111 lines
6.7 KiB
Text
111 lines
6.7 KiB
Text
# =============================================================================
|
|
# graham's home router — IPv6 apply (RB5009UG+S+, ROS 7.22.3)
|
|
# =============================================================================
|
|
#
|
|
# This is graham's home — connects to verona via ether5-vntx-static carrying
|
|
# 204.110.191.0/27 (home .1, verona .30). Multi-WAN: TMO primary, VNTX
|
|
# secondary, Starlink last-resort. v6 transit goes via VNTX (only v6-aware
|
|
# upstream).
|
|
#
|
|
# Treated like a regular WISP customer: DHCPv6-PD from verona's customer
|
|
# pool. Verona delegates a /56 from `verona-cust-pd-1` (2606:1c80:1001::/48).
|
|
# Whatever /56 verona hands us is then split into two /64s for our internal
|
|
# LANs:
|
|
# * bridge — main home LAN (10.0.16/24, 10.0.19/22)
|
|
# * ether3-servers — servers LAN (10.0.15.254/21)
|
|
# Both addresses are derived from the local pool `home-pd` populated by the
|
|
# DHCPv6 client when the /56 is delegated. If verona reboots and the pool
|
|
# happens to give a different /56 next time, both LANs renumber together.
|
|
# =============================================================================
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# WIPE — clean prior v6 config (preserve auto-link-local + Starlink ULA)
|
|
# -----------------------------------------------------------------------------
|
|
/ipv6 firewall filter remove [find]
|
|
/ipv6 nd remove [find !default]
|
|
/ipv6 nd prefix remove [find]
|
|
/ipv6 dhcp-server remove [find]
|
|
/ipv6 dhcp-server option remove [find]
|
|
/ipv6 dhcp-client remove [find]
|
|
/ipv6 pool remove [find name=home-pd]
|
|
/ipv6 route remove [find static=yes]
|
|
/ipv6 address remove [find !dynamic and !disabled]
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# APPLY — settings
|
|
# -----------------------------------------------------------------------------
|
|
# Forward must stay on; do NOT accept RAs as a router would. The dhcp-client
|
|
# below enables `add-default-route=yes` to install ::/0 from the server's
|
|
# advertisements specifically, separate from the global accept-RA toggle.
|
|
/ipv6 settings set forward=yes accept-router-advertisements=no
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# APPLY — DHCPv6 client (request prefix delegation from verona)
|
|
# -----------------------------------------------------------------------------
|
|
# Treats us as a wired customer: request=prefix asks for a /56, pool-name
|
|
# stores the delegation in a local pool we then assign /64s out of.
|
|
# add-default-route=yes installs ::/0 via verona's link-local on receipt.
|
|
/ipv6 dhcp-client
|
|
add interface=ether5-vntx-static request=prefix pool-name=home-pd pool-prefix-length=64 \
|
|
add-default-route=yes default-route-distance=2 \
|
|
use-peer-dns=yes \
|
|
comment="DHCPv6-PD from verona on the wired customer link"
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# APPLY — internal LAN addresses pulled from the delegated /56
|
|
# -----------------------------------------------------------------------------
|
|
# from-pool=home-pd grabs a /64 from the delegation; the `address=::1` part
|
|
# fills the host bits, so each LAN ends up at <prefix>::1.
|
|
# bridge gets <prefix>::1/64; ether3-servers gets the next /64 at
|
|
# <prefix+1>::1/64 — pool allocation is sequential, so /64s in the same /56
|
|
# stay contiguous.
|
|
/ipv6 address
|
|
add address=::1 from-pool=home-pd interface=bridge advertise=yes comment="home main LAN"
|
|
add address=::1 from-pool=home-pd interface=ether3-servers advertise=yes comment="home servers LAN"
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# APPLY — neighbour discovery on internal LANs (SLAAC + RDNSS for clients)
|
|
# -----------------------------------------------------------------------------
|
|
/ipv6 nd
|
|
add interface=bridge ra-interval=3m20s-10m managed-address-configuration=no other-configuration=yes advertise-dns=yes
|
|
add interface=ether3-servers ra-interval=3m20s-10m managed-address-configuration=no other-configuration=yes advertise-dns=yes
|
|
|
|
# Stateless DHCPv6 for DNS option (clients still get addresses from SLAAC)
|
|
/ipv6 dhcp-server
|
|
add interface=bridge name=home-bridge-stateless address-pool=static-only
|
|
add interface=ether3-servers name=home-servers-stateless address-pool=static-only
|
|
|
|
/ipv6 dhcp-server option
|
|
add name=v6-dns code=23 value="'2606:4700:4700::1111''2606:4700:4700::1001'"
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# APPLY — firewall (mirror v4 hygiene; deny by default on input)
|
|
# -----------------------------------------------------------------------------
|
|
/ipv6 firewall filter
|
|
add chain=input action=accept connection-state=established,related comment="established"
|
|
add chain=input action=drop connection-state=invalid comment="invalid"
|
|
add chain=input action=accept protocol=icmpv6 comment="icmpv6"
|
|
add chain=input action=accept src-address=fe80::/10 comment="link-local"
|
|
add chain=input action=accept src-address=2606:1c80::/32 comment="vntx internal"
|
|
add chain=input action=drop comment="default deny input"
|
|
|
|
# Forward — let internal LANs reach the world; allow inbound established
|
|
# but don't accept arbitrary inbound to home hosts.
|
|
add chain=forward action=accept connection-state=established,related comment="established"
|
|
add chain=forward action=drop connection-state=invalid comment="invalid"
|
|
add chain=forward action=accept protocol=icmpv6 hop-limit=equal:1 comment="PMTUD"
|
|
add chain=forward action=accept protocol=icmpv6 comment="icmpv6"
|
|
add chain=forward action=accept in-interface=bridge comment="home outbound (bridge)"
|
|
add chain=forward action=accept in-interface=ether3-servers comment="home outbound (servers)"
|
|
add chain=forward action=drop comment="default deny forward"
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# VERIFY (after apply)
|
|
# -----------------------------------------------------------------------------
|
|
# /ipv6 dhcp-client print ;; should show status=bound and a /56 prefix
|
|
# /ipv6 pool print ;; should show home-pd populated
|
|
# /ipv6 address print ;; bridge + ether3-servers each have ::1/64
|
|
# /ipv6 route print where active ;; ::/0 via fe80::xxxx of verona
|
|
# /ping 2606:1c80:0:10::101 count=3 ;; verona loopback
|
|
# /ping 2606:1c80:0:10::253 count=3 ;; core loopback
|
|
# /ping 2606:4700:4700::1111 count=3 ;; cloudflare (works once TWC v6 is solved)
|