IPv6 acccess is blocked until freedombox initiates a connection

Support
1

My freedombox refuses incoming IPv6 connections until itself used it before. For example, if another host on my network pings the freedombox to its local network IPv6 or GUA IPv6, no ping is successful. If I initiate the ping from the freedombox to the host, the ping is successful and following pings to the freedombox work.

How can I configure my freedombox to allow IPv6 access?

Edit: I was testing this over another OpenWRT router in between and wanted to rule out that that hop is causing the problem. I since then tested the behaviour from the router itself and it is the same. Freedombox refused the incoming connection in IPv6 until it starts it itself.

2

The freedombox device does not send Neighbor Solicitations, so the other devices on the network do not know about the IPv6 presence of the freedombox. It is required for IPv6 for hosts to send Neighbor Solicitations and respond to Neighbor Solicitations.

root@freedombox:~# tcpdump -tt “icmp6”
tcpdump: verbose output suppressed, use -v[v]… for full protocol decode
listening on enp7s0, link-type EN10MB (Ethernet), snapshot length 262144 bytes
1691069293.179607 IP6 _gateway > ip6-allnodes: ICMP6, router advertisement, length 208
1691069294.790014 IP6 _gateway > ip6-allnodes: ICMP6, router advertisement, length 208
1691069297.177176 IP6 _gateway > ip6-allnodes: ICMP6, router advertisement, length 208
1691069298.810057 IP6 _gateway > ip6-allnodes: ICMP6, router advertisement, length 208
1691069301.171308 IP6 _gateway > ip6-allnodes: ICMP6, router advertisement, length 208
1691069302.827041 IP6 _gateway > ip6-allnodes: ICMP6, router advertisement, length 208
1691069305.179191 IP6 _gateway > ip6-allnodes: ICMP6, router advertisement, length 208
1691069306.809636 IP6 _gateway > ip6-allnodes: ICMP6, router advertisement, length 208
1691069309.179518 IP6 _gateway > ip6-allnodes: ICMP6, router advertisement, length 208
1691069310.826159 IP6 _gateway > ip6-allnodes: ICMP6, router advertisement, length 208
1691069313.193696 IP6 _gateway > ip6-allnodes: ICMP6, router advertisement, length 208
1691069314.799047 IP6 _gateway > ip6-allnodes: ICMP6, router advertisement, length 208
1691069317.185525 IP6 _gateway > ip6-allnodes: ICMP6, router advertisement, length 208
1691069318.910336 IP6 _gateway > ip6-allnodes: ICMP6, router advertisement, length 208
1691069321.191357 IP6 _gateway > ip6-allnodes: ICMP6, router advertisement, length 208
1691069322.842358 IP6 _gateway > ip6-allnodes: ICMP6, router advertisement, length 208
1691069325.196114 IP6 _gateway > ip6-allnodes: ICMP6, router advertisement, length 208
1691069326.835424 IP6 _gateway > ip6-allnodes: ICMP6, router advertisement, length 208
1691069329.845589 IP6 _gateway > ip6-allnodes: ICMP6, router advertisement, length 208
1691069331.498254 IP6 _gateway > ip6-allnodes: ICMP6, router advertisement, length 208
1691069334.974316 IP6 _gateway > ip6-allnodes: ICMP6, router advertisement, length 208
1691069337.842114 IP6 _gateway > ip6-allnodes: ICMP6, router advertisement, length 208
1691069340.261608 IP6 _gateway > ip6-allnodes: ICMP6, router advertisement, length 208
1691069342.500225 IP6 _gateway > ip6-allnodes: ICMP6, router advertisement, length 208
1691069346.835100 IP6 _gateway > ip6-allnodes: ICMP6, router advertisement, length 208
1691069350.789954 IP6 _gateway > ip6-allnodes: ICMP6, router advertisement, length 208
1691069353.196751 IP6 _gateway > ip6-allnodes: ICMP6, router advertisement, length 208
1691069354.870641 IP6 _gateway > ip6-allnodes: ICMP6, router advertisement, length 208
1691069357.863215 IP6 _gateway > ip6-allnodes: ICMP6, router advertisement, length 208
1691069360.218373 IP6 _gateway > ip6-allnodes: ICMP6, router advertisement, length 208
1691069362.503822 IP6 _gateway > ip6-allnodes: ICMP6, router advertisement, length 208
1691069366.836078 IP6 _gateway > ip6-allnodes: ICMP6, router advertisement, length 208
1691069370.839754 IP6 _gateway > ip6-allnodes: ICMP6, router advertisement, length 208
1691069373.225624 IP6 _gateway > ip6-allnodes: ICMP6, router advertisement, length 208
1691069374.839522 IP6 _gateway > ip6-allnodes: ICMP6, router advertisement, length 208
1691069377.214381 IP6 _gateway > ip6-allnodes: ICMP6, router advertisement, length 208
1691069378.863137 IP6 _gateway > ip6-allnodes: ICMP6, router advertisement, length 208
1691069382.515215 IP6 _gateway > ip6-allnodes: ICMP6, router advertisement, length 208
^C
38 packets captured
38 packets received by filter
0 packets dropped by kernel

Another debian host on the network shows the required NDP communication:

root@b550m:~# tcpdump -tt “icmp6”
tcpdump: verbose output suppressed, use -v[v]… for full protocol decode
listening on enp4s0, link-type EN10MB (Ethernet), snapshot length 262144 bytes
1691069041.069153 IP6 _gateway > ip6-allnodes: ICMP6, router advertisement, length 208
1691069042.418766 IP6 _gateway > ip6-allnodes: ICMP6, router advertisement, length 208
1691069044.727559 IP6 _gateway > b550m.madez.de: ICMP6, neighbor solicitation, who has b550m.madez.de, length 32
1691069044.727578 IP6 b550m.madez.de > _gateway: ICMP6, neighbor advertisement, tgt is b550m.madez.de, length 24
1691069045.068764 IP6 _gateway > ip6-allnodes: ICMP6, router advertisement, length 208
1691069046.447029 IP6 _gateway > ip6-allnodes: ICMP6, router advertisement, length 208
1691069049.100834 IP6 _gateway > ip6-allnodes: ICMP6, router advertisement, length 208
1691069050.790822 IP6 _gateway > ip6-allnodes: ICMP6, router advertisement, length 208
1691069053.095133 IP6 _gateway > ip6-allnodes: ICMP6, router advertisement, length 208
1691069054.770049 IP6 _gateway > ip6-allnodes: ICMP6, router advertisement, length 208
1691069057.086956 IP6 _gateway > ip6-allnodes: ICMP6, router advertisement, length 208
1691069058.789582 IP6 _gateway > ip6-allnodes: ICMP6, router advertisement, length 208
1691069061.080519 IP6 _gateway > ip6-allnodes: ICMP6, router advertisement, length 208
1691069062.830462 IP6 _gateway > ip6-allnodes: ICMP6, router advertisement, length 208
1691069065.087518 IP6 _gateway > ip6-allnodes: ICMP6, router advertisement, length 208
1691069066.805928 IP6 _gateway > ip6-allnodes: ICMP6, router advertisement, length 208
1691069069.085946 IP6 _gateway > ip6-allnodes: ICMP6, router advertisement, length 208
1691069070.793545 IP6 _gateway > ip6-allnodes: ICMP6, router advertisement, length 208
1691069073.079519 IP6 _gateway > ip6-allnodes: ICMP6, router advertisement, length 208
1691069074.827668 IP6 _gateway > ip6-allnodes: ICMP6, router advertisement, length 208
1691069077.084213 IP6 _gateway > ip6-allnodes: ICMP6, router advertisement, length 208
1691069078.788973 IP6 _gateway > ip6-allnodes: ICMP6, router advertisement, length 208
1691069080.007467 IP6 _gateway > b550m.madez.de: ICMP6, neighbor solicitation, who has b550m.madez.de, length 32
1691069080.007488 IP6 b550m.madez.de > _gateway: ICMP6, neighbor advertisement, tgt is b550m.madez.de, length 24
1691069081.100824 IP6 _gateway > ip6-allnodes: ICMP6, router advertisement, length 208
1691069082.818910 IP6 _gateway > ip6-allnodes: ICMP6, router advertisement, length 208
1691069085.116380 IP6 _gateway > ip6-allnodes: ICMP6, router advertisement, length 208
1691069086.800294 IP6 _gateway > ip6-allnodes: ICMP6, router advertisement, length 208
1691069089.099506 IP6 _gateway > ip6-allnodes: ICMP6, router advertisement, length 208
1691069090.806234 IP6 _gateway > ip6-allnodes: ICMP6, router advertisement, length 208
1691069093.101997 IP6 _gateway > ip6-allnodes: ICMP6, router advertisement, length 208
1691069094.807533 IP6 _gateway > ip6-allnodes: ICMP6, router advertisement, length 208
1691069098.450408 IP6 _gateway > ip6-allnodes: ICMP6, router advertisement, length 208
1691069101.739559 IP6 _gateway > ip6-allnodes: ICMP6, router advertisement, length 208
1691069104.179347 IP6 _gateway > ip6-allnodes: ICMP6, router advertisement, length 208
1691069106.449330 IP6 _gateway > ip6-allnodes: ICMP6, router advertisement, length 208
1691069108.949931 IP6 _gateway > ip6-allnodes: ICMP6, router advertisement, length 208
1691069112.105474 IP6 _gateway > ip6-allnodes: ICMP6, router advertisement, length 208
1691069114.538980 IP6 _gateway > ip6-allnodes: ICMP6, router advertisement, length 208
1691069116.944771 IP6 _gateway > ip6-allnodes: ICMP6, router advertisement, length 208
1691069119.127243 IP6 _gateway > b550m.madez.de: ICMP6, neighbor solicitation, who has b550m.madez.de, length 32
1691069119.127257 IP6 b550m.madez.de > _gateway: ICMP6, neighbor advertisement, tgt is b550m.madez.de, length 24
1691069120.106321 IP6 _gateway > ip6-allnodes: ICMP6, router advertisement, length 208
^C
43 packets captured
43 packets received by filter
0 packets dropped by kernel

3

Some more testing shows that the freedombox never sees Neighbor Solicitations send by the router, so there is nothing to respond to. The freedombox runs in a vm on a debian host, and the issues seems to be outside of freedombox. Interestingly, starting tcpdump in that setup on the freedombox throws a lot of kernel errors, like for example:

[ 519.021006] BPF: [99714] Invalid name_offset:1772992
[ 519.021105] failed to validate module [crc16] BTF: -22
[ 519.044411] BPF: [99731] FUNC
[ 519.044497] BPF: type_id=99676
[ 519.044536] BPF:
[ 519.044565] BPF: Invalid name
[ 519.044601] BPF:
[ 519.044629] failed to validate module [ecc] BTF: -22
[ 519.050451] BPF: [99724] STRUCT
[ 519.050533] BPF: size=72 vlen=3
[ 519.050573] BPF:
[ 519.050603] BPF: Invalid name
[ 519.050639] BPF:
[ 519.050668] failed to validate module [ecdh_generic] BTF: -22
[ 519.085550] BPF: [99728] FUNC
[ 519.085633] BPF: type_id=21121
[ 519.085672] BPF:
[ 519.085700] BPF: Invalid name
[ 519.085735] BPF:
[ 519.085765] failed to validate module [ansi_cprng] BTF: -22

4

The BPF dmesg errors seem to be caused by the kernel update I installed by apt full-upgrade. I rolled back to an earlier snapshot and the errors are gone. I just don’t install the available updates manually now.

To workaround the IPv6 issues, I installed libndp-tools make my freedombox manually announce it’s presence with the command: while true; do ndptool -t na -U -i $iface -T $gua send; sleep 4; ndptool -t na -U -i $iface -T $ula send; sleep 4; done