Re: Routing issue: several interfaces with the same inet6 prefix

pf does not nat v6.

Paul de Weerd wrote:
> On Sun, Jun 05, 2005 at 09:03:54PM +0200, Olivier Mehani wrote:
> | This is not an OpenBSD-only problem, but I'm facing it will trying to
> | configure an OpenBSD based router.
> |
> | I have the followind network configuration:
> |
> |           sis0 /-----------\ sis1
> | (outside) -----|OpenBSD box|------ (local wired net)
> |                \-----------/
> |                     rtw0 \.oOo. (local wireless net)
> |
> | With this in sysctl.conf:
> | net.inet6.ip6.forwarding=1
> | net.inet6.ip6.accept_rtadv=1
> |
> | sis0's IPv6 is configured via stateless autoconfiguration, with a /64
> | prefix but (first problem) doesn't get a default route (I suspect this
> | is due to net.inet6.ip6.forwarding).
> |
> | The machine is then advertising the same prefix on sis1 and rtw0 to
> | autoconfigure the boxen behind the router. They properly get their
> | autoconf IP and default routes.
> |
> | (second and main problem) The router correctly passes request from the
> | local net to the outside, but then doesn't know where to send them back.
> | The following type of packets is sent on sis0:
> |
> | 20:52:28.945616 (THE_ROUTERS_IPV6) > ff02::1:ff8b:234a: icmp6:
> | neighbor sol: who has (THE_CLIENT_ON_rtw0)
> |
> | "8b:234a" is part of the client's autoconfigured IPv6.
> |
> | How can I make the router send the packets to the correct interface ? Is
> | there a way to update the routing tables when receiving packets from the
> | hosts ?
> |
> | I guess the same problem will arrise when trying to communicate from a
> | machine on rtw0's net to a machine on sis1's net.
> |
> | Any ideas ?
> 
> I think you should be looking at bridging or at getting more address
> space. You shouldn't
> 
> a) use router sollicitation on a(n IPv6) router
> b) distribute one IPv6 network over separate logical networks
> 
> To solve a) simply configure your interface with eui64 and add a
> default IPv6 gateway. To solve b) either get more address space and
> split that over your logical networks (this can be done without the
> extra address space but then you will not be able to use rtadvd) or
> bridge your interfaces to put them in the same logical network.
> 
> I'd suggest to get more address space. Your setup looks somewhat
> awkward with the same IPv6 subnet on all your interfaces. You are
> advertising the same prefix on sis1 and rtw0 as your v6-provider sent
> you on sis0 - baaaaaad.
> 
> You shouldn't be able to configure your system with both
> net.inet6.ip6.forwarding=1 and net.inet6.ip6.accept_rtadv=1, these are
> conflicting setting one will disable the other and vice versa. Don't
> do that.
> 
> If you want to get really nasty (but (IMO) less so then what you're
> doing now) then you could use pf(4) to NAT for IPv6 and use
> (deprecated) site-local addresses on sis1 and rtw0 :
> 
> /etc/hostname.sis0:
> inet6 <YOUR_PREFIX>:: 64 eui64
> !/bin/route add -inet6 default <GATEWAY_ADDRESS>
> 
> /etc/hostname.sis1:
> inet6 fec0:1:: 64 eui64
> 
> /etc/hostname.rtw0:
> inet6 fec0:2:: 64 eui64
> 
> /etc/pf.conf:
> nat on sis0 inet6 from fec0::/16 -> <IPV6_ON_SIS0>
> 
> /etc/rc.conf.local:
> rtadvd_flags="sis1 rtw0"
> 
> Cheers,
> 
> Paul 'WEiRD' de Weerd
> 
> --
> 
>>++++++++[<++++++++++>-]<+++++++.>+++[<------>-]<.>+++[<+
> 
> +++++++++++>-]<.>++[<------------>-]<+.--------------.[-]
>                  http://www.weirdnet.nl/
> 
> [demime 1.01d removed an attachment of type application/pgp-signature]
> 
> 

-- 
Todd Fries .. [email protected]

  _____________________________________________
|                                             \  1.636.410.0632 (voice)
| Free Daemon Consulting, LLC                 \  1.405.227.9094 (voice)
| http://FreeDaemonConsulting.com             \  1.866.792.3418 (FAX)
| "..in support of free software solutions."  \          250797 (FWD)
|                                             \
  \\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\

               37E7 D3EB 74D0 8D66 A68D  B866 0326 204E 3F42 004A
                         http://todd.fries.net/pgp.txt