Proper ipvlan configuration?

General
1

Hi All!

I’m in a very long problematic case which is surely caused by my improper Docker/IPv6/networking knowledge, but as I simply could not solve it in the last ~2 months I really have to ask you.

I had used my Home Assistant on my RPi4 through Docker without any problems for the last years, but some month ago I got a new ‘network environment’ from my ISP with IPv6 (with dual stack working method in theory) but without IPv4 NAT option so from that point I have to exclusively use my IPv6 network to reach my devices. As I didn’t have any experiences with IPv6 I really had to acclimate to it. After some weeks I had a ‘seems to work’ configuration but still have lot of small problems with my Home Assistant.

Instead of the previous default bridge mode I made an ipvlan based custom network to give direct IP addresses to my corresponding containers but the result is far from perfect. As on the host I have a dnsmasq service as DNS relay for my local domain names I have to use it from the containers also, but in default ipvlan situation the host can not reach directly the containers as the containers also can not reach the host, until we made custom ‘routing’ for this purpose. ‘Of course’ I made it but just with half-success.

On IPv4 network I can ping both of direction, the container from the host, and the host from the container, but on IPv6 I can only ping into one direction, I can ping the container from the host, but not the host from the container, therefore the DNS service on the host is unreachable from the container in IPv6 network.

Could anybody help me what is the problem on my config?

The environment:

docker-compose.yml:

version: '3.8'

services:
  home_assistant:
...
   networks:
      home_assistant:
        ipv4_address: '192.168.1.43'
        ipv6_address: '{my /56 prefix}::43'
    dns:
      - '192.168.1.2'
      - '{my /56 prefix}::2'
...
networks:
      
  home_assistant:
    name: 'Home_Assistant'
    driver: 'ipvlan'
    driver_opts:
      parent: 'wlan0'
      ipvlan_mode: 'l2'
    enable_ipv6: true
    ipam:
      config:
        - subnet: '192.168.1.0/24'
          ip_range: '192.168.1.32/28'
          gateway: '192.168.1.1'
        - subnet: '{my /56 prefix}::/64'
          ip_range: '{my /56 prefix}::40/124'
          gateway: '{my /56 prefix}:fae9:3ff:fec0:e330'

routing:

ip link add home_assistant link wlan0 type ipvlan mode l2
ip address add 192.168.1.41/32 dev home_assistant
ip address add {my /56 prefix}::41/128 dev home_assistant
ip link set home_assistant up
ip route add 192.168.1.32/28 dev home_assistant
ip route add {my /56 prefix}::40/124 dev home_assistant

docker network inspect Home_Assistant:

[
    {
        "Name": "Home_Assistant",
        "Id": "229a155125d777c6c656310ddd4e7ae97498b354271f5a0073ae947f7bdf1aca",
        "Created": "2023-06-04T16:03:43.303973033+02:00",
        "Scope": "local",
        "Driver": "ipvlan",
        "EnableIPv6": true,
        "IPAM": {
            "Driver": "default",
            "Options": null,
            "Config": [
                {
                    "Subnet": "192.168.1.0/24",
                    "IPRange": "192.168.1.32/28",
                    "Gateway": "192.168.1.1"
                },
                {
                    "Subnet": "{my /56 prefix}::/64",
                    "IPRange": "{my /56 prefix}::40/124",
                    "Gateway": "{my /56 prefix}:fae9:3ff:fec0:e330"
                }
            ]
        },
        "Internal": false,
        "Attachable": false,
        "Ingress": false,
        "ConfigFrom": {
            "Network": ""
        },
        "ConfigOnly": false,
        "Containers": {
            "62f0ccefbfed48380fc8dea0be6bc833266fd7aa91c3ff7e42c17c5502d6c6f4": {
                "Name": "Z-Wave_JS_UI",
                "EndpointID": "9dfe018326cb922aacb0b72fa77d5649e7257fb741b36cd4cf57b029bf5a0a9f",
                "MacAddress": "",
                "IPv4Address": "192.168.1.42/24",
                "IPv6Address": "{my /56 prefix}::42/64"
            },
            "ead26e5ea208441fa411d762ae4da8015982455782a4fa24207b3b98cebde06a": {
                "Name": "Home_Assistant",
                "EndpointID": "91e0ea089564c38101ef1b8870a5bfba8de727314b758490011fd41fb82a6b1a",
                "MacAddress": "",
                "IPv4Address": "192.168.1.43/24",
                "IPv6Address": "{my /56 prefix}::43/64"
            }
        },
        "Options": {
            "ipvlan_mode": "l2",
            "parent": "wlan0"
        },
        "Labels": {
            "com.docker.compose.network": "home_assistant",
            "com.docker.compose.project": "homeassistantdocker",
            "com.docker.compose.version": "2.18.1"
        }
    }
]

The IPv4 and the IPv6 gateways used in the configs are my router LAN addresses.

Are there any ideas what I’m doing wrong?

Thanks for your help in advance!

2

I don’t have really much to contribute, other than the question whether your ISP gave you a static /56 prefix?
In case you have a dynamic prefix, there is no way to assign GAs to your containers.

There used to be a docker-ipv6nat solution, that allowed to nat the hosts GA to containers ULA, but the project seems orphaned.

I really hope someone with a pure ipv6 setup sees this topic and is able to help.

3

IPv6 is still waiting for me too to learn more about it, but maybe there is another way.

When you say “reach my devices” do you mean from another machine on the internet and not from your local network?

It might be a stupid question but why was that necessary? How did that help with IPv6?

Would it help if you used ipvlan and a user-defined docker bridge for the container at the same time? You can have multiple networks attached to one container and one could be ipvlan while the other a simple bridge so your container could access your host using the IP of the docker bridge and your host could also use the bridge network to access the containers.

If I understand it correctly, that network is the network of the local router not the ISP.