I’m using a hetzner cloud instance with a /64 ipv6 subnet. I want to assign the containers a dedicated ipv6 address.
Basically the assignment works. But I got problems with loosing ipv4/ipv6 network connectivity after some time. I solved at least the ipv4 connectivity loss by setting:
But ipv6 still looses connectivity after some time.
I did some digging at recognized that ipv6 route expires and is not renewed:
root@proud-goldfish:~# ip -6 route
2a01:4f8:xxxx:xxxx::/120 dev eth0 proto ra metric 100 pref medium
fe80::/64 dev eth0 proto kernel metric 256 pref medium
default via fe80::185f:9bff:xxxx:xxxx dev eth0 proto ra metric 100 expires 707sec mtu 1500 pref medium
After some time the route is removed but not renewed:
root@proud-goldfish:~# ip -6 route
2a01:4f8:xxxx:xxxx:::/120 dev eth0 proto ra metric 100 pref medium
fe80::/64 dev eth0 proto kernel metric 256 pref medium
root@proud-goldfish:~# journalctl | grep eth0
May 19 07:09:45 proud-goldfish systemd-networkd[73]: eth0: IPv6 successfully enabled
May 19 07:09:45 proud-goldfish systemd-networkd[73]: eth0: DHCPv4 address 10.254.210.85/24 via 10.254.210.1
May 19 07:09:46 proud-goldfish systemd-networkd[73]: eth0: Gained IPv6LL
May 19 07:09:47 proud-goldfish systemd-networkd[73]: eth0: DHCPv6 address 2a01:4f8:xxxx:xxxx::c0/128 timeout preferred -1 valid -1
My first thought would be to check your firewall settings on the LXD host to make sure that IPv6 router advertisements and DHCPv6 isn’t getting blocked.
I guess that was the problem which I solved with the infinite configuration. But it seems not to solve the problem with disappearing route
After your comment I change default incoming and routed to allow and set ipv{4,6}.dhcp.expiry to 5m:
asbachb@ubuntu-8gb-nbg1-1:~$ sudo lxc network show lxdbr0
[sudo] password for asbachb:
config:
ipv4.address: 10.254.210.1/24
ipv4.dhcp.expiry: 5m
ipv4.nat: "true"
ipv6.address: 2a01:4f8:xxxx:xxxx::1/120
ipv6.dhcp.expiry: 5m
ipv6.dhcp.stateful: "true"
description: ""
name: lxdbr0
type: bridge
used_by:
- /1.0/instances/mutual-hen
- /1.0/instances/nixos-acme
- /1.0/instances/nixos-mail
- /1.0/instances/proud-goldfish
managed: true
status: Created
locations:
- none
abachb@ubuntu-8gb-nbg1-1:~$ sudo ufw status verbose
Status: active
Logging: on (high)
Default: allow (incoming), allow (outgoing), allow (routed)
New profiles: skip
...
But route still disappears after expiry:
root@mutual-hen:~# ip -6 route
2a01:4f8:xxxx:xxxx::/120 dev eth0 proto ra metric 100 expires 1774sec pref medium
fe80::/64 dev eth0 proto kernel metric 256 pref medium
default via fe80::b0b4:8bff:xxxx:xxxx dev eth0 proto ra metric 100 expires 1774sec mtu 1500 pref medium
root@mutual-hen:~# ip -6 route
fe80::/64 dev eth0 proto kernel metric 256 pref medium
Just to mention. Ther’re some additional ufw rules:
asbachb@ubuntu-8gb-nbg1-1:~$ sudo cat /etc/ufw/before.rules
#
# rules.before
#
# Rules that should be run before the ufw command line added rules. Custom
# rules should be added to one of these chains:
# ufw-before-input
# ufw-before-output
# ufw-before-forward
#
*nat
:PREROUTING ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
-F
# SMTP
-A PREROUTING -p tcp -i eth0 --dport 25 -j DNAT --to-destination 10.254.210.183:25
-A PREROUTING -p tcp -i eth0 --dport 587 -j DNAT --to-destination 10.254.210.183:587
# IMAP
-A PREROUTING -p tcp -i eth0 --dport 143 -j DNAT --to-destination 10.254.210.183:143
-A PREROUTING -p tcp -i eth0 --dport 993 -j DNAT --to-destination 10.254.210.183:993
COMMIT
# Don't delete these required lines, otherwise there will be errors
*filter
:ufw-before-input - [0:0]
:ufw-before-output - [0:0]
:ufw-before-forward - [0:0]
:ufw-not-local - [0:0]
# End required lines
# allow all on loopback
-A ufw-before-input -i lo -j ACCEPT
-A ufw-before-output -o lo -j ACCEPT
# quickly process packets for which we already have a connection
-A ufw-before-input -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A ufw-before-output -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A ufw-before-forward -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
# drop INVALID packets (logs these in loglevel medium and higher)
-A ufw-before-input -m conntrack --ctstate INVALID -j ufw-logging-deny
-A ufw-before-input -m conntrack --ctstate INVALID -j DROP
# ok icmp codes for INPUT
-A ufw-before-input -p icmp --icmp-type destination-unreachable -j ACCEPT
-A ufw-before-input -p icmp --icmp-type time-exceeded -j ACCEPT
-A ufw-before-input -p icmp --icmp-type parameter-problem -j ACCEPT
-A ufw-before-input -p icmp --icmp-type echo-request -j ACCEPT
# ok icmp code for FORWARD
-A ufw-before-forward -p icmp --icmp-type destination-unreachable -j ACCEPT
-A ufw-before-forward -p icmp --icmp-type time-exceeded -j ACCEPT
-A ufw-before-forward -p icmp --icmp-type parameter-problem -j ACCEPT
-A ufw-before-forward -p icmp --icmp-type echo-request -j ACCEPT
# allow dhcp client to work
-A ufw-before-input -p udp --sport 67 --dport 68 -j ACCEPT
#
# ufw-not-local
#
-A ufw-before-input -j ufw-not-local
# if LOCAL, RETURN
-A ufw-not-local -m addrtype --dst-type LOCAL -j RETURN
# if MULTICAST, RETURN
-A ufw-not-local -m addrtype --dst-type MULTICAST -j RETURN
# if BROADCAST, RETURN
-A ufw-not-local -m addrtype --dst-type BROADCAST -j RETURN
# all other non-local packets are dropped
-A ufw-not-local -m limit --limit 3/min --limit-burst 10 -j ufw-logging-deny
-A ufw-not-local -j DROP
# allow MULTICAST mDNS for service discovery (be sure the MULTICAST line above
# is uncommented)
-A ufw-before-input -p udp -d 224.0.0.251 --dport 5353 -j ACCEPT
# allow MULTICAST UPnP for service discovery (be sure the MULTICAST line above
# is uncommented)
-A ufw-before-input -p udp -d 239.255.255.250 --dport 1900 -j ACCEPT
# don't delete the 'COMMIT' line or these rules won't be processed
COMMIT
asbachb@ubuntu-8gb-nbg1-1:~$ sudo ufw disable
Firewall stopped and disabled on system startup
asbachb@ubuntu-8gb-nbg1-1:~$ sudo reboot
But still the same issue:
root@mutual-hen:~# ip -6 route
2a01:4f8:xxxx:xxxx::/120 dev eth0 proto ra metric 100 expires 6sec pref medium
fe80::/64 dev eth0 proto kernel metric 256 pref medium
default via fe80::c810:f5ff:xxxx:xxxx dev eth0 proto ra metric 100 expires 6sec mtu 1500 pref medium
root@mutual-hen:~# ip -6 route
fe80::/64 dev eth0 proto kernel metric 256 pref medium
With ipv6.dhcp.staeful = false. The container don’t get a route at all:
oot@mutual-hen:~# ip -6 addr
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 state UNKNOWN qlen 1000
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
12: eth0@if13: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 state UP qlen 1000
inet6 fe80::216:3eff:xxxx:xxxx/64 scope link
valid_lft forever preferred_lft forever
root@mutual-hen:~# ip -6 route
fe80::/64 dev eth0 proto kernel metric 256 pref medium
The host is running stock Hetzner Ubuntu 20.04. The guest image is images:ubuntu/focal.
AFAIK networking is done via cloud-init:
asbachb@ubuntu-8gb-nbg1-1:~$ cat /etc/netplan/50-cloud-init.yaml
# This file is generated from information provided by the datasource. Changes
# to it will not persist across an instance reboot. To disable cloud-init's
# network configuration capabilities, write a file
# /etc/cloud/cloud.cfg.d/99-disable-network-config.cfg with the following:
# network: {config: disabled}
network:
version: 2
ethernets:
eth0:
addresses:
- 2a01:4f8:xxxx:xxxx::1/64
dhcp4: true
gateway6: fe80::1
match:
macaddress: 96:00:00:xx:xx:xx
set-name: eth0
OK so now leave tcpdump running and wait until the route drops off again and advise if you still see those periodic route advertisements every few minutes.