openwrt: nat64 destination unreachable

[kaizirlewagen]

I used Openwrt 23 and add openthread described here https://github.com/openthread/ot-br-posix/tree/main/etc/openwrt/openthread-br to my image.

I use these Makefile settings:

CMAKE_OPTIONS+= \
	-DBUILD_TESTING=OFF \
	-DCMAKE_INSTALL_PREFIX=/usr \
	-DOTBR_BORDER_AGENT=ON \
	-DOTBR_BORDER_ROUTING=ON \
	-DOTBR_INFRA_IF_NAME=\"br-lan\" \
	-DOTBR_MDNS="avahi" \
	-DOTBR_OPENWRT=ON \
	-DOTBR_SRP_ADVERTISING_PROXY=ON \
	-DOT_FIREWALL=OFF \
	-DOT_POSIX_SETTINGS_PATH=\"/etc/openthread\" \
	-DOT_READLINE=OFF \
	-DOTBR_NAT64=ON \
	-DNAT64_SERVICE=\"openthread\" \
        -DOT_SLAAC=ON

I can add an ot-br network, ping the router and the devices. But i don't get nat64 working.

# tcpdump -i wpan0
[ 1201.836731] device wpan0 entered promiscuous mode
tcpdump: verbose output suppressed, use -v[v]... for full protocol decode
listening on wpan0, link-type RAW (Raw IP), snapshot length 262144 bytes
06:59:48.489301 IP6 fe80::f005:9cc9:8add:e3d4.19788 > ip6-allnodes.19788: UDP, length 43
06:59:48.805208 IP 192.168.255.254 > 192.168.100.174: ICMP echo request, id 6, seq 6, length 16
06:59:48.805421 IP 192.168.100.34 > 192.168.255.254: ICMP 192.168.100.174 protocol 1 port 48964 unreachable, length 44

My router is 192.168.100.34 and i want to try to ping 192.168.100.174 (a pc in my network). Which option is missing? I check the openwrt firewall, which has missing entries to enable ping6. But if firewall is disabled, the nat64 is always not working.

The ot-br settings:

# ot-ctl ipaddr
fd57:96cc:7d73:e968:0:ff:fe00:fc10
fd6d:7554:d5e4:1:de01:b2b4:370a:70a9
fd57:96cc:7d73:e968:0:ff:fe00:fc00
fd57:96cc:7d73:e968:0:ff:fe00:ec00
fd57:96cc:7d73:e968:df70:af4e:5edf:67c9
fe80:0:0:0:18b7:f3a5:48a1:25c8
Done

The nordic cli device:

> ipaddr
fd57:96cc:7d73:e968:0:ff:fe00:7400
fd6d:7554:d5e4:1:73ed:13e4:7ffb:865b
fd57:96cc:7d73:e968:9bed:4145:22d8:5d68
fe80:0:0:0:a8cd:c860:4acb:b942
Done

> netdata show
Prefixes:
fd6d:7554:d5e4:1::/64 paos low ec00
Routes:
fc00::/7 s med ec00
fd6d:7554:d5e4:2:0:0::/96 sn low ec00
Services:
44970 5d fd5796cc7d73e968df70af4e5edf67c9d120 s ec00
Contexts:
fd6d:7554:d5e4:1::/64 1 c
Commissioning:
64699 - - -
Done

I think the n network is assigned. So i don't find the hint on the openwrt firmware.

[kaizirlewagen]

To get NAT64 working is used this Makefile parts:

CMAKE_SOURCE_DIR=$(LOCAL_SOURCE_DIR)
CMAKE_OPTIONS+= \
	-DBUILD_TESTING=OFF \
	-DCMAKE_INSTALL_PREFIX=/usr \
	-DOTBR_BORDER_AGENT=ON \
	-DOTBR_BORDER_ROUTING=ON \
	-DOTBR_INFRA_IF_NAME=\"br-lan\" \
	-DOTBR_MDNS="avahi" \
	-DOTBR_OPENWRT=ON \
	-DOTBR_SRP_ADVERTISING_PROXY=ON \
	-DOT_FIREWALL=OFF \
	-DOT_POSIX_SETTINGS_PATH=\"/etc/openthread\" \
	-DOT_READLINE=OFF \
	-DOTBR_NAT64=ON \
	-DNAT64_SERVICE=\"openthread\" \
	-DOT_BORDER_ROUTER=ON \
	-DOT_CHANNEL_MANAGER=ON \
	-DOT_CHANNEL_MONITOR=ON \
	-DOTBR_BACKBONE_ROUTER=ON \
	-DOTBR_DNSSD_DISCOVERY_PROXY=ON \
	-DOTBR_DUA_ROUTING=ON \
	-DOTBR_REST=ON \
	-DOTBR_SRP_SERVER_AUTO_ENABLE=ON \
	-DOTBR_TREL=ON \
  -DOT_SLAAC=ON

TARGET_CFLAGS += -DOPENTHREAD_POSIX_CONFIG_DAEMON_SOCKET_BASENAME=\\\"/var/run/openthread-%s\\\"

define Package/openthread-br
	SECTION:=base
	CATEGORY:=Network
	TITLE:=OpenThread Border Router
	DEPENDS:=+libstdcpp +libjson-c +libubus +libblobmsg-json +libavahi-client +avahi-daemon +iptables-mod-extra +ipset +libncurses +libnetfilter-queue +libreadline +libubox
endef

And for Openwrt this settings also must be set:

iptables -t mangle -A PREROUTING -i wpan0 -j MARK --set-mark 0x1001
iptables -t nat -A POSTROUTING -m mark --mark 0x1001 -j MASQUERADE

iptables -t filter -A FORWARD -o br-lan -j ACCEPT
iptables -t filter -A FORWARD -i br-lan -j ACCEPT

uci set firewall.@zone[0].device='wpan0'
uci set firewall.@zone[1].device='wpan0'