IPv6 routing Public to a subnetwork

Question

Doing Linux/Debian IPV6 Routing from my vendor to a client not working.
IPV4 NAT/routing is reliably working using iptables and dnsmasq, however, even with forwarding enabled on IPv6 I can't make it work.
RADVD is publishing the new network but, I can't access any public IPv6 address.

Simplified diagram

                                        SW
                                         |    +---------+
                                         +--->| client  |
             PUBLIC              PRIVATE |    +---------+
                                         |
    ~/-(PR)-+       +---(ER)---+         | C0 +--(CL)---+
     public |P0  E0 | extender | E1      +--->| client  |
     vendor |<----->|  router  |<------->|    +---------+
            |       +----------+         |
 ~/---------+                            |    +---------+
                                         +--->| client  |
                                         |    +---------+

 Where:
    PR ISP Public router
       P0 Public network interface
    ER extender router Debian based, trying to configure
       E0 Public network interface
       E1 Private network interface
    CL Test Client
       C0 Private network interface

Using radvdump, ER shows public route (redacted addresses)

    ...
    route 2600:..:5b10::/60
    {
            AdvRoutePreference high;
            AdvRouteLifetime 1209600;
    }; # End of route definition

On ER using radvd I'm publishing a new /64 network on E1 (2600:..:5b11)
CL received the published network and configure itself with a global address on the 2600:..:5b11 network.
ER can ping6 and connect to: ipv6.google.com, P0, E0, E1 and C0
CL can ping6 and connect to: E0 and E1, but ..not.. P0 (nor any public addresses)

On ER->E1 tcpdump shows ER's periodic router advertisement.
When I ping a public address on CL this is the capture on ER-E1:

fe80::..:d477 is ER-E1
fe80::..:dff6 and 2600:..:5b11:..:f48 are CL-C0
fe80::..:f380 is PR-p0
2607:f8b0:4002:c0c::8a is ipv6.google.com

IP6 fe80::..:d477 > ff02::1: ICMP6, router advertisement, length 56
IP6 2600:..:5b11:..:f48 > 2607:f8b0:4002:c0c::8a: ICMP6, echo request, seq 1, length 64
IP6 fe80::..:dff6 > fe80::..:d477: ICMP6, neighbor solicitation, who has fe80::..:d477, length 32
IP6 fe80::..:d477 > fe80::..:dff6: ICMP6, neighbor advertisement, tgt is fe80::..:d477, length 24
IP6 fe80::..:d477 > fe80::..:dff6: ICMP6, neighbor solicitation, who has fe80::..:dff6, length 32
IP6 fe80::..:dff6 > fe80::..:d477: ICMP6, neighbor advertisement, tgt is fe80::..:dff6, length 24
IP6 fe80::..:d477 > ff02::1: ICMP6, router advertisement, length 56

Ping on CL just hung (until timeout) with no message.

On ER->E0 tcpdump (simplified):

IP6 2600:..:5b11:..:f48 > 2607:f8b0:4002:c0c::8a: ICMP6, echo request, seq 1, length 64
IP6 fe80::..:c446 > fe80::19d7:1db3:c381:23a: ICMP6, neighbor advertisement, tgt is fe80::..:c446, length 24
IP6 fe80::..:c446 > fe80::..:f380: ICMP6, neighbor solicitation, who has fe80::..:f380, length 32
IP6 fe80::..:f380 > fe80::..:c446: ICMP6, neighbor advertisement, tgt is fe80::..:f380, length 24
IP6 fe80::..:f380 > fe80::..:c446: ICMP6, neighbor solicitation, who has fe80::..:c446, length 32
IP6 fe80::..:c446 > fe80::..:f380: ICMP6, neighbor advertisement, tgt is fe80::..:c446, length 24

ER routing table (eth0=E0 eth1=E1)

2600:..:5b10::13 dev eth0 proto kernel metric 256  pref medium
2600:..:5b10::/64 dev eth0 proto kernel metric 256  expires 1209445sec pref medium
2600:..:5b10::/64 dev eth0 proto kernel metric 303  mtu 1500 pref medium
2600:..:5b11::/64 dev eth1 proto kernel metric 256  pref medium
fe80::/64 dev eth0 proto kernel metric 256  pref medium
fe80::/64 dev eth1 proto kernel metric 256  pref medium
default via fe80::..:f380 dev eth0 metric 303  mtu 1500 pref medium
default via fe80::..:f380 dev eth0 proto ra metric 1024  expires 1645sec hoplimit 64 pref medium

There are no firewalls involved at this time, not even ip6tables.

On ER I have forwarding=1 and proxy_ndp=1 for all and default.

Answer 1

As you can see, the ping echo request is arriving on E1 and going out on E0, so on ER, everything works as it should.

However, you have a problem on PR: when the ping echo reply arrives, it will have a destination address of 2600:...:5b11:...:f48. However, PR only knows about the 5b10/60 subnet behind P0, it has no idea that there also is a 5b11/64 subnet reachable via E0. So my guess (one would have to verify this on the interface dumps) is that PR does a neighbour solication for 2600:...:5b11:...:f48 on P0, but ER doesn't answer (because it doesn't own this address), so PR drops the packet.

I've never tried to set up IPv6 with a contained subnet this way, so I'm not sure what to recommend. First thing I'd try is to also advertise the 5b11/64 on E0, and see if this additional information makes P0 forward the packets.

Edit

I found ndppd, the neighbour discovery protocol proxy demon. If PR indeed sends a neughbour solicitation for which it gets no answer, using ndppd on ER might solve this problem.

I haven't used it myself yet.