[Cerowrt-devel] upgrading from CeroWRT --- seeking advice on rule testing

[Michael Richardson]

Dave Taht <dave at taht.net> wrote:
    >> systems having DualStack with NAT44.

    > I'm under the impression various ipv6 -> ipv4 nat tools are working much
    > better now. I can't bring myself to care much about ipv6 until I too can
    > get a static IPv6 allocation. I'm so fed up with the deployment that
    > I've been working on adding ips to ipv4....

Well, you can get a static IPv6 allocation for a fee, you just need an ISP that
you can speak BGP to.  That's really what your issue is more than the allocation.

    >> The naming "se00" vs "ethXX" gets in the way.  I have weird problems
    >> where
    >> machines behind the gateway can ping 8.8.8.8, but I can't ping it from
    >> the
    >> gateway.  The details don't matter. I'm mostly writing this for future
    >> people
    >> googling. I spent another two hours today trying to debug (the first
    >> time, I
    >> had no working uplink, and I was missing tcpdump on the new unit. I
    >> was
    >> convinced my ISP had dropped my static routes)...
    >>
    >> So I will be starting again from scratch (total factory reset), get it
    >> going, and then add my custom configuration.

    > I generally prototype by having a second router entirely take over the
    > functions of the network. Much like you added a pure wifi router, in
    > your case I'd have got another router entirely, flashed openwrt, and
    > tried to get each feature you needed working that way.

The problem with trying to make it all work in a test bench is that
it has to work with the v6 prefixes that matter, and those are in use.
So I guess I could put two routes in series and move things over VLAN by
VLAN.  I have the untagged traffic out of the router go into VLAN3800
on the switch, which I can see from my desktop.  At least the replacement
router has a serial console, which I never added to the original.

    > I do wish cerowrt's stateless firewall idea had been adopted by openwrt,
    > it leads to much less complicated rules to just pattern match for s+,
    > g+, etc.

Hmm. I am not sure I understand your point.
It all looks the same to me, but perhaps I'm running into this differences
under the hood which is screwing me up.

--
]               Never tell me the odds!                 | ipv6 mesh networks [
]   Michael Richardson, Sandelman Software Works        |    IoT architect   [
]     mcr at sandelman.ca  http://www.sandelman.ca/        |   ruby on rails    [




-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 487 bytes
Desc: not available
URL: <https://lists.bufferbloat.net/pipermail/cerowrt-devel/attachments/20190210/09cacc94/attachment.sig>