6 Jun
2021
6 Jun
'21
1:51 p.m.
Hi all!
I'm experiencing some trouble in dns resolution over ipv6 and I hope
someone can help me!
I'm using the lime packages at version 2020.1 with this configs
https://github.com/libremesh/network-profiles/blob/master/valsamoggia.ninux…
with this packages
https://github.com/libremesh/network-profiles/blob/master/valsamoggia.ninux…
and deselecting these packages
-dnsmasq
-firewall
-odhcpd-ipv6only
-odhcpd
-ppp
* note: I don't know if it's a problem but i can deselect the Base
System > firewall for ath79xx, but not in example for ar71xx e bcm63xx
* note: Not sure if i should also remove odhcp6c
and i just keep the ipv6 configs from previuos versions:
option main_ipv6_address '2a00:1508:0a%N1:%N200::/64'
Now, I'm with an ISP that don't provide ipv6
and some connections fails because the DNS request goes first to ipv6
address, failing, and then to ipv4
Is a good idea trying to remove ipv6 from the network?
Can i experience issues connecting to other nodes with ipv6 enabled?
Is there a risk of compromise the working of the mesh?
If no, will be enough to remove main_ipv6_address from lime-community?
Thanks in advance if for any advice!
Here are some demonstrations:
$ ping google.com
PING google.com(mil41s02-in-x0e.1e100.net (2a00:1450:4002:404::200e)) 56
data bytes
From ninux-561d87 (2a00:1508:afe:c00::871d:5600) icmp_seq=1 Destination
unreachable: Unknown code 5
From ninux-561d87 (2a00:1508:afe:c00::871d:5600) icmp_seq=2 Destination
unreachable: Unknown code 5
From ninux-561d87 (2a00:1508:afe:c00::871d:5600) icmp_seq=3 Destination
unreachable: Unknown code 5
^C
--- google.com ping statistics ---
3 packets transmitted, 0 received, +3 errors, 100% packet loss, time 2002ms
$ ping4 google.com
PING (142.250.184.46) 56(84) bytes of data.
64 bytes from mil41s02-in-f14.1e100.net (142.250.184.46): icmp_seq=1
ttl=115 time=78.2 ms
64 bytes from mil41s02-in-f14.1e100.net (142.250.184.46): icmp_seq=2
ttl=115 time=79.4 ms
64 bytes from mil41s02-in-f14.1e100.net (142.250.184.46): icmp_seq=3
ttl=115 time=77.7 ms
^C
--- ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2003ms
rtt min/avg/max/mdev = 77.741/78.470/79.432/0.709 ms
With wget i see it tries to resolv firstly ipv6 and then ipv4
$ wget google.com
Resolving www.google.com (www.google.com)... 2a00:1450:4016:803::2004,
172.217.22.196
Connecting to www.google.com
(www.google.com)|2a00:1450:4016:803::2004|:80... failed: Permission denied.
Connecting to www.google.com (www.google.com)|172.217.22.196|:80...
connected.
HTTP request sent, awaiting response... 200 OK
And if my pc i manually remove the ipv6 nameserver leaving only
10.170.0.1 from /etc/resolv.conf
the requests go only in ipv4 and stop failing
$ cat /etc/resolv.conf
# Generated by NetworkManager
search valsamoggia.ninux.org
nameserver 10.170.0.1
nameserver fe80::a8aa:aaff:fefe:caa%wlo1
nameserver fe80::c6ea:1dff:fea3:b68%wlo1
This is the status of the lime-app, showing the ipv6 addresses assigned
System
Uptime 5 hours, 34 minutes, 25 seconds
Device ADB P.DG A4001N
Firmware LiMe 2020.1 development (2020.1 rev. 002a53c 20210603_0623)
Internet connection
✔ IPv4 ✘ IPv6 ✔ DNS
IP Addresses
IPv4 10.170.157.135/16
IPv6 2a00:1508:afe:c00::871d:5600/64
IPv6 fe80::bef6:85ff:fe56:1d87/64
--
gothos
PGP Key ID: 0x6406B32F2CEC0008
PGP Key server: https://keys.openpgp.org/
6 Jun
6 Jun
2:31 p.m.
Dear Gothos,
The issue you're observing is this:
https://github.com/libremesh/lime-packages/issues/236
and has been fixed some time ago here:
https://github.com/libremesh/lime-packages/pull/657/
As you can see, the fix is to have the default main_ipv6_address be
main_ipv6_address fd%N1:%N2%N3:%N4%N5::/64
instead of this old and buggy address:
main_ipv6_address 2a00:1508:0a%N1:%N200::/64
So you'll have to update the lime-community file to the new default IPv6
address :)
The other thing you mention: "i can deselect the Base System > firewall
for ath79xx, but not in example for ar71xx e bcm63xx" does not happen to
me...
Can you open the "Help" tab inside Menuconfig for the "firewall"
package
and paste here what appears in the "Selected by" paragraph?
Anyway I hope that sooner or later we'll recommend using OpenWrt
firewall again, see:
https://github.com/libremesh/lime-packages/issues/280
And regarding "Not sure if i should also remove odhcp6c", meh, in the
LibreMesh build instructions there's no indication on that so it should
be ok to keep.
Ciao!
Ilario
On 6/6/21 3:51 PM, gothos wrote:
Hi all!
I'm experiencing some trouble in dns resolution over ipv6 and I hope
someone can help me!
I'm using the lime packages at version 2020.1 with this configs
https://github.com/libremesh/network-profiles/blob/master/valsamoggia.ninux…
with this packages
https://github.com/libremesh/network-profiles/blob/master/valsamoggia.ninux…
and deselecting these packages
-dnsmasq
-firewall
-odhcpd-ipv6only
-odhcpd
-ppp
* note: I don't know if it's a problem but i can deselect the Base
System > firewall for ath79xx, but not in example for ar71xx e bcm63xx
* note: Not sure if i should also remove odhcp6c
and i just keep the ipv6 configs from previuos versions:
option main_ipv6_address '2a00:1508:0a%N1:%N200::/64'
Now, I'm with an ISP that don't provide ipv6
and some connections fails because the DNS request goes first to ipv6
address, failing, and then to ipv4
Is a good idea trying to remove ipv6 from the network?
Can i experience issues connecting to other nodes with ipv6 enabled?
Is there a risk of compromise the working of the mesh?
If no, will be enough to remove main_ipv6_address from lime-community?
Thanks in advance if for any advice!
Here are some demonstrations:
$ ping google.com
PING google.com(mil41s02-in-x0e.1e100.net (2a00:1450:4002:404::200e)) 56
data bytes
From ninux-561d87 (2a00:1508:afe:c00::871d:5600) icmp_seq=1 Destination
unreachable: Unknown code 5
From ninux-561d87 (2a00:1508:afe:c00::871d:5600) icmp_seq=2 Destination
unreachable: Unknown code 5
From ninux-561d87 (2a00:1508:afe:c00::871d:5600) icmp_seq=3 Destination
unreachable: Unknown code 5
^C
--- google.com ping statistics ---
3 packets transmitted, 0 received, +3 errors, 100% packet loss, time 2002ms
$ ping4 google.com
PING (142.250.184.46) 56(84) bytes of data.
64 bytes from mil41s02-in-f14.1e100.net (142.250.184.46): icmp_seq=1
ttl=115 time=78.2 ms
64 bytes from mil41s02-in-f14.1e100.net (142.250.184.46): icmp_seq=2
ttl=115 time=79.4 ms
64 bytes from mil41s02-in-f14.1e100.net (142.250.184.46): icmp_seq=3
ttl=115 time=77.7 ms
^C
--- ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2003ms
rtt min/avg/max/mdev = 77.741/78.470/79.432/0.709 ms
With wget i see it tries to resolv firstly ipv6 and then ipv4
$ wget google.com
Resolving www.google.com (www.google.com)... 2a00:1450:4016:803::2004,
172.217.22.196
Connecting to www.google.com
(www.google.com)|2a00:1450:4016:803::2004|:80... failed: Permission denied.
Connecting to www.google.com (www.google.com)|172.217.22.196|:80...
connected.
HTTP request sent, awaiting response... 200 OK
And if my pc i manually remove the ipv6 nameserver leaving only
10.170.0.1 from /etc/resolv.conf
the requests go only in ipv4 and stop failing
$ cat /etc/resolv.conf
# Generated by NetworkManager
search valsamoggia.ninux.org
nameserver 10.170.0.1
nameserver fe80::a8aa:aaff:fefe:caa%wlo1
nameserver fe80::c6ea:1dff:fea3:b68%wlo1
This is the status of the lime-app, showing the ipv6 addresses assigned
System
Uptime 5 hours, 34 minutes, 25 seconds
Device ADB P.DG A4001N
Firmware LiMe 2020.1 development (2020.1 rev. 002a53c 20210603_0623)
Internet connection
✔ IPv4 ✘ IPv6 ✔ DNS
IP Addresses
IPv4 10.170.157.135/16
IPv6 2a00:1508:afe:c00::871d:5600/64
IPv6 fe80::bef6:85ff:fe56:1d87/64
--
Ilario
iochesonome(a)gmail.com
ilario(a)sindominio.net
12 Jun
12 Jun
6:51 p.m.
On 6/6/21 4:31 PM, Ilario Gelmetti wrote:
Dear Gothos,
The issue you're observing is this:
https://github.com/libremesh/lime-packages/issues/236
and has been fixed some time ago here:
https://github.com/libremesh/lime-packages/pull/657/
As you can see, the fix is to have the default main_ipv6_address be
main_ipv6_address fd%N1:%N2%N3:%N4%N5::/64
instead of this old and buggy address:
main_ipv6_address 2a00:1508:0a%N1:%N200::/64
So you'll have to update the lime-community file to the new default IPv6
address :)
Ok! Thanks Ilario!!!
The other thing you mention: "i can deselect the
Base System > firewall
for ath79xx, but not in example for ar71xx e bcm63xx" does not happen to
me...
Can you open the "Help" tab inside Menuconfig for the "firewall"
package
and paste here what appears in the "Selected by" paragraph?
..I was wrong it happens also for ath79xx, and it's because "firewall"
is selected by luci-app-firewall
which is selected by luci
I would keep luci, with luci it's more easy to create the vlan for the
wan port on a router
And it seems convenient to keep luci also to be able to do a wireless scan!
│ CONFIG_PACKAGE_firewall: │
│ │
│ This package provides a config-compatible C implementation of the UCI
firewall. │
│ Jo-Philipp Wich <jo(a)mein.io> │
│ │
│ │
│ Symbol: PACKAGE_firewall
[=n] │
│ Type : tristate │
│ Prompt: firewall.............................................. OpenWrt
C Firewall │
│ Location: │
│ -> Base system │
│ Defined at tmp/.config-package.in:287 │
│ Selects: PACKAGE_libuci [=y] && PACKAGE_kmod-ipt-nat [=y] &&
PACKAGE_libubus [=y] && \ │
│ PACKAGE_libip4tc [=y] && PACKAGE_kmod-ipt-core [=y] &&
PACKAGE_kmod-nf-conntrack6 [=y] && \ │
│ PACKAGE_kmod-ipt-conntrack [=y] && PACKAGE_librt [=y] && PACKAGE_libc
[=y] && \ │
│ PACKAGE_libxtables [=y] && PACKAGE_libubox [=y] && PACKAGE_libssp [=n]
&& \ │
│ PACKAGE_libpthread [=y] && PACKAGE_libip6tc
[=y] │
│ Selected by: MODULE_DEFAULT_firewall [=n] &&
TARGET_PER_DEVICE_ROOTFS [=n] && m && \ │
│ MODULES [=y] || PACKAGE_luci-app-firewall [=n] ||
PACKAGE_freifunk-firewall [=n] || \ │
│ PACKAGE_meshwizard [=n] || PACKAGE_gnunet-vpn [=n] && PACKAGE_gnunet [=n]
Anyway I hope that sooner or later we'll
recommend using OpenWrt
firewall again, see:
https://github.com/libremesh/lime-packages/issues/280
And regarding "Not sure if i should also remove odhcp6c", meh, in the
LibreMesh build instructions there's no indication on that so it should
be ok to keep.
OK!
Ciao!
Ilario
--
gothos
PGP Key ID: 0x6406B32F2CEC0008
PGP Key server: https://keys.openpgp.org/
13 Jun
13 Jun
6:45 p.m.
On 6/12/21 8:51 PM, gothos wrote:
On 6/6/21 4:31 PM, Ilario Gelmetti wrote:
Ok, it's clear now :)
It is not clear for me why OpenWrt firewall is not suggested to be used
with LibreMesh, I don't think there should be any problem with it.
Indeed, there's an open ticket with this discussion already:
https://github.com/libremesh/lime-packages/issues/280
It is opened since more than 3 years and no one ever bothered to comment
there why OpenWrt firewall should not be present in LibreMesh images, so
it is safe to include it.
Here you have a pull request for changing the compilation instructions
to include OpenWrt's firewall:
https://github.com/libremesh/lime-web/pull/139
If you observe any related issue **please** comment on the pull request
or on the aforementioned issue (or on this mailing list)!
Thanks!!!!!
Ilario
--
Ilario
iochesonome(a)gmail.com
ilario(a)sindominio.net
Can you open the "Help" tab inside
Menuconfig for the "firewall" package
and paste here what appears in the "Selected by" paragraph?
..I was wrong it happens also for ath79xx, and it's because "firewall"
is selected by luci-app-firewall
which is selected by luci
1235
days inactive
1242
days old
lime-users@lists.libremesh.org
3 comments
2 participants
participants (2)
-
gothos -
Ilario Gelmetti