I have a fairly simple home network with both IPv4 and IPv6. I get a IPv6 prefix from my ISP and advertise it to local devices on my LAN through RA. Each device configures itself using SLAAC.
I have also configured a DNS forwarder in VyOS to cache DNS requests and provide DNS for LAN devices. All devices are informed about the DNS through either DHCP or RA. The local devices identify with the home.arpa domain. This works well for local IPv4 devices which advertise their hostname to the IPv4 DHCP server. The DHCP server writes the resulting hostname and IPv4 address to /etc/hosts such that the VyOS DNS forwarder picks it up. I can lookup mydevice as mydevice.home.arpa from any device on the network.
I can not figure out how to get this kind of local DNS resolution for the IPv6 addresses. Does SLAAC even inform VyOS about the resulting IP? And is there a way I can feed those dynamic IPv6 addresse into the DNS forwarder? What is the recommended way to get the IPv6 address of local devices when using SLAAC?
I am fairly new with VyOS. I have used an EdgeRouter 4 for the last eight years without really touching the tree config, and now I have a new box with VyOS. I am pretty sure that I got DNS resolution of IPv6 addresses on EdgeRouter, but I do not know how it did it.
Below is the sanitized config for VyOS (eth0 is WAN, eth1 is LAN):
firewall {
group {
interface-group WAN {
interface "eth0"
}
}
ipv4 {
name LAN-LOCAL {
default-action "accept"
}
name LAN-WAN {
default-action "accept"
rule 6 {
action "drop"
state "invalid"
}
}
name LOCAL-LAN {
default-action "accept"
}
name LOCAL-WAN {
default-action "accept"
}
name WAN-LAN {
default-action "drop"
rule 5 {
action "accept"
description "Allow Established/Related traffic from WAN to LAN"
state "established"
state "related"
}
rule 6 {
action "drop"
state "invalid"
}
rule 10 {
action "accept"
connection-status {
nat "destination"
}
description "Allow all destination NAT (DNAT) port forwarding connections."
}
rule 20 {
action "accept"
protocol "icmp"
}
}
name WAN-LOCAL {
default-action "drop"
rule 5 {
action "accept"
description "Allow Established/Related traffic to LOCAL from WAN."
state "established"
state "related"
}
rule 6 {
action "drop"
state "invalid"
}
rule 10 {
action "accept"
connection-status {
nat "destination"
}
description "Allow all estination NAT (DNAT) port forwarding connections."
}
rule 20 {
action "accept"
protocol "icmp"
}
}
}
ipv6 {
name LAN-LOCAL {
default-action "accept"
}
name LAN-WAN {
default-action "accept"
rule 6 {
action "drop"
state "invalid"
}
}
name LOCAL-LAN {
default-action "accept"
}
name LOCAL-WAN {
default-action "accept"
}
name WAN-LAN {
default-action "drop"
rule 5 {
action "accept"
state "established"
state "related"
}
rule 6 {
action "drop"
state "invalid"
}
rule 20 {
action "accept"
protocol "ipv6-icmp"
}
}
name WAN-LOCAL {
default-action "drop"
rule 5 {
action "accept"
state "established"
state "related"
}
rule 6 {
action "drop"
state "invalid"
}
rule 20 {
action "accept"
protocol "ipv6-icmp"
}
rule 30 {
action "accept"
description "Allow DHCPv6 configuration"
destination {
port "546"
}
protocol "udp"
source {
port "547"
}
}
rule 40 {
action "accept"
description "Allow Wireguard to router."
destination {
port "51820"
}
protocol "udp"
}
}
}
zone LAN {
default-action "drop"
description "Zone for LAN"
from LOCAL {
firewall {
ipv6-name "LOCAL-LAN"
name "LOCAL-LAN"
}
}
from WAN {
firewall {
ipv6-name "WAN-LAN"
name "WAN-LAN"
}
}
member {
interface "eth1"
interface "wg1"
}
}
zone LOCAL {
default-action "drop"
description "Zone for LOCAL (router-internal)"
from LAN {
firewall {
ipv6-name "LAN-LOCAL"
name "LAN-LOCAL"
}
}
from WAN {
firewall {
ipv6-name "WAN-LOCAL"
name "WAN-LOCAL"
}
}
local-zone
}
zone WAN {
default-action "drop"
description "Zone for WAN (big internet)"
from LAN {
firewall {
ipv6-name "LAN-WAN"
name "LAN-WAN"
}
}
from LOCAL {
firewall {
ipv6-name "LOCAL-WAN"
name "LOCAL-WAN"
}
}
member {
interface "eth0"
}
}
}
interfaces {
ethernet eth0 {
address "dhcp"
address "dhcpv6"
description "WAN"
dhcp-options {
default-route-distance "10"
}
dhcpv6-options {
pd 0 {
interface eth1 {
address "1"
sla-id "16"
}
length "48"
}
}
hw-id "00:d0:b4:05:c5:90"
ipv6 {
address {
autoconf
}
}
mac "fc:ec:da:43:fd:b8"
offload {
gro
gso
sg
tso
}
}
ethernet eth1 {
address "192.168.10.1/24"
address "fd00:10::1/64"
description "LAN"
hw-id "00:d0:b4:05:c5:91"
ipv6 {
address {
autoconf
}
}
offload {
gro
gso
sg
tso
}
}
loopback lo {
}
}
nat {
source {
rule 100 {
description "NAT of regular LAN traffic to WAN."
outbound-interface {
group "WAN"
}
source {
address "192.168.10.0/24"
}
translation {
address "masquerade"
}
}
}
}
service {
dhcp-server {
hostfile-update
shared-network-name LAN {
authoritative
option {
domain-name "home.arpa"
domain-search "home.arpa"
name-server "192.168.10.1"
}
subnet 192.168.10.0/23 {
lease "86400"
option {
bootfile-name "netboot.xyz-snponly.efi"
bootfile-server "192.168.10.10"
default-router "192.168.10.1"
tftp-server-name "192.168.10.10"
}
range 0 {
start "192.168.10.64"
stop "192.168.10.250"
}
static-mapping myfixeddevice {
ip-address "192.168.10.10"
mac "f8:b1:56:a3:b3:4d"
}
subnet-id "1"
}
}
}
dns {
forwarding {
allow-from "192.168.10.0/24"
allow-from "fd00:10::/64"
listen-address "192.168.10.1"
listen-address "fd00:10::1"
system
}
}
ntp {
allow-client {
address "127.0.0.0/8"
address "169.254.0.0/16"
address "10.0.0.0/8"
address "172.16.0.0/12"
address "192.168.0.0/16"
address "::1/128"
address "fe80::/10"
address "fc00::/7"
}
server time1.vyos.net {
}
server time2.vyos.net {
}
server time3.vyos.net {
}
}
router-advert {
interface eth1 {
dnssl "home.arpa"
name-server "fd00:10::1"
prefix ::/64 {
}
prefix fd00:10::/64 {
}
}
}
}
system {
console {
device ttyS0 {
speed "115200"
}
}
domain-name "home.arpa"
host-name "vyos-router"
name-server "1.1.1.1"
name-server "8.8.8.8"
name-server "2606:4700:4700::1111"
name-server "2001:4860:4860::8888"
option {
kernel {
disable-mitigations
}
keyboard-layout "no"
reboot-on-upgrade-failure "5"
startup-beep
}
syslog {
local {
facility all {
level "info"
}
facility local7 {
level "debug"
}
}
}
time-zone "Europe/Oslo"
}
