000::10: icmp_seq=2 ttl=63 time=1.90 ms
--- 2001:db8:f000::10 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1010ms
rtt min/avg/max/mdev = 1.902/3.052/4.203/1.150 ms- Lines 5–6: WAN and LAN1 addresses.
- Line 19: The default route.
- Line 20: The /48 blackhole.
- Lines 25–28: Link-local fe80::/64 on every interface, configured or not.
- Lines 31–32: R1 can reach the server.
root@client1:~# ip -6 addr show dev eth0
2: eth0@if613: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default link-netnsid 0
inet6 fe80::c8e8:1bff:fef2:b85d/64 scope link
valid_lft forever preferred_lft forever
root@client1:~# ip -6 route
fe80::/64 dev eth0 proto kernel metric 256 pref medium- Line 3: Only a link-local address…
- Line 6: …and no default route.