129 lines
7.7 KiB
Text
129 lines
7.7 KiB
Text
# =============================================================================
|
|
# graham's home router — IPv6 apply (RB5009UG+S+, ROS 7.22.3)
|
|
# =============================================================================
|
|
#
|
|
# This is graham's home — multi-WAN: TMHI primary, VNTX secondary, Starlink
|
|
# last-resort. v6 source is T-Mobile Home Internet's gateway via DHCPv6-PD
|
|
# on ether6-tmobile. Switched off the verona-PD path on 2026-05-09 because
|
|
# TWC isn't accepting our 2606:1c80::/32 yet (separate ticket); TMHI gives
|
|
# us a globally-reachable v6 prefix today, even if it rotates.
|
|
#
|
|
# Whatever TMHI delegates (typically /64 on residential, sometimes /60 on
|
|
# the newer gateways) populates the local `home-pd` pool. Internal LANs
|
|
# pull /64s from it:
|
|
# * bridge — main home LAN (10.0.16/24, 10.0.19/22)
|
|
# * ether3-servers — servers LAN (10.0.15.254/21)
|
|
# If TMHI only delegates a single /64, only `bridge` gets v6; the second
|
|
# `from-pool=` add will error harmlessly. If they hand out a /60 or /56,
|
|
# both LANs come up.
|
|
# =============================================================================
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# WIPE — clean prior v6 config (preserve auto-link-local + Starlink ULA)
|
|
# -----------------------------------------------------------------------------
|
|
/ipv6 firewall filter remove [find]
|
|
/ipv6 nd remove [find default=no]
|
|
/ipv6 nd prefix remove [find]
|
|
/ipv6 dhcp-server remove [find]
|
|
/ipv6 dhcp-server option remove [find]
|
|
/ipv6 dhcp-client remove [find]
|
|
/ipv6 pool remove [find name=home-pd]
|
|
/ipv6 route remove [find static=yes]
|
|
/ipv6 address remove [find dynamic=no and disabled=no]
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# APPLY — settings
|
|
# -----------------------------------------------------------------------------
|
|
# Forward stays on (we're a router). accept-router-advertisements=yes is
|
|
# REQUIRED on this router because TMHI only provides v6 via SLAAC — no
|
|
# DHCPv6 server, no PD downstream. Without this we wouldn't even get a
|
|
# global v6 address on ether6-tmobile. RAs we send on bridge/ether3-servers
|
|
# are not received by ourselves so this is safe to leave global.
|
|
/ipv6 settings set forward=yes accept-router-advertisements=yes
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# APPLY — DHCPv6 client (request prefix delegation from TMHI gateway)
|
|
# -----------------------------------------------------------------------------
|
|
# request=address,prefix asks for both an IA_NA address on the WAN and a
|
|
# delegated prefix (IA_PD) for downstream LANs. pool-name stores the PD in
|
|
# a local pool we then carve /64s out of. add-default-route=yes installs
|
|
# ::/0 via TMHI's gateway link-local on receipt. Distance 1 matches the v4
|
|
# default priority for TMHI.
|
|
# Disabled — TMHI Sagemcom 5688W gateway runs no DHCPv6 server, only
|
|
# SLAAC. Verified 2026-05-09: client stays in status=searching... forever
|
|
# even with prefix-hint=::/56. The ROUTER itself gets v6 from RAs (above).
|
|
# Internal LANs can't get native PD from TMHI. To get v6 on internal LANs
|
|
# while routing via TMHI: add NAT66 with a ULA prefix (see notes in
|
|
# CLAUDE.md / memory). Kept here disabled so we remember the attempt.
|
|
/ipv6 dhcp-client
|
|
add interface=ether6-tmobile request=address,prefix pool-name=home-pd pool-prefix-length=64 \
|
|
add-default-route=yes default-route-distance=1 \
|
|
use-peer-dns=yes disabled=yes \
|
|
comment="DHCPv6-PD from TMHI (disabled - TMHI runs SLAAC only, no PD server)"
|
|
|
|
# Disabled fallback — re-enable manually if TMHI v6 dies and verona is up
|
|
# AND TWC has accepted our 2606:1c80::/32 (separate ticket).
|
|
add interface=ether5-vntx-static request=prefix pool-name=home-pd-vntx pool-prefix-length=64 \
|
|
add-default-route=yes default-route-distance=2 \
|
|
use-peer-dns=yes disabled=yes \
|
|
comment="DHCPv6-PD from verona (disabled, fallback)"
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# APPLY — internal LAN addresses
|
|
# -----------------------------------------------------------------------------
|
|
# Currently no internal v6 — TMHI doesn't delegate a prefix and the verona
|
|
# path is held until TWC accepts our /32. When PD is restored, re-enable
|
|
# whichever dhcp-client is appropriate above and uncomment these:
|
|
#
|
|
# /ipv6 address
|
|
# add address=::1 from-pool=home-pd interface=bridge advertise=yes comment="home main LAN"
|
|
# add address=::1 from-pool=home-pd interface=ether3-servers advertise=yes comment="home servers LAN"
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# APPLY — neighbour discovery on internal LANs (SLAAC + RDNSS for clients)
|
|
# -----------------------------------------------------------------------------
|
|
# Skipped while no internal v6 prefix exists — RAs without a global prefix
|
|
# would just announce the router as a default gateway with no on-link
|
|
# prefix, which doesn't help clients. Re-enable along with the address
|
|
# block above when PD is back.
|
|
#
|
|
# /ipv6 nd
|
|
# add interface=bridge ra-interval=3m20s-10m managed-address-configuration=no other-configuration=yes advertise-dns=yes
|
|
# add interface=ether3-servers ra-interval=3m20s-10m managed-address-configuration=no other-configuration=yes advertise-dns=yes
|
|
#
|
|
# /ipv6 dhcp-server
|
|
# add interface=bridge name=home-bridge-stateless address-pool=static-only
|
|
# add interface=ether3-servers name=home-servers-stateless address-pool=static-only
|
|
#
|
|
# /ipv6 dhcp-server option
|
|
# add name=v6-dns code=23 value="'2606:4700:4700::1111''2606:4700:4700::1001'"
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# APPLY — firewall (mirror v4 hygiene; deny by default on input)
|
|
# -----------------------------------------------------------------------------
|
|
/ipv6 firewall filter
|
|
add chain=input action=accept connection-state=established,related comment="established"
|
|
add chain=input action=drop connection-state=invalid comment="invalid"
|
|
add chain=input action=accept protocol=icmpv6 comment="icmpv6"
|
|
add chain=input action=accept src-address=fe80::/10 comment="link-local"
|
|
add chain=input action=accept src-address=2606:1c80::/32 comment="vntx internal"
|
|
add chain=input action=drop comment="default deny input"
|
|
|
|
# Forward — let internal LANs reach the world; allow inbound established
|
|
# but don't accept arbitrary inbound to home hosts.
|
|
add chain=forward action=accept connection-state=established,related comment="established"
|
|
add chain=forward action=drop connection-state=invalid comment="invalid"
|
|
add chain=forward action=accept protocol=icmpv6 hop-limit=equal:1 comment="PMTUD"
|
|
add chain=forward action=accept protocol=icmpv6 comment="icmpv6"
|
|
add chain=forward action=accept in-interface=bridge comment="home outbound (bridge)"
|
|
add chain=forward action=accept in-interface=ether3-servers comment="home outbound (servers)"
|
|
add chain=forward action=drop comment="default deny forward"
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# VERIFY (after apply)
|
|
# -----------------------------------------------------------------------------
|
|
# /ipv6 dhcp-client print ;; should show status=bound on ether6-tmobile
|
|
# /ipv6 pool print ;; should show home-pd populated (whatever TMHI delegated)
|
|
# /ipv6 address print ;; bridge gets ::1/64; servers gets one too if TMHI gave /60+
|
|
# /ipv6 route print where active ;; ::/0 via fe80::xxxx of TMHI gateway
|
|
# /ping 2606:4700:4700::1111 count=3 ;; cloudflare — should work once dhcp-client is bound
|