IPv6 ULA with NPT, when WAN is Dynamic

[FlangeMonkey]

Hi Guys,

• I have DHCPv6 configured on the WAN interface and its using PD with a /56.
• I also have Static IPv6 configured on my LAN interfaces using ULA configured as /64.
• I'd like to use NPT for 1:1 between the equivalent WAN /56 mapped to the LAN /56.

I have this working with NPT (/56 and /64) mapping configs, however I need to enter the "External IPv6 Prefix (target)" to make this work.  I recall reading to leave "External IPv6 Prefix (target)" empty for it to work dynamically, however that does not work, even with /56, which is address to address.

Any thoughts, what I'm missing?

[Maurice]

So you want to use the entire /56 PD for NPT? No GUAs in the LANs at all?

Set the internal IPv6 prefix (source) to your ULA /56, leave the external IPv6 prefix (target) empty and set the track interface to an interface which tracks the WAN interface. Since you don't seem to be using tracking at all, you'll have to create a dummy interface for this purpose. Make sure the IPv6 Prefix ID used there isn't in use for any of your "real" LAN interfaces.

This is a rather new workaround and I haven't personally tested it yet, but I think that's how it's supposed to work. There's currently no "direct" way to use a delegated prefix for NPT.

Cheers
Maurice

[bestboy]

Out of curiosity: May I ask why one would want to map GUAs to ULAs via NPt?
NPt seems to be the little brother of NAT, which is the bane of IPv4. I see no good reason to bring this flaw to IPv6 that was explicitly designed to overcome this flaw...

[ProximusAl]

I use ULA internally and use NPTv6 to map to GUA.

Main reason for me is to keep a consistent IPv6 address scheme internally, even if the IPv6 prefix changes on the WAN.

I'd just like to add, NPTv6 works *brilliantly* on OPNSense. :)

[ProximusAl]

I should also add, NPTv6 is stateless, so not NAT.

[Patrick M. Hausen]

Are your clients using IPv6 ULA only? No IPv4?

If they have IPv4 addresses and Internet access, how do you force them to use ULA instead?

[ProximusAl]

No, dual stack.

But obviously being ULA the preference is IPv4 WAN, IPv6 local connectivity, IPv6 WAN

I'm quite happy with that, as we have dual leased lines and only one of them has IPv6, so the IPv4 goes out the main leased line, and the IPv6 goes out the *backup* leased line.

They are both 2GB symetrical, so it doesnt really matter.

Plus, we use wireguard for remote users, so they have IPv6 ULA, and IPv4 privates, so NPTv6 seemed so easy to implement.

[FlangeMonkey]

So you want to use the entire /56 PD for NPT? No GUAs in the LANs at all?

Set the internal IPv6 prefix (source) to your ULA /56, leave the external IPv6 prefix (target) empty and set the track interface to an interface which tracks the WAN interface. Since you don't seem to be using tracking at all, you'll have to create a dummy interface for this purpose. Make sure the IPv6 Prefix ID used there isn't in use for any of your "real" LAN interfaces.

This is a rather new workaround and I haven't personally tested it yet, but I think that's how it's supposed to work. There's currently no "direct" way to use a delegated prefix for NPT.

Like others I want to keep it consistance with the prefix changes on the WAN.  I'll give your suggestion a look, but @ProximusAl how are you mapping addresses on the WAN side?

[ProximusAl]

I have a static /56