2

I have two ISPs for my home network. They are connected to two separate routers. If I run radvd and dhcpd on both routers at the same time, I get no IPv6 connectivity. My IPv6 connectivity only works if only one of the routers is running radvd and dhcpd. Why is that the case?

In contrast, for IPv4, I run dhcpd on both routers, and the other computers on the network opportunistically pick up IP and gateway settings base on which router responded first.

kasperd
  • 29,894
  • 16
  • 72
  • 122
Fufu Fang
  • 23
  • 1
  • 3

2 Answers2

2

IPv4

The reason IPv4 behaves the way you have observed is that it wasn't originally intended to support more than one IP address on an interface. Hence the DHCP client will just wait for the first DHCP server to send an offer, and the client will pretty much assume that's the only DHCP server.

IPv6

IPv6 however is intended to support many addresses on an interface, so the machine can accept router advertisements from multiple routers and assign multiple IP addresses to the interface.

However unless you start using fancy setups such as policy routing, you will have a routing table which only consider the destination address for routing decisions and will have just one default route pointing to the one of the two routers.

So you can expect packets to be routed to the same of the two routers regardless of which source address the client is using. The choice of source address will consider a number of factors including whether the source address will be one of those assigned to the interface which the packet will eventually be routed through. That however doesn't help here since the client will use the same interface to reach both routers.

Thus it's possible that the client machine ends up choosing a source IP address in the range assigned by one router but will send the packets to the other router. This would have worked if it wasn't for packet filters on the way. Even if you can somehow find a solution for those packet filters, it still isn't an ideal setup as you wouldn't really get a redundant setup when outgoing traffic goes through one router and incoming traffic goes through the other.

There isn't enough information in your question to say for certain that this is why it fails for you. However given the information you have provided it does sound like the most likely explanation.

Simple solution

On the short term the simplest solution I can suggest for how you get this setup to work and give you redundancy is to configure one of the routers as IPv4-only and the other as IPv6-only.

Clients which implement RFC 6555 will automatically fail over between IPv4 and IPv6, so with IPv4 and IPv6 going through different routers it would fail over between those two routers.

This will work for reaching services which are dual stack. You can achieve the same failover for IPv4-only services by using DNS64+NAT64. If your ISP doesn't provide NAT64 for you, you could configure NAT64 on the router you choose to use for IPv6 connectivity.

Long term solution

On a long term you presumably want redundancy even when accessing IPv6-only services. The best way to achieve that is if the client machine will automatically choose between the two routers. That means logic similar to RFC 6555 need to choose between two IPv6 connections.

I haven't seen software supporting that today. Some parts of it can be done with policy routing, but that means you need to override routing tables otherwise produced by auto configuration on each client machine. A simpler and slightly worse solution is to only configure the policy routing on the routers at the cost of having outgoing traffic often being sent from client to the wrong router and then taking an extra hop between the two routers.

But to get the full benefit you need software which does all of this:

  • When receiving router advertisements from two routers configure policy routing (or equivalent) in a way that consult the source IP address to decide which of the two routers to use as gateway for the default route.
  • When applications do DNS lookups send the request to two DNS recursors (one from each router advertisement) and ensure the source IP of each DNS request is from the same router advertisement as the destination IP.
  • When receiving a DNS response bind to the same local IP the response was sent to and attempt to connect to one of the addresses in the response.
  • Use RFC 6555 equivalent logic to choose between two connections opened with different source and destination IPv6 address pairs.
kasperd
  • 29,894
  • 16
  • 72
  • 122
  • Thanks, I think your explanation on why it failed on me is correct. The network interface did pick up 2 IP addresses, and the route table did have both gateway. I think the computer basically "got confused". I tried to set route priority in Radvd, sometimes it works, sometimes it doesn't. So I guess I will just have to use some other form of load balancing. – Fufu Fang Sep 19 '18 at 18:26
  • @FufuFang Even if both gateways are in the routing table it may only be using one of them because the routing table has no information to choose between them. Both would be matching on `::/0` aka `default` and match all packets not matched by any entry with a longer prefix. And that means the first `default` route will be used and no packet will reach the second `default` route. – kasperd Sep 19 '18 at 19:44
0

Not sure how endpoints do it when there are multiple ipv6 addrs/routes with same preference.

There's one solution in pfsense: https://docs.netgate.com/pfsense/en/latest/recipes/multiwan-ipv6.html

Basically, your endpoint is assigned a prefix you got delegated from your "primary" WAN, but the firewall may opt to NAT your IP to a prefix delegated from your "secondary" WAN

Phil
  • 1
  • Please include a general description of what you're linking to, if possible with the general technical idea. Links change or disappear and it would be best if your answer's quality wasn't affected. – Ginnungagap Feb 27 '22 at 09:07