ffac-private-wan-dhcp: route clients' IPv6 over LTE correctly

[mariuswhm]

• update.lua: on uplink up, add an IPv6 policy-routing rule (network.lte_clients, a rule6) that sends the LTE /64 clients into the LTE routing table (lookup 1, priority 9999), using the prefix already derived from wwan0; removed on down. Fixes clients getting an IPv6 address but no connectivity (their traffic fell back to the Freifunk default route).

ffac-web-private-wan-dhcp: fix the IPv6 DNS field reusing the dns_server option id (now uradvd_dns_server).

[maurerle]

@mariuswhm wouldn't it be better to add cake/SQM for gluon core as a separate part? This would just need to extend the existing SQM package: https://gluon.readthedocs.io/en/main/package/gluon-mesh-vpn-sqm.html#gluon-mesh-vpn-sqm ?

[mariuswhm]

@maurerle - I've dropped all SQM/cake from this PR, so it's now just the IPv6 policy-routing fix (+ a small web-UI fix for the IPv6 DNS field).

[T-X]

Noticing this package for the first time but sounds very interesting to have a routed private wifi feature. And I'm wondering if this could be a viable new private-wifi option suitable for upstream.

The main use-case(s) I'd see (and feel free to correct me if that seems different/incompatible to the originally envisioned use-cases): 1) Having a private WiFi, typically for your printer / NAS / TV / sound system / lights / IoT devices, things you don't want accessible from Freifunk networks, which (optionally) allows simultaneous access to the Freifunk network(s). 2) Having a private WiFi which is not accessible from the WAN side. 3) A mode which allows using a private WiFi without an extra home router with most ISPs.

Ideally, for upstream, it would maybe be something like a new role 'uplink-routed'?

(And as a future "vision": Which by default (in the future) would need no extra config, just like you'd expect from a Fritz!Box, maybe with the help of TR-069 or DHCPv6 Prefix Delegation. But would optionally allow customizations for IP addresses etc., maybe even optionally allowing to announce your private subnets via OSPF/RIP/Babel/... to the Freifunk side with customizable firewall rules at some point.) And would also work simultaneously with the current, classic, bridged role 'uplink' via a separate ESSID.

[T-X]

And I would actually have a real, current use-case for simultaneous uplink-bridged + uplink-routed modes:

We have a network here with a housing project of ~50 people. With one shared fiber internet access, leased by a club / Verein. It also has a 2D ink printer on it, potentially later also a shared NAS and other digitial collaboration tools dedicated to the local residents (only). There is one common ESSID with WPA for this network (+VLAN). Next there is also an extra VLAN for Freifunk mesh-on-wan on this network.

Now people would either: Set up/use a Gluon router with two WAN VLANs, one for mesh-on-wan and one for the direct, bridged uplink without Freifunk. Or, if they have devices which they don't want to share with other residents (for instance a 3D printer, solar control, private NAS etc.) then they use a non-Gluon router. But then they don't have access to the Freifunk network.

It seems like a new, additional role 'uplink-routed' feature could allow using Gluon devices in more scenarios here.

[maurerle]

Hi @T-X,
thanks for your comments - I think that these should be a separate issue.

The current upstream gluon situation is, that all cellular devices do not expose a routed private wan network, and therefore can not use the private-wifi feature. To solve this, this package exists.

ffac-private-wan-dhcp adds a running dhcp-server on br-wan for situations in which you have an uplink.
When this is needed:

• your device has cellular uplink (via wwan0) but nothing on WAN/br-wan.
• your device has DSL uplink using ffac-dsl (and then uplink via pppoe0 instead of br-wan)

What this package does not do:

• improve situation when cabled WAN and cellular WWAN exists simultanously (this would require mwan3)
• create a independent subnet on a new network interface, as the 'uplink-routed' feature you described.