Guide: IPv4/IPv6 home router/bridge/firewall (brouter)

skaloo · n00b Joined: 18 Jul 2014 Posts: 21

Hi everybody,

Foreword: apologies for any english mistake, not an english-native speaker.

Disclaimer: my network topology and my choices are mine only, I don't pretend this is the *best* way to do things (any comment on that part is welcome), but that's how I decided to do it and I will eventualy give a couple reasons further down the post. Also, I do not intend to explain everything step-by-step as imho this kind of setup is not trivial and someone who's reading this has basic knowledge of gentoo/linux/networking. Feel free to ask for details. The post is more intended to save people with similar goals a lot of reading of deprecated or complex things on the internet when there is a decently easy solution it took me a couple days to find, set up and test -- see below for details.

Tags: home router - IPv6 - dual stack - dhcp - dns - dnsmasq - brouter - iptables - ip6tables - ebtables - bridge

Note: To skip all the chitchat about why I did it that way: search for "At (long) last: HOWTO"

Preamble: the 'why' and the roots of the 'how'

A few days ago, I decided to finaly migrate my home network to IPv4/IPv6 dual stack as my provider is actualy offering native IPv6 for a while. I had postponed this migration mostly because of security issues as IPv6 basicaly gives all your hosts 'public' addresses and I didn't have the hardware and time to deal with that.

Old IPv4 only topology: (( The Internet )) ... [ISP ADSL Router] ... { my hosts }

That network was easy to manage, the router did all the work: DHCP-ing all hosts private IPv4 addresses, NAT-ing, DNAT-ing (port-forward) a few services, DNS-relaying and so on.

The main reason why I postponed going IPv6 was I didn't want to bother managing security on all my hosts (I have quite a bunch of them, as I work at home and use an extensive number of VMs and physical hosts). I could of course have disabled IPv6 on all hosts I didn't want to manage, but then what is the point having an IPv6-enabled network

Anyway, the idea to ease network management of all my hosts is to have a linux box in between the router and the actual LAN that will do most of the firewalling job (and some of the automatic-configuring too).

So the new topology will be: (( The Internet )) ... [ISP ADSL Router] ... [Linux Box] ...{ my hosts }

I bought a barebone PC with 2 network interfaces and a USB3-Gigabit adapter in order the linux box to have 3 NICs and completely isolate the various links (router, dmz, lan). What is required then is to have the Linux box fulfill the following services:

giving addresses to internal hosts (both IPv4 and IPv6)
providing some DNS relaying (or caching)
firewalling all coms between the 3 network branches

Having done some years of sysadmin in the past, IPv4 wasn't a problem at all, but I admit I hadn't read much on IPv6 yet, so first things first: RTFM :p I spent a few hours searching the web for infos, examples, documentations on IPv6 and related stuff, and to my surprise, most articles were *old* and often outdated. And that's the main reason behind this post, I ended up doing what I think is a neat and easy setup, but had to dig through tons of articles to put it together properly (which is odd considering how simple it is in the end).
So, let's start with the easy bit...

IPv4: the old trusted thing

I will shamelessly bypass details on the IPv4 configuration, mostly because it doesn't have much in terms of tricky details. It's just an old trusted classical IPv4 router with dnsmasq as the DHCP/DNS server and iptables doing filtering + DNAT + SNAT.

[ISP Router]192.168.1.1 ... 192.168.1.2[Linux box]172.16.0.1 ... 172.16.0.0/16{LAN hosts} ++ 172.17.0.1 ... 172.17.0.0/16{DMZ hosts}

My router has a specific setting that makes it transfer all 'incoming' connections to a given IPv4 address. The alternative would have been to define DNAT rules for *all* IPv4 services I need to serve. Lucky me ! I didn't have to do that

Anyway, enough of IPv4, this is not the real target of the post, so onto...

IPv6: shiny !

My findings were sometimes confusing, I've read many things on 'radvd', IPv6 routing, router advertisement, neighbor detection protocol, and so on... But something kept tickling my brain... IPv6 is all about giving 'public' addresses to all hosts. The ISP actualy allocates your router some sub-net (generaly a /64 or /56) that you are supposed to use for all your hosts on a 'flat' model. This is called the 'prefix' in IPv6 documentations. Technically, if I was working on an IPv4 network with the same premices, I would have 2 choices: sub-net the allocated network and route it or... bridge it ! In the world of IPv6, sub-netting the prefix given by your ISP ain't really a good idea, and it can actualy break some protocols (IPv6 auto-config works only on /64 as far as I know), and to make things worse, changing the linux box into a true IPv6 router is actualy not so easy (not so well supported as of now). IPv6 includes some additionnal protocols to deal with automatic routing (router advertisement, neighbor detection, ...) but all those are seldomly supported and simply not needed if you bridge ! Bridging also removes the need of IPv6 allocations as the ISP router will do it.
So the question is now: is it possible to do bridging while retaining the IPv4 routing ?
And luckily the answer is: YES !
That was the key in my decision process, everything became easier and more straight-forward.

So the final idea is:

each physical interface has *only* an IPv4 address
a bridge covering all the physical interfaces is created and has only an IPv6 address (for the linux box itself)

The problem is then to tell the kernel what to route and what to bridge: here comes 'ebtables'. 'ebtables' is a tool similar to 'iptables' but aimed at dealing specificaly with bridging. For the gory details, I'll point you to an internet serach, suffice to say that 'ebtables' filtering kicks in very early in the packet flow (and at a low protocol level too), allowing the kernel to split IPv4 and IPv6 processing in order to do exactly what's needed here.

At (long) last: HOWTO

Required kernel options (this was done on a basic gentoo installation, kernel 3.12.21):

Networking support
- Networking options
  - Network packet filtering framework (Netfilter)
    - Advanced netfilter configuration (required to display some options we'll need)
      - Bridged IP/ARP packets filtering (not sure this is needed, didn't have time to check w/o it)
      - Core Netfilter Configuration
        
        ... anything you want for your filewall...
        
        "physdev" match support (this will allow to match ip6 packets on the bridge ports)
      - Ethernet Bridge tables (ebtables) support
        
        ebt: broute table support
        
        ebt: IP6 filter support
        
        ...anything else you may need...
    - 802.1d Ethernet Bridging

Required tools:

net-misc/bridge-utils
net-firewall/iptables
net-firewall/ip6tables
net-firewall/ebtables
opt. sys-apps/iproute2 - many (old) documentations strongly suggest using iproute2 over ifconfig when dealing with IPv6; I'm not sure if that really matters anymore, ifconfig always seemed to work fine for me during the first hours of my testing though I ended up installing iproute2 and didn't try the end configuration w/o it
opt. dhcp client of your choice - this is only needed if you want your uplink interface to get its IPv4 address from the router dynamically

I'm not going to go through the required steps to configure network cards and make them go up at boot time and so on, this is well explained in the 'gentoo handbook' and in the 'modular networking' documents. I'll just show my /etc/conf.d/net file:

szatox · Advocate Joined: 27 Aug 2013 Posts: 3129

THere is some good info, indeed. Thanks for new ideas

However, you might want to reconsider some other things:
Bridged interfaces work a bit like a network switch. The bridge has it's own logic, and that logic works in the ethernet layer. Both, IP4 and IP6 are higher layers than ethernet. That means, if you bridge 2 interfaces, you can't really isolate networks. As a test, try manually set some other IP to hosts on different (but bridged) lans. I bet they will be able to ping each other even though your firewall forbids it.
Then, why would you assign IP4 to every interface you have? Does it mean you have 1 interface per zone and you want to assign different IP pools to them?

Second thing, AFAIR link-local adresses in IP6 are not routable. Do you assign e.g. site-local or global IPs to your hosts? Seems no. So do you use ipv6 to connect to the outer world? Your ISP supports IP6? I'm really curious, IPv6 seems to be gaining popularity in a very, VERY slow pace.

NeddySeagoon · Posted: Fri Jul 18, 2014 9:25 pm Post subject:

Moved from Networking & Security to Documentation, Tips & Tricks.

Its one of these, so moved here now that there has been a response.
_________________
Regards,

NeddySeagoon

Computer users fall into two groups:-
those that do backups
those that have never had a hard drive fail.

skaloo · n00b Joined: 18 Jul 2014 Posts: 21

skaloo · n00b Joined: 18 Jul 2014 Posts: 21

skaloo · n00b Joined: 18 Jul 2014 Posts: 21

skaloo · n00b Joined: 18 Jul 2014 Posts: 21

A few screenshots to show the results.

Server interfaces config: http://postimg.org/image/efmc8oh5j/
Key points:

the physical interfaces (www0,lan0,dmz0) only have IPv4 addresses
link & global IPv6 addresses on br0

Server pinging the IPv6 world: http://postimg.org/image/cmq4ulkub/

Server firewall rules excerpt: http://pastebin.com/jKLFzy2F
Key points:

not an ultra secured firewall, work in progress and only here to show a couple key points
classical IPv4 rules using the physical interfaces, including DNAT and SNAT (masquerade)
allows ICMPv6 on link-local segment for IPv6 auto-configuration (not any other incoming ICMP, will be shown below)
IPv6 rules use the PHYSDEV match extension
the ebtables rule and policy at the end

An host config (lan segment): http://postimg.org/image/9nahzddj7/
Key points:

win7 assigns 2 different IPv6 addresses using the public prefix (classical one made using the MAC address, plus a 'temporary' one)
IPv4 address in the proper lan network 172.16.0.0/16
IPv4 DNS server is the linux box

Win7 host pinging the IPv6 world: http://postimg.org/image/469dnd53p/

Now to check the bridge is filtering the incoming packets, I used some online IP6 ping tool to ping my network from outside:

world pinging my ISP router (I do not control any filtering on this so I can't block it): http://postimg.org/image/xewue6wn7/
world pinging the Win7 host (does not pass, filtering works): http://postimg.org/image/jp6wj4ywz/

And finaly the well-known test-ipv6.com website results:
http://postimg.org/image/5ihh1ubon/
http://postimg.org/image/lbr0w1nzb/

The warning about the browser is not an error, I specificaly configured it to prefer IPv4 a while ago. During my testings, I was using a VM with a non-modified browser and there wasn't any warning.
Note that my provider doesn't actualy offer any IPv6 DNS, but the website still shows that part ok. That's because my hosts use the Linux box as DNS, and my dnsmasq is configured to use both IPv6 and IPv4. It even has an IPv6 DNS uplink, though that's not mandatory for the test to pass.

szatox · Advocate Joined: 27 Aug 2013 Posts: 3129

Well, good job gathering that info then

There is some buzz about IPv6, but it still hard to find anyone who would actually know how it works, so gratz on your patience during all the research you had to do.
Building a hybrid router/bridge device is an interesting idea, and indeed with both, iptables and ebtables it seems to have a good chance to work.

Ebtables uses an insane command line convention though, so double and tripple check it before using. Prefferably with a sniffer

I've run a brief search for ebtables docs, and they are inconsistent.

skaloo · n00b Joined: 18 Jul 2014 Posts: 21

Shameless bump + update to let people know that I'm using this since I wrote the guide back last summer without any trouble.
It seems robust enough and remains so far imho the lightest way to enable IPv6 on a home LAN or any other internal network.

UberLord

steveL · Posted: Thu Jan 29, 2015 5:35 pm Post subject:

Well, I have nfc about IP6 (and would defer to UberLord) but I like the ebtables thing, and splitting traffic by type to the bridge like that.

UberLord · Posted: Thu Jan 29, 2015 5:57 pm Post subject:

skaloo · n00b Joined: 18 Jul 2014 Posts: 21

UberLord

steveL · Posted: Fri Jan 30, 2015 10:14 pm Post subject:

UberLord · Posted: Sat Jan 31, 2015 12:53 am Post subject:

Oh sorry I missed that part of the bridge setup. Still, the rest of my argument still applies.

Now if this article is re-done with the following premise:
HOWTO: Bridge IPv6 from your non customizable router to your Linux router

and the preceding IPv6 technical blurb is either remove or corrected to be technically accurate I wouldn't have a problem with this guide.
_________________
Use dhcpcd for all your automated network configuration needs
Use dhcpcd-ui (GTK+/Qt) as your System Tray Network tool

skaloo · n00b Joined: 18 Jul 2014 Posts: 21

I've changed the title because it probably wasn't well describing my purpose with the post, but I won't change anything else.
If you want to waste time getting sentences out of context and reading them in a way you can nitpick and call me a liar, go ahead. I stand with my previous position on things not being well supported by some tools, dnsmasq for instance, despite being a neat tool and offering various things for IPv6, didn't work fully in my situation.

I wrote this post because in about 20 years of linux, it's probably the first time I had to spend more than an hour gathering informations on how to do something, mostly because 'ebtables' is not well known and underrated. The core of the idea (as I already said, it's not mine), comes from a very obscure forum (and in french too) that's dated 9 years back or so (at least, that's where I found it), and I thought it would be a good idea to get it 'up to date' and share it here so other people could consider it for their own purpose.
It's a 'bandaid' you said ? I fully disagree, to me it's a very elegant and lightweight alternative (not replacement, it's completely different) to routing IPv6 (and specifically 'radvd'), if you don't need routing. You don't like it ? fine, don't use it. As of me, I'm done with this, and I guess I shouldn't have wasted time sharing.

[edit add] Actualy, I take that back: SteveL said he's glad to have read it for 'ebtable', so if it was useful to at least one person, it wasn't a waste of time.

steveL · Posted: Sat Jan 31, 2015 9:47 am Post subject:

Kilr00y · n00b Joined: 11 Aug 2016 Posts: 1

i've set up a brouter just like you line out. works fine... while ipv6 on the clients is busy (ping is enough).

but once it's idle for a few minutes, the clients lose the ipv6 network (ipv4 keeps on working)

the brouter is setup in a kvm and therefore sitting on top of another bridge on the host, if that makes any difference.

tried all kinda of stuff like changing timeouts, en/disabling stp and so on, but problem persists.
google gave me nothing.

anybody ran into the same issues or has any idea where still to look for the solution?