https://github.com/vi/ipv6proxy
IPv6 router advertisment and neighbour discovery proxy for simple bridge-like extensions of /64 networks.
https://github.com/vi/ipv6proxy
Last synced: about 1 year ago
JSON representation
IPv6 router advertisment and neighbour discovery proxy for simple bridge-like extensions of /64 networks.
- Host: GitHub
- URL: https://github.com/vi/ipv6proxy
- Owner: vi
- License: mit
- Created: 2014-06-28T03:44:44.000Z (about 12 years ago)
- Default Branch: master
- Last Pushed: 2022-08-03T20:46:02.000Z (almost 4 years ago)
- Last Synced: 2025-04-15T14:13:43.762Z (about 1 year ago)
- Language: C
- Homepage:
- Size: 36.1 KB
- Stars: 4
- Watchers: 4
- Forks: 2
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
- License: LICENSE
Awesome Lists containing this project
README
ipv6proxy - IPv6 network NDP proxy router; `/64` network extender
Rationale
---
Imagine you have `/64` IPv6 network based on auto-configuration.
You can extend it using switches and bridges, but putting a router that splits `/64` further, interfering with address auto-configuration.
But making a bridge can be disrupting. Also bridging Wi-Fi in Linux can be problematic.
This program sets up a tricky router mode, like a "bridgeless bridge", proxying NDP and other ICMPv6 things and ensuring only one source MAC address is in use.
Usage
---
Imagine you have working `eth0` with auto-configured IPv6. You want to extend it to `wlan0`.
IPV6PROXY_DEBUG=ism ./ipv6proxy eth0 wlan0
This command with start ipv6proxy in default mode (it will set up `forwarding` and `accept_ra` values if necessary).
Upon terminationg ipv6proxy tries to revert everything back.
IPV6PROXY_DEBUG is only for making it to print more messages.
What the program does
---
It listens for ICMPv6 on all specified interfaces and each ICMPv6 packet it does see to all other interfaces, changing source and destination MAC addresses as necessary.
Additionally, special `/128` routes get added as necessary.
Non-ICMPv6 traffic gets forwarded by Linux as usual.
Supposing you have already working auto-configured setup at `eth0` and one remote node waiting to be configured at `wlan0`, ipv6proxy should print something like this, if started by command line above:
```
+ echo 2 > /proc/sys/net/ipv6/conf/eth0/accept_ra
(Force eth0 to stay auto-configured even though becoming a router)
+ echo 1 > /proc/sys/net/ipv6/conf/eth0/forwarding
(Turn on forwarding)
+ ip link set eth0 allmulticast on
(Turn on allmulticast mode)
+ echo 1 > /proc/sys/net/ipv6/conf/wlan0/forwarding
+ ip link set wlan0 allmulticast on
(if accept_ra is 0, it is not changed by ipv6proxy)
FE8000000000000000C50AFFFEC19433:02C50AC19433 -> FF020000000000000000000000000001:333300000001 eth0(RouAdv)
Adding entry: FE8000000000000000C50AFFFEC19433 at eth0 mac 02C50AC19433
(ipv6proxy saw a router advertisment on eth0 and forwarded it to wlan0)
( ,from the appropriate MAC address instead of 02C50AC19433)
00000000000000000000000000000000:FEC9D280DFA5 -> FF0200000000000000000001FF80DFA5:3333FF80DFA5 wlan0(NeigSol)
Adding entry: 00000000000000000000000000000000 at wlan0 mac FEC9D280DFA5
(the node at wlan0 is booting up IPv6, checking for address duplicates)
FE8000000000000000C50AFFFEC19433:02C50AC19433 -> FF0200000000000000000001FF80DFA5:3333FF80DFA5 eth0(NeigSol)
FE8000000000000000C50AFFFEC19433:02C50AC19433 -> FF0200000000000000000001FF80DFA5:3333FF80DFA5 eth0(NeigSol)
200104707BD6E106FCC9D2FFFE80DFA5:FEC9D280DFA5 -> FE8000000000000000C50AFFFEC19433:5ACACAD9D63D wlan0(NeighAdv)
Adding entry: 200104707BD6E106FCC9D2FFFE80DFA5 at wlan0 mac FEC9D280DFA5
+ ip -6 route add 2001:0470:7bd6:e106:fcc9:d2ff:fe80:dfa5/128 dev veth_cm metric 5
(the node have chosen the address, and we have added a route for it)
(The node should have now IPv6 connectivity and be reachable from outside)
```
Prototype of the program: [setup_ipv6_hacky_router.sh](https://gist.github.com/vi/9633572)
Hacks
---
The project is eary and hacky. There are following known problems:
* Ping replies get duplicated;
* Source MAC address substitution code is hacky. Some special source MAC addresses may fail (it does search&replace MAC mentions though the whole packet and fix up ICMPv6 checksum afterwards).
* Usage of shell and /bin/ip to manage routes instead of AF_NETLINK;
* Not scalable approach in general - by design.