IPv6 forwarding broken? [solved]

lytenyn · n00b Joined: 29 Jan 2004 Posts: 44

Dear all, I would really appreciate your help with the following issue: I have a network topology like this:

ISP router --------- (public interface) Router (private interface) --------- Client

The router and client are Gentoo boxes that I (try to) maintain.

For IPv4, both the ISP router and my own router (on the private interface) run a DHCP server, and IPv4 forwarding is enabled on the router. Everything works fine.

For IPv6. I use systemd-networkd to request a delegated prefix from the ISP router, which seems to work.
The router gets a IPv6 address in the correct subnet on both interfaces, the client also gets a IPv6 address in the delegated prefix as expected

Everything looks ok, but the router does not seem to forward any IPv6 traffic at all. Using tcpdump to print ICMP6 packets shows that pings from the client arrive at the router, but never leave the router on the public interface.
I have a firewall set up using nftables, but it is set to accept any ICMP6 packets, and I can see them being accepted in the forward and prerouting tables.

I have also set up docker on the host which might complicate things, but the problem persists even if I disable all docker containers and remove all relevant network interfaces.

systemd-networkd is properly configured (IPv6Forwarding=yes in /etc/systemd/networkd.conf, which results correctly in:

NeddySeagoon · Posted: Mon Jan 06, 2025 6:53 pm Post subject:

lytenyn,

lytenyn · n00b Joined: 29 Jan 2004 Posts: 44

Thanks a lot for looking at my issue!

Not sure, I fully understand you: Using ip -6 addr, I get something like:

NeddySeagoon · Posted: Mon Jan 06, 2025 8:34 pm Post subject:

lytenyn,

Rewording what I think you said.
You have a /56 delegated prefix for your use. hats 256 /64 subnets.
You use prefix delegation to get a /64 for your LAN. Your ISP will drop unused nets in your /56 at its boundary router for two reasons.
1. It saves your ISP network bandwidth.
2. It saves your network bandwidth too, as you don't get junk to throw away.

lytenyn · n00b Joined: 29 Jan 2004 Posts: 44

Again, sorry, I'm not 100% sure that I understand correctly. I have two routers in series, my ISP router and my own, problematic one like this:

ISP router -------------- (publ) router (priv) ---------- client

The IPv6 addresses of these are:

ISP router:

- has an external IP address 2003:aaaa:bbqq:something/64 which is outside its own prefix which is:
- Prefix: 2003:aaaa:bbbb:cc00::/56
- It also listens to some address in this prefix of the form 2003:aaaa:bbbb:cc00:mac_address

My own router has two interfaces, a public and a private one with addresses:

- publ: 2003:aaaa:bbbb:cc00:xxxx:yyyy:zzzz:4458/64
- priv: 2003:aaaa:bbbb:ccfd:xxxx:yyyy:zzzz:4459/64
According to systemd-networkd, it has received the prefix 2003:aaaa:bbbb:ccfc::/62, and I infer that it has assigned 2003:aaaa:bbbb:ccfd::/64 to the priv interface.

Correspondingly, my client receives an address of the form 2003:aaaa:bbbb:ccfd:mac_address/64.

As far as I can tell, this is all ok. Do you agree?

Also, as far as I can see from tcpdump, a ICMP6 ping from the client towards the internet arrives at the router on the priv interface, but never leaves the router at the publ interface. I do not understand why.

lytenyn · n00b Joined: 29 Jan 2004 Posts: 44

I just found it. I have set up a firewall manually using nftables which accepts all ICMP6 packets.

However, I have also docker installed, which apparently comes with a second set of ip6tables rules which I knew nothing about.
These rules seem to block ICMP6 packets.

Now I just have to find out where these rules are set and how to remove them.

Thanks for your help!