Chci rozjet IPv6 na routeru (Linux Debian 10, Quagga, ručně bez DHCP)

<h2>Než začneme</h2><p>Nainstalovat balíček <code>quagga-ospf6d</code> </p><table class="wysiwyg-macro" data-macro-name="code" data-macro-id="6dbd7fb3-b92e-4dde-894d-41242bd83c9c" aria-label="code macro" data-macro-schema-version="1" style="background-image: url(https://confluence.hkfree.org/plugins/servlet/confluence/placeholder/macro-heading?definition=e2NvZGV9&amp;locale=cs_CZ&amp;version=2); background-repeat: no-repeat;" data-macro-body-type="PLAIN_TEXT"><tr><td class="wysiwyg-macro-body"><pre>root@debian10a:~# apt install quagga-ospf6d</pre></td></tr></table><p><br /></p><h2>Zapnout IPv6 a forwarding</h2><p>Poeditovat sysctl.conf</p><table class="wysiwyg-macro" data-macro-name="code" data-macro-id="7e5ed5ca-c155-40ec-a0b8-1903da3191de" aria-label="code macro" data-macro-schema-version="1" style="background-image: url(https://confluence.hkfree.org/plugins/servlet/confluence/placeholder/macro-heading?definition=e2NvZGV9&amp;locale=cs_CZ&amp;version=2); background-repeat: no-repeat;" data-macro-body-type="PLAIN_TEXT"><tr><td class="wysiwyg-macro-body"><pre>root@debian10a:~# nano /etc/sysctl.conf</pre></td></tr></table><p>Najít <code>net.ipv6.conf.all.forwarding</code>  a nastavit <code>1</code>. (projeví se po rebootu)</p><table class="wysiwyg-macro" data-macro-name="code" data-macro-id="8984e3c1-0fd7-4db6-bc90-fda0c500279e" aria-label="code macro" data-macro-schema-version="1" style="background-image: url(https://confluence.hkfree.org/plugins/servlet/confluence/placeholder/macro-heading?definition=e2NvZGV9&amp;locale=cs_CZ&amp;version=2); background-repeat: no-repeat;" data-macro-body-type="PLAIN_TEXT"><tr><td class="wysiwyg-macro-body"><pre># Uncomment the next line to enable packet forwarding for IPv6
#  Enabling this option disables Stateless Address Autoconfiguration
#  based on Router Advertisements for this host
net.ipv6.conf.all.forwarding=1</pre></td></tr></table><p>Spustit sysctl (projeví se hned)</p><table class="wysiwyg-macro" data-macro-name="code" data-macro-id="c0d711bc-80d3-4b2e-9fbb-97476938cf3b" aria-label="code macro" data-macro-schema-version="1" style="background-image: url(https://confluence.hkfree.org/plugins/servlet/confluence/placeholder/macro-heading?definition=e2NvZGV9&amp;locale=cs_CZ&amp;version=2); background-repeat: no-repeat;" data-macro-body-type="PLAIN_TEXT"><tr><td class="wysiwyg-macro-body"><pre>root@debian10a:~# sysctl net.ipv6.conf.all.forwarding=1</pre></td></tr></table><p>Kontrola (musí tam bejt 1)</p><table class="wysiwyg-macro" data-macro-name="code" data-macro-id="216d258d-19cf-4068-a77d-429eb6ee53f6" aria-label="code macro" data-macro-schema-version="1" style="background-image: url(https://confluence.hkfree.org/plugins/servlet/confluence/placeholder/macro-heading?definition=e2NvZGV9&amp;locale=cs_CZ&amp;version=2); background-repeat: no-repeat;" data-macro-body-type="PLAIN_TEXT"><tr><td class="wysiwyg-macro-body"><pre>root@debian10a:~# sysctl net.ipv6.conf.all.forwarding
net.ipv6.conf.all.forwarding = 1</pre></td></tr></table><p><br /></p><h2>Nastavit vlastní adresu pro router</h2><p>Poeditovat /etc/network/interfaces</p><table class="wrapped confluenceTable"><colgroup><col /><col /></colgroup><tbody><tr><th scope="col" class="confluenceTh">před (pouze IPv4)</th><th scope="col" class="confluenceTh">po (oboje IPv4 a IPv6)</th></tr><tr><td class="confluenceTd"><div class="content-wrapper"><table class="wysiwyg-macro" data-macro-name="code" data-macro-id="6ec68354-bc15-4931-a1a0-309b9157fe5a" aria-label="code macro" data-macro-schema-version="1" style="background-image: url(https://confluence.hkfree.org/plugins/servlet/confluence/placeholder/macro-heading?definition=e2NvZGV9&amp;locale=cs_CZ&amp;version=2); background-repeat: no-repeat;" data-macro-body-type="PLAIN_TEXT"><tr><td class="wysiwyg-macro-body"><pre># The loopback network interface
auto lo
iface lo inet loopback

# Spoj -> PMV, uplink
auto enp0s8
iface enp0s8 inet static
 address 10.107.99.130/30

# AP Oblast-DB1, router 1, tady jsou pripojenci
auto enp0s9
iface enp0s9 inet static
 address 10.107.184.1/26</pre></td></tr></table><p><br /></p></div></td><td class="confluenceTd"><div class="content-wrapper"><table class="wysiwyg-macro" data-macro-name="code" data-macro-id="77472a38-e1aa-4b5f-b498-675c767be056" aria-label="code macro" data-macro-schema-version="1" style="background-image: url(https://confluence.hkfree.org/plugins/servlet/confluence/placeholder/macro-heading?definition=e2NvZGV9&amp;locale=cs_CZ&amp;version=2); background-repeat: no-repeat;" data-macro-body-type="PLAIN_TEXT"><tr><td class="wysiwyg-macro-body"><pre># The loopback network interface
auto lo
iface lo inet loopback

# Spoj -> PMV, uplink
auto enp0s8
iface enp0s8 inet static
 address 10.107.99.130/30
# tady nepotřebuješ inet6, stačí ti link-local adresa (fe80::)

# AP Oblast-DB1, router 1, tady jsou pripojenci
auto enp0s9
iface enp0s9 inet static
 address 10.107.184.1/26
iface enp0s9 inet6 static
 address 2a01:16d:b110::/64</pre></td></tr></table><p><br /></p></div></td></tr></tbody></table><ul><li>Na interface routeru doporučuji vždy nasazovat IPv6 adresu s prefixem<span> </span><strong>/64</strong><span> </span>(pokud tam chcete adresovat více zařízení) nebo<span> </span><strong>/128</strong><span> </span>(pokud vám stačí jen jedna adresa pro management). Vyvarujte se adresovat velké prefixy<span> </span><strong>/40</strong>,<strong><span> </span>/44</strong><span> </span>a<strong><span> </span>/48</strong><span> </span>pokud vyloženě nevíte co děláte - přináší to problémy a nestandardní chování. Například nefunguje redistribute static apod.</li></ul><p>Shodit a nahodit interface (bacha na ostrý síti!)</p><table class="wysiwyg-macro" data-macro-name="code" data-macro-id="4eae5a3f-af9e-495c-bb35-b25721d2460c" aria-label="code macro" data-macro-schema-version="1" style="background-image: url(https://confluence.hkfree.org/plugins/servlet/confluence/placeholder/macro-heading?definition=e2NvZGV9&amp;locale=cs_CZ&amp;version=2); background-repeat: no-repeat;" data-macro-body-type="PLAIN_TEXT"><tr><td class="wysiwyg-macro-body"><pre>root@debian10a:~# ifdown enp0s9; ifup enp0s9</pre></td></tr></table><p>Kontrola</p><table class="wysiwyg-macro" data-macro-name="code" data-macro-id="dd62f2cc-126b-4732-8ce3-b674f8b0e944" aria-label="code macro" data-macro-schema-version="1" style="background-image: url(https://confluence.hkfree.org/plugins/servlet/confluence/placeholder/macro-heading?definition=e2NvZGV9&amp;locale=cs_CZ&amp;version=2); background-repeat: no-repeat;" data-macro-body-type="PLAIN_TEXT"><tr><td class="wysiwyg-macro-body"><pre>root@debian10a:~# ip address show</pre></td></tr></table><h2>Routování - co budeme šířit ven?</h2><p>Zadat 1x agregovanou routu pro tento router. Velikost bude mezi /40 - /48, <a class="external-link" href="https://wiki.hkfree.org/IPv6#pods.C3.AD.C5.A5_v_oblasti_.2F48.2C_tzn._pp_.3D_00_-_ff_.28256_s.C3.ADt.C3.AD_v_oblasti.29." rel="nofollow">záleží na správci</a>. Doporučuju /44.</p><p><u>/etc/quagga/zebra.conf</u></p><table class="wrapped confluenceTable"><colgroup class=""><col class="" /><col class="" /></colgroup><tbody class=""><tr class=""><th class="confluenceTh">před (pouze IPv4)</th><th class="confluenceTh">po (oboje IPv4 a IPv6)</th></tr><tr class=""><td class="confluenceTd"><div class="content-wrapper"><table class="wysiwyg-macro" data-macro-name="code" data-macro-id="4e374fef-497d-46f7-8c65-db502193fdd1" aria-label="code macro" data-macro-schema-version="1" style="background-image: url(https://confluence.hkfree.org/plugins/servlet/confluence/placeholder/macro-heading?definition=e2NvZGV9&amp;locale=cs_CZ&amp;version=2); background-repeat: no-repeat;" data-macro-body-type="PLAIN_TEXT"><tr><td class="wysiwyg-macro-body"><pre>!
! Vzorovy router, oblast DB1, router 1
!
hostname oblastDB1-router1
password free
enable password ch80hv7836so20dh235f

ip route 224.0.0.5/32 127.0.0.1
ip route 224.0.0.6/32 127.0.0.1

! Verejky IPv4
ip route 89.200.200.16/28 eth0

ip forwarding

</pre></td></tr></table><p><br /></p></div></td><td class="confluenceTd"><div class="content-wrapper"><table class="wysiwyg-macro" data-macro-name="code" data-macro-id="0b47e44f-6cca-4224-ad00-5ec10ecc9fca" aria-label="code macro" data-macro-schema-version="1" style="background-image: url(https://confluence.hkfree.org/plugins/servlet/confluence/placeholder/macro-heading?definition=e2NvZGV9&amp;locale=cs_CZ&amp;version=2); background-repeat: no-repeat;" data-macro-body-type="PLAIN_TEXT"><tr><td class="wysiwyg-macro-body"><pre>!
! Vzorovy router, oblast DB1, router 1
!
hostname oblastDB1-router1
password free
enable password ch80hv7836so20dh235f

ip route 224.0.0.5/32 127.0.0.1
ip route 224.0.0.6/32 127.0.0.1

! Verejky IPv4
ip route 89.200.200.16/28 eth0

! IPv6: Agregovana routa pro cely tento router (jde ven pres OSPF)
ipv6 route 2a01:16d:b110::/44 lo

ip forwarding
ipv6 forwarding</pre></td></tr></table><p><br /></p></div></td></tr></tbody></table><p><br /></p><p><u>/etc/quagga/ospf6d.conf</u></p><table class="wysiwyg-macro" data-macro-name="code" data-macro-id="221d367d-ecb6-476d-be84-2f9193a9ff3d" aria-label="code macro" data-macro-schema-version="1" style="background-image: url(https://confluence.hkfree.org/plugins/servlet/confluence/placeholder/macro-heading?definition=e2NvZGV9&amp;locale=cs_CZ&amp;version=2); background-repeat: no-repeat;" data-macro-body-type="PLAIN_TEXT"><tr><td class="wysiwyg-macro-body"><pre>!
! Vzorovy router, oblast DB1, router 1
!
hostname oblastDB1-router1
password free
enable password ch80hv7836so20dh235f

interface enp0s8
 description Spoj -> PMV, uplink
 ipv6 ospf6 cost 10
 ipv6 ospf6 hello-interval 2
 ipv6 ospf6 dead-interval 6
 ipv6 ospf6 network point-to-point

router ospf6
 router-id 10.107.184.1
 redistribute static route-map JEN-VELKY-SUBNETY
 interface enp0s8 area 0.0.0.0

route-map JEN-VELKY-SUBNETY permit 10
  match ipv6 address prefix-list velikost-40-az-48

ipv6 prefix-list velikost-40-az-48 seq 5 permit 2a01:168::/29 ge 40 le 48

</pre></td></tr></table><p><br /></p><h2>Adresy pro připojence ručně bez DHCP</h2><h3>Rozvaha</h3><p>Ze subnetu <span style="color: rgb(0,128,0);">2a01:16d:b11</span>0::/44 (oblast DB1, router 1) si ukrojíme <span style="color: rgb(0,128,0);">2a01:16d:b110</span>::/48 (oblast DB1, router 1, interface enp0s9).</p><p>Tento menší subnet rozdělíme na </p><ol><li><span style="color: rgb(0,128,0);">2a01:16d:b110:00</span>00::/56 - pro WAN <br /><ul><li>z toho jednu /64 pro &quot;spojovací&quot; síť, jednotlivé adresy na WAN interfacech připojenců</li><li>viz co jsme nastavili na enp0s9</li></ul></li><li><span style="color: rgb(255,0,0);">2a01:16d:b110:01</span>00::/56 - pro připojence UID2345</li><li><span style="color: rgb(255,0,0);">2a01:16d:b110:02</span>00::/56 - pro připojence UID2346</li><li><span style="color: rgb(255,0,0);">2a01:16d:b110:03</span>00::/56 - pro připojence UID2347</li><li><span style="color: rgb(255,0,0);">2a01:16d:b110:04</span>00::/56 - pro připojence UID2348</li></ol><p><br /></p><table class="wrapped confluenceTable"><colgroup><col /><col /><col /><col /></colgroup><tbody><tr><th scope="col" class="confluenceTh">připojenec</th><th scope="col" class="confluenceTh">jedna adresa pro WAN interface</th><th scope="col" class="confluenceTh">routovaný &quot;/56&quot; subnet</th><th scope="col" class="confluenceTh"><br /></th></tr><tr><td class="confluenceTd">UID2345</td><td class="confluenceTd">2a01:16d:b110::01/64</td><td class="confluenceTd">2a01:16d:b110:0100::/56</td><td class="confluenceTd"><br /></td></tr><tr><td class="confluenceTd">UID2346</td><td class="confluenceTd">2a01:16d:b110::02/64</td><td class="confluenceTd">2a01:16d:b110:0200::/56</td><td class="confluenceTd"><br /></td></tr><tr><td class="confluenceTd">UID2347</td><td class="confluenceTd">2a01:16d:b110::03/64</td><td class="confluenceTd">2a01:16d:b110:0300::/56</td><td class="confluenceTd"><br /></td></tr><tr><td class="confluenceTd">UID2348</td><td class="confluenceTd">2a01:16d:b110::04/64</td><td class="confluenceTd">2a01:16d:b110:0400::/56</td><td class="confluenceTd"><br /></td></tr></tbody></table><p><br /></p><h3>Krok za krokem - připojenec UID2345</h3><p>Zapsat do userdb do poznámky:<br /><em>IPv6 adresa: 2a01:16d:b110::01</em><br /><em>IPv6 subnet: 2a01:16d:b110:0100::/56</em></p><p><br /></p><table class="wrapped confluenceTable"><colgroup><col /><col /></colgroup><tbody><tr><th scope="col" class="confluenceTh">nastavení v síti (na hkfree routeru)</th><th scope="col" class="confluenceTh">nastavení u připojence (na jejich routeru)</th></tr><tr><td class="confluenceTd"><div class="content-wrapper"><p>Přidat do <code>/etc/quagga/zebra.conf</code> :</p><table class="wysiwyg-macro" data-macro-name="code" data-macro-id="feab2342-5bb8-4ba7-87f1-996abef8df2f" aria-label="code macro" data-macro-schema-version="1" style="background-image: url(https://confluence.hkfree.org/plugins/servlet/confluence/placeholder/macro-heading?definition=e2NvZGV9&amp;locale=cs_CZ&amp;version=2); background-repeat: no-repeat;" data-macro-body-type="PLAIN_TEXT"><tr><td class="wysiwyg-macro-body"><pre>! UID2345 Josef Novak
ipv6 route 2a01:16d:b110:0100::/56 2a01:16d:b110::01</pre></td></tr></table></div><p><br /></p><p>Bez restartu routu oživit:</p><table class="wysiwyg-macro" data-macro-name="code" data-macro-id="151ccae9-fa10-4b2e-8b6a-651485ca2d95" aria-label="code macro" data-macro-schema-version="1" style="background-image: url(https://confluence.hkfree.org/plugins/servlet/confluence/placeholder/macro-heading?definition=e2NvZGV9&amp;locale=cs_CZ&amp;version=2); background-repeat: no-repeat;" data-macro-body-type="PLAIN_TEXT"><tr><td class="wysiwyg-macro-body"><pre>root@debian10a:~# vtysh -c "configure terminal" -c "ipv6 route 2a01:16d:b110:0100::/56 2a01:16d:b110::01"</pre></td></tr></table><p><br /></p></td><td class="confluenceTd"><p>WAN interface</p><p>IP: <code>2a01:16d:b110::01/64</code> </p><p>Gateway: <code>2a01:16d:b110::</code> </p><p>DNS: <code>2a01:168:0:10::f:2</code> </p><p><br /></p><p>LAN interface</p><p>IP: 2a01:16d:b110:0100::/64</p><p>zapnout SLAAC (v RouterOS se to jmenuje <img class="emoticon emoticon-2611" data-emoji-id="2611" border="0" src="/plugins/servlet/twitterEmojiRedirector?id=2611" alt="check box with check" title="check box with check" data-emoji-short-name=":ballot_box_with_check:" /> Advertise)</p></td></tr></tbody></table><p><br /></p><h3>Krok za krokem - připojenec UID2346</h3><p>Zapsat do userdb do poznámky:<br /><em>IPv6 adresa: 2a01:16d:b110::02</em><br /><em>IPv6 subnet: 2a01:16d:b110:0200::/56</em></p><p><br /></p><table class="wrapped confluenceTable"><colgroup class=""><col class="" /><col class="" /></colgroup><tbody class=""><tr class=""><th class="confluenceTh">nastavení v síti (na hkfree routeru)</th><th class="confluenceTh">nastavení u připojence (na jejich routeru)</th></tr><tr class=""><td class="confluenceTd"><div class="content-wrapper"><p>Přidat do <code>/etc/quagga/zebra.conf</code> :</p><table class="wysiwyg-macro" data-macro-name="code" data-macro-id="0bcab1f0-31d3-4a8d-894a-4ca71f757619" aria-label="code macro" data-macro-schema-version="1" style="background-image: url(https://confluence.hkfree.org/plugins/servlet/confluence/placeholder/macro-heading?definition=e2NvZGV9&amp;locale=cs_CZ&amp;version=2); background-repeat: no-repeat;" data-macro-body-type="PLAIN_TEXT"><tr><td class="wysiwyg-macro-body"><pre>! UID2346 Johanka z Arku
ipv6 route 2a01:16d:b110:0200::/56 2a01:16d:b110::02</pre></td></tr></table></div><p><br /></p><p>Bez restartu routu oživit:</p><table class="wysiwyg-macro" data-macro-name="code" data-macro-id="9027805e-b919-4f00-8fd7-d6ae68abb4ab" aria-label="code macro" data-macro-schema-version="1" style="background-image: url(https://confluence.hkfree.org/plugins/servlet/confluence/placeholder/macro-heading?definition=e2NvZGV9&amp;locale=cs_CZ&amp;version=2); background-repeat: no-repeat;" data-macro-body-type="PLAIN_TEXT"><tr><td class="wysiwyg-macro-body"><pre>root@debian10a:~# vtysh -c "configure terminal" -c "ipv6 route 2a01:16d:b110:0200::/56 2a01:16d:b110::02"</pre></td></tr></table><p><br /></p></td><td class="confluenceTd"><p>WAN interface</p><p>IP: <code>2a01:16d:b110::02/64</code> </p><p>Gateway: <code>2a01:16d:b110::</code> </p><p>DNS: <code>2a01:168:0:10::f:2</code> </p><p><br /></p><p>LAN interface</p><p>IP: 2a01:16d:b110:0200::/64</p><p>zapnout SLAAC (v RouterOS se to jmenuje <img class="emoticon emoticon-2611" data-emoji-id="2611" border="0" src="/plugins/servlet/twitterEmojiRedirector?id=2611" alt="check box with check" title="check box with check" data-emoji-short-name=":ballot_box_with_check:" /> Advertise)</p></td></tr></tbody></table><p><br /></p><h3>Krok za krokem - připojenec UID2347</h3><p>Zapsat do userdb do poznámky:<br /><em>IPv6 adresa: 2a01:16d:b110::03</em><br /><em>IPv6 subnet: 2a01:16d:b110:0300::/56</em></p><p><br /></p><table class="wrapped confluenceTable"><colgroup class=""><col class="" /><col class="" /></colgroup><tbody class=""><tr class=""><th class="confluenceTh">nastavení v síti (na hkfree routeru)</th><th class="confluenceTh">nastavení u připojence (na jejich routeru)</th></tr><tr class=""><td class="confluenceTd"><div class="content-wrapper"><p>Přidat do <code>/etc/quagga/zebra.conf</code> :</p><table class="wysiwyg-macro" data-macro-name="code" data-macro-id="bd24c75a-93f4-48ae-8403-5f1de53e69d5" aria-label="code macro" data-macro-schema-version="1" style="background-image: url(https://confluence.hkfree.org/plugins/servlet/confluence/placeholder/macro-heading?definition=e2NvZGV9&amp;locale=cs_CZ&amp;version=2); background-repeat: no-repeat;" data-macro-body-type="PLAIN_TEXT"><tr><td class="wysiwyg-macro-body"><pre>! UID2347 John the Ripper
ipv6 route 2a01:16d:b110:0300::/56 2a01:16d:b110::03</pre></td></tr></table></div><p><br /></p><p>Bez restartu routu oživit:</p><table class="wysiwyg-macro" data-macro-name="code" data-macro-id="6213074b-e8f5-4147-9437-ddd47768e40d" aria-label="code macro" data-macro-schema-version="1" style="background-image: url(https://confluence.hkfree.org/plugins/servlet/confluence/placeholder/macro-heading?definition=e2NvZGV9&amp;locale=cs_CZ&amp;version=2); background-repeat: no-repeat;" data-macro-body-type="PLAIN_TEXT"><tr><td class="wysiwyg-macro-body"><pre>root@debian10a:~# vtysh -c "configure terminal" -c "ipv6 route 2a01:16d:b110:0300::/56 2a01:16d:b110::03"</pre></td></tr></table><p><br /></p></td><td class="confluenceTd"><p>WAN interface</p><p>IP: <code>2a01:16d:b110::03/64</code> </p><p>Gateway: <code>2a01:16d:b110::</code> </p><p>DNS: <code>2a01:168:0:10::f:2</code> </p><p><br /></p><p>LAN interface</p><p>IP: 2a01:16d:b110:0300::/64</p><p>zapnout SLAAC (v RouterOS se to jmenuje <img class="emoticon emoticon-2611" data-emoji-id="2611" border="0" src="/plugins/servlet/twitterEmojiRedirector?id=2611" alt="check box with check" title="check box with check" data-emoji-short-name=":ballot_box_with_check:" /> Advertise)</p></td></tr></tbody></table><p><br /></p><p><br /></p><p><br /></p><p><br /></p><p><br /></p><p><br /></p>