How to share an IPv6 connection to the whole LAN?

Question

My ISP still doesn't support IPv6, and I currently use OpenVpn or OpenConnect VPN to get IPv6 connection.

Now that there is a Ubuntu server running VPN client UNDER an OpenWRT router.

Is it possible to share (only) the IPv6 connection from the server to the whole LAN network?

Answer 1

Sure, if your IPv6 connection gives you a prefix that is large enough for all the devices in the LAN (i.e. a prefix number smaller than /128, ideally /64 or less).

First, enable IPv6 forwarding by adding this line to /etc/sysctl.conf:

net.ipv6.conf.all.forwarding=1

Then either run sudo sysctl -p or reboot to make it take effect.

This will disable IPv6 autoconfiguration as a side effect, so you may need to re-enable it on your VPN interface, by arranging for these commands to run after your VPN interface has come up:

sysctl -w net.ipv6.conf.<your_VPN_interface_here>.accept_ra=2
sysctl -w net.ipv6.conf.<your_VPN_interface_here>.autoconf=1

If you are getting a /128 prefix (= single host only) on the VPN interface, you'll need to contact your VPN provider and find out how you can get a wider prefix. It might require different VPN settings, or it might require setting up a DHCPv6 client to make a Prefix Request on the VPN-side.

If you can get a wider-than-/64 prefix (= smaller number) on your VPN interface, it will allow you to use SLAAC on your LAN, which is probably the easiest way to configure IPv6.

You'll also want to think about IPv6 firewalling here: set some IPv6 firewall rules in advance to block any incoming connections from the VPN-side you don't specifically need. Think twice before blocking any ICMPv6 types or IPv6 multicasts; both are essential parts of the IPv6 protocol and you can't just completely block them.

Your system is now ready to become an IPv6 router. You should now think about how you split the IPv6 address space allowed to you by the prefix on the VPN interface, and assign sub-prefix(es) of it to your LAN-side interface(s). Since all the IPv6 addresses within your prefix are now yours to use as you see fit, you can just manually assign the IPv6 address for your LAN-side interface(s).

Then install and configure radvd to make your system announce to the LAN that it's an IPv6 router. Modern versions of radvd will also be able to announce the IPv6 DNS servers and the domain suffix the clients should use.

radvd configuration will also include a few settings that tell the clients if they're allowed to just pick an IPv6 address on their own by using stateless address autoconfiguration (SLAAC), or if they're supposed to use DHCPv6. Also, even if you choose to allow SLAAC, you may still make a DHCPv6 server available to provide some extra configuration information to your clients.

Once you've set those bits appropriately and started up radvd to announce the presence of an IPv6 router to your LAN, if your LAN-side sub-prefixes are /64 or wider and you have allowed SLAAC, your clients should now be receiving the radvd announcements and automatically getting themselves a basic IPv6 configuration.

If you ended up with a tighter-than-/64 prefix (=higher number) on your LAN-side, or if you chose to not use SLAAC, you'll now need to set up a DHCPv6 server for your clients.

Then it's time to start testing. If your clients are only showing a link-local IPv6 address that starts with fe80::, you should first verify that they are seeing the router announcements of radvd. That's a fundamental part of IPv6 autoconfiguration; without those announcements, nothing else will happen.

Answer 2

In addition to telcoM's answer:

If the VPN provider only gives a tighter-than-/64 prefix IPv6 address (/128 in my case), it's also acceptable to do an IPv6 NAT.

First, add net.ipv6.conf.all.forwarding=1 to /etc/sysctl.conf and enable it.

Then, enable IPv6 NAT by run ip6tables -t nat -A POSTROUTING -o tun0 -j MASQUERADE

Then, pick an ULA address (better than IANA reserved in this particular situation) and edit /etc/radvd.conf like this:

# /etc/radvd.conf
interface eth0 {
  AdvSendAdvert on;
  MinRtrAdvInterval 3;
  MaxRtrAdvInterval 10;
  prefix fd12:3456:7980:abcd::/64 {
    AdvOnLink on;
    AdvAutonomous on;
    AdvRouterAddr on;
  };
};

And finally, restart the radvd service.

The system will do DHCPv6 automatically.