Router can't reach IPv6 despite clients having full connectivity

[iTheMask]

I'm using an ASUS router with Merlin firmware and a PPPoE WAN connection. All LAN clients successfully obtain global IPv6 addresses via DHCPv6-PD and have full IPv6 internet access. However, the router itself cannot reach any IPv6 destinations - pings and traceroutes from the router fail beyond the second hop. I've suspicion that this is caused by my ISP, but I wanted to see if anyone faced something similar and found a workaround. My ISP provide IPv6 but no technical details are published, nor they will provide support for using my own router (they provide specific brand only which is completely locked)

• Global IPv6 prefix is shown in the router Web UI
• All clients can connect and ping IPv6 hosts
• Router cannot ping IPv6 targets
  • Using the Web UI -> Networks tool (Only IPv4 targets works)
  • Ping from SSH is timing out
  • DNS can resolve IPv6
• Router cannot connect to IPv6-only VPN (router as VPN client)
  • IPv4 VPN connect successfully

Within the router Advanced Settings -> IPv6, I had to set the following to obtain the dynamic IPv6 prefix (other methods didn't work):

• Connection type: Native
• Interface: PPP
• DHCP-PD: Enable
• Accept Default Route: Enable
• [IPv6 WAN Setting]
  • WAN Prefix Length: 56 (was auto configured once connected to ISP)
• [IPv6 LAN Setting]
  • LAN IPv6 Address: 2001:ffff:4321:5678::1 (was auto configured once connected to ISP)
  • LAN Prefix Length: 64 (was auto configured once connected to ISP)
  • LAN IPv6 Prefix: 2001:ffff:4321:5678:: (was auto configured once connected to ISP)
  • Auto Configuration Setting: Stateless
• [IPv6 DNS Settings]
  • Connect to DNS Server automatically: Enable
• [Auto Configuration Setting]
  • Enable Router Advertisement: Enable

The below trace route from router SSH, google domain was reoslved, the hop 1 & 2 seems to belong to my ISP as the prefix is different than the one assigned to me. I tried with `traceroute6 -n -i ppp0 ipv6.google.com` as well with the same result

# traceroute -6 google.com
traceroute to google.com (2a00:1450:4019:800::200e), 30 hops max, 16 byte packets
 1  2001:ffff:100:10:: (2001:ffff:100:10::)  2.816 ms  2.442 ms  2.808 ms # <-- This what seems to be the ISP gateway
 2  2001:ffff:1f06:aa::b (2001:ffff:1f06:aa::b)  3.279 ms  3.160 ms  2.942 ms
 3  *  *  *
...
30  *  *  *

I tried to find the default route and the interface with the help of LLM

# ip -6 route show
2001:ffff:100:10::45d5 dev ppp0 proto kernel metric 256 pref medium # <-- This what seems to be the ISP gateway
2001:ffff:4321:5678::/64 dev br0 proto kernel metric 256 pref medium # <-- This the the global IPv6 prefix assigned to the router
default via fe80::200:5eff:fe00:101 dev ppp0 proto ra metric 1024 expires 1331sec pref medium

# ip -6 addr
1: lo: <LOOPBACK,MULTICAST,UP,LOWER_UP> mtu 65536
    inet6 ::1/128 scope host
       valid_lft forever preferred_lft forever
68: br0: <BROADCAST,MULTICAST,ALLMULTI,UP,LOWER_UP> mtu 1500
    inet6 2001:ffff:4321:5678::1/64 scope global # <-- This the the global IPv6 prefix assigned to the router
       valid_lft forever preferred_lft forever
    inet6 fe80::7e10:c9ff:fe58:e0a8/64 scope link
       valid_lft forever preferred_lft forever
69: ppp0: <POINTOPOINT,MULTICAST,UP,LOWER_UP> mtu 1492 qlen 3
    inet6 2001:ffff:100:10::45d5/128 scope global # <-- This what seems to be the ISP gateway
       valid_lft forever preferred_lft forever
    inet6 fe80::f174:761b:cea8:ce2/10 scope link
       valid_lft forever preferred_lft forever

# ifconfig
br0       Link encap:Ethernet  HWaddr e3:80:dd:11:a7:f3
          inet addr:192.168.50.1  Bcast:192.168.50.255  Mask:255.255.255.0
          inet6 addr: 2001:ffff:4321:5678::1/64 Scope:Global # <-- This the the global IPv6 prefix assigned to the router
          inet6 addr: fe80::7e10:c9ff:fe58:e0a8/64 Scope:Link
          UP BROADCAST RUNNING ALLMULTI MULTICAST  MTU:1500  Metric:1
          RX packets:738811 errors:0 dropped:59 overruns:0 frame:0
          TX packets:1502179 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:103088636 (98.3 MiB)  TX bytes:1247449496 (1.1 GiB)
lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING MULTICAST  MTU:65536  Metric:1
          RX packets:37248736 errors:0 dropped:0 overruns:0 frame:0
          TX packets:37248736 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:8367122514 (7.7 GiB)  TX bytes:8367122514 (7.7 GiB)
lo:0      Link encap:Local Loopback
          inet addr:127.0.1.1  Mask:255.0.0.0
          UP LOOPBACK RUNNING MULTICAST  MTU:65536  Metric:1
ppp0      Link encap:Point-to-Point Protocol
          inet addr:12.34.56.78  P-t-P:12.34.56.1  Mask:255.255.255.255 # My actual public IPv4 was here and the P-t-P looks to be my ISP gateway
          inet6 addr: fe80::f174:761b:cea8:ce2/10 Scope:Link
          inet6 addr: 2001:ffff:100:10::45d5/128 Scope:Global # <-- This what seems to be the ISP gateway and not the prefix assigned to me
          UP POINTOPOINT RUNNING MULTICAST  MTU:1492  Metric:1
          RX packets:1468981 errors:0 dropped:0 overruns:0 frame:0
          TX packets:690727 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:3
          RX bytes:1209230527 (1.1 GiB)  TX bytes:90669250 (86.4 MiB)

 

[bennor]

I'm using an ASUS router with Merlin firmware

For added context, what specific router and what specific Asus-Merlin firmware?

 

[iTheMask]

For added context, what specific router and what specific Asus-Merlin firmware?

AX58U V2 (AX3000)
Asuswrt Merlin Firmware: 3004.388.9_2

Edit: The following ping works when I specified the interface to be the IPv6 prefix assigned to br0, but how to set this as default for everything iniated from the router?

# ping -6 -I 2001:ffff:4321:5678::1 ipv6.google.com
PING ipv6.google.com (2a00:1450:4019:807::200e) from 2001:ffff:4321:5678::1: 56 data bytes
64 bytes from 2a00:1450:4019:807::200e: seq=0 ttl=119 time=19.075 ms
64 bytes from 2a00:1450:4019:807::200e: seq=1 ttl=119 time=19.571 ms
64 bytes from 2a00:1450:4019:807::200e: seq=2 ttl=119 time=20.802 ms

 

[dave14305]

The IPv6 addresses look fine to me. Maybe your ISP doesn’t like something about the WAN IPv6 address which is from a different prefix than the one delegated to the LAN. That’s normal that they are different, but they seem to treat it differently.

On the other hand, you seem to be running a Gnuton firmware and could have subtle differences from the real Merlin firmware.

 

[iTheMask]

The IPv6 addresses look fine to me. Maybe your ISP doesn’t like something about the WAN IPv6 address which is from a different prefix than the one delegated to the LAN. That’s normal that they are different, but they seem to treat it differently.

On the other hand, you seem to be running a Gnuton firmware and could have subtle differences from the real Merlin firmware.

But the IPv6 showing in the ppp0 interface seems to belong to the ISP Gateway, it's /128 which seems to be point-to-point? When I did the ping using the IPv6 assigned in the br0 it went through just fine.

As for the firmware, I'm not sure if it's considered Gnuton, but I always downloaded it from https://www.asuswrt-merlin.net/ which list my router model RT-AX58U in the page

 

[bennor]

AX58U V2 (AX3000)
Asuswrt Merlin Firmware: 3004.388.9_2

For clarity if you really have a RT-AX58U V2 then one would use the GNuton fork of the Asus Merlin firmware. The Asus-Merlin firmware does not support RT-AX58U V2. The RT-AX3000 V1 uses the same firmware as RT-AX58U.

 

[iTheMask]

For clarity if you really have a RT-AX58U V2 then one would use the GNuton fork of the Asus Merlin firmware. The Asus-Merlin firmware does not support RT-AX58U V2. The RT-AX3000 V1 uses the same firmware as RT-AX58U.

Based on the router sticker it's AX3000, I don't remember exactly why I recall it as V2 but definitely the board was renewed or something when I bought it. I've been using this with Asuswrt Merlin firmware for more than two years

 

[dave14305]

But the IPv6 showing in the ppp0 interface seems to belong to the ISP Gateway, it's /128 which seems to be point-to-point?

The ISP gateway is fe80::200:5eff:fe00:101 (the default route from the router advertisement). The /128 just means the router assigned a /128 from the prefix your ISP was advertising (separate from the DHCPv6 prefix delegated to the LAN). Admittedly I don’t know anything about how PPP might change the behavior, but I still think the ISP isn’t treating the WAN address the same as the LAN prefix.

 

[RMerlin]

I can ping from both my ppp IPv6 and from the br0 IPv6 delegated to me by the ISP through PD. Something seems wrong with your ISP then if routing fails with the PPP interface.