查看“︁Photoincat 2 IPv6 PPPoE”︁的源代码

{| class="wikitable"
|-
! 适用版本 / Applies to
| photonicatWrt '''26.04.1''' (r7720, OpenWrt 24+ base, fw4/nftables, odhcpd) — 更新于 2026-07 / Updated 2026-07
|-
! 旧版指南 / Older firmware
| 2023–2024 固件请参考本页面历史版本 / For 2023–2024 firmware see the page history
|}

* 本文说明如何在 photonicat (photonicatWrt 26.04.x) 上配置基于 '''PPPoE 的原生 IPv6'''，让内网设备通过 '''SLAAC / DHCPv6''' 获得公网 (GUA) 地址，全球直连、无需 NAT6。
* This document explains how to configure '''native IPv6 over PPPoE''' on photonicat (photonicatWrt 26.04.x), so LAN clients get global (GUA) addresses via '''SLAAC / DHCPv6''' — direct global connectivity, no NAT6 required.

== 中文指南 ==

=== 1. WAN 接口（PPPoE） ===
新版固件下 '''不需要手动创建绑定 eth0 的 WAN6 接口'''。只要 WAN 口开启 IPv6 协商，netifd 会自动在 PPPoE 逻辑口上创建动态别名接口 <code>wan_6</code>（注意是下划线），负责 DHCPv6 / 前缀委托。

LuCI: '''网络 → 接口 → WAN → 高级设置'''
* 获取 IPv6 地址 → '''自动'''
* 委托 IPv6 前缀 → '''启用'''

或使用 UCI：
<pre>
uci set network.wan.ipv6='auto'
uci commit network
ifup wan
</pre>

; 注意 如果系统里遗留了一个绑定 <code>eth0</code> 的 WAN6 接口（老指南的做法），它在 PPPoE 线路上会一直处于 pending 状态。建议直接禁用：
<pre>
uci set network.wan6.auto='0'
uci commit network
</pre>

=== 2. LAN 接口 ===
LuCI: '''网络 → 接口 → LAN'''
* IPv6 分配长度 (ip6assign) → '''60'''（运营商一般下发 /56 或 /60）
* '''IPv6 前缀过滤器 (ip6class) → 必须留空！'''

<pre>
uci set network.lan.ip6assign='60'
uci -q delete network.lan.ip6class
uci commit network
ifup lan
</pre>

; ⚠ 最常见故障 如果 <code>ip6class</code> 被设为 <code>local</code>，LAN 只会分配 ULA（fd00::/8 私有前缀），运营商委托的公网前缀'''永远不会'''下发到 br-lan，内网设备就只有 fdxx 地址、无法访问 IPv6 互联网。删除该选项即可恢复。

=== 3. RA / DHCPv6（SLAAC） ===
LuCI: '''网络 → 接口 → LAN → DHCP 服务器 → IPv6 设置'''
* RA 服务：'''混合模式''' （SLAAC 默认开启，即 RA 前缀带 A 标志）
* DHCPv6 服务：'''混合模式'''
* NDP 代理：'''混合模式'''（旁路由/中继场景才需要）

<pre>
uci set dhcp.lan.ra='hybrid'
uci set dhcp.lan.dhcpv6='hybrid'
uci commit dhcp
/etc/init.d/odhcpd reload
</pre>

; 提示 若局域网内还有其它设备也在发 RA（多路由/多线路环境），把 photonicat 的路由优先级调高，客户端会优先选它作为默认网关：
<pre>
uci set dhcp.lan.ra_preference='high'
uci commit dhcp && /etc/init.d/odhcpd reload
</pre>

=== 4. Docker 与 IPv6 转发（26.04 版重要坑） ===
photonicatWrt 自带 Docker（27.x）。Docker 27+ 默认启用 ip6tables，会创建 <code>ip6 filter FORWARD</code> 链且'''策略为 drop''' —— 它会丢弃'''所有'''转发的 IPv6 流量，即使 fw4 防火墙已放行 lan→wan。症状：路由器本机 <code>ping6</code> 正常，内网设备拿到了公网 IPv6 却 ping 不通外网。

检查：
<pre>
nft list chain ip6 filter FORWARD
# 如果看到 policy drop 且计数一直增长，即中招
</pre>

永久修复（禁用 Docker 的 ip6tables 管理，不影响 IPv4 容器网络）：
<pre>
cat > /etc/docker/daemon.json <<'EOF'
{ "data-root": "/opt/docker/", "log-level": "warn", "iptables": true, "ip6tables": false }
EOF
uci set dockerd.globals.alt_config_file='/etc/docker/daemon.json'
uci commit dockerd
/etc/init.d/dockerd restart
</pre>

=== 5. 防火墙 ===
fw4 默认已放行 lan→wan 的 IPv6 转发和必要的 ICMPv6，'''出站上网无需额外规则'''。只有当你需要'''从公网主动访问内网设备'''（自建服务器/NAS）时才添加入站规则，且建议按端口精确放行，不要整段 ACCEPT 全部入站 IPv6。

=== 6. 验证 ===
路由器上：
<pre>
ifstatus wan_6 | grep -A6 ipv6-prefix     # 应看到运营商委托的 /56 或 /60
ifstatus lan | grep -A8 ipv6-prefix-assignment   # 应看到公网前缀已分配给 br-lan
ping -6 -c3 photonicat.com
</pre>
内网设备上：
<pre>
ip -6 addr show   # 应有公网 (如 240e:/2408:/2409: 等) SLAAC 地址
ping -6 -c3 photonicat.com
</pre>

=== 7. 多出口/多 RA 环境排障 ===
如果局域网里有多台设备宣告 RA（例如另一台 5G 网关、Proxmox 虚拟机等），Linux 客户端会把多个默认网关做 ECMP 负载均衡，流量可能被分到没有 IPv6 上行的网关而'''间歇性丢包'''；或者源地址选择与网关不匹配（photonicat 的默认路由是按源前缀限定的 <code>from 240e:xxxx::/56</code>），返回 "Destination unreachable: No route"。

* 首选：让没有上行的设备停止宣告默认路由（router lifetime 设为 0）。
* 客户端（systemd-networkd）也可固定网关并用地址标签固定源地址选择：
<pre>
# /etc/systemd/network/eth0.network.d/50-ipv6-gateway.conf
[IPv6AcceptRA]
UseGateway=false

[Route]
Gateway=fe80::xxxx:xxxx:xxxx:xxxx   # photonicat br-lan 的链路本地地址

[IPv6AddressLabel]
Label=99
Prefix=2409::/16    # 不希望选为源地址的运营商前缀
</pre>

== English Guide ==

=== 1. WAN interface (PPPoE) ===
On current firmware you '''no longer need a manual WAN6 interface bound to eth0'''. With IPv6 negotiation enabled on WAN, netifd automatically spawns a dynamic alias interface <code>wan_6</code> (with an underscore) on the PPPoE logical interface, which handles DHCPv6 and prefix delegation.

LuCI: '''Network → Interfaces → WAN → Advanced'''
* Obtain IPv6 address → '''Automatic'''
* Delegate IPv6 prefix → '''Enabled'''

Or via UCI:
<pre>
uci set network.wan.ipv6='auto'
uci commit network
ifup wan
</pre>

; Note If a legacy WAN6 interface bound to <code>eth0</code> exists (as older guides suggested), it will sit in "pending" forever on a PPPoE line. Disable it:
<pre>
uci set network.wan6.auto='0'
uci commit network
</pre>

=== 2. LAN interface ===
* IPv6 assignment length (ip6assign) → '''60''' (ISPs typically delegate a /56 or /60)
* '''IPv6 prefix filter (ip6class) → must be left EMPTY!'''

<pre>
uci set network.lan.ip6assign='60'
uci -q delete network.lan.ip6class
uci commit network
ifup lan
</pre>

; ⚠ Most common failure If <code>ip6class</code> is set to <code>local</code>, the LAN only gets ULA (fd00::/8) prefixes — the ISP-delegated global prefix is '''never''' assigned to br-lan, so clients only get fdxx addresses and cannot reach the IPv6 internet. Deleting this option fixes it.

=== 3. RA / DHCPv6 (SLAAC) ===
* RA-Service: '''hybrid''' (SLAAC is on by default — RA prefixes carry the A flag)
* DHCPv6-Service: '''hybrid'''
* NDP-Proxy: '''hybrid''' (only needed for relay/bridge setups)

<pre>
uci set dhcp.lan.ra='hybrid'
uci set dhcp.lan.dhcpv6='hybrid'
uci commit dhcp
/etc/init.d/odhcpd reload
</pre>

; Tip If other devices on the LAN also send RAs (multi-router / multi-uplink environments), raise the photonicat's router preference so clients prefer it as default gateway:
<pre>
uci set dhcp.lan.ra_preference='high'
uci commit dhcp && /etc/init.d/odhcpd reload
</pre>

=== 4. Docker vs IPv6 forwarding (important 26.04 pitfall) ===
photonicatWrt ships Docker (27.x). Docker 27+ enables ip6tables by default and creates an <code>ip6 filter FORWARD</code> chain with '''policy drop''' — it silently drops '''all''' forwarded IPv6, even though fw4 correctly allows lan→wan. Symptom: <code>ping6</code> works from the router itself, LAN clients get global IPv6 addresses but cannot reach the internet.

Check:
<pre>
nft list chain ip6 filter FORWARD
# if you see "policy drop" and a growing counter, this is your problem
</pre>

Permanent fix (disable Docker's ip6tables management; IPv4 container networking is unaffected):
<pre>
cat > /etc/docker/daemon.json <<'EOF'
{ "data-root": "/opt/docker/", "log-level": "warn", "iptables": true, "ip6tables": false }
EOF
uci set dockerd.globals.alt_config_file='/etc/docker/daemon.json'
uci commit dockerd
/etc/init.d/dockerd restart
</pre>

=== 5. Firewall ===
fw4 already allows IPv6 lan→wan forwarding and the required ICMPv6 by default — '''no extra rules are needed for outbound connectivity'''. Only add inbound rules when you need to reach LAN devices from the internet (self-hosted servers/NAS), and prefer precise per-port rules over a blanket ACCEPT of all inbound IPv6.

=== 6. Verification ===
On the router:
<pre>
ifstatus wan_6 | grep -A6 ipv6-prefix     # ISP-delegated /56 or /60 should appear
ifstatus lan | grep -A8 ipv6-prefix-assignment   # the global prefix should be assigned to br-lan
ping -6 -c3 photonicat.com
</pre>
On a LAN client:
<pre>
ip -6 addr show   # expect a global (e.g. 240e:/2408:/2409:) SLAAC address
ping -6 -c3 photonicat.com
</pre>

=== 7. Troubleshooting multi-uplink / multi-RA LANs ===
If several devices advertise RAs on the LAN (another 5G gateway, Proxmox VMs, …), Linux clients install an ECMP default route across all of them; flows hashed to a gateway without IPv6 upstream '''blackhole intermittently'''. Source-address selection can also mismatch the gateway (the photonicat's upstream default route is source-restricted, e.g. <code>from 240e:xxxx::/56</code>), yielding "Destination unreachable: No route".

* Preferred fix: make routers without upstream stop advertising a default route (router lifetime 0).
* On a systemd-networkd client you can pin the gateway and steer source selection:
<pre>
# /etc/systemd/network/eth0.network.d/50-ipv6-gateway.conf
[IPv6AcceptRA]
UseGateway=false

[Route]
Gateway=fe80::xxxx:xxxx:xxxx:xxxx   # photonicat br-lan link-local address

[IPv6AddressLabel]
Label=99
Prefix=2409::/16    # ISP prefix you do NOT want chosen as source
</pre>

== IPv6 地址说明 / Understanding the addresses ==
一个接口同时拥有多个 IPv6 地址是正常现象 / Multiple IPv6 addresses on one interface is normal:
* <code>240e:xxxx:xxxx:xx00:xxxx:xxff:fexx:xxxx/64</code> → 公网地址，SLAAC 由 RA 前缀+接口标识自动生成 / global address, auto-generated via SLAAC
* <code>240e:xxxx:xxxx:xx00::2e9/128</code> → DHCPv6 下发的公网地址 / global address assigned by stateful DHCPv6
* <code>fdxx:....../64</code> → ULA 私有地址，仅内网使用，不上公网 / ULA private address, LAN-only
* <code>fe80::/64</code> → 链路本地地址，用于邻居发现/网关 / link-local, used for NDP and as gateway
只有 global (GUA) 地址可用于公网通信；“全球直连”意味着设备在公网可见，请合理配置防火墙。 / Only GUA addresses reach the internet; being globally reachable means you should keep the firewall sensible.