Cfxtrjtrk

I'm setting up a new firewall/router on a Protectli appliance with 4 Gbit interfaces, running Ubuntu 18.04. Comcast (xfinity) is delegating /64 ipv6 to me, and setting up subnets on Linksys routers with ipv6 set to "pass-through" works great. So I know that ipv6 can be successfully routed from the xfinity box (or at least "passed through") to subnets.

My setup details:

On the Proctectli, I'm connecting enp1 as the WAN via hardwire directly to the xfinity modem with static IP of 10.0.0.20. The Xfinity LAN is 10.0.0.0/24, with the gateway being 10.0.0.1.

enp2 on the Protectli creates a LAN running isc-dhcp-server, with the static address of 192.168.19.1, and the gateway - enp1 at 10.0.0.20. (I am setting all this up through the GUI, NOT in /etc/network/interfaces.) /etc/dhcp/dhcpd.conf sets up the DHCP range on the LAN to be 192.168.19.100 - 192.168.19.120. And yes, I have set it to be the authoritative dhcp server.

In /etc/sysctl.conf I have enabled both ipv4 and ipv6 forwarding with:

net.ipv4.ip_forward=1

net.ipv6.conf.all.forwarding=1

iptables AND ip6tables rules are all using the default policy of ACCEPT, and the only rule I've added is this:

iptables -t nat -A POSTROUTING -o enp1 -j MASQUERADE

.... to allow forwarding from * to the WAN (enp1) for ipv4. Don't seem to need any FORWARD rules to get ipv4 working just fine everywhere.

With ipv6 set (again, using the GUI network manager) to "Automatic" or "Manual" (using static ipv6 addresses), ipv6 works great when working directly on the Protectli. I am able to ping6 ipv6.google.com, and ipv6 only websites work just fine. I can also ping6 the xfinity box's link-local gateway from the Protectli through enp1 (obviously).

Workstations connected to the LAN (enp2) set to DHCP for ipv4 are successfully served addresses, and ipv4 works great, so I know the firewall is doing the right thing for ipv4, at least. Static ipv4 addresses set up on workstations on the LAN outside of the 192.168.19.100 - 192.168.19.120 range also work fine.

The problem:

ipv6 on workstations connected to the Protectli LAN doesn't seem to work at all, using either Auto or static addressing. Workstations connected to the LAN with either static or Auto ipv6 addressing DO get /64 link-local AND global (both temp AND dynamic) addresses. I've configured /etc/radvd.conf like this:

interface enp2 {

        AdvSendAdvert on;

        MinRtrAdvInterval 3;

        MaxRtrAdvInterval 10;

        prefix 2601:xxxx:yyyy:zzzz::/64 {

                AdvOnLink on;

                AdvAutonomous on;

                AdvRouterAddr on;

         };



        RDNSS 2606:4700:4700::1111 2606:4700:4700::1001 {

        AdvRDNSSLifetime 10;

        };

};

I can ping6 the link-local LAN interface (enp2 at fe80::ea71:672a:4c0e:abe0) from connected workstations fine. But I cannot ping6 the WAN (enp1) link-local address, the xfinity link-local gateway (fe80::250:f1ff:fe80:0), or anything on the outside world. I am also NOT able to ping ANY global ipv6 addresses from any workstation on the LAN. ping6 successfully resolves ipv6.google.com to 2607:f8b0:400f:800::200e on LAN attached workstations, but the ping doesn't make it across to enp1 or out to the xfinity gateway.

So... clearly it seems that I either have a firewall (forwarding?) problem between LAN and WAN interfaces, or... a routing problem.

I am not a master of routing, by any means. With "Auto Routes" ON... the routing table on the Protectli device looks like this:

$  netstat -rnA inet6

Kernel IPv6 routing table

Destination                    Next Hop                   Flag Met Ref Use If

::1/128                        ::                         U    256 1     0 lo

2601:xxxx:yyyy:zzzz::/64       ::                         U    101 1     0 enp2

2601:xxxx:yyyy:zzzz::/64       ::                         U    102 1     0 enp1

fe80::/64                      ::                         U    101 2     3 enp2

fe80::/64                      ::                         U    102 2     5 enp1

fe80::/64                      ::                         U    256 1     0 enp2

fe80::/64                      ::                         U    256 1     0 enp1

::/0                           fe80::250:f1ff:fe80:0      UG   102 5     8 enp1

::1/128                        ::                         Un   0   6    25 lo

2601:xxxx:yyyy:zzzz:1ee8:9921:3378:3ceb/128 ::            Un   0   2     0 enp1

2601:xxxx:yyyy:zzzz:94ab:aa93:d2b5:2476/128 ::            Un   0   2     0 enp2

2601:xxxx:yyyy:zzzz:ecd0:c2f2:6cab:a803/128 ::            Un   0   2     0 enp2

2601:xxxx:yyyy:zzzz:edf6:56d5:38ca:47f7/128 ::            Un   0   3    18 enp1

fe80::39a3:6838:eda7:2fa0/128  ::                         Un   0   3    17 enp1

fe80::ea71:672a:4c0e:abe0/128  ::                         Un   0   5    12 enp2

ff00::/8                       ::                         U    256 5   615 enp2

ff00::/8                       ::                         U    256 5   612 enp1

::/0                           ::                         !n   -1  1     1 lo

$  

I have tried adding a global gw route for enp1 to the xfinity gateway, but that has no effect:

$   route -A inet6 add default gw 2601:xxxx:yyyy:zzzz:250:f1ff:fe80:0 enp1

... I have also tried adding a link-local gw to enp1, with no effect:

$  sudo ip -6 route add 2601:xxxx:yyyy:zzzz::/64 via fe80::39a3:6838:eda7:2fa0 dev enp2

... or from ANY /64, with no effect:

$  sudo ip -6 route add ::/64 via fe80::39a3:6838:eda7:2fa0 dev enp2

So.... sorry for the long post. If anyone has any hints for me on something I'm missing with a firewall rule, or better routing strategy, I would very much appreciate that!

20190125 edit - @ Michael Hampton - xfinity modem is a Cisco DPC3941T.