Re: ipv6 gateway on different subnet

On Sat, Jan 18, 2025 at 10:43:05AM -0600, Peter Miller wrote:
> with this running and connection is good
> ping6 -S 2602:fed2:7116:d82c::1 google.com
> 
> doas tcpdump -npi vioif0 icmp6

Nothing unexpected here.


> on the other address with 100% packet loss
> ping6 -S 2602:fed2:7116:d82c::2 google.com
> 
> 10:37:17.595359 IP6 fe80::da67:d9ff:fe58:3d1b > ff02::1:ff00:0: ICMP6,
> neighbor solicitation, who has 2604:f440:3:17::, length 32
> 10:37:17.851412 IP6 2602:fed2:7116:d82c::2 > 2607:f8b0:4023:1002::71:
> ICMP6, echo request, seq 0, length 16

The interesting thing here is that there is neither an echo reply nor
a neighbor solicitation from the router.

[...]
> 10:37:21.871745 IP6 2602:fed2:7116:d82c::2 > 2607:f8b0:4023:1002::71:
> ICMP6, echo request, seq 4, length 16
> 10:37:21.874248 IP6 fe80::da67:d9ff:fe58:3d1b > ff02::1:ff00:2: ICMP6,
> neighbor solicitation, who has 2602:fed2:7116:d82c::2, length 32
> 10:37:21.874304 IP6 fe80::216:3eff:fed7:cf50 >
> fe80::da67:d9ff:fe58:3d1b: ICMP6, neighbor advertisement, tgt is
> 2602:fed2:7116:d82c::2, length 32

Finally a neighbor solicitation from the router, and the corresponding
advertisement from your VPS. Looks fine to me.

Except, that I would now expect the echo reply packet that triggered
the neighbor solicitation.

> 10:37:22.102207 IP6 fe80::da67:d9ff:fe58:3d1b > ff02::1:ff00:1: ICMP6,
> neighbor solicitation, who has 2602:2c8:0:1007::1, length 32
> 10:37:22.622296 IP6 fe80::da67:d9ff:fe58:3d1b > ff02::1:ff00:1: ICMP6,
> neighbor solicitation, who has 2602:2c8:0:103f::1, length 32
> 10:37:22.870697 IP6 2602:fed2:7116:d82c::2 > 2607:f8b0:4023:1002::71:
> ICMP6, echo request, seq 5, length 16
> 10:37:22.873565 IP6 fe80::da67:d9ff:fe58:3d1b > ff02::1:ff00:2: ICMP6,
> neighbor solicitation, who has 2602:fed2:7116:d82c::2, length 32
> 10:37:22.873611 IP6 fe80::216:3eff:fed7:cf50 >
> fe80::da67:d9ff:fe58:3d1b: ICMP6, neighbor advertisement, tgt is
> 2602:fed2:7116:d82c::2, length 32

That's weird that you get another neighbor solicitation for the same
address. Somehow the router must not have gotten the previous neighbor
advertisement.

To me it seems your VPS acts as expected, but there must be something
weird going on in that network.

Have you actually tested that it works when running Linux? (I am
assuming your provider will just blame it on your NetBSD configuration
otherwise) Maybe you can just temporarily boot into something like an
Alpine Linux live image via netboot.xzy to test?


Christof

-- 
https://cmeerw.org                             sip:cmeerw at cmeerw.org
mailto:cmeerw at cmeerw.org                   xmpp:cmeerw at cmeerw.org