Problem routing data

[agalliazzo]

Hi guys,
Similar to #8633 I have some problem configuring the routing.

I followed the document attached by @jwhui (https://openthread.io/codelabs/openthread-border-router#2) but I'm still missing something: From the border router shell I can ping anywhere in the world, but from any of the thread node there is no way to go outside the OMR domain. I cannot also ping my PC.

Routing seems working cause, from my PC, I can ping the OMR

There is a step that is driving me crazy on the tutorial and is the one saying:
"An external route for the on-link prefix fd49:7770:7fc5:0::/64 which is created by OTBR when no IPv6 network is already present on the Wi-Fi/Ethernet link."

calling netdata show

> netdata show
Prefixes:
fd11:22:0:0::/64 paros med 6c00
Routes:
fd94:57d7:b924:2:0:0::/96 sn low 6c00
::/0 s med 6c00
Services:
44970 5d fd4d8b3ce59025db66da468f3b2ad1ced11f s 6c00
44970 01 66000500000e10 s 6c00
Contexts:
fd38:bae0:256:1::/64 1 -
fd11:22:0:0::/64 2 c
Commissioning:
11829 - - -
Done

I also get a route though a fd7d* gw but the ip address of the ens18 (my LAN network) is different:

2: ens18: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 state UP qlen 1000
    inet6 2a0d:3344:1b79:b700:bc4a:77ff:fea2:138/64 scope global dynamic mngtmpaddr noprefixroute
       valid_lft 86287sec preferred_lft 14287sec
    inet6 fe80::bc4a:77ff:fea2:138/64 scope link
       valid_lft forever preferred_lft forever

and is part of the subnet given by my ISP.

Any idea?
Thanks in advance
Alessio

[jwhui]

From the border router shell I can ping anywhere in the world, but from any of the thread node there is no way to go outside the OMR domain. I cannot also ping my PC.

For public IPv6 reachability, the Thread network must be configured with a globally routable IPv6 prefix. This is typically done using DHCPv6 Prefix Delegation to retrieve an IPv6 prefix from the upstream Internet Service Provider.

For public IPv4 reachability, the Thread network can leverage NAT64. For more information, see the Thread Border Router - Provide Internet access via NAT64 codelab.

[agalliazzo]

Hi, thanks for spending time helping me out.

I read here that the OTBR include a DHCPv6 prefix delegation. Doesn't it mean that, if I have my DHCP server properly configured, the OTBR should take care to get a prefix from my DHCP server?

I have, indeed, a DHCP server configured enabling PD and I can see that other router obtain the PD properly. Does I'm missing something else?

Anyway no need for NAT64, I have the whole test network in IPv6

[jwhui]

DHCPv6 PD Client is not fully implemented in ot-br-posix, but we are planning to do that soon.

/cc/ @erjiaqing

[agalliazzo]

Ok, so, your suggestion is to setup the network setting the On-Mesh prefix to a delegate subnet and setup the routing properly to reach the single devices, isn't it? I suppose that I have to setup a sort of RA (soemthing like radvd) from the OTBR to the rest of the LAN to inform the route, right? Sorry for bothering again, but I'm still a noob on both IPv6 and OT...

Thanks again

[agalliazzo]

Just for other interested, I had sucessfully made my devices connect to the internet and be accessible through a firewall.

This is how I did:

• Set a Globally routerable IPv6 address as On-Mesh Prefix in the web interface under the form network part
• I choosed a subnet that my DHCPv6 server is not able to assign, for example: My ISP give me a 2d11:1111:1111:1100::/56, I setup the DHCP server to delegate prefixes in the range 2d11:1111:1111:1100::/62 and assigned to the on-mesh prefix the value 2d11:1111:1111:11A0::/64. In this way DHCP can only serve 4 subnet as PD and openthread network will be able to use a whole 64bit block of op addresses that should be in specs
• I added a static route to my gw that route the 2d11:1111:1111:11A0::/64 network to my BR address. Here you should be able to choose any proper IPv6 address of the BR assigned to the eth0 or wlan0 interface (depend if you are using ethernet or wifi to connect BR to internet). As far as I understood, reading IPv6, is preferable to choose a link-local addr rather than a global ruterable address.
• In this way I can ping any of my end devices on the thread network form everywhere in the world (of course, I have a proper firewall blocking ports and doing its job) and vice-versa

Side note:
I think that the route is advertised by the BR itself cause on the PC connected to the network packets goes directly from PC to BR to End device and I have a route for the OT network pointing directly to the BR link-local address... So the dedicate route on the gateway maybe useless...

Thanks again to @jwhui for pointing me to the right direction