In uk.telecom.broadband Andy Burns <usenet@andyburns.uk> wrote:
> Theo wrote:
>
> > In uk.telecom.broadband Java Jive <java@evij.com.invalid> wrote:
> >> root@OpenWrt:~# udhcpc eth1
> >> udhcpc: started, v1.28.3
> >> udhcpc: sending discover
> >> udhcpc: sending discover
> >> udhcpc: sending discover [Ctrl-C pressed after some delay]
> >
> > That suggests it's not responding to DHCP.
>
> These "NIC-on-a-stick" models fake it, the DHCP server that they appear
> to talk to is internal to the stick, not on the far side of the 4G radio

Indeed, so a lack of DHCP means there's something wrong with the stick or
its config, rather than anything to do with the network. In particular you
need DHCP working to get to the settings web page for the mobile network.

Theo

On 2023-07-02 18:36, Theo wrote:
> In uk.telecom.broadband Andy Burns <usenet@andyburns.uk> wrote:
>> Theo wrote:
>>
>>> In uk.telecom.broadband Java Jive <java@evij.com.invalid> wrote:
>>>> root@OpenWrt:~# udhcpc eth1
>>>> udhcpc: started, v1.28.3
>>>> udhcpc: sending discover
>>>> udhcpc: sending discover
>>>> udhcpc: sending discover [Ctrl-C pressed after some delay]
>>>
>>> That suggests it's not responding to DHCP.
>>
>> These "NIC-on-a-stick" models fake it, the DHCP server that they appear
>> to talk to is internal to the stick, not on the far side of the 4G radio
>
> Indeed, so a lack of DHCP means there's something wrong with the stick or
> its config, rather than anything to do with the network. In particular you
> need DHCP working to get to the settings web page for the mobile network.

Or, you could manually setup that internal "fake" lan assigning IP
addresses manually, same as when you configure a computer to access a
new gadget with network interface before connecting it for real.

--
Cheers, Carlos.

In uk.telecom.broadband Carlos E.R. <robin_listas@es.invalid> wrote:
> On 2023-07-02 18:36, Theo wrote:
> > In uk.telecom.broadband Andy Burns <usenet@andyburns.uk> wrote:
> >> Theo wrote:
> >>
> >>> In uk.telecom.broadband Java Jive <java@evij.com.invalid> wrote:
> >>>> root@OpenWrt:~# udhcpc eth1
> >>>> udhcpc: started, v1.28.3
> >>>> udhcpc: sending discover
> >>>> udhcpc: sending discover
> >>>> udhcpc: sending discover [Ctrl-C pressed after some delay]
> >>>
> >>> That suggests it's not responding to DHCP.
> >>
> >> These "NIC-on-a-stick" models fake it, the DHCP server that they appear
> >> to talk to is internal to the stick, not on the far side of the 4G radio
> >
> > Indeed, so a lack of DHCP means there's something wrong with the stick or
> > its config, rather than anything to do with the network. In particular you
> > need DHCP working to get to the settings web page for the mobile network.
>
> Or, you could manually setup that internal "fake" lan assigning IP
> addresses manually, same as when you configure a computer to access a
> new gadget with network interface before connecting it for real.

We'd need to know what IP address the dongle is listening at, which is
something the OP will have to find out. Once we know that we can configure
one in the same subnet to the PC and try to get into the dongle
configuration web pages. Once we're in, there should be a toggle for DHCP.
There isn't much to be gained by using a static IP here apart from the
initial setup.

If it's not clear what the default IP of the dongle is, or it doesn't work,
then there may be a factory reset procedure.

The main thing is this dongle behaves much like a home router, except with
the Ethernet over USB and the WAN being wireless. So you need to think like
you're configuring a router.

Theo

On 02/07/2023 17:28, Theo wrote:
>
> In uk.telecom.broadband Java Jive <java@evij.com.invalid> wrote:
>>
>> root@OpenWrt:~# udhcpc eth1
>> udhcpc: started, v1.28.3
>> udhcpc: sending discover
>> udhcpc: sending discover
>> udhcpc: sending discover [Ctrl-C pressed after some delay]
>
> That suggests it's not responding to DHCP.

No, actually it's the stick that's not booting its networking, because
knowing what subnet it should be using I tried Carlos' suggestion
downthread of using a fixed IP, without any change. But see below for
the good news ...

> It seems that it's possible to disable DHCP on the stick. Does it get an
> address if you plug it into a PC? If not, maybe you need to work out how to
> enable it.

It just works if I plug it into a W7 PC.

> It sounds like the ethernet device is coming up, so I don't think you need
> any shenanigans with usb_modeswitch, which is used for some sticks which
> first pretend to be DVD devices with the Windows software on them.

No, it's definitely getting that far alright, the dmesg output shows that.

> If you have a Linux PC, I'd see if you can get it to work from there, as
> that will give confidence that everything is in order. I think on some of
> them there's a web interface where you set the APN, and it would make sense
> if that can be set up from a PC.

Think I've solved it, but have yet to test with the SIM ...

After various searches long into the night finding nothing that fixed
it, in desperation I wondered whether an updated image would help, so I
flashed OpenWRT 18.0.6 r7808-ef686b7292 which has been fixed for an
OpenWRT problem specific to certain routers (not the same as my problem
that has been the subject of this thread) ...

https://forum.openwrt.org/t/18-06-4-speed-fix-for-bt-homehub-5a/23643
https://bit.ly/2xypJqv

.... and now I get the dongle admin page come up at 192.168.8.1, so I'm
reasonably certain that when I put the SIM in the dongle it should work.
Too late for that now, though, a job for tomorrow maybe.

Thanks with much appreciation to everyone who has given advice and help.

--

Fake news kills!

I may be contacted via the contact address given on my website:
www.macfh.co.uk

In uk.telecom.broadband Java Jive <java@evij.com.invalid> wrote:
> After various searches long into the night finding nothing that fixed
> it, in desperation I wondered whether an updated image would help, so I
> flashed OpenWRT 18.0.6 r7808-ef686b7292 which has been fixed for an
> OpenWRT problem specific to certain routers (not the same as my problem
> that has been the subject of this thread) ...
>
> https://forum.openwrt.org/t/18-06-4-speed-fix-for-bt-homehub-5a/23643
> https://bit.ly/2xypJqv
>
> ... and now I get the dongle admin page come up at 192.168.8.1, so I'm
> reasonably certain that when I put the SIM in the dongle it should work.
> Too late for that now, though, a job for tomorrow maybe.

Oh, that's really old. Were you on something even older?

The current stable release is 22.03 and there's an 23.05-rc2 available.
I'm using 22.03 reliably on a HH5a with no problems (although not using USB
though). 23.05-rc1 has also been working fine for me on a Fritzbox 7530.

Download links from here:
https://openwrt.org/

Theo

On 03/07/2023 13:19, Theo wrote:
> In uk.telecom.broadband Java Jive <java@evij.com.invalid> wrote:
>> After various searches long into the night finding nothing that fixed
>> it, in desperation I wondered whether an updated image would help, so I
>> flashed OpenWRT 18.0.6 r7808-ef686b7292 which has been fixed for an
>> OpenWRT problem specific to certain routers (not the same as my problem
>> that has been the subject of this thread) ...
>>
>> https://forum.openwrt.org/t/18-06-4-speed-fix-for-bt-homehub-5a/23643
>> https://bit.ly/2xypJqv
>>
>> ... and now I get the dongle admin page come up at 192.168.8.1, so I'm
>> reasonably certain that when I put the SIM in the dongle it should work.
>> Too late for that now, though, a job for tomorrow maybe.
>
> Oh, that's really old.

I know, but ...

> Were you on something even older?

18-06-1

> The current stable release is 22.03 and there's an 23.05-rc2 available.
> I'm using 22.03 reliably on a HH5a with no problems (although not using USB
> though). 23.05-rc1 has also been working fine for me on a Fritzbox 7530.
>
> Download links from here:
> https://openwrt.org/

I tried the current 22 and got a message that the file was in the wrong
format.

Currently I'm trying to create a single configuration that will work
with any of my dongles and my mobile. I think I'm nearly there, but my
original dongle, a Huawei E3372s, worked at first and then did not. The
only significant thing that I did in between the successful and the
unsuccessful attempt was to try altering the IP6 connections. Something
about doing this altered the way the E3372s came up, connecting the
interface thereafter produced an OpenWRT constructed virtual IP4
interface, which at first I couldn't assign to a firewall zone - the
vinterface only appeared when the dongle was connected and then it
wasn't editable. I got round this by hacking /etc/config/firewall and
rebooting, but even though the vinterface was now in the correct
firewall zone, I still couldn't connect to the internet. So I've just
gone back to factory defaults and started again.

I'm not very well up on IP6, so expect a question about that soon!

--

Fake news kills!

I may be contacted via the contact address given on my website:
www.macfh.co.uk

In uk.telecom.broadband Java Jive <java@evij.com.invalid> wrote:
> I tried the current 22 and got a message that the file was in the wrong
> format.

There is typically a 'first install' kernel.bin, and a sysupgrade.bin for
upgrading a router that already has OpenWRT:

https://firmware-selector.openwrt.org/?version=22.03.5&target=lantiq%2Fxrx200&id=bt_homehub-v5a

You want the latter. I normally upgrade by something like:

$ scp sysupgrade.bin root@192.168.1.1:/tmp
$ ssh root@192.168.1.1
....
# sysupgrade /tmp/sysupgrade.bin

but you can also do it from the GUI.

> Currently I'm trying to create a single configuration that will work
> with any of my dongles and my mobile. I think I'm nearly there, but my
> original dongle, a Huawei E3372s, worked at first and then did not. The
> only significant thing that I did in between the successful and the
> unsuccessful attempt was to try altering the IP6 connections. Something
> about doing this altered the way the E3372s came up, connecting the
> interface thereafter produced an OpenWRT constructed virtual IP4
> interface, which at first I couldn't assign to a firewall zone - the
> vinterface only appeared when the dongle was connected and then it
> wasn't editable. I got round this by hacking /etc/config/firewall and
> rebooting, but even though the vinterface was now in the correct
> firewall zone, I still couldn't connect to the internet. So I've just
> gone back to factory defaults and started again.

I'm not sure I follow what's going on there, but just to say that
onemarcfifty on YouTube has a number of videos on configuring OpenWRT, and
you might find them helpful in understanding what's going on:

https://www.youtube.com/@OneMarcFifty/playlists

(in particular they changed the VLAN config in v21 and I found his video on
that useful in understanding what the differences were so I could port my
config to the new setup)

> I'm not very well up on IP6, so expect a question about that soon!

Fire away :-)

Theo

On 03/07/2023 17:46, Theo wrote:
>
> In uk.telecom.broadband Java Jive <java@evij.com.invalid> wrote:
>>
>> I tried the current 22 and got a message that the file was in the wrong
>> format.
>
> There is typically a 'first install' kernel.bin, and a sysupgrade.bin for
> upgrading a router that already has OpenWRT:
>
> https://firmware-selector.openwrt.org/?version=22.03.5&target=lantiq%2Fxrx200&id=bt_homehub-v5a

Thanks, I've just tried that, but unfortunately now I can't get the
admin interface to load. I can only ssh into it. Struggling to roll it
back.

--

Fake news kills!

I may be contacted via the contact address given on my website:
www.macfh.co.uk

In uk.telecom.broadband Java Jive <java@evij.com.invalid> wrote:
> On 03/07/2023 17:46, Theo wrote:
> >
> > In uk.telecom.broadband Java Jive <java@evij.com.invalid> wrote:
> >>
> >> I tried the current 22 and got a message that the file was in the wrong
> >> format.
> >
> > There is typically a 'first install' kernel.bin, and a sysupgrade.bin for
> > upgrading a router that already has OpenWRT:
> >
> > https://firmware-selector.openwrt.org/?version=22.03.5&target=lantiq%2Fxrx200&id=bt_homehub-v5a
>
> Thanks, I've just tried that, but unfortunately now I can't get the
> admin interface to load. I can only ssh into it. Struggling to roll it
> back.

It may be the Luci GUI isn't installed, as on some low memory images. You
may need to install it by hand:
https://openwrt.org/docs/guide-user/luci/luci.essentials

Theo

On 03/07/2023 22:45, Theo wrote:
> In uk.telecom.broadband Java Jive <java@evij.com.invalid> wrote:
>> On 03/07/2023 17:46, Theo wrote:
>>>
>>> In uk.telecom.broadband Java Jive <java@evij.com.invalid> wrote:
>>>>
>>>> I tried the current 22 and got a message that the file was in the wrong
>>>> format.
>>>
>>> There is typically a 'first install' kernel.bin, and a sysupgrade.bin for
>>> upgrading a router that already has OpenWRT:
>>>
>>> https://firmware-selector.openwrt.org/?version=22.03.5&target=lantiq%2Fxrx200&id=bt_homehub-v5a
>>
>> Thanks, I've just tried that, but unfortunately now I can't get the
>> admin interface to load. I can only ssh into it. Struggling to roll it
>> back.
>
> It may be the Luci GUI isn't installed, as on some low memory images. You
> may need to install it by hand:
> https://openwrt.org/docs/guide-user/luci/luci.essentials

Last night I didn't seem able to even communicate with it via the LAN,
so I put it aside as potentially bricked, and concentrated on the other
two (three in total because I keep a spare as backup, and an old one was
out-of-use as possibly flaky). I managed to reconfigure both the other
two to use any of my dongles and/or my mobile phone. One of these is in
use ATM, but it's the potentially flaky one. However, as currently it's
downloading Wimbledon, I'll wait until either that's complete or the
router gives problems and loses the connection before swapping back the
one that was in use before, now also reconfigured as above.

I'll probably make a new thread to post exactly how I've accomplished
this reconfiguration, so that any information that may potentially be
useful to others can be found in one post, rather than trawling through
this entire thread.

Returning this lunchtime to the one partially bricked by installing 22,
I can now connect to it and ssh into it, but that's about all. I'm
getting consistent errors on trying to install luci or do anything else
useful with it:

root@OpenWrt:~# opkg update && opkg install luci
Downloading
http://downloads.openwrt.org/snapshots/targets/lantiq/xrx200/packages/Packages.gz
Updated list of available packages in /var/opkg-lists/openwrt_core
Downloading
http://downloads.openwrt.org/snapshots/targets/lantiq/xrx200/packages/Packages.sig
Signature check passed.
Downloading
http://downloads.openwrt.org/snapshots/targets/lantiq/xrx200/kmods/4.14.99-1-e1364da2397b9f1b7fd3b92933663f5d/Packages.gz
*** Failed to download the package list from
http://downloads.openwrt.org/snapshots/targets/lantiq/xrx200/kmods/4.14.99-1-e1364da2397b9f1b7fd3b92933663f5d/Packages.gz
~ Downloading
http://downloads.openwrt.org/snapshots/packages/mips_24kc/base/Packages.gz
Updated list of available packages in /var/opkg-lists/openwrt_base
Downloading
http://downloads.openwrt.org/snapshots/packages/mips_24kc/base/Packages.sig
Signature check passed.
Downloading
http://downloads.openwrt.org/snapshots/packages/mips_24kc/luci/Packages.gz
Updated list of available packages in /var/opkg-lists/openwrt_luci
Downloading
http://downloads.openwrt.org/snapshots/packages/mips_24kc/luci/Packages.sig
Signature check passed.
Downloading
http://downloads.openwrt.org/snapshots/packages/mips_24kc/packages/Packages.gz
Updated list of available packages in /var/opkg-lists/openwrt_packages
Downloading
http://downloads.openwrt.org/snapshots/packages/mips_24kc/packages/Packages.sig
Signature check passed.
Downloading
http://downloads.openwrt.org/snapshots/packages/mips_24kc/routing/Packages.gz
Updated list of available packages in /var/opkg-lists/openwrt_routing
Downloading
http://downloads.openwrt.org/snapshots/packages/mips_24kc/routing/Packages.sig
Signature check passed.
Downloading
http://downloads.openwrt.org/snapshots/packages/mips_24kc/telephony/Packages.gz
Updated list of available packages in /var/opkg-lists/openwrt_telephony
Downloading
http://downloads.openwrt.org/snapshots/packages/mips_24kc/telephony/Packages.sig
Signature check passed.
Collected errors:
* opkg_download: Failed to download
http://downloads.openwrt.org/snapshots/targets/lantiq/xrx200/kmods/4.14.99-1-e1364d
a2397b9f1b7fd3b92933663f5d/Packages.gz, wget returned 8.

If I try to install luci regardless of the above error, I get ...

root@OpenWrt:~# opkg install luci
Installing luci (git-23.051.66410-a505bb1) to root...
Downloading
http://downloads.openwrt.org/snapshots/packages/mips_24kc/luci/luci_git-23.051.66410-a505bb1_all.ipk
Installing luci-proto-ipv6 (git-21.148.48881-79947af) to root...
Downloading
http://downloads.openwrt.org/snapshots/packages/mips_24kc/luci/luci-proto-ipv6_git-21.148.48881-79947af_all.ipk
Installing luci-app-firewall (git-23.174.36228-fbe1875) to root...
Downloading
http://downloads.openwrt.org/snapshots/packages/mips_24kc/luci/luci-app-firewall_git-23.174.36228-fbe1875_all.ipk
Installing libubox20230523 (2023-05-23-75a3b870-1) to root...
Downloading
http://downloads.openwrt.org/snapshots/packages/mips_24kc/base/libubox20230523_2023-05-23-75a3b870-1_mips_24kc.ipk
Installing libubus20220615 (2022-06-15-9913aa61-1) to root...
Downloading
http://downloads.openwrt.org/snapshots/packages/mips_24kc/base/libubus20220615_2022-06-15-9913aa61-1_mips_24kc.ipk
Installing libjson-c5 (0.16-3) to root...
Downloading
http://downloads.openwrt.org/snapshots/packages/mips_24kc/base/libjson-c5_0.16-3_mips_24kc.ipk
Installing libblobmsg-json20230523 (2023-05-23-75a3b870-1) to root...
Downloading
http://downloads.openwrt.org/snapshots/packages/mips_24kc/base/libblobmsg-json20230523_2023-05-23-75a3b870-1_mips_24kc.ipk
Installing rpcd (2023-07-01-c07ab2f9-1) to root...
Downloading
http://downloads.openwrt.org/snapshots/packages/mips_24kc/base/rpcd_2023-07-01-c07ab2f9-1_mips_24kc.ipk
Installing rpcd-mod-file (2023-07-01-c07ab2f9-1) to root...
Downloading
http://downloads.openwrt.org/snapshots/packages/mips_24kc/base/rpcd-mod-file_2023-07-01-c07ab2f9-1_mips_24kc.ipk
Installing libnl-tiny2023-07-01 (2023-07-01-d433990c-1) to root...
Downloading
http://downloads.openwrt.org/snapshots/packages/mips_24kc/base/libnl-tiny2023-07-01_2023-07-01-d433990c-1_mi
ps_24kc.ipk
Configuring libjson-c5.
Configuring libubox20230523.
Configuring libblobmsg-json20230523.
Configuring libubus20220615.
Configuring rpcd.
Configuring luci-app-firewall.
Configuring rpcd-mod-file.
Command failed: Not found
Configuring luci-proto-ipv6.
Collected errors:
* check_data_file_clashes: Package libnl-tiny2023-07-01 wants to
install file /usr/lib/libnl-tiny.so
But that file is already provided by package * libnl-tiny
* opkg_install_cmd: Cannot install package luci.

So now I'm trying to roll it back to a build that I know works, the
question is how? Particularly, how to get a retro image onto it?

I've tried ssh-ing in and mounting an NFS share on my NAS, which for
certain I can do from a Linux PC without any problem, but the router
gives a message along the lines of "device not available", which, as the
device clearly is available, probably means that the NFS networking
client is not installed by default. So I looked up how to install it,
but I get an error with that too:

root@OpenWrt:~# opkg install kmod-fs-nfs kmod-fs-nfs-common nfs-utils
Installing kmod-fs-nfs (5.15.111-1) to root...
Downloading
http://downloads.openwrt.org/snapshots/targets/lantiq/xrx200/packages/kmod-fs-nfs_5.15.111-1_mips_24kc.ipk
Installing kmod-fs-nfs-common (5.15.111-1) to root...
Downloading
http://downloads.openwrt.org/snapshots/targets/lantiq/xrx200/packages/kmod-fs-nfs-common_5.15.111-1_mips_24kc.ipk
Installing nfs-utils (2.6.2-3) to root...
Downloading
http://downloads.openwrt.org/snapshots/packages/mips_24kc/packages/nfs-utils_2.6.2-3_mips_24kc.ipk
Multiple packages (libpthread and libpthread) providing same name marked
HOLD or PREFER. Using latest.
Multiple packages (libpthread and libpthread) providing same name marked
HOLD or PREFER. Using latest.
Multiple packages (librt and librt) providing same name marked HOLD or
PREFER. Using latest.
Multiple packages (libpthread and libpthread) providing same name marked
HOLD or PREFER. Using latest.
Configuring kmod-fs-nfs-common.
Collected errors:
* satisfy_dependencies_for: Cannot satisfy the following dependencies
for kmod-fs-nfs:
* kernel (= 5.15.111-1-cf66ca0b201d986f9127dda1b9bbc526)
* opkg_install_cmd: Cannot install package kmod-fs-nfs.
* satisfy_dependencies_for: Cannot satisfy the following dependencies
for nfs-utils:
* kernel (= 5.15.111-1-cf66ca0b201d986f9127dda1b9bbc526)
* opkg_install_cmd: Cannot install package nfs-utils.

So then I tried installing the packages for mounting a USB stick, but
that fails too, some of the errors being the same:

root@OpenWrt:~# opkg install block-mount e2fsprogs kmod-fs-vfat
kmod-usb2 kmod-usb3
Installing block-mount (2023-02-28-bfe882d5-1) to root...
Downloading
http://downloads.openwrt.org/snapshots/targets/lantiq/xrx200/packages/block-mount_2023-02-28-bfe882d5-1_mips
_24kc.ipk
Installing e2fsprogs (1.47.0-2) to root...
Downloading
http://downloads.openwrt.org/snapshots/packages/mips_24kc/base/e2fsprogs_1.47.0-2_mips_24kc.ipk
Multiple packages (librt and librt) providing same name marked HOLD or
PREFER. Using latest.
Installing libuuid1 (2.39-2) to root...
Downloading
http://downloads.openwrt.org/snapshots/packages/mips_24kc/base/libuuid1_2.39-2_mips_24kc.ipk
Installing libblkid1 (2.39-2) to root...
Downloading
http://downloads.openwrt.org/snapshots/packages/mips_24kc/base/libblkid1_2.39-2_mips_24kc.ipk
Installing libcomerr0 (1.47.0-2) to root...
Downloading
http://downloads.openwrt.org/snapshots/packages/mips_24kc/base/libcomerr0_1.47.0-2_mips_24kc.ipk
Installing libss2 (1.47.0-2) to root...
Downloading
http://downloads.openwrt.org/snapshots/packages/mips_24kc/base/libss2_1.47.0-2_mips_24kc.ipk
Installing libext2fs2 (1.47.0-2) to root...
Downloading
http://downloads.openwrt.org/snapshots/packages/mips_24kc/base/libext2fs2_1.47.0-2_mips_24kc.ipk
Installing kmod-fs-vfat (5.15.111-1) to root...
Downloading
http://downloads.openwrt.org/snapshots/targets/lantiq/xrx200/packages/kmod-fs-vfat_5.15.111-1_mips_24kc.ipk
Installing kmod-usb2 (5.15.111-1) to root...
Downloading
http://downloads.openwrt.org/snapshots/targets/lantiq/xrx200/packages/kmod-usb2_5.15.111-1_mips_24kc.ipk
Installing kmod-usb3 (5.15.111-1) to root...
Downloading
http://downloads.openwrt.org/snapshots/targets/lantiq/xrx200/packages/kmod-usb3_5.15.111-1_mips_24kc.ipk
Configuring libuuid1.
Configuring libblkid1.
Configuring libcomerr0.
Configuring libss2.
Configuring libext2fs2.
Configuring e2fsprogs.
Collected errors:
* satisfy_dependencies_for: Cannot satisfy the following dependencies
for block-mount:
* libubox20220927
* libblobmsg-json20220927
* opkg_install_cmd: Cannot install package block-mount.
* satisfy_dependencies_for: Cannot satisfy the following dependencies
for kmod-fs-vfat:
* kernel (= 5.15.111-1-cf66ca0b201d986f9127dda1b9bbc526)
* opkg_install_cmd: Cannot install package kmod-fs-vfat.
* satisfy_dependencies_for: Cannot satisfy the following dependencies
for kmod-usb2:
* kernel (= 5.15.111-1-cf66ca0b201d986f9127dda1b9bbc526)
* opkg_install_cmd: Cannot install package kmod-usb2.
* satisfy_dependencies_for: Cannot satisfy the following dependencies
for kmod-usb3:
* kernel (= 5.15.111-1-cf66ca0b201d986f9127dda1b9bbc526)
* opkg_install_cmd: Cannot install package kmod-usb3.

Java Jive wrote:

> Downloading
> http://downloads.openwrt.org/snapshots/targets/lantiq/xrx200/kmods/4.14.99-1-e1364da2397b9f1b7fd3b92933663f5d/Packages.gz
> *** Failed to download the package list from
> http://downloads.openwrt.org/snapshots/targets/lantiq/xrx200/kmods/4.14.99-1-e1364da2397b9f1b7fd3b92933663f5d/Packages.gz
Looks as though you may have installed a daily snapshot version, not a
release version?

IME the corresponding snapshot packages are only available for 24 hours,
after which you need to install a new snapshot and get the packages
while they're "hot"

On 04/07/2023 17:19, Andy Burns wrote:
> Java Jive wrote:
>
>> Downloading
>> http://downloads.openwrt.org/snapshots/targets/lantiq/xrx200/kmods/4.14.99-1-e1364da2397b9f1b7fd3b92933663f5d/Packages.gz
>>
>> *** Failed to download the package list from
>> http://downloads.openwrt.org/snapshots/targets/lantiq/xrx200/kmods/4.14.99-1-e1364da2397b9f1b7fd3b92933663f5d/Packages.gz
>>
> Looks as though you may have installed a daily snapshot version, not a
> release version?
>
> IME the corresponding snapshot packages are only available for 24 hours,
> after which you need to install a new snapshot and get the packages
> while they're "hot"

Possibly, I followed Theo's link, but I may have clicked the wrong
download. I managed to get my USB-Serial lead working again, and now
have rolled it back to the same 18.06.4 version and configuration that
worked with the others.

--

Fake news kills!

I may be contacted via the contact address given on my website:
www.macfh.co.uk

In uk.telecom.broadband Java Jive <java@evij.com.invalid> wrote:
> On 04/07/2023 17:19, Andy Burns wrote:
> > Java Jive wrote:
> >
> >> Downloading
> >> http://downloads.openwrt.org/snapshots/targets/lantiq/xrx200/kmods/4.14.99-1-e1364da2397b9f1b7fd3b92933663f5d/Packages.gz
> >>
> >> *** Failed to download the package list from
> >> http://downloads.openwrt.org/snapshots/targets/lantiq/xrx200/kmods/4.14.99-1-e1364da2397b9f1b7fd3b92933663f5d/Packages.gz
> >>
> > Looks as though you may have installed a daily snapshot version, not a
> > release version?
> >
> > IME the corresponding snapshot packages are only available for 24 hours,
> > after which you need to install a new snapshot and get the packages
> > while they're "hot"
>
> Possibly, I followed Theo's link, but I may have clicked the wrong
> download. I managed to get my USB-Serial lead working again, and now
> have rolled it back to the same 18.06.4 version and configuration that
> worked with the others.

For the record, I've just done this with a Homehub 5a.

Currently they're not offering a 23.05 release candidate because of a
blocking bug:
https://patchwork.kernel.org/project/netdevbpf/patch/20220630212703.3280485-1-martin.blumenstingl@googlemail.com/
via
https://github.com/openwrt/openwrt/issues/10672

which as I understand is quite harmless - it spews a message in the
dmesg:

gswip 1e108000.switch: port 0 failed to add [mac address] vid 1 to fdb: -22

but that's easy to ignore. So I installed the snapshot build anyway.
That preserved config but wiped my packages, so I had to reinstall them.
For whatever reason the snapshot builds don't include luci by default.

First of all, connect the router to the internet. We need to install luci
via opkg, so opkg needs some networking. In the default config the WAN
ethernet port will work as an internet connection which would be sufficient.
If you have a different setup you'll need to set it up to get a route via
one of the ethernet ports - it may require use of 'ip addr add' and 'ip route
add' commands, and setting the DNS server in /etc/resolv.conf. I did
something like:

First udhcpd so the router doesn't offer DHCP responses
# ps
look for the process ID of udhcpd and kill it
# kill 12345

Then configure the interface with a temporary IP:
# ip addr add 192.168.99.245/24 dev br-lan
# ip route add default via 192.168.99.1 # (LAN IP of my internet-facing router)
# vi /etc/resolv.conf
(changed 'nameserver 127.0.0.1' to 'nameserver 8.8.8.8')
# ping 8.8.8.8
# ping example.com

Once it has internet, we need to set the time otherwise TLS certificates
will fail (your error above):

# ntpd -p pool.ntp.org

Then we can fetch luci:

# opkg update
# opkg install luci luci-ssl

and now Luci is available for further config on the GUI.

The HH5a looks to be working with the snapshot version, but I have yet to
test it thoroughly. I'm on:

Target Platform lantiq/xrx200
Firmware Version OpenWrt SNAPSHOT r22888-0779c47be6 / LuCI Master git-23.158.78004-23a246e
Kernel Version 5.15.111

Theo

On 25/06/2023 18:49, Java Jive wrote:
>
> Deliberate X-Post for reasons that will become apparent.
>
> [Big snip]

I now have the BT Home Hub 5a running 18.6.4 working with:
Alcatel_IK40 4G(?) dongle *
BT Assure/Huawei E3372h 4G dongle
Huawei E3372s 4G dongle
Samsung Galaxy Tab S2 model SM-T719 tablet/mobile phone
ZTE MF823 4G dongle

* Not actually tested with this build, because I didn't want the bother
of pushing out the centre of the SIM to make a mini/micro-SIM and then
having to re-insert back to make up the full SIM card again. However,
it should work, because it takes the same settings as the mobile phone
and the ZTE.

As promised, I am preparing a document with how to get all these dongles
working, but have decided that I will make it a webpage rather than a
post here, but, also as promised, I have some questions about IP6

The original OpenWRT build for the BTHH5a has the following three
sections relating to the WAN in /etc/config/network ...

config interface 'wan'
option ifname 'dsl0'
option proto 'pppoe'
option username 'username'
option password 'password'
option ipv6 '1'

config device 'wan_dev'
option name 'dsl0'
option macaddr '<MAC Address>'

config interface 'wan6'
option ifname '@wan'
option proto 'dhcpv6'

.... which, to get the above USB-attached devices working, I have
replaced with ...

config interface 'WAN_DSL'
option proto 'pppoa'
option encaps 'vc'
option atmdev '0'
option vci '38'
option vpi '0'
option macaddr '<MAC Address>'
option ipv6 'auto'
option metric '2'
option auto '0'

config interface 'WAN_Ethernet'
option proto 'dhcp'
option ifname 'eth0.2'
option macaddr '<MAC Address>'
option auto '0'

config interface 'WAN_Huawei_E3372h'
option proto 'dhcp'
option ifname 'eth1'

config interface 'WAN_Huawei_E3372s'
option proto 'ncm'
option pdptype 'IP'
option apn '3internet'
option ipv6 'auto'
option device '/dev/ttyUSB0'
option delay '20'
option auto '0'

config interface 'WAN_USB'
option proto 'dhcp'
option ifname 'usb0'
option auto '0'

.... where the WAN_Huawei_E3372h section covers also a BT Assure 4G
unlocked dongle and the generic WAN_USB section covers the Alcatel and
ZTE dongles, and a Samsung mobile phone in USB Tethering mode.

The modules needed are as follows:
chat
comgt
comgt-ncm
kmod-mii
kmod-usb-net
kmod-usb-net-cdc-ether
kmod-usb-net-cdc-ncm
kmod-usb-net-huawei-cdc-ncm
kmod-usb-net-qmi-wwan
kmod-usb-net-rndis
kmod-usb-serial
kmod-usb-serial-option
kmod-usb-serial-wwan
kmod-usb-wdm
luci-app-mwan3
luci-app-sqm
luci-app-wol
luci-proto-3g
luci-proto-ncm
mwan3
procps-ng-ps
uqmi
usb-modeswitch
usbutils
wwan

The above all works fine in IP4, but I'm concerned that I have removed
the original WAN6 section. Following the pattern of that, I could
define a WAN6 section for each of the above, as per the following
example ...

config interface 'WAN_Huawei_E3372h'
option ifname 'eth1'
option proto 'dhcp'

config interface 'WAN_Huawei_E3372h_6'
option ifname '@WAN_Huawei_E3372h'
option proto 'dhcpv6'

.... and similarly for the others, but this seems somewhat clumsy because
to swap dongles, I'd have to stop two connections and start two others,
instead of just the one as at present, and further I have no idea if it
will work - ATM the BT Assure 4G dongle is in use and is working well
downloading Wimbledon, so I'm not inclined to fiddle about testing just
now ...

How can I test whether IP6 is being supported properly?

Noting the lan_dev and wan_dev devices, is there a way, for example by
defining different devices rather than different interfaces for the
different dongles, that I can switch the system over to a different
dongle by just a single configuration change instead of the present two
or potentially four with IP6?

Note, I have searched about devices in /etc/config/network, but didn't
find much useful info.

--

Fake news kills!

I may be contacted via the contact address given on my website:
www.macfh.co.uk

In uk.telecom.broadband Java Jive <java@evij.com.invalid> wrote:
> config interface 'WAN_Huawei_E3372h'
> option proto 'dhcp'
> option ifname 'eth1'
>
> config interface 'WAN_Huawei_E3372s'
> option proto 'ncm'
> option pdptype 'IP'
> option apn '3internet'
> option ipv6 'auto'
> option device '/dev/ttyUSB0'
> option delay '20'
> option auto '0'
>
> config interface 'WAN_USB'
> option proto 'dhcp'
> option ifname 'usb0'
> option auto '0'
>
> ... where the WAN_Huawei_E3372h section covers also a BT Assure 4G
> unlocked dongle and the generic WAN_USB section covers the Alcatel and
> ZTE dongles, and a Samsung mobile phone in USB Tethering mode.

OK, so one group of dongles are pretend-ethernet cards and another
pretend-dialup modems.

> The above all works fine in IP4, but I'm concerned that I have removed
> the original WAN6 section. Following the pattern of that, I could
> define a WAN6 section for each of the above, as per the following
> example ...
>
> config interface 'WAN_Huawei_E3372h'
> option ifname 'eth1'
> option proto 'dhcp'
>
>
> config interface 'WAN_Huawei_E3372h_6'
> option ifname '@WAN_Huawei_E3372h'
> option proto 'dhcpv6'
>
> ... and similarly for the others, but this seems somewhat clumsy because
> to swap dongles, I'd have to stop two connections and start two others,
> instead of just the one as at present, and further I have no idea if it
> will work - ATM the BT Assure 4G dongle is in use and is working well
> downloading Wimbledon, so I'm not inclined to fiddle about testing just
> now ...

I think the reason for the above is IPv4 and IPv6 have different ways of
getting addresses. For IPv4 over ethernet it's DHCP, but for IPv4 over
dialup modems it's PPP. For IPv6 over ethernet it could be SLAAC
(stateless autoconfiguration) or DHCPv6. For IPv6 over modem I think it's
also PPP (not sure if SLAAC is also an option here).

So you would need multiple interface blocks defined depending on what each
protocol needs, and I think you'd need four interface blocks.

But what I'd do is keep everything set up, and just pick routing based on
which interface is up. ie if only one dongle is plugged in, only one
configuration block is going to be active. I think if only one is plugged
in, without any special config you'll get a default route and that's where
packets will go. If both are plugged in, one default route will win -
although fancier routing config is possible.

I think if you just configure both interfaces as appropriate and see if they
work if one or other dongle is plugged in.

I think you may need to put all your WAN_* interfaces in the WAN firewall
zone, so they're all treated as 'outside' your network. The defaults are
mostly there - on my Firewall setup I have in the 'wan' zone:

wan wan6 EthWAN EthWAN6

('wan' is the DSL interface in my settings, 'EthWAN' is the red ethernet port)

So I'd just create _6 versions of your interfaces and add them to this
zone.

> How can I test whether IP6 is being supported properly?

$ host example.com
example.com has address 93.184.216.34
example.com has IPv6 address 2606:2800:220:1:248:1893:25c8:1946
example.com mail is handled by 0 .

$ ping6 2606:2800:220:1:248:1893:25c8:1946
[should answer]

and then try an IPv6 test website:
https://ipv6test.google.com/
http://testmyipv6.com/
and plenty of others if you google for them

> Noting the lan_dev and wan_dev devices, is there a way, for example by
> defining different devices rather than different interfaces for the
> different dongles, that I can switch the system over to a different
> dongle by just a single configuration change instead of the present two
> or potentially four with IP6?

You should be able to just run the two devices completely in parallel,
without any config changes. At worst you'd need to adjust the default route
if both were plugged in together.

> Note, I have searched about devices in /etc/config/network, but didn't
> find much useful info.

OneMarcFifty has a video on using IPv6 in his OpenWRT playlist. I haven't
watched it, but it may be helpful:
https://www.youtube.com/watch?v=LJPXz8eA3b8

- although bear in mind this is mostly focused on ethernet which is more
straightforward and has fewer quirks generated by whatever dongle you have.

On the 'Wifi, networking...' playlist he also has some introductory videos
on IPv6 concepts which may be useful for understand what's happening:
https://www.youtube.com/watch?v=oItwDXraK1M
https://www.youtube.com/watch?v=jlG_nrCOmJc

Theo

In uk.telecom.broadband Theo <theom+news@chiark.greenend.org.uk> wrote:
> OneMarcFifty has a video on using IPv6 in his OpenWRT playlist. I haven't
> watched it, but it may be helpful:
> https://www.youtube.com/watch?v=LJPXz8eA3b8
>
> - although bear in mind this is mostly focused on ethernet which is more
> straightforward and has fewer quirks generated by whatever dongle you have.

That reminds me of something. It's one thing for the interface to get an
address for the router, but what you want is to be able to get a block of
addresses for the rest of the network. Each local network takes up 2^64
addresses, so if your ISP gives you a /56 bit prefix meaning you have 2^8
networks each containing 2^64 addresses (128-64-8=56).

So it depends what you mobile network gives you. You hope it will issue you
a /64 or larger, which means you have a prefix for your network (the ISP
gives you the public 64 bits, machines on the network use the remaining 64
bits). SLAAC autoconfiguration works with at least a 64 bit local part.

But there's a risk the ISP will give you fewer bits. If you get a /128
they've only given you a single IP address so you'd have to do NAT. If they
give you something smaller like a /112 you can't use SLAAC to assign local
addresses, you'd have to use DHCPv6 like you would with v4.

That means your network configuration will depend on how your ISP configures
things. Regular ISPs do predictable things with IPv6 so you'd get a /64 or
bigger, but mobile networks may do something strange. You'll only find out
by connecting and seeing what address blocks you get given.

Theo

Theo wrote:

> Each local network takes up 2^64 addresses, so if your ISP gives you
> a /56 bit prefix meaning you have 2^8 networks each containing 2^64
> addresses (128-64-8=56).

I've never understood why ISPs are *SO* profligate with IPv6 addrs, yes
I understand 128bits is very big, and billions of IP addrs per grain of
sand yada-yada, but 640KB was big once, and 4GB was big once ...

Many thanks for your continuing help, Theo ...

On 08/07/2023 22:45, Theo wrote:
>
> In uk.telecom.broadband Java Jive <java@evij.com.invalid> wrote:
>>
>> config interface 'WAN_Huawei_E3372h'
>> option proto 'dhcp'
>> option ifname 'eth1'
>>
>> config interface 'WAN_Huawei_E3372s'
>> option proto 'ncm'
>> option pdptype 'IP'
>> option apn '3internet'
>> option ipv6 'auto'
>> option device '/dev/ttyUSB0'
>> option delay '20'
>> option auto '0'
>>
>> config interface 'WAN_USB'
>> option proto 'dhcp'
>> option ifname 'usb0'
>> option auto '0'
>>
>> ... where the WAN_Huawei_E3372h section covers also a BT Assure 4G
>> unlocked dongle and the generic WAN_USB section covers the Alcatel and
>> ZTE dongles, and a Samsung mobile phone in USB Tethering mode.
>
> OK, so one group of dongles are pretend-ethernet cards and another
> pretend-dialup modems.
>
>> The above all works fine in IP4, but I'm concerned that I have removed
>> the original WAN6 section. Following the pattern of that, I could
>> define a WAN6 section for each of the above, as per the following
>> example ...
>>
>> config interface 'WAN_Huawei_E3372h'
>> option ifname 'eth1'
>> option proto 'dhcp'
>>
>>
>> config interface 'WAN_Huawei_E3372h_6'
>> option ifname '@WAN_Huawei_E3372h'
>> option proto 'dhcpv6'
>>
>> ... and similarly for the others, but this seems somewhat clumsy because
>> to swap dongles, I'd have to stop two connections and start two others,
>> instead of just the one as at present, and further I have no idea if it
>> will work - ATM the BT Assure 4G dongle is in use and is working well
>> downloading Wimbledon, so I'm not inclined to fiddle about testing just
>> now ...
>
> I think the reason for the above is IPv4 and IPv6 have different ways of
> getting addresses. For IPv4 over ethernet it's DHCP, but for IPv4 over
> dialup modems it's PPP. For IPv6 over ethernet it could be SLAAC
> (stateless autoconfiguration) or DHCPv6. For IPv6 over modem I think it's
> also PPP (not sure if SLAAC is also an option here).
>
> So you would need multiple interface blocks defined depending on what each
> protocol needs, and I think you'd need four interface blocks.
>
> But what I'd do is keep everything set up, and just pick routing based on
> which interface is up. ie if only one dongle is plugged in, only one
> configuration block is going to be active. I think if only one is plugged
> in, without any special config you'll get a default route and that's where
> packets will go. If both are plugged in, one default route will win -
> although fancier routing config is possible.
>
> I think if you just configure both interfaces as appropriate and see if they
> work if one or other dongle is plugged in.
>
> I think you may need to put all your WAN_* interfaces in the WAN firewall
> zone, so they're all treated as 'outside' your network. The defaults are
> mostly there - on my Firewall setup I have in the 'wan' zone:
>
> wan wan6 EthWAN EthWAN6

Yes, currently, without '_6' interfaces the relevant section in
/etc/config/firewall reads:

config zone
option name 'wan'
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
option masq '1'
option mtu_fix '1'
option network 'WAN_DSL WAN_Ethernet WAN_Huawei_E3372h
WAN_Huawei_E3372s WAN_Huawei_E3372s_4 WAN_USB'

> ('wan' is the DSL interface in my settings, 'EthWAN' is the red ethernet port)
>
> So I'd just create _6 versions of your interfaces and add them to this
> zone.
>
>> How can I test whether IP6 is being supported properly?
>
> $ host example.com
> example.com has address 93.184.216.34
> example.com has IPv6 address 2606:2800:220:1:248:1893:25c8:1946
> example.com mail is handled by 0 .
>
> $ ping6 2606:2800:220:1:248:1893:25c8:1946
> [should answer]

So, as feared, I don't have IP6 support. From a Windows PC:

23:54:15 D:\Temp>ping -6 2606:2800:220:1:248:1893:25c8:1946

Pinging 2606:2800:220:1:248:1893:25c8:1946 with 32 bytes of data:
PING: transmit failed. General failure.
PING: transmit failed. General failure.
PING: transmit failed. General failure.
PING: transmit failed. General failure.

Ping statistics for 2606:2800:220:1:248:1893:25c8:1946:
Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),

23:54:25 D:\Temp>ping -4 93.184.216.34

Pinging 93.184.216.34 with 32 bytes of data:
Reply from 93.184.216.34: bytes=32 time=152ms TTL=49
Reply from 93.184.216.34: bytes=32 time=141ms TTL=49
Reply from 93.184.216.34: bytes=32 time=157ms TTL=49
Reply from 93.184.216.34: bytes=32 time=138ms TTL=49

Ping statistics for 93.184.216.34:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 138ms, Maximum = 157ms, Average = 147ms

> and then try an IPv6 test website:
> https://ipv6test.google.com/
> http://testmyipv6.com/
> and plenty of others if you google for them

Thanks, but for now, given the results above, I'll have to note those
for later.

As Wimbledon is still ongoing and therefore still downloading, I'll wait
until either it's over or until there's another problem before trying to
fix IP6.

>> Noting the lan_dev and wan_dev devices, is there a way, for example by
>> defining different devices rather than different interfaces for the
>> different dongles, that I can switch the system over to a different
>> dongle by just a single configuration change instead of the present two
>> or potentially four with IP6?
>
> You should be able to just run the two devices completely in parallel,
> without any config changes. At worst you'd need to adjust the default route
> if both were plugged in together.
>
>> Note, I have searched about devices in /etc/config/network, but didn't
>> find much useful info.
>
> OneMarcFifty has a video on using IPv6 in his OpenWRT playlist. I haven't
> watched it, but it may be helpful:
> https://www.youtube.com/watch?v=LJPXz8eA3b8
>
> - although bear in mind this is mostly focused on ethernet which is more
> straightforward and has fewer quirks generated by whatever dongle you have.
>
> On the 'Wifi, networking...' playlist he also has some introductory videos
> on IPv6 concepts which may be useful for understand what's happening:
> https://www.youtube.com/watch?v=oItwDXraK1M
> https://www.youtube.com/watch?v=jlG_nrCOmJc

I'll try and take a look at these over the next few days.

Thanks again.

--

Fake news kills!

I may be contacted via the contact address given on my website:
www.macfh.co.uk

In uk.telecom.broadband Andy Burns <usenet@andyburns.uk> wrote:
>
> Theo wrote:
>
> > Each local network takes up 2^64 addresses, so if your ISP gives you
> > a /56 bit prefix meaning you have 2^8 networks each containing 2^64
> > addresses (128-64-8=56).
>
> I've never understood why ISPs are *SO* profligate with IPv6 addrs, yes
> I understand 128bits is very big, and billions of IP addrs per grain of
> sand yada-yada, but 640KB was big once, and 4GB was big once ...

It's because autoconfiguration works if you have a large enough namespace.
MAC addresses are 48 bits, so providing a namespace of 2^48+1 addresses
to ensures that any machine is able to generate its own unique IP (but
predictable) from its MAC.

Actually there are some other things you might want to use as local
addresses that don't clash with the MAC namespace (eg randomly changing IPs
for privacy purposes) so you need a few more than 48 bits. The next block up
is 64 so that's what you get.

That's basic IPv6: 64 bits of local addresses = one subnet. Measly
ISPs can give you a /64, but better ones give you a /56 or larger (256
subnets), which allows multiple globally-routable subnets without needing to
NAT.

Basically you need to change mindset from the ideas that IPs are handed out
one by one and need a central authority to manage clashes. It just gets
easier if everything is able to figure out its own IP without the central
authority managing a database.

(of course there are other reasons why you might want to a central authority
- eg in a business scenario - so you can have that if you want)

Theo

Theo wrote:

> Actually there are some other things you might want to use as local
> addresses that don't clash with the MAC namespace (eg randomly changing IPs
> for privacy purposes) so you need a few more than 48 bits.

I thought they were already planning for 64bit MAC addrs, instead of 48bit

On 09/07/2023 10:30, Andy Burns wrote:
>
> Theo wrote:
>
>> Each local network takes up 2^64 addresses, so if your ISP gives you
>> a /56 bit prefix meaning you have 2^8 networks each containing 2^64
>> addresses (128-64-8=56).
>
> I've never understood why ISPs are *SO* profligate with IPv6 addrs, yes
> I understand 128bits is very big, and billions of IP addrs per grain of
> sand yada-yada, but 640KB was big once, and 4GB was big once ...

I still can't get my brain around why IPv6 addresses present the large
number of device addresses to the internet. I can see that the world is
running out of public IP (WAN) addresses for routers. But why do we need
so many private addresses? What is wrong with a 6-byte rather than
4-byte WAN address, with a private LAN of 256 addresses - or for larger
organisations, maybe 512, 1024, 2048 etc addresses - all multiplexed
onto the same WAN address by the power of NAT as we do with IPv4.

If private addresses are propagated onto the WAN, that places the onus
on every single device, even cheap security cameras etc, having its own
secure firewall, rather than the router being the thing with the
firewall, behind which there are devices that don't have and and don't
need their own firewalls.

[dropping the crosspost]

In uk.telecom.broadband NY <me@privacy.net> wrote:
> I still can't get my brain around why IPv6 addresses present the large
> number of device addresses to the internet. I can see that the world is
> running out of public IP (WAN) addresses for routers. But why do we need
> so many private addresses? What is wrong with a 6-byte rather than
> 4-byte WAN address, with a private LAN of 256 addresses - or for larger
> organisations, maybe 512, 1024, 2048 etc addresses - all multiplexed
> onto the same WAN address by the power of NAT as we do with IPv4.

Because we don't have enough addresses for purely WAN-facing ones. We're
already NATted up to the hilt and v4 addresses are exhausted, so we're
having to go around scrounging tiny blocks of a few addresses at a time and
paying their sellers a big premium to do that. The only 'solution' is CGNAT
where the thousands of ISP customers live behind a single public IPv4 and
that's a world of trouble (eg if one of those customers gets the IP banned
by a site, so are all the others). Also if you're running a server you need
a public-facing IP and CGNAT doesn't help you.

Secondly, there aren't enough private addresses either. There's only three
RFC1918 subnets, offering 2^16+2^20+2^24 = about 18 million private
addresses. Some ISPs have more customers than this, and reissuing the same
private IP to multiple customers gets awkward too (eg now we can't tell from
a website log which customer it was).

There's no way to change the system in a backwards compatible way, so if
you're going to have a breaking change you might as well give yourself more
address space than you could possibly want, rather than be miserly and have
to do the whole thing again in 20 years.

While the default v6 address assignment is fairly profligate, the system
allows for tighter allocation of space should giving a whole /64 to a subnet
turn out to be a problem down the line. The internet backbone isn't fussy
how you set up your local network, it can deliver the packets there without
another multi-decade change process like the v4->v6 transition.

> If private addresses are propagated onto the WAN, that places the onus
> on every single device, even cheap security cameras etc, having its own
> secure firewall, rather than the router being the thing with the
> firewall, behind which there are devices that don't have and and don't
> need their own firewalls.

IPv6 works exactly the same as v4 in this respect. You still have a
firewall between devices and the internet, and by default the internet can't
get at your device. v6 just simplifies the firewall because it no longer
needs to do NAT.

Theo

NY <me@privacy.net> writes:
> If private addresses are propagated onto the WAN, that places the onus
> on every single device, even cheap security cameras etc, having its
> own secure firewall, rather than the router being the thing with the
> firewall, behind which there are devices that don't have and and don't
> need their own firewalls.

There's no reason you can't have routable IPs on your internal network
and still implement a firewall at the border.

It's what I do at home: every device on my LAN gets a routable IPv6
address, but my router (a Linux box) has a firewall configured to block
incoming connections.

john

On 09/07/2023 22:11, Theo wrote:
> [dropping the crosspost]
>
> In uk.telecom.broadband NY <me@privacy.net> wrote:
>> I still can't get my brain around why IPv6 addresses present the large
>> number of device addresses to the internet.
>
>
> Secondly, there aren't enough private addresses either. There's only three
> RFC1918 subnets, offering 2^16+2^20+2^24 = about 18 million private
> addresses. Some ISPs have more customers than this, and reissuing the same
> private IP to multiple customers gets awkward too (eg now we can't tell from
> a website log which customer it was).

It doesn't matter that there are only about 18 million private addresses
(10.x.x.x, 172.x.x.x and 192.168.x.x). I would imagine almost every LAN
in the world has a device with private IP 192.168.1.1. But unless a PC
on one LAN needs to talk directly to one on another LAN, that
duplication is irrelevant - as long as every router in the world is
given (by the customer's ISP) a unique public IP. It is public IPs which
are in short supply and that is the addressing space that needs to be
increased.

> There's no way to change the system in a backwards compatible way, so if
> you're going to have a breaking change you might as well give yourself more
> address space than you could possibly want, rather than be miserly and have
> to do the whole thing again in 20 years.

I agree. At present (and for the foreseeable future) any LAN won't have
more than a few hundred devices (for a domestic LAN) and allocating a
whole /56 or /64 block seems a waste.

> While the default v6 address assignment is fairly profligate, the system
> allows for tighter allocation of space should giving a whole /64 to a subnet
> turn out to be a problem down the line. The internet backbone isn't fussy
> how you set up your local network, it can deliver the packets there without
> another multi-decade change process like the v4->v6 transition.
>
>> If private addresses are propagated onto the WAN, that places the onus
>> on every single device, even cheap security cameras etc, having its own
>> secure firewall, rather than the router being the thing with the
>> firewall, behind which there are devices that don't have and and don't
>> need their own firewalls.
>
> IPv6 works exactly the same as v4 in this respect. You still have a
> firewall between devices and the internet, and by default the internet can't
> get at your device. v6 just simplifies the firewall because it no longer
> needs to do NAT.

Within a LAN, do all the bytes of an IPv6 address need to be specified
in things like a ping command or a local URL (eg to access an Internet
of Things device that has a web interface)? Or can you get away with
omitting the bytes which are the same for all devices on your LAN?

I presume port forwarding with IPv6 becomes much simpler because you are
just opening up a specific port so someone from outside can access
PC1_IP:80 whereas normally the firewall would block it; in contrast with
IPv4 you have to map WAN_IP:80 to PC1_IP:80 and you have to use another
WAN port number if you want to make PC2_IP:80 accessible.

Are IPv6 addresses always fixed? Does a given device (identified by its
MAC) always get the same address, or is it still necessary (as it is
with IPv4) to use dynamic DNS services such as no-ip so port-forwarded
PCs keep a fixed public URL even though the ISP may from time to time
change your router's public IP (the common bytes within your IPv6 address)?

What handles MAC-to-IP mapping with IPv6? Once you've been given your
/56 block of IPv6 addresses, do you have any control over what IP within
that block a specific device gets, eg using DHCP at the router? I tend
to use DHCP address-reservation so each Windows/Linux PC gets a fixed IP
from one block of local addresses, each mobile phones or tablet gets a
fixed one from another block, and (very important) my printer gets a
fixed IP because many printer drivers for LAN-connected printers can't
handle the printer's IP changing. Apart from the printer, it's just for
reasons of keeping things tidy and OCD-like :-)

Part of the problem is that until ISPs (well, mine specifically) start
using IPv6, there's no opportunity to experiment and investigate, and
gain the knowledge.

(I'm old enough to remember the days before DHCP when all computers at
work had to use the same copy of a HOSTS file, and every new computer
has to be given a new address that has been checked against this HOSTS
file. DHCP and star Ethernet topology rather than daisy-chained toplogy
with T pieces and terminators have got to be the two of the biggest
innovations in LANs in the last 30 years.)

NY <me@privacy.net> wrote:
> On 09/07/2023 22:11, Theo wrote:
> > [dropping the crosspost]
> >
> > In uk.telecom.broadband NY <me@privacy.net> wrote:
> >> I still can't get my brain around why IPv6 addresses present the large
> >> number of device addresses to the internet.
> >
> >
> > Secondly, there aren't enough private addresses either. There's only three
> > RFC1918 subnets, offering 2^16+2^20+2^24 = about 18 million private
> > addresses. Some ISPs have more customers than this, and reissuing the same
> > private IP to multiple customers gets awkward too (eg now we can't tell from
> > a website log which customer it was).
>
> It doesn't matter that there are only about 18 million private addresses
> (10.x.x.x, 172.x.x.x and 192.168.x.x). I would imagine almost every LAN
> in the world has a device with private IP 192.168.1.1. But unless a PC
> on one LAN needs to talk directly to one on another LAN, that
> duplication is irrelevant - as long as every router in the world is
> given (by the customer's ISP) a unique public IP. It is public IPs which
> are in short supply and that is the addressing space that needs to be
> increased.

It does matter. Comcast has 32.3 million broadband customers. There are
not enough private IPv4 addresses to give each one a unique private IP.
This is a problem for Comcast because now they can't run servers that are
accessible by every customer, they have to run NAT *inside* their network.
It also complicates law enforcement because having that internal IP is no
longer enough to identify a specific customer.

> > There's no way to change the system in a backwards compatible way, so if
> > you're going to have a breaking change you might as well give yourself more
> > address space than you could possibly want, rather than be miserly and have
> > to do the whole thing again in 20 years.
>
> I agree. At present (and for the foreseeable future) any LAN won't have
> more than a few hundred devices (for a domestic LAN) and allocating a
> whole /56 or /64 block seems a waste.

When there are more addresses than atoms in the universe, why is wasting a
problem?

Which is not to say we can't use a different allocation policy later if it
turns out to be so. It doesn't change anything about how the internet
functions, it's just a local decision.

> Within a LAN, do all the bytes of an IPv6 address need to be specified
> in things like a ping command or a local URL (eg to access an Internet
> of Things device that has a web interface)? Or can you get away with
> omitting the bytes which are the same for all devices on your LAN?

You can skip leading zeroes and omit consecutive 16-bit chunks which are
zero with a double colon.

In other words, if your ISP gives you 1234:5678:0bcd as a 48-bit prefix,
you can allocate
1234:5678:bcd:0:0:0:0:1
as an address and that can be shortened to:
1234:5678:bcd::1

If you're concerned about the length of written addresses, that would be a
way to allocate them to keep them short.

You can't omit bytes that 'everyone knows' because devices have multiple
addresses in different scopes (localhost, link-local, private, global) so
the device needs to know to which of those you refer.

Devices have at least one address in each scope, and often more than one
(since addresses are so cheap, remember?)

> I presume port forwarding with IPv6 becomes much simpler because you are
> just opening up a specific port so someone from outside can access
> PC1_IP:80 whereas normally the firewall would block it; in contrast with
> IPv4 you have to map WAN_IP:80 to PC1_IP:80 and you have to use another
> WAN port number if you want to make PC2_IP:80 accessible.

Yes, it doesn't need to translate the IP address and port as it does for
NAT.

You can do 1:1 NAT if you like though - keep the local part the same and
swap the network part at the router. There are times you want to do that,
eg if you're have multiple upstream ISP connections where the public IP is
only known when you know which connection the packet going to take.

> Are IPv6 addresses always fixed? Does a given device (identified by its
> MAC) always get the same address, or is it still necessary (as it is
> with IPv4) to use dynamic DNS services such as no-ip so port-forwarded
> PCs keep a fixed public URL even though the ISP may from time to time
> change your router's public IP (the common bytes within your IPv6 address)?

It depends on local policy. Typically a device will have multiple IPs: one
stable one generated from the MAC address, which is what you'd use for
incoming traffic (connections to services running on it), and maybe others
it uses for initiating connections - for privacy reasons these can be
changed at regular intervals so a particular device can't be tracked.

> What handles MAC-to-IP mapping with IPv6? Once you've been given your
> /56 block of IPv6 addresses, do you have any control over what IP within
> that block a specific device gets, eg using DHCP at the router? I tend
> to use DHCP address-reservation so each Windows/Linux PC gets a fixed IP
> from one block of local addresses, each mobile phones or tablet gets a
> fixed one from another block, and (very important) my printer gets a
> fixed IP because many printer drivers for LAN-connected printers can't
> handle the printer's IP changing. Apart from the printer, it's just for
> reasons of keeping things tidy and OCD-like :-)

You can have devices work out their own IP if you want - just send router
advertisements with the prefix in them and devices will configure
themselves. Or don't send RAs and expect devices to do DHCPv6. Up to you.

Autoconfiguration is based on the MAC address so those addresses won't
change unless the MAC changes. Effectively it's just the same as that
IP<->MAC table when setting up static DHCPv4 in your router, only it happens
automatically for every device. If you want to OCD which address gets
allocated, that might be a job for DHCPv6.

> Part of the problem is that until ISPs (well, mine specifically) start
> using IPv6, there's no opportunity to experiment and investigate, and
> gain the knowledge.

Some ISPs are particular laggards. I name and shame Virgin Media as a
special example - there's been a thread on their forum asking 'when will VM
get IPv6?' for 13 years now.

> (I'm old enough to remember the days before DHCP when all computers at
> work had to use the same copy of a HOSTS file, and every new computer
> has to be given a new address that has been checked against this HOSTS
> file. DHCP and star Ethernet topology rather than daisy-chained toplogy
> with T pieces and terminators have got to be the two of the biggest
> innovations in LANs in the last 30 years.)

You can still allocate addresses statically too if you want. For example
you could give every device a private address (in the fc00:: to fdff::
range) - this could be useful for eg printers where you're only
communicating with them locally. They'll get a globally routable address
too (eg if they need to download firmware updates or whatever), but if you
want to access devices via easy to remember IPs then this is one way - the
printer could be fd00::2 or something.

Theo