OpenWRT IPv6 中继模式

IPv6 relay 模式怎么配置网上有一大把教程，就不多说了。重点在于为什么客户端能获取地址却 ping 不通公网，但 ping 一下路由器的 wan IPv6 地址后就可以上网了。通过在客户端设备上抓包和查看 ip neigh（或 ndp -an）可以发现，区别在于 IPv6 的邻居发现过程。

正确方式

IP6 fe80::xxxx > [solicited-node multicast address]: ICMP6, neighbor solicitation, who has [client address], length 32
IP6 fe80::yyyy > fe80::xxxx: ICMP6, neighbor advertisement, tgt is [client address], length 32

错误方式（路由器在 lan 侧找不到客户端 IP）

IP6 fd..:[ULA-prefix address] > [solicited-node multicast address]: ICMP6, neighbor solicitation, who has [target address], length 32

为什么错误方式下邻居发现会失败呢？原因是纯 relay 模式下客户端不会获取到 ULA-prefix¹ 下的地址/路由/邻居信息，当客户端尝试回复从路由器发出的 ULA-prefix 下地址的 neighbor solicitation 时，匹配不到这个 ULA 地址的路由只好放弃。

那么为什么 ping 一下网又通了呢？这是因为 odhcpd 从 wan 那边获取到了客户端的信息，从而配置上了 NDP 代理和路由。将 odhcpd 的 loglevel 配置成 7（LOG_DEBUG，数字来自syslog(3)）后可以看到对应的 proxy 日志。

所以只要去掉路由器 lan 上的 ULA 就可以了，也就是在 network 配置中注释掉 ip6assign。重启路由器后，客户端就可以正常上网了。

另一种可能的方式是同时启用 lan 上 ULA 和 relay 的地址分配，不过 relay 模式下不好实现。

最后剩下一个问题，中继模式下首次请求延迟会比较高，之后就正常了，这部分原理可以参考 https://blog.icpz.dev/articles/notes/odhcpd-relay-mode-discuss/。

参考资料

https://openwrt.org/docs/guide-user/network/ipv6/start#ipv6_relay

# cat /etc/config/dhcp
config dhcp lan
    option dhcpv6 relay
    option ra relay
    option ndp relay
    ...
 
config dhcp wan6
    option dhcpv6 relay
    option ra relay
    option ndp relay
    option master 1
    option interface wan6

笔者注：如非必要建议关闭 dhcpv6，原因见 https://issuetracker.google.com/issues/36949085

https://datatracker.ietf.org/doc/html/rfc4291#section-2.7.1

Solicited-Node multicast address are computed as a function of a
node's unicast and anycast addresses. A Solicited-Node multicast
address is formed by taking the low-order 24 bits of an address
(unicast or anycast) and appending those bits to the prefix
FF02:0:0:0:0:1:FF00::/104 resulting in a multicast address in the
range

     FF02:0:0:0:0:1:FF00:0000

to

     FF02:0:0:0:0:1:FFFF:FFFF

https://openwrt.org/docs/guide-user/base-system/basic-networking

network.globals.ula_prefix='fd27:70fa:5c1d::/48'

https://datatracker.ietf.org/doc/html/rfc4861#section-7.2.4

If the source of the solicitation is the unspecified address, the
node MUST set the Solicited flag to zero and multicast the
advertisement to the all-nodes address. Otherwise, the node MUST set
the Solicited flag to one and unicast the advertisement to the Source
Address of the solicitation.

P.S. Hybrid 模式是什么？其实就是智能开启 relay，代码如下，不要误以为是同时开启 relay 和 server 模式。

            /* Resolve hybrid mode */
            if (i->dhcpv6 == MODE_HYBRID)
                i->dhcpv6 = (master && master->dhcpv6 == MODE_RELAY) ?
                        MODE_RELAY : MODE_SERVER;

            if (i->ra == MODE_HYBRID)
                i->ra = (master && master->ra == MODE_RELAY) ?
                        MODE_RELAY : MODE_SERVER;

            if (i->ndp == MODE_HYBRID)
                i->ndp = (master && master->ndp == MODE_RELAY) ?
                        MODE_RELAY : MODE_DISABLED;

odhcpd 的 README 里有这么一段，说明客户端地址在路由器上的路由是它配置的。

4. Proxy for Neighbor Discovery messages (solicitations and advertisements)
   a) support for auto-learning routes to the local routing table
   b) support for marking interfaces "external" not proxying NDP for them
      and only serving NDP for DAD and for traffic to the router itself
      [Warning: you should provide additional firewall rules for security]