IPv6 basics: verify ULA, RA/SLAAC, PD and DNS

Five address/mechanism terms

Name	Example/role	Common mistake
link-local	`fe80::/10`	every NIC has one; not public
ULA	inside `fd00::/8`	not directly routable on the internet
GUA	`2000::/3` public address	requires upstream PD/allocation
RA	router advertises prefix/gateway/DNS	no RA → no SLAAC
SLAAC	client generates an address from RA prefix	not DHCPv6
DHCPv6	server assigns address/prefix/DNS	different from IPv4 DHCP
PD	upstream delegates a prefix to the router	no PD → no LAN GUA

Current state

Router shellCheck addresses, routes and UCI

ip -6 addr show
ip -6 route
uci show network.lan
uci show dhcp.lan
uci show network.globals
logread -e odhcpd | tail -30

This lab: br-lan had ULA fd2f:385b:7d0a::1/60 and link-local; no default IPv6 route and no GUA.

ExpectedKnow whether you have only link-local, ULA, or GUA.

LAN: ULA + RA/SLAAC

Router shellConfirm LAN prefix and RA service

uci show network.globals.ula_prefix
uci show network.lan.ip6assign
uci show dhcp.lan.ra
uci show dhcp.lan.ra_slaac
uci show dhcp.lan.dhcpv6
ps | grep [o]dhcpd

This lab:

network.globals.ula_prefix='fd2f:385b:7d0a::/48'
network.lan.ip6assign='60'
dhcp.lan.ra='server'
dhcp.lan.ra_slaac='1'
dhcp.lan.dhcpv6='server'

ip6assign='60' takes a /60 for LAN out of the ULA /48; clients usually get /64.

ExpectedLAN has a ULA prefix and odhcpd sends RA.

ComputerLet a client get an address from RA

Linux example (accept_ra=2 only in this netns; normal clients usually keep defaults):

sysctl -w net.ipv6.conf.eth0.accept_ra=2
ip -6 addr show eth0
ip -6 route
ping -6 -c 2 <router-ULA>

This lab netns client got:

fd2f:385b:7d0a:0:5088:71ff:fed4:32d2/64  scope global dynamic
fe80::5088:71ff:fed4:32d2/64             scope link

and pinged fd2f:385b:7d0a::1. The client only had fd2f:385b:7d0a::/64, no default IPv6 route (no upstream).

ExpectedThe client gets a ULA and can ping the router IPv6.

WAN: GUA and PD

Router shellCheck whether WAN6/upstream provides a prefix

uci show network.wan6 2>/dev/null
ubus call network.interface.wan6 status 2>/dev/null
ip -6 route
ip -6 addr show eth1
logread | grep -Ei 'odhcp6c|dhcpv6|pd' | tail -30

Typical main router:

uci set network.wan6=interface
uci set network.wan6.device='eth1'
uci set network.wan6.proto='dhcpv6'
uci commit network
/etc/init.d/network reload

Upstream must support IPv6/PD; some ONTs/ISPs give only /64 or nothing;
Without PD, do not invent a “public prefix” on LAN;
This lab had no upstream IPv6, so GUA/PD were not verified; only ULA/RA/SLAAC were.

ExpectedA GUA and default route, or a clear upstream “no IPv6”.

DNS and firewall

Router shellTest AAAA and IPv6 DNS separately

nslookup -type=AAAA openwrt.org 127.0.0.1
nslookup -type=AAAA openwrt.org <router-ULA>
cat /tmp/resolv.conf.d/resolv.conf.auto

AAAA can resolve even when DNS uses IPv4;
client DNS may come from RA/DHCPv6 or manual config;
Do not switch all DNS to IPv6 for “IPv6 works”; keep IPv4/IPv6 fallback.

Firewall:

uci show firewall
nft list ruleset 2>/dev/null | head -80

Allow ICMPv6/ND/RA (otherwise IPv6 breaks);
Allow LAN→WAN IPv6 forward;
Do not disable the IPv6 firewall “to test connectivity”; that exposes the LAN.

ExpectedKnow whether it is “no AAAA” or “DNS did not use IPv6”.

Common failures

Only fe80 addresses

LAN has no ULA prefix/ip6assign;
odhcpd is not running / RA blocked;
client accept_ra=0;
switch/AP blocks multicast/ICMPv6.

ULA but no GUA

upstream has no IPv6/PD;
wan6 not configured/prefix not received;
ISP gives only /64, cannot split for LAN;
relay/ND proxy scenarios are different; do not force it.

Address but no internet

no default IPv6 route;
firewall forward/ICMPv6;
DNS only on IPv4;
upstream route/prefix invalid.

IPv4 slows/breaks after enabling IPv6

DNS preference/dual-stack fallback;
client privacy addresses/RA parameters;
Keep IPv4 working; add IPv6 one step at a time.

E2 lab run (2026-10-20)

Environment: OpenWrt 25.12.6 x86 VM 200; LAN 192.168.1.2/24 + ULA fd2f:385b:7d0a::1/60.
ULA prefix fd2f:385b:7d0a::/48; ip6assign=60; ra=server, ra_slaac=1, dhcpv6=server; odhcpd running.
Client: SLAAC got fd2f:385b:7d0a:0:5088:71ff:fed4:32d2/64; pinged the router ULA.
No upstream IPv6/GUA/PD; WAN6, real ISP, DHCPv6 client and IPv6 firewall/NAT untested.
Recipe: tests/recipes/ipv6-25.12.md.

Sources and review

This is E2 partial: LAN ULA/RA/SLAAC were tested; WAN GUA/PD and a real ISP were not.
No independent reviewer; conclusions are limited to this VM/netns environment.
Do not turn “LAN has a ULA” into “IPv6 internet works”; ULA is internal only.

Sources

Router.Homes

Independent OpenWrt notes. Every page states the firmware, device, package manager and way back.

Icons: Solar by 480 Design, CC BY 4.0