openwrt 南京电信 PPPOE IPv6 dhcpv6 client设置方法

怼烎@ 2022-10-22 04:13 568阅读 0赞

**意图：在电信家庭宽带环境启用IPv6**

**环境：X86 + openwrt 19.07.7**

**南京电信家庭宽带，给用户分配的是/60的IPv6前缀，网上一堆博文，但大多都是片段，不完整。**

**一、错误的做法：**  
修改/etc/config/dhcp，在 option ignore '1'后面添加 ra,dhcpv6,ndp,master

> config dhcp 'wan'  
> option interface 'wan'  
> option ignore '1'  
> option ra 'relay'  
> option dhcpv6 'relay'  
> option ndp 'relay'  
> option master '1'

**二、正确的做法**

WAN6口无需删除，配置可参考：https://openwrt.org/docs/guide-user/network/ipv6/start

>     # cat /etc/config/network
>     config interface wan
>             option ipv6 1 # only required for PPP-based protocols
>             ...
>      
>     config interface wan6
>             option ifname   eth1 # use same ifname as in wan-section or "@wan"
>             option proto    dhcpv6
>      
>     config interface lan
>             option proto    static
>             option ip6assign 60
>             ...

**不修改config dhcp 'wan'，使其保持如下默认值(否则WAN6口无法获取到IPv6 DNS服务器）**

> config dhcp 'wan'  
> option interface 'wan'  
> option ignore '1'

按需修改/etc/config/dhcp，以下配置供参考：

> config dhcp 'lan'  
> option interface 'lan'  
> option limit '150'  
> option leasetime '12h'  
> option start '2'  
> option ra 'server'  
> option ra\_management '1'  
> option dhcpv6 'server'  
> option ra\_default '1'

参照 https://openwrt.org/docs/guide-user/network/ipv6/start 修改防火墙策略，放通DHCPv6报文，否则内网无法获取到IPv6地址，如下：

> \# cat /etc/config/firewall  
> ....  
> config rule  
> option target 'ACCEPT'  
> option src 'wan'  
> option proto 'udp'  
> option dest\_port '547'  
> option name 'Allow DHCPv6 (546-to-547)'  
> option family 'ipv6'  
> option src\_port '546'  
>   
> config rule  
> option target 'ACCEPT'  
> option src 'wan'  
> option proto 'udp'  
> option dest\_port '546'  
> option name 'Allow DHCPv6 (547-to-546)'  
> option family 'ipv6'  
> option src\_port '547'

修改防火墙Firewall - Traffic Rules：允许ICMPv6报文进入路由器，主要是neighbour-solicitation, neighbour-advertisement, router-solicitation, router-advertisement，  
否则，WAN6口会30分钟断线，随即通过wan6口访问互联网的IPv6默认路由会消失

> config rule  
> option name 'Allow-ICMPv6-Input'  
> option src 'wan'  
> option proto 'icmp'  
> list icmp\_type 'echo-reply'  
> list icmp\_type 'destination-unreachable'  
> list icmp\_type 'packet-too-big'  
> list icmp\_type 'time-exceeded'  
> list icmp\_type 'bad-header'  
> list icmp\_type 'unknown-header-type'  
> list icmp\_type 'router-solicitation'  
> list icmp\_type 'neighbour-solicitation'  
> list icmp\_type 'router-advertisement'  
> list icmp\_type 'neighbour-advertisement'  
> option limit '1000/sec'  
> option family 'ipv6'  
> option target 'ACCEPT'