OpenWRT校园网设置IPv6 NAT6

转载自 再说 OpenWRT 校园网 IPv6 NAT6-OPENWRT专版-恩山无线论坛 (right.com.cn)
第一步：执行命令

opkg update 
opkg install ip6tables
opkg install kmod-ipt-nat6

这一步是更新软件源并安装这两个软件包。有些第三方 OpenWRT 自带，注意看提示。

第二步：执行命令

uci set network.globals.ula_prefix="$(uci get network.globals.ula_prefix | sed 's/^./d/')"
uci commit network

这一步是将 IPv6 LAN 内网地址由 fd 开头变成 dd 开头。

家庭用户注意：你们宽带的 IPv6 LAN 内网地址不应该是 f 开头，应该是 2 开头，由 DHCPv6-PD 申请。如果不是，你的宽带的IPv6就配错了。内网 IPv6 是极特殊用途的。再次注意，此步骤不适用于家庭宽带，除非你家光猫处于路由模式且不支持 DHCPv6-PD且你无法修改光猫设置时才能使用此办法。

第三步：执行命令

uci set dhcp.lan.ra_default='1'
uci commit dhcp

这一步是让DHCP服务器总是通告默认路由。

第四步：创建 /etc/init.d/nat6 文件

，内容见最后。你可以选择使用 vi 命令复制粘贴，也可以用 WinSCP 软件把文件传进去。后者请注意文件的换行符必须是LF。

vi /etc/init.d/nat6

以下是内容：

#!/bin/sh /etc/rc.common
# NAT6 init script for OpenWrt // Depends on package: kmod-ipt-nat6

# edited by Sad Pencil at 2020-02-09
# replace route command with ip command to solve issues on new OpenWRT

# edited by Sad Pencil at 2021-11-29
# update line WAN6_INTERFACE=$(uci get "network.$WAN6_NAME.device" || uci get "network.$WAN6_NAME.ifname")

START=55
 
# Options
# -------
 
# Use temporary addresses (IPv6 privacy extensions) for outgoing connections? Yes: 1 / No: 0
PRIVACY=1
 
# Maximum number of attempts before this script will stop in case no IPv6 route is available
# This limits the execution time of the IPv6 route lookup to (MAX_TRIES+1)*(MAX_TRIES/2) seconds. The default (15) equals 120 seconds.
MAX_TRIES=15
 
# An initial delay (in seconds) helps to avoid looking for the IPv6 network too early. Ideally, the first probe is successful.
# This would be the case if the time passed between the system log messages "Probing IPv6 route" and "Setting up NAT6" is 1 second.
DELAY=5
 
# Logical interface name of outbound IPv6 connection
# There should be no need to modify this, unless you changed the default network interface names
# Edit by Vincent: I never changed my default network interface names, but still I have to change the WAN6_NAME to "wan" instead of "wan6"
WAN6_NAME="wan6"
 
# ---------------------------------------------------
# Options end here - no need to change anything below
 
boot() {
        [ $DELAY -gt 0 ] && sleep $DELAY
        WAN6_INTERFACE=$(uci get "network.$WAN6_NAME.device" || uci get "network.$WAN6_NAME.ifname")
        logger -t NAT6 "Probing IPv6 route"
        PROBE=0
        COUNT=1
        while [ $PROBE -eq 0 ]
        do
                if [ $COUNT -gt $MAX_TRIES ]
                then
                        logger -t NAT6 "Fatal error: No IPv6 route found (reached retry limit)" && exit 1
                fi
                sleep $COUNT
                COUNT=$((COUNT+1))
                PROBE=$(ip -6 route | grep -i '^default.*via' | grep -i -F "dev $WAN6_INTERFACE" | grep -i -o 'via.*' | wc -l)
        done
 
        logger -t NAT6 "Setting up NAT6"
 
        if [ -z "$WAN6_INTERFACE" ] || [ ! -e "/sys/class/net/$WAN6_INTERFACE/" ] ; then
                logger -t NAT6 "Fatal error: Lookup of $WAN6_NAME interface failed. Were the default interface names changed?" && exit 1
        fi
        WAN6_GATEWAY=$(ip -6 route | grep -i '^default.*via' | grep -i -F "dev $WAN6_INTERFACE" | grep -i -o 'via.*' | cut -d ' ' -f 2 | head -n 1)
        if [ -z "$WAN6_GATEWAY" ] ; then
                logger -t NAT6 "Fatal error: No IPv6 gateway for $WAN6_INTERFACE found" && exit 1
        fi
        LAN_ULA_PREFIX=$(uci get network.globals.ula_prefix)
        if [ $(echo "$LAN_ULA_PREFIX" | grep -c -E "^([0-9a-fA-F]{4}):([0-9a-fA-F]{0,4}):") -ne 1 ] ; then
                logger -t NAT6 "Fatal error: IPv6 ULA prefix $LAN_ULA_PREFIX seems invalid. Please verify that a prefix is set and valid." && exit 1
        fi
 
        ip6tables -t nat -I POSTROUTING -s "$LAN_ULA_PREFIX" -o "$WAN6_INTERFACE" -j MASQUERADE
        if [ $? -eq 0 ] ; then
                logger -t NAT6 "Added IPv6 masquerading rule to the firewall (Src: $LAN_ULA_PREFIX - Dst: $WAN6_INTERFACE)"
        else
                logger -t NAT6 "Fatal error: Failed to add IPv6 masquerading rule to the firewall (Src: $LAN_ULA_PREFIX - Dst: $WAN6_INTERFACE)" && exit 1
        fi
 
        ip -6 route add 2000::/3 via "$WAN6_GATEWAY" dev "$WAN6_INTERFACE"
        if [ $? -eq 0 ] ; then
                logger -t NAT6 "Added $WAN6_GATEWAY to routing table as gateway on $WAN6_INTERFACE for outgoing connections"
        else
                logger -t NAT6 "Error: Failed to add $WAN6_GATEWAY to routing table as gateway on $WAN6_INTERFACE for outgoing connections"
        fi
 
        if [ $PRIVACY -eq 1 ] ; then
                echo 2 > "/proc/sys/net/ipv6/conf/$WAN6_INTERFACE/accept_ra"
                if [ $? -eq 0 ] ; then
                        logger -t NAT6 "Accepting router advertisements on $WAN6_INTERFACE even if forwarding is enabled (required for temporary addresses)"
                else
                        logger -t NAT6 "Error: Failed to change router advertisements accept policy on $WAN6_INTERFACE (required for temporary addresses)"
                fi
                echo 2 > "/proc/sys/net/ipv6/conf/$WAN6_INTERFACE/use_tempaddr"
                if [ $? -eq 0 ] ; then
                        logger -t NAT6 "Using temporary addresses for outgoing connections on interface $WAN6_INTERFACE"
                else
                        logger -t NAT6 "Error: Failed to enable temporary addresses for outgoing connections on interface $WAN6_INTERFACE"
                fi
        fi
 
        exit 0
}

第五步：执行命令

chmod +x /etc/init.d/nat6
/etc/init.d/nat6 enable

这一步是让 nat6 脚本开机启动。

第六步：执行命令

uci set firewall.@rule["$(uci show firewall | grep 'Allow-ICMPv6-Forward' | cut -d'[' -f2 | cut -d']' -f1)"].enabled='0'
uci commit firewall

这一步可省略。

第七步：修改

/etc/sysctl.conf 文件，修改以下内容，没有的话就添加

net.ipv6.conf.default.forwarding=2
net.ipv6.conf.all.forwarding=2
net.ipv6.conf.default.accept_ra=2
net.ipv6.conf.all.accept_ra=2

这一步必做。内核选项最好在 sysctl.conf 文件里改了，而不是看到 nat6 脚本里有了就不做了，否则可能失败。

第八步：重启路由器

第九步： 如果由于某些原因重启后还是无法成功 NAT6，需要在 OpenWRT 防火墙规则页面添加一句话，参考 这个回帖。

修改后的 NAT6 文件内容如下。注意换行符必须是LF

注意，在更新的OpenWRT里（如OpenWRT 21），有一处地方又发生了变化，文件的 $(uci get “network.$WAN6_NAME.ifname”) 可能需要改成 $(uci get “network.$WAN6_NAME.device”) 才能生效，因此我进一步改了脚本 改成了$(uci get “network.$WAN6_NAME.device” || uci get “network.$WAN6_NAME.ifname”)。或者你可以直接把 WAN6_INTERFACE=$(uci get “network.$WAN6_NAME.ifname”) 替换为 WAN6_INTERFACE=wan，其中wan为WAN6对应的网络设备名