☰

Linux 不喜欢在 dhcpv6 网络上使用 ipv6

tag-icon • tag-icon linux networking wireless-networking iptables ipv6
Linux 不喜欢在 dhcpv6 网络上使用 ipv6

在我的家庭网络上，我使用 (Raspbian) Raspberry Pi 作为 wifi 路由器，并安装了hostapd、isc-dhcp-server、radvd、pihole和dnscrypt-proxy。我不是使用dhcpcd，我使用dhclient。由于我从 ISP 仅获得一个 ipv4 地址和一个 ipv6 地址，因此我同时设置了 dhcp 和 dhcpv6 服务器以及 NAT。连接到 wifi 网络时，一切都运行正常，我可以使用 ipv4 和 ipv6 连接到互联网。但是，如果我是ping主机，则使用 ipv4 地址：

$ ping google.com
PING google.com (216.58.212.174) 56(84) bytes of data.
64 bytes from ams15s22-in-f174.1e100.net (216.58.212.174): icmp_seq=1 ttl=55 time=16.1 ms
64 bytes from ams15s22-in-f174.1e100.net (216.58.212.174): icmp_seq=2 ttl=55 time=16.3 ms
64 bytes from ams15s22-in-f174.1e100.net (216.58.212.174): icmp_seq=3 ttl=55 time=16.5 ms

我想默认使用 ipv6。没有Raspberry Pi，ping使用ipv6地址：

$ ping google.com
PING google.com(ams15s22-in-x0e.1e100.net (2a00:1450:400e:801::200e)) 56 data bytes
64 bytes from ams15s22-in-x0e.1e100.net (2a00:1450:400e:801::200e): icmp_seq=1 ttl=56 time=103 ms
64 bytes from ams15s22-in-x0e.1e100.net (2a00:1450:400e:801::200e): icmp_seq=2 ttl=56 time=18.5 ms
64 bytes from ams15s22-in-x0e.1e100.net (2a00:1450:400e:801::200e): icmp_seq=3 ttl=56 time=16.8 ms

这种行为扩展到浏览器curl，，wget......

我已经测试了有和没有 Pihole DNS 服务器的网络，行为没有差异，所以我不认为这是原因。

我的本地设置：

$ ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: enp2s0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc fq_codel state DOWN group default qlen 1000
    link/ether 30:65:ec:b8:45:66 brd ff:ff:ff:ff:ff:ff
3: wlp3s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
    link/ether b2:a5:95:7c:58:a0 brd ff:ff:ff:ff:ff:ff
    inet 192.168.0.161/24 brd 192.168.0.255 scope global dynamic noprefixroute wlp3s0
       valid_lft 83213sec preferred_lft 83213sec
    inet6 fd97:367f:e5b4:8c28:17e3:4ca9:b7b8:3150/64 scope global dynamic noprefixroute 
       valid_lft 86275sec preferred_lft 14275sec
    inet6 fe80::755f:ab92:41fe:9872/64 scope link noprefixroute 
       valid_lft forever preferred_lft forever

/etc/gai.conf是空的。

我的 Raspberry Pi 设置：

/etc/dhcp/dhcpd.conf：

default-lease-time 86400;
authoritative;
subnet 192.168.0.0 netmask 255.255.255.0 {
    range 192.168.0.2 192.168.0.254;
    option routers 192.168.0.1;
    option domain-name-servers 192.168.0.1;
}

/etc/dhcp/dhcpd6.conf：

default-lease-time 2592000;
authoritative;
subnet6 fd97:367f:e5b4:8c28::/64 {
    range6 fd97:367f:e5b4:8c28:0000:0000:0000:2 fd97:367f:e5b4:8c28:ffff:ffff:ffff:fffe;
    option dhcp6.name-servers fd97:367f:e5b4:8c28:0000:0000:0000:1;
}

/etc/network/interfaces：

auto lo
iface lo inet loopback

auto eth0
allow-hotplug eth0
iface eth0 inet dhcp
iface eth0 inet6 auto
privext 2

auto wlan0
allow-hotplug wlan0
iface wlan0 inet static
    address 192.168.0.1
    netmask 255.255.255.0
    up iptables-restore < /etc/iptables.ipv4.nat
iface wlan0 inet6 static
    address fd97:367f:e5b4:8c28:0000:0000:0000:1
    netmask 64
    dad-attempts 0
    up ip6tables-restore < /etc/iptables.ipv6.nat

/etc/radvd.conf：

interface wlan0 {
    AdvSendAdvert on;
    prefix fd97:367f:e5b4:8c28::/64 {};
};

/etc/iptables.ipv4.nat：

# Generated by iptables-save v1.6.0 on Fri Feb  8 13:46:33 2019
*filter
:INPUT ACCEPT [74:5800]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [96:7812]
-A FORWARD -i eth0 -o wlan0 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -i wlan0 -o eth0 -j ACCEPT
COMMIT
# Completed on Fri Feb  8 13:46:33 2019
# Generated by iptables-save v1.6.0 on Fri Feb  8 13:46:33 2019
*nat
:PREROUTING ACCEPT [1844:56256]
:INPUT ACCEPT [4:513]
:OUTPUT ACCEPT [6:492]
:POSTROUTING ACCEPT [1:48]
-A POSTROUTING -o eth0 -j MASQUERADE
COMMIT
# Completed on Fri Feb  8 13:46:33 2019

/etc/iptables.ipv6.nat：

# Generated by ip6tables-save v1.6.0 on Fri Feb  8 13:59:43 2019
*filter
:INPUT ACCEPT [105:9056]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [63:7044]
-A FORWARD -i eth0 -o wlan0 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -i wlan0 -o eth0 -j ACCEPT
COMMIT
# Completed on Fri Feb  8 13:59:43 2019
# Generated by ip6tables-save v1.6.0 on Fri Feb  8 13:59:43 2019
*nat
:PREROUTING ACCEPT [7:584]
:INPUT ACCEPT [1:104]
:OUTPUT ACCEPT [1:140]
:POSTROUTING ACCEPT [1:140]
-A POSTROUTING -o eth0 -j MASQUERADE
COMMIT
# Completed on Fri Feb  8 13:59:43 2019

net.ipv4.ip_forward并net.ipv6.conf.all.forwarding设置为 1 /etc/sysctl.conf。dhcpcd被禁用并停止。

答案1

因此，在 Google 上搜索了有关 NAT66 的更多信息后，我发现了这篇博客文章：https://mcilloni.ovh/2018/01/20/oh-god-why-NAT66/

确实，作者遇到了和我一样的问题，解决方案是编辑/etc/gai.conf以删除子网标签fc00::/7（即与全局 IPv6 地址一样处理）。不幸的是，问题是网络和客户端交互的结合，因此每个客户端都必须进行相同的配置更改。

相关内容