I have an RB960PGS (hEX PoE) with 7.23.1 on a DS-Lite connection.
A DS-Lite connection consists of a PPPoE connection for IPv6 and an IPIPv6 tunnel for IPv4. For the tunnel to reach the AFTR (NAT server) it is required that the PPPoE interface gets a SLAAC address.
What I’m observing is that after the PPPoE link comes up, an RS is sent and an RA is received (verified in Wireshark) but the RA does not create a SLAAC address under IPv6>Addresses. And more importantly, no SLAAC address is used as the local tunnel endpoint for the IPIPv6 tunnel and so IPv4 traffic doesn’t work at first.
About 10 minutes later when the ISP sends another unsolicited RA, the SLAAC address is added, the tunnel takes it as local endpoint address and the tunnel starts working.
As a workaround, I added a rule to drop RAs right after establishing the PPPoE connection:
/ipv6 firewall filter add action=drop chain=input comment=delay-ra disabled=yes icmp-options=134:0-255 in-interface=dsl protocol=icmpv6
Interestingly, even though the first RA does not create a working SLAAC address, it does prevent the router from sending further solicitations.
If I suppress the RAs with the rule above, then more solicitations are sent and more RAs are received, which are then correctly applied in the form of a SLAAC address.
I don’t know for how long exactly after PPPoE up the router is “blind” to RAs, it's only a few seconds.
After these few seconds have elapsed, of course this rule needs to be disable to let the RA through.
I tried using PPP profile on-up/on-down scripts, but it seems those are never executed?
So for now I’m “abusing” the DHCPv6 script for the workaround:
:if ($"pd-valid" = 1) do={
:log info "Now accepting RAs";
/ipv6 firewall filter disable [find comment="delay-ra"];
} else={
:log info "Enabling rule to suppress RAs on next connect";
/ipv6 firewall filter enable [find comment="delay-ra"];
}
My intentions with this post are:
- to let others in the same situation know about the issue and the workaround,
- possibly find a better solution than the hacky workaround and
- maybe find out why my PPP profile on-up/on-down scripts are not executed.