Tunnelbroker OpenWRT-vel

Itt röviden leírom (magamnak is emlékeztetőül) a Hurricane Electric által ingyenesen igénybe vehető IPv6-in-IPv4 tunnel, közismert nevén Tunnelbroker konfigurálását OpenWRT-n. Abban az esetben jöhet jól, ha az internet szolgáltató csak IPv4-et biztosít.

OpenWRT 23.03.3

Kernel version: 5.10.161

A tunnelbroker oldalán (https://tunnelbroker.net/) regisztráljunk, és kérjünk /48 prefixet. A Google problémázott a /56 és /64 prefix-szel. Amire szükségünk van: felhasználónév <myusername>, jelszó <mypassword>, tunnel ID <mytunnelid>, IPv6 cím <2001:470:XXXX:YYYY::2/64> (ez lesz a helyi tunnel végpontunk), delegált IPv6 prefix <2001:470:ZZZZ::/48> (ezt kapják a LAN kliensek). A DNS szerverek tetszőlegesek, használhatjuk a HE DNS6 szervereit, vagy mást. Nálam helyi cache IPv4 és IPv6 DNS szerver van a 192.168.0.2 és fe80::CCCC:DDDD:EEEE:FFFF címen. A helyi gateway 192.168.0.1, ez az OpenWRT LAN IPv4 címe.

Telepítsük fel a következő csomagokat: 6in4, iptables-mod-ipopt, luci-proto-ipv6

Nálam így néz ki a /etc/config/network:

config interface 'loopback'
option device 'lo'
option proto 'static'
option ipaddr '127.0.0.1'
option netmask '255.0.0.0'

config globals 'globals'
option ula_prefix 'fd31:AAAA:BBBB::/48'

config device
option name 'br-lan'
option type 'bridge'
list ports 'lan1'
list ports 'lan2'
list ports 'lan3'
list ports 'lan4'

config interface 'lan'
option device 'br-lan'
option proto 'static'
option netmask '255.255.255.0'
option ip6assign '64'
option ip6hint '1'
list dns '192.168.0.2'
list dns 'fe80::CCCC:DDDD:EEEE:FFFF'
option macaddr 'aa:bb:cc:dd:ee:ff'
option ipaddr '192.168.0.1'
option igmp_snooping '1'

config interface 'wan'
option device 'wan'
option proto 'dhcp'
option peerdns '0'
list dns '208.67.222.222'
list dns '208.67.220.220'
option macaddr 'ab:bc:cd:de:ef:fa'
option delegate '0'
option broadcast '1'

config interface 'wan6'
option proto '6in4'
option peeraddr '216.66.87.14'
option ip6addr '2001:470:XXXX:YYYY::2/64'
option tunnelid '<mytunnelid>'
option username '<myusername>'
option force_link '1'
option defaultroute '0'
option mtu '1280'
option password '<mypassword>'
option peerdns '0'
list dns '2620:119:35::35'
list dns '2620:119:53::53'
list ip6prefix '2001:470:ZZZZ::/48'

config route6
option interface 'wan6'
option target '::/0'

A /etc/config/firewall

config defaults
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'REJECT'
option synflood_protect '1'
option drop_invalid '1'

config zone
option name 'lan'
list network 'lan'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'ACCEPT'

config zone
option name 'wan'
list network 'wan'
list network 'wan6'
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
option masq '1'
option mtu_fix '1'

config forwarding
option src 'lan'
option dest 'wan'

config rule
option name 'Allow-DHCP-Renew'
option src 'wan'
option proto 'udp'
option dest_port '68'
option target 'ACCEPT'
option family 'ipv4'

config rule
option name 'Allow-Ping'
option src 'wan'
option proto 'icmp'
option family 'ipv4'
option target 'ACCEPT'
list icmp_type 'echo-request'
option limit '10/second'

config rule
option name 'Allow-IGMP'
option src 'wan'
option proto 'igmp'
option family 'ipv4'
option target 'ACCEPT'

config rule
option name 'Allow-DHCPv6'
option src 'wan'
option proto 'udp'
option dest_port '546'
option family 'ipv6'
option target 'ACCEPT'

config rule
option name 'Allow-MLD'
option src 'wan'
option proto 'icmp'
option src_ip 'fe80::/10'
list icmp_type '130/0'
list icmp_type '131/0'
list icmp_type '132/0'
list icmp_type '143/0'
option family 'ipv6'
option target 'ACCEPT'

config rule
option name 'Allow-ICMPv6-Input'
option src 'wan'
option proto 'icmp'
option family 'ipv6'
option target 'ACCEPT'
list icmp_type 'bad-header'
list icmp_type 'destination-unreachable'
list icmp_type 'echo-reply'
list icmp_type 'echo-request'
list icmp_type 'neighbour-advertisement'
list icmp_type 'neighbour-solicitation'
list icmp_type 'packet-too-big'
list icmp_type 'router-advertisement'
list icmp_type 'router-solicitation'
list icmp_type 'time-exceeded'
list icmp_type 'unknown-header-type'
option limit '10/second'

config rule
option name 'Allow-ICMPv6-Forward'
option src 'wan'
option dest '*'
option proto 'icmp'
option family 'ipv6'
option target 'ACCEPT'
list icmp_type 'bad-header'
list icmp_type 'destination-unreachable'
list icmp_type 'echo-reply'
list icmp_type 'echo-request'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'unknown-header-type'
option limit '10/second'

config rule
option name 'Allow-IPSec-ESP'
option src 'wan'
option dest 'lan'
option proto 'esp'
option target 'ACCEPT'

config rule
option name 'Allow-ISAKMP'
option src 'wan'
option dest 'lan'
option dest_port '500'
option proto 'udp'
option target 'ACCEPT'

config rule
option name 'Allow-protocol-41'
option src 'wan'
option proto '41'
option target 'ACCEPT'

config rule
option name 'Multicast'
option src 'wan'
option dest 'lan'
option dest_ip '224.0.0.0/4'
option proto 'udp'
option family 'ipv4'
option target 'ACCEPT'

(Itt több IPv6 szempontból irreleváns rule is van).

/etc/resolv.conf

search lan
nameserver 127.0.0.1
nameserver ::1

Ha a szolgáltató nem ad fix IPv4 WAN címet, periodikusan bejelentkezünk a Tunnelbrokernél, ezzel a tunnel végponti IPv4 címe update-elődik:

/etc/crontabs/root

30 * * * * wget -q -O /dev/null https://<myusername>:<mypassword>@ipv4.tunnelbroker.net/nic/update?host…;