Summary
Add an optional route-sync feature under service ndp-proxy ... prefix ... to keep /128 host routes in sync with active LAN IPv6 neighbors when NDP proxy is used in mode interface.
This is meant to solve the common IPv6 passthrough case where ndppd can answer NDP correctly, but return traffic is still routed to WAN because the delegated/on-link prefix exists on the upstream interface.
Use case
A typical ISP/ONT setup gives a dynamic IPv6 prefix via SLAAC/DHCPv6 on WAN (eth0), and downstream clients are behind LAN/bridge (br0).
With only:
- set service ndp-proxy interface eth0 prefix ::/0 mode interface
- set service ndp-proxy interface eth0 prefix ::/0 interface br0
clients can receive global IPv6 addresses, but traffic may still fail because the router kernel prefers WAN on-link routing for replies.
route-sync fixes that by automatically adding/removing /128 routes for active LAN neighbors toward br0, so return packets go to the correct downstream interface.
Additional information
- Backward-compatible: feature is disabled by default.
- Guardrails: route-sync is only valid with mode interface.
- Routes are managed with a dedicated protocol tag (ndp-proxy-sync) for safe cleanup.
- Managed routes are removed when neighbors disappear, when config is removed, or when service is stopped.
- Current sync loop interval is 2 seconds.
- This keeps the change focused on NDP passthrough behavior without changing unrelated RA logic.