Difference between revisions of "TN3"

From Paddon.org
Jump to navigation Jump to search
Line 27: Line 27:
 
#. Select a random [https://tools.ietf.org/html/rfc4193 RFC 4193] IPv6 prefix of the form fdxx:xxxx:xxxx:/48. There are online tools to make this easy.
 
#. Select a random [https://tools.ietf.org/html/rfc4193 RFC 4193] IPv6 prefix of the form fdxx:xxxx:xxxx:/48. There are online tools to make this easy.
 
#. Use the configuration GUI to assign addresses and subnets to each internal interface. For example, fdxx:xxxx:xxxx:1::1/64
 
#. Use the configuration GUI to assign addresses and subnets to each internal interface. For example, fdxx:xxxx:xxxx:1::1/64
  +
  +
== Configure NATv6 ==
  +
  +
Create the file
  +
/config/scripts/post-config.d/nat6.sh
  +
on the USG, containing
  +
#!/bin/bash
  +
# enable ipv6 NAT
  +
/sbin/ip6tables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
  +
  +
Make sure it is executable:
  +
chmod 755 /config/scripts/post-config.d/nat6.sh

Revision as of 06:57, 2 May 2020

IPv6 stateless address autoconfiguration of the WAN interface on a Unifi Security Gateway

The WAN interface on a Unifi Security Gateway (USG) supports static IPv6 address configuration and IPv6 prefix delegation. However it does not officially support the scenario of IPv6 stateless address autoconfiguration. This mode is deployed by some ISPs, notably NTT in Japan.

This note describes the configuration of a USG to operate in this environment.

Configure IPv6 stateless address autoconfiguration on eth0

This requires the creation or modification of a config.gateway.json file on the Unifi controller. On a Unifi Cloud Key controller, this file is located at:

/srv/unifi/data/sites/default/config.gateway.json

The config.gateway.json should include the following nodes:

{
    "interfaces": {
        "ethernet": {
            "eth0": {
                "ipv6": {
                    "address": "autoconf"
                }
            }
        }
    }
}

Configure private local IPv6 addresses for internal use

  1. . Select a random RFC 4193 IPv6 prefix of the form fdxx:xxxx:xxxx:/48. There are online tools to make this easy.
  2. . Use the configuration GUI to assign addresses and subnets to each internal interface. For example, fdxx:xxxx:xxxx:1::1/64

Configure NATv6

Create the file

/config/scripts/post-config.d/nat6.sh

on the USG, containing

#!/bin/bash
# enable ipv6 NAT
/sbin/ip6tables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

Make sure it is executable:

chmod 755 /config/scripts/post-config.d/nat6.sh