ipv6 | Flat-Planet.net

With the recent price hikes (June 2023) for Virgin Media’s service, and a well timed knock on the door, I decided to switch (after many years) from Virgin Media [VM] to Eir’s FTTH service.

It wasn’t the smoothest install – which seems to be fairly typical, but up and running for a few days now without any issues.

Main points about the service;

Fiber to the Home [FTTH]!
Dual Stack Public IPv4 & IPv6 addresses – more on this later
Gigabit downlink
Cheaper!

Hardware & Software

Router

Hardware: EdgeRouter X SFP 6-Port

Software Release: v2.0.9-hotfix.6

Switch

Hardware: DCS-7010T-48

Software: 4.28.5.1M

Clients

Windows: Win 11, Win 10

Linux: Debian, Android 13, OS X

EdgeRouter Configuration

WAN Interface

The connection to the ONT e.g. the WAN port, needs to be tagged with VLAN ID: 10. This seems to be the standard for all FTTH in Ireland (eir, siro, etc.).

Additionally we’ll need to have both DHCP and DHCPv6-PD configured to (1) get our IPv4 address, and (2) have our IPv6 prefix delegated to us.

Since Eir provides both public IPv4 and IPv6 addresses, implementing a WAN firewall is advisable.

    ethernet eth0 {
        duplex auto
        poe {
            output off
        }
        speed auto
        vif 10 {
            address dhcp
            description Internet
            dhcpv6-pd {
                pd 0 {
                    interface switch0 {
                        host-address ::1
                        service slaac
                    }
                    prefix-length /56
                }
                prefix-only
                rapid-commit enable
            }
            firewall {
                in {
                    ipv6-name WANv6_IN
                    name WAN_IN
                }
                local {
                    ipv6-name WANv6_LOCAL
                    name WAN_LOCAL
                }
            }
        }
    }

Note: eir will delegate a /56 prefix on request, however since the SLAAC service is configured, each subnet on the LAN will have a /64.

NAT & Port-Forwarding Services

The outbound-interface for the NAT service will need to be updated to reflect the now tagged WAN interface.

    nat {
        rule 5010 {
            description "masquerade for WAN"
            outbound-interface eth0.10
            type masquerade
        }
    }

Likewise, the Port-Forwarding will need a change for the wan-interface to match.

Testing

show interfaces will show the IPv4 address assigned to the WAN port, while the first /64 of our IPv6 space will be assigned to the LAN (switch0)

~$  show interfaces
Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down
Interface    IP Address                        S/L  Description
---------    ----------                        ---  -----------
eth0         -                                 u/u
eth0.10      A.B.C.D/23                   u/u  Internet
eth1         -                                 u/u  Local
eth2         -                                 u/D  Local
eth3         -                                 u/D  Local
eth4         -                                 u/D  Local
eth5         -                                 u/D
lo           127.0.0.1/8                       u/u
             ::1/128
switch0      192.168.1.1/24                    u/u  Local
             2001:aaaa:bbbb:cccc::1/64

With a default route via the link-local address, out the WAN interface:

~$ show ipv6 route
IPv6 Routing Table
Codes: K - kernel route, C - connected, S - static, R - RIP, O - OSPF,
       IA - OSPF inter area, E1 - OSPF external type 1,
       E2 - OSPF external type 2, N1 - OSPF NSSA external type 1,
       N2 - OSPF NSSA external type 2, B - BGP
Timers: Uptime

IP Route Table for VRF "default"
K      ::/0 [0/1024] via fe80::a2f3:aaaa:bbbb:cccc, eth0.10, 03:56:46
C      ::1/128 via ::, lo, 03:58:38
C      2001:aaaa:bbbb:cccc::/64 via ::, switch0, 03:50:46
C      fe80::/64 via ::, eth0.10, 03:58:02

And a ping, just to be sure

~$ ping6 facebook.com
PING facebook.com(edge-star-mini6-shv-01-dub4.facebook.com (2a03:2880:f132:83:face:b00c:0:25de)) 56 data bytes
64 bytes from edge-star-mini6-shv-01-dub4.facebook.com (2a03:2880:f132:83:face:b00c:0:25de): icmp_seq=1 ttl=58 time=2.41 ms
64 bytes from edge-star-mini6-shv-01-dub4.facebook.com (2a03:2880:f132:83:face:b00c:0:25de): icmp_seq=2 ttl=58 time=2.11 ms
64 bytes from edge-star-mini6-shv-01-dub4.facebook.com (2a03:2880:f132:83:face:b00c:0:25de): icmp_seq=3 ttl=58 time=2.12 ms
64 bytes from edge-star-mini6-shv-01-dub4.facebook.com (2a03:2880:f132:83:face:b00c:0:25de): icmp_seq=4 ttl=58 time=2.13 ms
^C
--- facebook.com ping statistics ---
4 packets transmitted, 4 received, 0% packet loss, time 3011ms
rtt min/avg/max/mdev = 2.114/2.197/2.415/0.134 ms

Quirks

One annoying behaviour with SLaaC as implemented on the EdgeRouter, is that the default (not changable) config is following RFC4861, which specifies Preferred Lifetime (AdvPreferredLifetime): 604800 seconds (7 days) and Valid Lifetime (AdvValidLifetime): 2592000 seconds (30 days).

This has the effect that unless the router (EdgeRouter) explicitly signals to stop using a prefix, the hosts will continue to use the same prefix for 7 days. If you restart the router, have a WAN interface flap, etc. Eir will assign a new Prefix, but the hosts will continue to use the old one, meaning that IPv6 connectivity will be broken until you clear out the autoassigned IPv6 addresses (something that is harder to do than you’d think!!).