# =============================================================================
# graham's home router — IPv6 apply (RB5009UG+S+, ROS 7.22.3)
# =============================================================================
#
# This is graham's home — multi-WAN: TMHI primary, VNTX secondary, Starlink
# last-resort. v6 source is T-Mobile Home Internet's gateway via DHCPv6-PD
# on ether6-tmobile. Switched off the verona-PD path on 2026-05-09 because
# TWC isn't accepting our 2606:1c80::/32 yet (separate ticket); TMHI gives
# us a globally-reachable v6 prefix today, even if it rotates.
#
# Whatever TMHI delegates (typically /64 on residential, sometimes /60 on
# the newer gateways) populates the local `home-pd` pool. Internal LANs
# pull /64s from it:
#   * bridge          — main home LAN (10.0.16/24, 10.0.19/22)
#   * ether3-servers  — servers LAN (10.0.15.254/21)
# If TMHI only delegates a single /64, only `bridge` gets v6; the second
# `from-pool=` add will error harmlessly. If they hand out a /60 or /56,
# both LANs come up.
# =============================================================================

# -----------------------------------------------------------------------------
# WIPE — clean prior v6 config (preserve auto-link-local + Starlink ULA)
# -----------------------------------------------------------------------------
/ipv6 firewall filter remove [find]
/ipv6 nd remove [find default=no]
/ipv6 nd prefix remove [find]
/ipv6 dhcp-server remove [find]
/ipv6 dhcp-server option remove [find]
/ipv6 dhcp-client remove [find]
/ipv6 pool remove [find name=home-pd]
/ipv6 route remove [find static=yes]
/ipv6 address remove [find dynamic=no and disabled=no]

# -----------------------------------------------------------------------------
# APPLY — settings
# -----------------------------------------------------------------------------
# Forward stays on (we're a router). accept-router-advertisements=yes is
# REQUIRED on this router because TMHI only provides v6 via SLAAC — no
# DHCPv6 server, no PD downstream. Without this we wouldn't even get a
# global v6 address on ether6-tmobile. RAs we send on bridge/ether3-servers
# are not received by ourselves so this is safe to leave global.
/ipv6 settings set forward=yes accept-router-advertisements=yes

# -----------------------------------------------------------------------------
# APPLY — DHCPv6 client (request prefix delegation from TMHI gateway)
# -----------------------------------------------------------------------------
# request=address,prefix asks for both an IA_NA address on the WAN and a
# delegated prefix (IA_PD) for downstream LANs. pool-name stores the PD in
# a local pool we then carve /64s out of. add-default-route=yes installs
# ::/0 via TMHI's gateway link-local on receipt. Distance 1 matches the v4
# default priority for TMHI.
# Disabled — TMHI Sagemcom 5688W gateway runs no DHCPv6 server, only
# SLAAC. Verified 2026-05-09: client stays in status=searching... forever
# even with prefix-hint=::/56. The ROUTER itself gets v6 from RAs (above).
# Internal LANs can't get native PD from TMHI. To get v6 on internal LANs
# while routing via TMHI: add NAT66 with a ULA prefix (see notes in
# CLAUDE.md / memory). Kept here disabled so we remember the attempt.
/ipv6 dhcp-client
add interface=ether6-tmobile request=address,prefix pool-name=home-pd pool-prefix-length=64 \
    add-default-route=yes default-route-distance=1 \
    use-peer-dns=yes disabled=yes \
    comment="DHCPv6-PD from TMHI (disabled - TMHI runs SLAAC only, no PD server)"

# Disabled fallback — re-enable manually if TMHI v6 dies and verona is up
# AND TWC has accepted our 2606:1c80::/32 (separate ticket).
add interface=ether5-vntx-static request=prefix pool-name=home-pd-vntx pool-prefix-length=64 \
    add-default-route=yes default-route-distance=2 \
    use-peer-dns=yes disabled=yes \
    comment="DHCPv6-PD from verona (disabled, fallback)"

# -----------------------------------------------------------------------------
# APPLY — internal LAN addresses
# -----------------------------------------------------------------------------
# Currently no internal v6 — TMHI doesn't delegate a prefix and the verona
# path is held until TWC accepts our /32. When PD is restored, re-enable
# whichever dhcp-client is appropriate above and uncomment these:
#
# /ipv6 address
# add address=::1 from-pool=home-pd interface=bridge         advertise=yes comment="home main LAN"
# add address=::1 from-pool=home-pd interface=ether3-servers advertise=yes comment="home servers LAN"

# -----------------------------------------------------------------------------
# APPLY — neighbour discovery on internal LANs (SLAAC + RDNSS for clients)
# -----------------------------------------------------------------------------
# Skipped while no internal v6 prefix exists — RAs without a global prefix
# would just announce the router as a default gateway with no on-link
# prefix, which doesn't help clients. Re-enable along with the address
# block above when PD is back.
#
# /ipv6 nd
# add interface=bridge          ra-interval=3m20s-10m managed-address-configuration=no other-configuration=yes advertise-dns=yes
# add interface=ether3-servers  ra-interval=3m20s-10m managed-address-configuration=no other-configuration=yes advertise-dns=yes
#
# /ipv6 dhcp-server
# add interface=bridge          name=home-bridge-stateless  address-pool=static-only
# add interface=ether3-servers  name=home-servers-stateless address-pool=static-only
#
# /ipv6 dhcp-server option
# add name=v6-dns code=23 value="'2606:4700:4700::1111''2606:4700:4700::1001'"

# -----------------------------------------------------------------------------
# APPLY — firewall (mirror v4 hygiene; deny by default on input)
# -----------------------------------------------------------------------------
/ipv6 firewall filter
add chain=input action=accept connection-state=established,related comment="established"
add chain=input action=drop   connection-state=invalid             comment="invalid"
add chain=input action=accept protocol=icmpv6                      comment="icmpv6"
add chain=input action=accept src-address=fe80::/10                comment="link-local"
add chain=input action=accept src-address=2606:1c80::/32           comment="vntx internal"
add chain=input action=drop                                        comment="default deny input"

# Forward — let internal LANs reach the world; allow inbound established
# but don't accept arbitrary inbound to home hosts.
add chain=forward action=accept connection-state=established,related              comment="established"
add chain=forward action=drop   connection-state=invalid                          comment="invalid"
add chain=forward action=accept protocol=icmpv6 hop-limit=equal:1                 comment="PMTUD"
add chain=forward action=accept protocol=icmpv6                                   comment="icmpv6"
add chain=forward action=accept in-interface=bridge                               comment="home outbound (bridge)"
add chain=forward action=accept in-interface=ether3-servers                       comment="home outbound (servers)"
add chain=forward action=drop                                                     comment="default deny forward"

# -----------------------------------------------------------------------------
# VERIFY (after apply)
# -----------------------------------------------------------------------------
# /ipv6 dhcp-client print           ;; should show status=bound on ether6-tmobile
# /ipv6 pool print                  ;; should show home-pd populated (whatever TMHI delegated)
# /ipv6 address print               ;; bridge gets ::1/64; servers gets one too if TMHI gave /60+
# /ipv6 route print where active    ;; ::/0 via fe80::xxxx of TMHI gateway
# /ping 2606:4700:4700::1111 count=3 ;; cloudflare — should work once dhcp-client is bound
