ipv6 NAT; accept_ra errors and about network choice

[Ian Wienand]

Hello,

Firstly THANK YOU for the IPv6 NAT support merged in 6.5.  It has been
almost impossible to get IPv6 into a VM on a laptop that switches
between wifi and wired (dock) connections, because you can not add a
wifi interface to a bridge.  I know NAT is against the IPv6 end-to-end
xen but it makes this "just work" for the vast majority of people like
me who need to ssh/curl/talk to ipv6 only hosts!

So I installed 6.6.0 from the virt-preview repos on Fedora 32 to
eagerly test it out.

My network config looks like

  <network>
  <name>network</name>
  <uuid> ...  </uuid>
  <forward mode='nat'>
    <nat ipv6='yes'/>
  </forward>
  <bridge name='virbr0' stp='on' delay='0'/>
  <mac address=' ... '/>
  <domain name='network'/>
  <ip address='192.168.100.1' netmask='255.255.255.0'>
    <dhcp>
      <range start='192.168.100.128' end='192.168.100.254'/>
    </dhcp>
  </ip>
  <ip family='ipv6' address='fc00:dead:beef:55::' prefix='64'>
  </ip>
 </network>

The first problem I hit was trying to start that network:

 error: internal error: Check the host setup: enabling IPv6 forwarding
 with RA routes without accept_ra set to 2 is likely to cause routes
 loss. Interfaces to look at: wlp4s0

wlp4s0 is my wifi card that is configured by NetworkManager in a
completely unremarkable fashion.  By default it gets an ipv6 via SLAAC
from my router.  This feels a bit like the unresolved bug [1] which
says that systemd-networkd is handling the RA's in userspace for
... reasons [2].  It's unclear to me if NetworkManager is doing
similar.

I feel like this must be a red-herring.  My wired interface has the
same setting of 0

 $ cat /proc/sys/net/ipv6/conf/enp0s31f6/accept_ra
 0

and is similarly just a very standard auto-configured NetworkManager
interface.  When I "net-start" the network whilst on wifi libvirt
doesn't seem to care about that interface (I presume it only looks at
the active one?).  When I dock and turn off wifi, ipv6 connectivity
continues to work through enp0s31f6, so I don't think the accept_ra
really matters in this case.

I feel like this message is incorrect, and being as I've done nothing
special to my underlying interfaces probably going to be wrong for a
lot of people trying this?  Does anyone know the details of this
message and see why it would be required in this situation?

The other thing that I'd like to expand the documentation on, if I can
get some clarity, is the choice of network.  It seems like it has to
be a /64, and it seems like the best choice is within fc00::/7, or at
least that is what has been assigned for private networks like this
[3]?

The only problem with this is that I think glibc filters this range so
nothing prefers IPv6.  Is this the range expected to be used for ipv6
NAT?  If so, would a patch to drop some documentation breadcrumbs
about setting gai.conf or something be useful?  Or are there better
choices for the network?

Thanks!

-i

[1] https://bugzilla.redhat.com/show_bug.cgi?id=1639087
[2] https://github.com/systemd/systemd/commit/3b015d40c19d9338b66bf916d84dec601019c811
[3] https://tools.ietf.org/html/rfc4193