EdgeRouter: IPv4 over IPv6 (DS-Lite)とIPoE

(このページは工事中です)

このページは

私の覚え書きです。

参照ページ

条件

Asahi-Net

Ubiquiti EdgeRouter ER-X

IPv6アドレス割り当てとIPv4 over IPv6トンネル(DS-Lite)の設定

以降の設定をするにはファームウェアのアップグレードが必要だった。

$ set interfaces ipv6-tunnel v6tun0 encapsulation ipip6

$ set interfaces ipv6-tunnel v6tun0 local-ip eth0のIPv6アドレス

$ set interfaces ipv6-tunnel v6tun0 remote-ip 2001:c28:5:301::11 # 調べたAFTRアドレス

$ set interfaces ipv6-tunnel v6tun0 mtu 1500

$ set interfaces ipv6-tunnel v6tun0 multicast disable

$ set protocols static interface-route 0.0.0.0/0 next-hop-interface v6tun0

$ commit

$ save

PPPoEの設定を削除

$ delete interfaces ethernet eth0 pppoe

通信できてる。

DSLite用のファイアウォール設定:

set firewall name DSLite_IN default-action drop # DSLite_INチェインのデフォルトはパケットの破棄。

set firewall name DSLite_IN description 'IPv4 DSLite to LAN' # GUIに表示されるチェインの説明。

set firewall name DSLite_IN enable-default-log # デフォルトアクションのログをとる。

set firewall name DSLite_IN rule 10 action accept

set firewall name DSLite_IN rule 10 description 'Allow established/related sessions'

set firewall name DSLite_IN rule 10 state established enable

set firewall name DSLite_IN rule 10 state related enable

# 状態がestblished又はrelatedなパケットは通す。

set firewall name DSLite_IN rule 20 action accept

set firewall name DSLite_IN rule 20 description 'Allow IPv4 ICMP'

set firewall name DSLite_IN rule 20 protocol icmp

# ICMPパケットは通す。

set firewall name DSLite_IN rule 30 action drop

set firewall name DSLite_IN rule 30 description 'Drop invalid state'

set firewall name DSLite_IN rule 30 state invalid enable

# 状態がinvalidなパケットは破棄する。

set firewall name DSLite_LOCAL default-action drop # DSLite_LOCALチェインのデフォルトはパケットの破棄。

set firewall name DSLite_LOCAL description 'IPv4 DSLite to router' # GUIに表示されるチェインの説明。

set firewall name DSLite_LOCAL enable-default-log # デフォルトアクションのログをとる。

set firewall name DSLite_LOCAL rule 10 action accept

set firewall name DSLite_LOCAL rule 10 description 'Allow established/related sessions'

set firewall name DSLite_LOCAL rule 10 state established enable

set firewall name DSLite_LOCAL rule 10 state related enable

# 状態がestblished又はrelatedなパケットは通す。

set firewall name DSLite_LOCAL rule 20 action accept

set firewall name DSLite_LOCAL rule 20 description 'Allow IPv4 icmp'

set firewall name DSLite_LOCAL rule 20 protocol icmp

# ICMPパケットは通す。

set firewall name DSLite_LOCAL rule 50 action drop

set firewall name DSLite_LOCAL rule 50 description 'Drop invalid state'

set firewall name DSLite_LOCAL rule 50 state invalid enable

# 状態がinvalidなパケットは破棄する。

set interfaces ipv6-tunnel v6tun0 firewall in name DSLite_IN

# DSLite_INチェインをv6tun0ポートのインバウンドパケットに適用する。

set interfaces ipv6-tunnel v6tun0 firewall local name DSLite_LOCAL

# DSLite_LOCALチェインをv6tun0ポートからルータ宛のパケットに適用する。

静的アドレスの設定(ルータ再起動後すぐに使えるように)

$ show interfaces ethernet eth0

eth0に割り当てられているアドレス

2405:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx/64

$ show ipv6 neighbors

対向リンクローカルアドレス

fe80:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx

IPv6アドレスの自動割り当てを解除:

$ configure

$ delete interfaces ethernet eth0 ipv6

$ commit

$ exit

いま割り当てられているIPv6アドレスの消去:

$ sudo ip addr flush dev eth0

$ show interfaces ethernet eth0

で確認。

静的割り当て:

$ configure

$ set interfaces ethernet eth0 address '2405:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx/64'

$ set protocols static route6 ::/0 next-hop 'fe80::xxxx:xxxx:xxxx' interface eth0

$ commit

$ save

$ exit

$ show interfaces ethernet eth0

で確認。

ひかり電話なし(/64)でもNDプロクシでIPv6通信

EdgeRouter用にndppdのビルド: 参照ページ4で@sho7650さんが全部用意してくださっているのでそのままやってみる。

Windows(Cygwin)上でやるのでDocker Desktopを起動しておく。

$ docker run -v d:/home/work/ndppd-mipsel:/ndppd -it --rm sho7650/mipsel

code: コメンタリー

# -v d:/home/work/ndppd:/ndppd: ホストのd:/home/work/ndppdディレクトリをコンテナの/ndppdにマウント。

# -i -t: インタラクティブなプロセスにttyを割り当てる。

# --rm: コンテナの終了時に、自動的にコンテナをクリーンアップし、ファイルシステムを削除する。

# sho7650/mipsel: 起動するコンテナの元になるDockerイメージ(Docker Hub上にある)。

コンテナ上のシェルプロンプトが出るので

$ cd /ndppd

$ make

Warningがいくつか出るが気にしない。

$ exit

EdgeRouterへインストール:

$ cd ndppd

$ ssh admin@<EdgeRouter> sudo mkdir -p /ndppd/local/sbin

$ ssh admin@<EdgeRouter> sudo mkdir -p /ndppd/etc

$ ssh admin@<EdgeRouter> sudo chgrp -R vyattacfg /ndppd

$ ssh admin@<EdgeRouter> sudo chmod -R g+ws /ndppd

$ scp -p ndppd admin@<EdgeRouter>:/ndppd/local/sbin

$ scp -p scripts/ndppd admin@<EdgeRouter>:/config/scripts/post-config.d

$ scp -p scripts/ndppd.initscript admin@<EdgeRouter>:/ndppd/local/sbin

$ ssh admin@<EdgeRouter> sudo chown -R root /ndppd

$ ssh admin@<EdgeRouter> sudo chown root /config/scripts/post-config.d/ndppd

code:/etc/ndppd.conf

proxy eth0 {

router no

timeout 500

autowire yes

keepalive yes

retries 3

ttl 30000

rule ::/0 {

iface switch0

}

}

proxy switch0 {

router yes

timeout 500

autowire yes

keepalive yes

retries 3

ttl 30000

rule ::/0 {

auto

}

}

$ scp -p ndppd.conf admin@<EdgeRouter>:/ndppd/etc

$ ssh admin@<EdgeRouter> sudo ln -sf /ndppd/etc/ndppd.conf /etc

LAN内へRouter Advertismentメッセージを流す設定: admin@EdgeRouterで行う。

$ configure

$ set interfaces switch switch0 ipv6 address eui64 '2409:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx/64'

$ set interfaces switch switch0 ipv6 dup-addr-detect-transmits 1

$ set interfaces switch switch0 ipv6 router-advert cur-hop-limit 64

$ set interfaces switch switch0 ipv6 router-advert link-mtu 1500

$ set interfaces switch switch0 ipv6 router-advert managed-flag false

$ set interfaces switch switch0 ipv6 router-advert max-interval 600

$ set interfaces switch switch0 ipv6 router-advert other-config-flag true

$ set interfaces switch switch0 ipv6 router-advert prefix '::/64' autonomous-flag true

$ set interfaces switch switch0 ipv6 router-advert prefix '::/64' on-link-flag true

$ set interfaces switch switch0 ipv6 router-advert prefix '::/64' valid-lifetime 2592000

$ set interfaces switch switch0 ipv6 router-advert reachable-time 0

$ set interfaces switch switch0 ipv6 router-advert retrans-timer 0

$ set interfaces switch switch0 ipv6 router-advert send-advert true

$ commit

$ save

$ exit

ndppdの起動:

$ sudo /config/scripts/post-config.d/ndppd

IPv6のファイアウォール設定:

$ configure

$ set firewall all-ping enable

$ set firewall broadcast-ping disable

$ set firewall ipv6-name WANv6_IN default-action drop

$ set firewall ipv6-name WANv6_IN description 'IPv6 WAN to LAN'

$ set firewall ipv6-name WANv6_IN enable-default-log

$ set firewall ipv6-name WANv6_IN rule 10 action accept

$ set firewall ipv6-name WANv6_IN rule 10 description 'Allow established/related sessions'

$ set firewall ipv6-name WANv6_IN rule 10 state established enable

$ set firewall ipv6-name WANv6_IN rule 10 state related enable

$ set firewall ipv6-name WANv6_IN rule 20 action accept

$ set firewall ipv6-name WANv6_IN rule 20 description 'Allow IPv6 ICMP'

$ set firewall ipv6-name WANv6_IN rule 20 protocol ipv6-icmp

$ set firewall ipv6-name WANv6_IN rule 30 action drop

$ set firewall ipv6-name WANv6_IN rule 30 description 'Drop invalid state'

$ set firewall ipv6-name WANv6_IN rule 30 state invalid enable

$ set firewall ipv6-name WANv6_LOCAL default-action drop

$ set firewall ipv6-name WANv6_LOCAL description 'IPv6 WAN to router'

$ set firewall ipv6-name WANv6_LOCAL enable-default-log

$ set firewall ipv6-name WANv6_LOCAL rule 10 action accept

$ set firewall ipv6-name WANv6_LOCAL rule 10 description 'Allow established/related sessions'

$ set firewall ipv6-name WANv6_LOCAL rule 10 state established enable

$ set firewall ipv6-name WANv6_LOCAL rule 10 state related enable

$ set firewall ipv6-name WANv6_LOCAL rule 20 action accept

$ set firewall ipv6-name WANv6_LOCAL rule 20 description 'Allow IPv6 icmp'

$ set firewall ipv6-name WANv6_LOCAL rule 20 protocol ipv6-icmp

$ set firewall ipv6-name WANv6_LOCAL rule 30 action accept

$ set firewall ipv6-name WANv6_LOCAL rule 30 description 'Allow DS-Lite'

$ set firewall ipv6-name WANv6_LOCAL rule 30 protocol ipip

$ set firewall ipv6-name WANv6_LOCAL rule 40 action accept

$ set firewall ipv6-name WANv6_LOCAL rule 40 description 'allow dhcpv6'

$ set firewall ipv6-name WANv6_LOCAL rule 40 destination port 546

$ set firewall ipv6-name WANv6_LOCAL rule 40 protocol udp

$ set firewall ipv6-name WANv6_LOCAL rule 50 action drop

$ set firewall ipv6-name WANv6_LOCAL rule 50 description 'Drop invalid state'

$ set firewall ipv6-name WANv6_LOCAL rule 50 state invalid enable

$ set firewall ipv6-receive-redirects disable

$ set firewall ipv6-src-route disable

$ set firewall ip-src-route disable

$ set firewall log-martians enable

$ set interfaces ethernet eth0 firewall in ipv6-name WANv6_IN

$ set interfaces ethernet eth0 firewall local ipv6-name WANv6_LOCAL

$ commit

$ save

$ exit

続き

(2022-02-05)