If possible, give your suggested cli path for my reference

I can't find how to enable ipv6 connection tracking. Recompiling and modifying the linux kernel switch does not seem to see the module loaded. I think the current nat66 has completed 90%, and only need to implement ndp proxy to make it work normally.

set interfaces ethernet eth0 ip proxy-arp

I think we do need it, we can’t let users manage all IP manually unless we implement stateful NAT66

Beeing stateless or statefull both should work. We can add a CLI node for the proxy.ndp option like we have for proxy arp on ipv4, no big deal.

In T2518#75586, @c-po wrote:

Beeing stateless or statefull both should work. We can add a CLI node for the proxy.ndp option like we have for proxy arp on ipv4, no big deal.

This is a milestone, which means we have to decide whether to use stateful or stateless

It is confirmed that there is a bug in the implementation, but no solution has been found yet. In the nat66 rule, the prefix translation is indeed performed in the expected behavior, but the upstream device cannot return the data packet from the specific prefix. If the community has a good solution, please let me know

Please give the configuration of R1 so that I can immediately test your topology in the simulation environment

It’s best to provide links to related descriptions instead of asking everyone to search for the related details and patch implementations you describe

Isn't it upgraded to 5.x? Why 4.x?

We look forward to the solution of this problem

Is this problem solved at present?

The updated code was successfully tested on the virtual machine, and 5.1 has not been tested yet, waiting for the release of kernel 5.1

As described in T2814, under 5.1, nft_chain_nat_ipv6 will be merged into nft_chain_nat, I have updated pr to support this change, but like T2814, it has not been tested

The SNPT and DNPT functions are basically implemented, but because they have not been reviewed and approved for the time being, they enter the hold state, waiting for processing and discussion

Thanks

Although nat66 (NPT) is not currently incorporated into the mainline, I may need to modify my implementation if it is also modified

Hello, here is a request beyond the outline. Please help me check whether the NAT kernel module of IPv6 has also changed? It turned out to be nft_chain_nat_ipv6？

Sorry, I don't understand what you mean. Can you tell me more about it? What is using net-snmp to submit feature requests?

The list of oids currently supported by vyos is as follows:

The document has been updated and moved to a more suitable location

This is a good bug report

This problem may have been resolved for a few months, and I am currently using VyOS 1.3-rolling-202007190117
If no problem is found, I will close this question. If other problems are found, I will reopen it.

GNS3 virtualization network verification passed

https://github.com/vyos/vyos-1x/pull/522

Dependency and VRF support for tcptraceroute6 will be submitted in the next few days

Update document

smoketest for nptv6

I have consulted some documents of vyos about DNAT of IPv4, and I don't understand why there seems to be SNAT content in the DNAT IPv4 syntax of vyos, and what is the meaning of supporting the prefix format address setting of dsddr in DNAT syntax? Is there something wrong with me?

Use cases for sNPT testing

@c-po Change the task and add duplicate address detection option in force ARP

@thomas-mangin Maybe it's better to discuss it here

@thomas-mangin As mentioned in my comments, I refer to the configuration structure of H3C. In the original command structure, nptv6 does not support the division of SNAT and DNAT. In order to implement nat66, I separated it for the following reasons:

It is hoped that this implementation can make the prefix translation work again. Refer to the relevant operation of H3C equipment and fully support nat66

I don't use this kind of tool to test his nftables policy, but I'm used to testing it by manually configuring nftables and replacing my nftables template file with that of the vyos system. Vyos did not report errors during its build configuration.

@c-po The related nftables policy in the local environment test did not find syntax problems, only need to be tested to verify the effectiveness of the function, so I call it experimental support.

@c-po Can you take a look at this PR for me?

@c-po Can you take a look at this PR for me? At present, the command implementation of ndptool send has been canceled

This PR will provide experimental nat66 support, which needs to be tested

Maybe I just didn't encounter it. In short, please try the latest version first. If this problem still exists, please provide the detailed configuration and environment information of the error to facilitate the recurrence and troubleshooting of community members

Please try the latest version of the image, I have not encountered similar problems at present

I don't understand what you mean. If you use the SSH protocol remotely, you should be able to automatically resume the connection within the allowable time of the protocol. However, if the time is exceeded, you may need to wait for the network connection to recover and reopen the SSH connection.

@c-po According to H3C, the relevant operations are as follows:

@c-po According to H3C and the third-party information on the Internet, NPT is also called nat66. Nat66 is actually the SNAT and DNAT implementation of IPv6, and implements 1-to-1 mapping and prefix address translation. Since there is no separate configuration directory for these two directions in the configuration, this draft implements two directions. Tomorrow, we will try to modify the configuration path according to the document of H3C device, add the diff of the draft, and then propose Submit merger request.

@c-po It has been revised as follows:

I didn't get any specific help. The modified pudding was set up based on the trial and limited third-party data here, and it needs to be fully tested.

@c-po This is a simple draft of my current implementation of NPT. At present, I haven't tested it, and I haven't applied for merger. I can send it here for some discussion.

@c-po In my vyos, the following commands run successfully, and the rule settings are normal, but the rules are not tested to be effective and correct. For reference only, if I have time, I will open the eve ng simulation environment.

@c-po Since I can't find a suitable place to use ndptool send, in this task list, cancel the implementation of this function. If necessary, the user can run it directly from the command, and now submit the correction. If possible, please re audit pr

Although this document may not be a direct help, it may help us understand how to set up IPv6 NAT for nftables?

@c-po I have changed the top-level command, maybe it's better, can you help me see it, if possible, request a merge, otherwise, please reply?

@c-po I have changed the top-level command, maybe it's better, can you help me see it, if possible, request a merge, otherwise, please reply?

It seems that the problem is serious and under attention

This feature request will be closed because the community does not agree to the replacement

In T2736#71448, @Viacheslav wrote:

https://github.com/aria2/aria2/issues

720 issues, one of them https://github.com/aria2/aria2/issues/1549

Sorry, but I also -1.

Of course, even if vyos does not support it or the community does not agree with it, it is not impossible to upgrade. I usually use SFTP to upload to the router to perform the local upgrade after downloading from the computer. Therefore, the current download tool can be modified and replaced selectively. This is only to explore the possibility

You may be mistaken. I'm right. If the server supports downloading and using breakpoint continuation protocol (HTTP range download), then aria2c can make it work, and breakpoint continuation has certain advantages, that is, in case of abnormal interruption, it can restart the download from the last interrupted location, instead of downloading from the beginning.. Moreover, the multi-threaded download function of aria2c may improve the efficiency and speed of downloading