Troubleshooting IPv6 routing

[bdruth]

Hi,

Hoping someone here more knowledgeable about IPv6 can help me understand what's going on and maybe how to fix it.

TL;DR is - I can ping IPv6 things up to OMR, from devices on my network; I can ping6 VPS & beyond from the OMR, but I can't ping6 the VPS or beyond from devices on my network.

I have a VPS w/ working IPv6

root@debian-13:~# ping6 ipv6.google.com
PING ipv6.google.com(ord37s36-in-x0e.1e100.net) 56 data bytes
64 bytes from ord37s36-in-x0e.1e100.net (2607:f8b0:4009:817::200e): icmp_seq=1 ttl=117 time=1.21 ms
64 bytes from ord37s36-in-x0e.1e100.net (2607:f8b0:4009:817::200e): icmp_seq=2 ttl=117 time=1.28 ms
64 bytes from ord37s36-in-x0e.1e100.net (2607:f8b0:4009:817::200e): icmp_seq=3 ttl=117 time=1.22 ms
64 bytes from ord37s36-in-x0e.1e100.net (2607:f8b0:4009:817::200e): icmp_seq=4 ttl=117 time=1.21 ms
64 bytes from ord37s36-in-x0e.1e100.net (2607:f8b0:4009:817::200e): icmp_seq=5 ttl=117 time=1.19 ms

My OMR box is connected & working, and can ping both the VPS v6 as well as beyond that

OpenMPTCProuter# ping6 2604:bc0:*::*:*
PING 2604:bc0:*::*:* (2604:bc0:*::*:*): 56 data bytes
64 bytes from 2604:bc0:*::*:*: seq=0 ttl=64 time=54.840 ms
64 bytes from 2604:bc0:*::*:*: seq=1 ttl=64 time=34.287 ms
64 bytes from 2604:bc0:*::*:*: seq=2 ttl=64 time=39.064 ms
64 bytes from 2604:bc0:*::*:*: seq=3 ttl=64 time=33.288 ms

OpenMPTCProuter# ping6 google.com
PING google.com (2607:f8b0:4002:c08::66): 56 data bytes
64 bytes from 2607:f8b0:4002:c08::66: seq=0 ttl=118 time=54.015 ms
64 bytes from 2607:f8b0:4002:c08::66: seq=1 ttl=118 time=59.356 ms

OK - so, that's good. My IPv6 prefix in the settings wizard says fdfe:8abf:9104::/48 and the IPv6 address that DHCP is handing out to my eero router is fdfe:8abf:9104:4::/62. Seems fine ...

My MBP gets multiple (?) IPv6 addresses:

	inet6 fe80::10f7:eeac:2454:bbc0%en0 prefixlen 64 secured scopeid 0xf
	inet6 fd2c:8dd0:2e49:42b6:879:23d1:d1c8:331a prefixlen 64 autoconf secured
	inet6 fd6a:f459:349e:1:180b:2152:7ab7:35de prefixlen 64 autoconf secured
	inet6 fdfe:8abf:9104:4:10ef:911c:413a:139c prefixlen 64 autoconf secured

I understand the fe80:* is link-local, but I don't understand where the other stuff is coming from. From my MBP, I can ping the IPv6 address that the gateway eero node appears to show ... fd6a:f459:349e:1:0:0:0:1

❯ ping6 fd6a:f459:349e:1:0:0:0:1
PING6(56=40+8+8 bytes) fd6a:f459:349e:1:180b:2152:7ab7:35de --> fd6a:f459:349e:1::1
16 bytes from fd6a:f459:349e:1::1, icmp_seq=0 hlim=64 time=9.368 ms
16 bytes from fd6a:f459:349e:1::1, icmp_seq=1 hlim=64 time=12.131 ms
16 bytes from fd6a:f459:349e:1::1, icmp_seq=2 hlim=64 time=4.923 ms
16 bytes from fd6a:f459:349e:1::1, icmp_seq=3 hlim=64 time=6.614 ms

and I can also ping the OMR IPv6, I think?

❯ ping6 fdfe:8abf:9104::1
PING6(56=40+8+8 bytes) fdfe:8abf:9104:4:10ef:911c:413a:139c --> fdfe:8abf:9104::1
16 bytes from fdfe:8abf:9104::1, icmp_seq=0 hlim=63 time=12.530 ms
16 bytes from fdfe:8abf:9104::1, icmp_seq=1 hlim=63 time=7.956 ms
16 bytes from fdfe:8abf:9104::1, icmp_seq=2 hlim=63 time=10.072 ms
16 bytes from fdfe:8abf:9104::1, icmp_seq=3 hlim=63 time=14.819 ms

That all seems good ... BUT, I can't ping the VPS IPv6 or beyond that, e.g.:

❯ ping6 google.com
PING6(56=40+8+8 bytes) fd6a:f459:349e:1:180b:2152:7ab7:35de --> 2607:f8b0:4004:c1b::64
^C
--- google.com ping6 statistics ---
6 packets transmitted, 0 packets received, 100.0% packet loss

So ... any clue where to start looking? I have little to no practical understanding of how IPv6 and it's associated routing or ULA stuff works, relative to my IPv4 knowledge.

Thanks!