No IPv6 with Asus RT-N56U

Consider the following:

My ISP have native IPv6.
When I plug directly into ethernet port on my motherboard I have IPv6 connectivity, everything is configured automatically, and works fine.
But when I plug through my router I don't have IPv6.
And the most interesting part: I have network tool in my router, and it seems that router can communicate to the outside world, because I can do something like this:

traceroute to ipv6.google.com (2a00:1450:4010:c03::66), 30 hops max, 16 byte packets
1  2a00:f480:4:184::1 (2a00:f480:4:184::1)  1.046 ms  0.546 ms  0.488 ms
2  2a00:f480:0:3::4:ff (2a00:f480:0:3::4:ff)  0.698 ms  0.877 ms  5.531 ms
3  2a00:f480:0:1::28 (2a00:f480:0:1::28)  1.024 ms  0.686 ms  0.642 ms
4  2a00:f480:0:1::23 (2a00:f480:0:1::23)  0.742 ms  1.045 ms  0.747 ms
5  2a00:f480:0:1:: (2a00:f480:0:1::)  8.804 ms  1.353 ms  1.019 ms
6  msk-ix-gw1.google.com (2001:7f8:20:101::244:232)  1.158 ms  1.588 ms  1.272 ms
7  2001:4860::1:0:2aae (2001:4860::1:0:2aae)  44.500 ms  16.706 ms  16.433 ms
8  2001:4860::8:0:59da (2001:4860::8:0:59da)  16.010 ms  16.414 ms  16.102 ms
9  2001:4860::2:0:2ab0 (2001:4860::2:0:2ab0)  22.574 ms  22.072 ms  16.521 ms
10  *  *

The router is Asus RT-N56U (3.0.0.4.374_979 firmware [latest]) and it supports IPv6.

To be honest, I don't understand what's the problem - I have native IPv6, router supports IPv6, and it seems to establish correct network. However, nothing works.

When I am directly connected to the Internet, I have the following settings on my PC:

Ethernet adapter Ethernet:

Connection-specific DNS Suffix  . : msu
Description . . . . . . . . . . . : Realtek PCIe GBE Family Controller
Physical Address. . . . . . . . . : 74-D0-2B-96-15-D0
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
IPv6 Address. . . . . . . . . . . : 2a00:f480:4:184:69c9:4031:9c54:5cca(Preferred)
IPv6 Address. . . . . . . . . . . : fd5e:6dc5:33b8::7(Preferred)
Lease Obtained. . . . . . . . . . : Thursday, February 13, 2014 11:29:11 PM
Lease Expires . . . . . . . . . . : Monday, March 23, 2150 6:02:10 AM
Temporary IPv6 Address. . . . . . : 2a00:f480:4:184:4108:dbdc:98cf:e2b4(Preferred)
Link-local IPv6 Address . . . . . : fe80::69c9:4031:9c54:5cca%3(Preferred)
IPv4 Address. . . . . . . . . . . : 89.249.166.212(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.248.0
Lease Obtained. . . . . . . . . . : Thursday, February 13, 2014 11:29:09 PM
Lease Expires . . . . . . . . . . : Friday, February 14, 2014 1:29:09 AM
Default Gateway . . . . . . . . . : fe80::215:c7ff:fe47:ec00%3
                                   89.249.160.1
DHCP Server . . . . . . . . . . . : 89.249.160.1
DHCPv6 IAID . . . . . . . . . . . : 57987115
DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-19-A7-83-47-74-D0-2B-96-15-D0

DNS Servers . . . . . . . . . . . : 93.180.4.5
Primary WINS Server . . . . . . . : 93.180.4.5
NetBIOS over Tcpip. . . . . . . . : Enabled

When I am connected through router, router's settings are

       IPv6 Connection Type: Native with DHCP-PD
           WAN IPv6 Address: 2a00:f480:4:184:da50:e6ff:fe95:e730/64
           WAN IPv6 Gateway: fe80::215:c7ff:fe47:ec00
           LAN IPv6 Address: /64
LAN IPv6 Link-Local Address: fe80::da50:e6ff:fe95:e731/128
                    DHCP-PD: Enabled
            LAN IPv6 Prefix: /64
                DNS Address:

and the following settings on my PC:

Ethernet adapter Ethernet:

Connection-specific DNS Suffix  . :
Description . . . . . . . . . . . : Realtek PCIe GBE Family Controller
Physical Address. . . . . . . . . : 74-D0-2B-96-15-D0
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
IPv6 Address. . . . . . . . . . . : fd5e:6dc5:33b8::7(Preferred)
Lease Obtained. . . . . . . . . . : Thursday, February 13, 2014 11:29:11 PM
Lease Expires . . . . . . . . . . : Monday, March 23, 2150 6:28:23 AM
Link-local IPv6 Address . . . . . : fe80::69c9:4031:9c54:5cca%3(Preferred)
IPv4 Address. . . . . . . . . . . : 192.168.1.14(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Lease Obtained. . . . . . . . . . : Thursday, February 13, 2014 11:35:41 PM
Lease Expires . . . . . . . . . . : Friday, February 14, 2014 11:58:19 PM
Default Gateway . . . . . . . . . : fe80::da50:e6ff:fe95:e731%3
                                    192.168.1.1
DHCP Server . . . . . . . . . . . : 192.168.1.1
DHCPv6 IAID . . . . . . . . . . . : 57987115
DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-19-A7-83-47-74-D0-2B-96-15-D0

DNS Servers . . . . . . . . . . . : 192.168.1.1
NetBIOS over Tcpip. . . . . . . . : Enabled

All seems well. I can ping my router:

ping fe80::da50:e6ff:fe95:e731

Pinging fe80::da50:e6ff:fe95:e731 with 32 bytes of data:
Reply from fe80::da50:e6ff:fe95:e731: time<1ms
Reply from fe80::da50:e6ff:fe95:e731: time<1ms
Reply from fe80::da50:e6ff:fe95:e731: time<1ms
Reply from fe80::da50:e6ff:fe95:e731: time<1ms

but can't ping anything from the outside world (names, however, seems to be resolved):

ping ipv6.google.com

Pinging ipv6.l.google.com [2a00:1450:4010:c03::66] with 32 bytes of data:
Request timed out.
Request timed out.
Request timed out.
Request timed out.

Artem Pyanykh

Posted 2014-02-13T20:29:41.253

Reputation: 273

That's not the latest firmware, and it's known to have various IPv6 related bugs. Update to 3.0.0.4.374_2239.

– Michael Hampton – 2014-02-14T22:53:46.210

Answers

Your router appears to have successfully used IPv6 Router Discovery and Stateless Address Auto-Configuration (SLAAC) to get its own WAN IPv6 address. However, it appears that it was unsuccessful in using DHCP-PD, so it doesn't know what IPv6 prefix it should advertise to IPv6 clients on its "LAN" side. Without a separate IPv6 prefix for its LAN side, which the upstream network knows to route to its WAN interface, it can't act as a router between LAN and WAN.

The PD in DHCP-PD stands for "Prefix Delegation". It's a special use case of DHCP, where an IPv6 router can ask a DHCP server to delegate an IPv6 prefix for the router to use. An IPv6-capable ISP that uses DHCP-PD must make sure their DHCP server knows how to delegate prefixes to routers, and also knows how to notify the ISP's routing layer that a given prefix has been delegated to a given router, so that the ISP's route tables get updated and start forwarding traffic for that prefix to that router.

Your next steps would be to check with your ISP to see exactly what kind of native IPv6 service they provide. Are they really set up to do DHCP-PD? Or do they maybe expect you to manually request a prefix via their customer service website, and manually enter it into your router, rather than having it automatically delegated via DHCP-PD? Or maybe they don't support customers having their own IPv6 routers at all; maybe they just support individual IPv6 hosts, and not routers that route a whole prefix?

If they say DHCP-PD is supposed to work, you could set up a packet sniffer on the WAN side of your Asus router and capture its DHCP-PD attempts, and see if they're properly-formed, and if they get any responses from the ISP's DHCP servers, and if those responses are properly-formed.

Spiff

Posted 2014-02-13T20:29:41.253

Reputation: 84 656

Thanks for your reply! And I would be very grateful if you could provide some additional details. Could you tell how you notice that my router wasn't successful with DHCP-PD? And I will surely ask my ISP about DHCP-PD, but what if they support only individual IPv6 hosts? Is there anything I can do in that case? – Artem Pyanykh – 2014-02-13T21:09:53.793

Good answer! @Spiff: you should get the additional details from your ISP. For a router to be able to provide IPv6 to a LAN you need to get a prefix using DHCPv6-PD from the ISP or you have to manually configure the prefix. DHCPv6-PD is the normal way, and you should get something like a /48 or a /56 prefix delegated from them. – Sander Steffann – 2014-02-13T21:14:09.877

@ArtemPyanykh Your router output showed it was set for "Native with DHCP-PD", but it didn't have a LAN prefix. A LAN prefix is like roughly the first half of an IPv6 address, ending in ::, followed by a prefix length like /64. Your router only showed the /64, which is probably its default expected prefix length, but it didn't show the actual prefix, so it probably didn't know it, because DHCP-PD probably failed.

If your ISP only supports individual IPv6 hosts, then you need to find a way to make your Asus bridge IPv6 from WAN to LAN transparently instead of trying to be the IPv6 router. – Spiff – 2014-02-13T21:24:05.397

@SanderSteffann Although it's probably a best practice to delegate something as large as a /56 or /48, most home networks only need one or two /64's (main network and guest network), so everything else is overkill and just gets null-routed. I doubt most people could even put a /60 to good use. – Spiff – 2014-02-13T21:29:26.683

[you need to find a way to make your Asus bridge IPv6 from WAN to LAN transparently instead of trying to be the IPv6 router] @Spiff could you point to any materials on the subject? – Artem Pyanykh – 2014-02-13T21:49:46.977

@ArtemPyanykh I can't really help any further as I'm not familiar with that box's capabilities. If you have Linux root shell access to that box, you might be able to configure a software bridge device between interfaces, and put a firewall filter rule that only lets IPv6's EtherType get to the bridge. But how to set that up is beyond the scope of this Question. – Spiff – 2014-02-14T02:08:41.390

@Spiff, ok I got it. Thank you anyway, for now I have some understanding of what is going on. – Artem Pyanykh – 2014-02-14T08:24:03.100

1@Spiff: you would be surprised... Today it is already common for a home router to have 3 interfaces: LAN, WAN, Guest. And companies like NXP produce chips for lamps based on 6lowpan, which needs at least a separate subnet, and having separate subnets per room is not that weird. IPv6 needs to provide for future developments, and if ISPs start with limiting the number of subnets they provide there is a big risk of killing innovation. – Sander Steffann – 2014-02-14T18:59:23.173

@Spiff Best current practice seems to be to delegate /56 to residential end users, more or less, though that's not a hard number (RFC 6177). I for one would run out very quickly if I only had a /60, but I'm not most people... – Michael Hampton – 2014-02-15T19:42:45.043