Native IPv6: routing between eth0 and eth1

Question

I humbly ask for your assistance with the problem I can't resolve myself.

I have a native IPv6 link with 2001:db8:14::/48 assigned. I'm running Slackware on 3.2.50-grsec kernel. My ISP's side (my default gw for ::/0) is 2001:db8:14::1. I have assigned 2001:db8:14::2 to my WAN interface (eth0) and it's working - I can ping and access various services in the Internet via IPv6. I would like this machine to act as a router for machines in LAN (eth1). I deployed radvd and all computers (various Win XP, Win 7 and Linux systems) successfully acquired IPv6 addresses from 2001:db8:14:a::/64 subnet. I assigned 2001:db8:14:a::1 to the eth1 LAN interface. Now... I can ping6 between all machines inside LAN. I can ping6 2001:db8:14:a::1 from any machine in the LAN. I can't ping6 2001:db8:14::2 (eth0) from any machine the LAN ("Destination unreachable: Address unreachable"). I can ping 2001:db8:14::2 from the Internet. I can't ping 2001:db8:14:a::1 from the Internet.

Clearly there is something wrong with the forwarding traffic between interfaces. Of course I have set all /proc/sys/net/ipv6/conf/*/forwarding pseudofiles to "1". I have my default route set to "::/0 via 2001:db8:14::1 on dev eth0". I do not have any firewall and just in case the default policy on ip6tables for FORWARDING (and anything else) is ACCEPT.

Is there something I'm missing? Any ideas what might be wrong with the routing?

Answer 1

I notice one specific problem in your routing table. It specifies 2001:db8:14::/48 as directly attached to eth0. That should have been a /64. But I don't see how that could explain the symptoms.

One piece of information is clearly missing. The ISP router would have to be configured with a gateway address for 2001:db8:14::/48. If that gateway address is 2001:db8:14::2, the routing should be working correctly. If it is something else, then packets from outside cannot reach anything on your LAN, only the router WAN address would be reachable. That would explain why 2001:db8:14:a::1 is not reachable from outside. But 2001:db8:14::2 should still have been reachable from inside, which is puzzling.

The only way forward in such a situation is to repeat the pings, which did not work, and this time be observing the network traffic on both interfaces of the router with tcpdump or equivalent.

When sending packets from outside, the eth0 interface on the router should see neighbor discovery for the gateway that the ISP assigned for your prefix. If sending packets to any address in your /48 results in neighbor discovery for the exact same address, then that address is the gateway address you should be assigning to eth0. There is a few other ways this can turn out, in that case you need to update your question with information about what traffic you actually see.