How do I make a Linux-based IPv6 access point?

Question

To make a typical IPv4-based access point on Linux, one does these steps:

1. Use hostapd to make e.g. wlan0 available for incoming connections;
2. Choose some local subnet. For example, 192.168.99.0/24.
3. Add one of IP addresses in that network (e.g. 192.168.99.1/24) to wlan0.
4. Enable forwarding both for this network (wlan0) and for upstream (e.g. eth0).
5. Insert MASQUERADE rule to firewall to enable NAT.
6. Start dnsmasq or other DHCP server to manage local IP addresses of clients.

Are there similar steps for IPv6? Ideally clients of wlan0 should see the IPv6 world just as if they were connected to eth0 directly (i.e. not another NAT, which is unidiomatic in IPv6 world), something like a pseudo-bridge (true brctl bridging may be problematic).

It would also be useful if eth0 could be reconnected to another network without requiring restarting the infrastructure for serving wlan0, just like in the IPv4 case.

Will the steps be different depending on whether DHCPv6 or router advertisements are used on eth0?

Answer 1

Are there similar steps for IPv6? Ideally clients of wlan0 should see the IPv6 world just as if they were connected to eth0 directly (i.e. not another NAT, which is unidiomatic in IPv6 world), something like a pseudo-bridge (true brctl bridging may be problematic).

The idiomatic IPv6 equivalent of the steps you described would be simply routing without NAT. (Everybody keeps forgetting that you can route packets without NATing them.) Your access point would acquire its own /64 prefix using DHCPv6-PD – automatically making the upstream router set up the correct route – and the other steps would remain the same (just without the MASQUERADE rule), with dnsmasq announcing the /64 via SLAAC and/or DHCPv6. "Hotspots" set up by NetworkManager do exactly this.

Now if you're on a network which does not support DHCPv6-PD sub-delegation (many routers unfortunately don't), then you could implement a "pseudo-bridge" by using NDP proxying (the IPv6 equivalent of ARP proxying). There are several proxy-NDP implementations, but the one you want is ndprbrd, though the same functionality is now also presend in ndppd. Unlike static NDP proxy, these daemons dynamically learn which IPv6 addresses are on which side, so you can just set up SLAAC to mimic the upstream interface's /64 and ndprbrd will figure it out.

Finally, as you're calling this an access point, I want to be pedantic and point out that a real "access point" would be a true bridge. Not a pseudo-bridge, but literally a br0 interface containing both your wlan0 AP and the eth0 uplink – making IPv6 work by default as well as providing seamless roaming when you have multiple APs per SSID. (Bridging wlan0 is only impossible when it's in station mode, but perfectly possible when it's in access-point mode; that's how all APs and indeed even wireless routers work.)