Salut,
je vous ajoute la configuration de mon routeur Linux.
root@pve:~ $ uname -a
Linux pve 6.1.0-23-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.99-1 (2024-07-15) x86_64 GNU/Linux
root@pve:~ $ cat /etc/os-release
PRETTY_NAME="Debian GNU/Linux 12 (bookworm)"
NAME="Debian GNU/Linux"
VERSION_ID="12"
VERSION="12 (bookworm)"
VERSION_CODENAME=bookworm
ID=debian
HOME_URL="https://www.debian.org/"
SUPPORT_URL="https://www.debian.org/support"
BUG_REPORT_URL="https://bugs.debian.org/"
Les interfaces réseaux :
root@pve:~ $ lshw -class network
*-network:0
description: Ethernet interface
produit: NetXtreme II BCM57810 10 Gigabit Ethernet
fabriquant: Broadcom Inc. and subsidiaries
identifiant matériel: 0
information bus: pci@0000:01:00.0
nom logique: enp1s0f0
version: 10
numéro de série: 98:b7:85:20:46:e0
taille: 10Gbit/s
capacité: 10Gbit/s
bits: 64 bits
horloge: 33MHz
fonctionnalités: pm vpd msi msix pciexpress bus_master cap_list rom ethernet physical fibre 1000bt-fd 10000bt-fd
configuration: autonegotiation=off broadcast=yes driver=bnx2x driverversion=6.1.0-23-amd64 duplex=full firmware=7.13b.4.1c bc 7.13.75 latency=0 link=yes multicast=yes speed=10Gbit/s
ressources: irq:16 mémoire:51800000-51ffffff mémoire:51000000-517fffff mémoire:52010000-5201ffff mémoire:54180000-541fffff
*-network:1
description: Ethernet interface
produit: NetXtreme II BCM57810 10 Gigabit Ethernet
fabriquant: Broadcom Inc. and subsidiaries
identifiant matériel: 0.1
information bus: pci@0000:01:00.1
nom logique: enp1s0f1
version: 10
numéro de série: 98:b7:85:20:46:e1
capacité: 10Gbit/s
bits: 64 bits
horloge: 33MHz
fonctionnalités: pm vpd msi msix pciexpress bus_master cap_list rom ethernet physical fibre 1000bt-fd 10000bt-fd
configuration: autonegotiation=off broadcast=yes driver=bnx2x driverversion=6.1.0-23-amd64 firmware=7.13b.4.1c bc 7.13.75 latency=0 link=no multicast=yes port=fibre
ressources: irq:17 mémoire:50800000-50ffffff mémoire:50000000-507fffff mémoire:52000000-5200ffff mémoire:54100000-5417ffff
*-network:0
description: Interface réseau sans fil
produit: Cannon Lake PCH CNVi WiFi
fabriquant: Intel Corporation
identifiant matériel: 14.3
information bus: pci@0000:00:14.3
nom logique: wlo1
version: 10
numéro de série: 98:af:65:9b:45:79
bits: 64 bits
horloge: 33MHz
fonctionnalités: pm msi pciexpress msix bus_master cap_list ethernet physical wireless
configuration: broadcast=yes driver=iwlwifi driverversion=6.1.0-23-amd64 firmware=46.ea3728ee.0 9000-pu-b0-jf-b0- latency=0 link=yes multicast=yes wireless=IEEE 802.11
ressources: irq:16 mémoire:54234000-54237fff
*-network:1
description: Ethernet interface
produit: Ethernet Connection (7) I219-V
fabriquant: Intel Corporation
identifiant matériel: 1f.6
information bus: pci@0000:00:1f.6
nom logique: eno2
version: 10
numéro de série: b4:2e:99:aa:98:2f
taille: 1Gbit/s
capacité: 1Gbit/s
bits: 32 bits
horloge: 33MHz
fonctionnalités: pm msi bus_master cap_list ethernet physical tp 10bt 10bt-fd 100bt 100bt-fd 1000bt-fd autonegotiation
configuration: autonegotiation=on broadcast=yes driver=e1000e driverversion=6.1.0-23-amd64 duplex=full firmware=0.5-4 latency=0 link=yes multicast=yes port=twisted pair speed=1Gbit/s
ressources: irq:126 mémoire:54200000-5421ffff
La configuration IP des interfaces réseaux :
root@pve:~ $ ifconfig
eno2: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
ether b4:2e:99:aa:98:2f txqueuelen 1000 (Ethernet)
RX packets 28413471 bytes 35538979118 (33.0 GiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 11909071 bytes 3520880855 (3.2 GiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
device interrupt 16 memory 0x54200000-54220000
enp1s0f0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
ether 98:b7:85:20:46:e0 txqueuelen 1000 (Ethernet)
RX packets 11473775 bytes 4167184558 (3.8 GiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 25664404 bytes 32295796527 (30.0 GiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
device interrupt 16 memory 0x51800000-51ffffff
enp1s0f1: flags=4099<UP,BROADCAST,MULTICAST> mtu 1500
ether 98:b7:85:20:46:e1 txqueuelen 1000 (Ethernet)
RX packets 0 bytes 0 (0.0 B)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 0 bytes 0 (0.0 B)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
device interrupt 17 memory 0x50800000-50ffffff
lanbr0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet 172.16.0.254 netmask 255.255.255.0 broadcast 172.16.0.255
inet6 fe80::d02f:72ff:fea8:7c4e prefixlen 64 scopeid 0x20<link>
inet6 fc01::172:16:0:254 prefixlen 104 scopeid 0x0<global>
ether d2:2f:72:a8:7c:4e txqueuelen 1000 (Ethernet)
RX packets 10514575 bytes 3896990206 (3.6 GiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 19910537 bytes 31818617209 (29.6 GiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
lo: flags=73<UP,LOOPBACK,RUNNING> mtu 65536
inet 127.0.0.1 netmask 255.0.0.0
inet6 ::1 prefixlen 128 scopeid 0x10<host>
loop txqueuelen 1000 (Boucle locale)
RX packets 211 bytes 81014 (79.1 KiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 211 bytes 81014 (79.1 KiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
netbr0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet 192.168.1.254 netmask 255.255.255.0 broadcast 192.168.1.255
inet6 2a01:cb1d:12:1c00::1 prefixlen 64 scopeid 0x0<global>
inet6 fe80::e46c:baff:fe32:4113 prefixlen 64 scopeid 0x20<link>
ether e6:6c:ba:32:41:13 txqueuelen 1000 (Ethernet)
RX packets 19487792 bytes 34560475071 (32.1 GiB)
RX errors 0 dropped 73543 overruns 0 frame 0
TX packets 10895474 bytes 3393043258 (3.1 GiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
vmbr0: flags=4099<UP,BROADCAST,MULTICAST> mtu 1500
inet 10.126.42.254 netmask 255.255.255.0 broadcast 10.126.42.255
inet6 fc01::10:126:42:254 prefixlen 104 scopeid 0x0<global>
ether 62:4b:0c:67:e5:6a txqueuelen 1000 (Ethernet)
RX packets 0 bytes 0 (0.0 B)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 0 bytes 0 (0.0 B)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
wifibr0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet 10.6.42.254 netmask 255.255.255.0 broadcast 10.6.42.255
inet6 fe80::6822:e7ff:fe4b:f077 prefixlen 64 scopeid 0x20<link>
inet6 fc01::10:6:42:254 prefixlen 104 scopeid 0x0<global>
ether 6a:22:e7:4b:f0:77 txqueuelen 1000 (Ethernet)
RX packets 1199607 bytes 458830788 (437.5 MiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 2565510 bytes 3204480278 (2.9 GiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
wlo1: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
ether 98:af:65:9b:45:79 txqueuelen 1000 (Ethernet)
RX packets 1313833 bytes 483523503 (461.1 MiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 2581472 bytes 3277971892 (3.0 GiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
netbr0 (eno2) : interface (192.168.1.0/24) connecté à la livebox
lanbr0 (enp1s0f0) : interface (172.16.1.0/24) connecté au switch - LAN
wifibr0 (wlo1) : interface (10.6.42.0/24) connecté HostAP - WiFi
vmbr0 : interface (10.126.42.0/26) connecté au Virtual Machine - LinuX Container (LXC) - VM (Qemu)
Mes routes :
root@pve:~ $ ip -6 route show
2607:5300:60:9389::/64 via fc01::172:16:0:1 dev lanbr0 metric 1024 pref medium
2a01:cb1d:12:1c00::/64 dev netbr0 proto kernel metric 256 pref medium
2a01:cb1d:12:1c00::/56 dev netbr0 metric 1024 pref medium
fc01::10:0:0:0/104 via fc01::172:16:0:1 dev lanbr0 metric 1024 pref medium
fc01::10:6:0:0/104 dev wifibr0 proto kernel metric 256 pref medium
fc01::10:126:0:0/104 dev vmbr0 proto kernel metric 256 linkdown pref medium
fc01::172:16:0:0/104 dev lanbr0 proto kernel metric 256 pref medium
fe80::/64 dev netbr0 proto kernel metric 256 pref medium
fe80::/64 dev lanbr0 proto kernel metric 256 pref medium
fe80::/64 dev wifibr0 proto kernel metric 256 pref medium
default via 2a01:cb1d:12:1c00:c2d7:aaff:fec0:f839 dev netbr0 metric 1024 onlink pref medium
Les bridges réseaux (pas encore de Virtual Machines connecté sur "vmbr0") :
root@pve:~ $ brctl show
bridge name bridge id STP enabled interfaces
iscbr0 8000.1e6ade947c24 no enp1s0f1
lanbr0 8000.d22f72a87c4e no enp1s0f0
netbr0 8000.e66cba324113 no eno2
vmbr0 8000.624b0c67e56a yes
wifibr0 8000.6a22e74bf077 no wlo1
----
Un début de configuration parce que je suis sympat
![Clin d'oeil ;)](https://lafibre.info/Smileys/default/wink.gif)
root@pve:~ $ cat /etc/network/interfaces
auto lo
iface lo inet loopback
iface eno2 inet manual
iface enp1s0f0 inet manual
iface enp1s0f1 inet manual
iface wlo1 inet manual
auto netbr0
iface netbr0 inet static
address 192.168.1.254
netmask 255.255.255.0
gateway 192.168.1.1
dns-nameserver 158.69.126.137
dns-nameserver 2607:5300:60:9389:15:2:a:1000
dns-nameserver 2607:5300:60:9389:15:1:a:1000
bridge_ports eno2
bridge_stp off
bridge_fd 0
iface netbr0 inet6 static
address 2a01:cb1d:12:1c00:0000:0000:0000:0001
netmask 64
gateway 2a01:cb1d:12:1c00:c2d7:aaff:fec0:f839
iface netbr0 inet6 static
address fc01::172:16:0:254
netmask 104
auto lanbr0
iface lanbr0 inet static
address 172.16.0.254
netmask 255.255.255.0
dns-nameserver 158.69.126.137
dns-nameserver 2607:5300:60:9389:15:2:a:1000
dns-nameserver 2607:5300:60:9389:15:1:a:1000
bridge_ports enp1s0f0
bridge_stp off
bridge_fd 0
iface lanbr0 inet6 static
address fc01::172:16:0:254
netmask 104
auto iscbr0
iface iscbr0 inet static
address 10.0.0.254
netmask 255.255.255.255
bridge_ports enp1s0f1
bridge_stp off
bridge_fd 0
iface iscbr0 inet6 static
address fc01::10:0:0:254
netmask 128
auto wifibr0
iface wifibr0 inet static
address 10.6.42.254
netmask 255.255.255.0
bridge_ports wlo1
bridge_stp off
bridge_fd 0
iface wifibr0 inet6 static
address fc01::10:6:42:254
netmask 104
auto vmbr0
iface vmbr0 inet static
address 10.126.42.254
netmask 255.255.255.0
bridge_ports none
bridge_stp on
bridge_fd 0
iface vmbr0 inet6 static
address fc01::10:126:42:254
netmask 104
J'ajoute les config system des interfaces network (netbr0.accept_ra = 1 pour attraper l'association du router (avoir l'adresse passerelle en link-local "fe80::" de la livebox - Todo : Relayer, découvrir avec les daemons RADvD, NDP (Neighbors Discovery Protocol) et DHCPdv6 les voisins connectées aux interfaces local (vmbr0) et xLANs):
sysctl net.ipv6.conf.netbr0.forwarding = 1
sysctl net.ipv6.conf.netbr0.autoconf = 0
sysctl net.ipv6.conf.netbr0.accept_redirects = 1
sysctl net.ipv6.conf.netbr0.accept_ra = 1
sysctl net.ipv6.conf.netbr0.proxy_ndp = 0
sysctl net.ipv6.conf.netbr0.accept_source_route = 0
sysctl net.ipv6.conf.lanbr0.forwarding = 1
sysctl net.ipv6.conf.lanbr0.autoconf = 0
sysctl net.ipv6.conf.lanbr0.accept_redirects = 1
sysctl net.ipv6.conf.lanbr0.accept_ra = 0
sysctl net.ipv6.conf.lanbr0.proxy_ndp = 0
sysctl net.ipv6.conf.lanbr0.accept_source_route = 0
sysctl net.ipv6.conf.wifibr0.forwarding = 1
sysctl net.ipv6.conf.wifibr0.autoconf = 0
sysctl net.ipv6.conf.wifibr0.accept_redirects = 1
sysctl net.ipv6.conf.wifibr0.accept_ra = 0
sysctl net.ipv6.conf.wifibr0.proxy_ndp = 0
sysctl net.ipv6.conf.wifibr0.accept_source_route = 0
sysctl net.ipv6.conf.vmbr0.forwarding = 1
sysctl net.ipv6.conf.vmbr0.autoconf = 0
sysctl net.ipv6.conf.vmbr0.accept_redirects = 1
sysctl net.ipv6.conf.vmbr0.accept_ra = 0
sysctl net.ipv6.conf.vmbr0.proxy_ndp = 0
sysctl net.ipv6.conf.vmbr0.accept_source_route = 0
Il manque le firewall ICMPv6 ;
https://howto.zw3b.fr/linux/securite/comment-faire-un-reseau-ipv6-firewall-icmpv6 ![Clin d'oeil ;)](https://lafibre.info/Smileys/default/wink.gif)
Note de Moi-même : Si tu galère trop avec le pare-feu, l'important c'est le transfert de paquets entre les cartes réseau :
Tu met en (pour voir si les pings sur les IP interne répondent) :
root@pve:~ # ip6tables -P FORWARD ACCEPT
Pour remettre "normal" :
root@pve:~ # ip6tables -P FORWARD DROP
-----
Ah oui, "netbr0.accept_ra = 2" quand il y a le "sysctl net.ipv6.conf.netbr0.forwarding = 1" qui m'a permis "instantanément" de recevoir ma passerelle fe80::
CF :
default via fe80::c2d7:aaff:fec0:f839 dev netbr0 proto ra metric 1024 expires 562sec hoplimit 64 pref highroot@pve:~ # sysctl net.ipv6.conf.netbr0.accept_ra=2
net.ipv6.conf.netbr0.accept_ra = 2
root@pve:~ # ip -6 r s
2607:5300:60:9389::/64 via fc01::172:16:0:1 dev lanbr0 metric 1024 pref medium
2a01:cb1d:12:1c00::/64 dev netbr0 proto kernel metric 256 pref medium
2a01:cb1d:12:1c00::/56 dev netbr0 metric 1024 pref medium
fc01::10:0:0:0/104 via fc01::172:16:0:1 dev lanbr0 metric 1024 pref medium
fc01::10:6:0:0/104 dev wifibr0 proto kernel metric 256 pref medium
fc01::10:126:0:0/104 dev vmbr0 proto kernel metric 256 linkdown pref medium
fc01::172:16:0:0/104 dev lanbr0 proto kernel metric 256 pref medium
fe80::/64 dev netbr0 proto kernel metric 256 pref medium
fe80::/64 dev lanbr0 proto kernel metric 256 pref medium
fe80::/64 dev wifibr0 proto kernel metric 256 pref medium
default via 2a01:cb1d:12:1c00:c2d7:aaff:fec0:f839 dev netbr0 metric 1024 onlink pref medium
default via fe80::c2d7:aaff:fec0:f839 dev netbr0 proto ra metric 1024 expires 562sec hoplimit 64 pref high
Informations FAI (ISP) :
$ whois 2a01:cb1d:0012:1c00::/64 | grep inet6num
inet6num: 2a01:c000::/20
$ sipcalc 2a01:c000::/20 | grep "Network range" -A1
Network range - 2a01:c000:0000:0000:0000:0000:0000:0000 -
2a01:cFFF:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF
Plus d'informations - GestióIP - IPv4/IPv6 subnet calculator :
http://www.gestioip.net/cgi-bin/subnet_calculator.cgiMaintenant je vais ajouter ma propre passerelle "générale" (style c moi le FAI) avant la boxe :
My IPv6 GUA : 2a01:cb1d:0012:1c00::/64
My IPv6 ULA :
fc01:cb1d:0012:1c00::/64My IPv6 ULA :
fc01:0000:0000:0000::/64# Pas celle-ci :
root@pve:~ # ip -6 address add fc01:cb1d:00FF:00FF:00FF:00FF:00FF:00FF/48 dev netbr0
Je n'avais pas réfléchis à configurer mon bloc (ULA) LAN "fc01::" comme celui d'Orange (GUA) "2a01::" .. Ce serait à faire
![Clin d'oeil ;)](https://lafibre.info/Smileys/default/wink.gif)
Donc, selon mon fichier /etc/network/interfaces), j'ai configuré en : fc01:0000:0000:0000::/64 avec plusieurs réseaux IPv6::/104.
J'ajoute, donc, sur ma carte principale, celle qui va faire le lien avec l'association de la livebox et de mes ordinateurs connectés aux cartes de mon routeur linux.
root@pve:~ # ip -6 address add fc01:00FF:00FF:00FF:00FF:00FF:00FF:00FF/48 dev netbr0
root@pve:~ # ip -6 route show
[...]
fc01:ff:ff::/48 dev netbr0 proto kernel metric 256 pref medium
[...]
Maintenant il faut installer RADvd pour envoyer les paquets NDP, les annonces pour la découverte du réseau et prévenir qu'il y a un routeur à cet endroit (sur cette machine).
J'essaie plustard.
@+
Note de Moi-même Août 22 : Debian-FR :
Network IPv6 - IPSec - strongSwan - Modern Security communication Post Quantum VPN (sur le forum)