Sfdwhf

I have been scratching my head about this all day. Basically, I have several servers on a private network, each with a private IPv6 address assigned and a public IPv4 and IPv6 assigned. I want the servers to only communicate with each other using their private IPv6 addresses.

I have set up the IP addresses using Netplan, but am now trying to set up the routes so that if Server A is trying to communicate with Server B it does so via Server A's private IPv6 not through any other IP assigned to the server.

This is my Netplan configuration file so far (I've XXX'd out parts of the IP addresses for security):

network:

  version: 2

  renderer: networkd

  ethernets:

    eth0:

      dhcp4: no

      dhcp6: no

      addresses:

        - 139.XXX.XXX.132/24

        - "2a01:XXXX::XXXX:XXXX:XXXX:0f9c/64"

      gateway4: 139.XXX.XXX.1

      gateway6: "fe80::1"

      routes:

        - to: "2a01:XXXX:e000:01e6:1111:1111:1111:1111/64"

          via: "2a01:XXXX:e000:01e5:1111:1111:1111:1111/64"

          on-link: true

        - to: "2a01:XXXX:e000:01e7:1111:1111:1111:1111/64"

          via: "2a01:XXXX:e000:01e5:1111:1111:1111:1111/64"

          on-link: true

        - to: "2a01:XXXX:e000:01e8:1111:1111:1111:1111/64"

          via: "2a01:XXXX:e000:01e5:1111:1111:1111:1111/64"

          on-link: true

      nameservers:

        addresses: [8.8.8.8, 8.8.4.4]

The problem that I have is that the routes are not showing when I do the command ip route list or ip -6 route show.

Any help would be greatly appreciated. I'm fairly new to networking and Netplan and I'm struggling with the official documentation.

Since your routes are IPv6 you should use ip -6 route show the ip route list is showing the IPV4 route only which you do not have in your netplan.

ip -6 route add ipv6network/prefixlength via ipv6address

via: "2a01:XXXX:e000:01e5:1111:1111:1111:1111/64" is the wrong syntax. "via" takes a host address of a router, not a network address (when you append a netmask - i.e. /64 - it's a network address not a host address).

You also show "2a01:XXXX:e000:01e6:1111:1111:1111:1111/64" as your to, which is irregular. Normally one would leave blank (that is, 0) the masked bits and just write "2a01:XXXX:e0000:01e6::/64". I don't know if networkd cares about this, but it might, and it's better to use the canonicalized form anyway.

I was also able to reproduce this in a container:

network:

  version: 2

  ethernets:

    eth0:

      dhcp4: true

      dhcp6: no

      addresses:

        - "2a01:1234::1111:1111:1111:0f9c/64"

      routes:

        - to: "2a01:1234:e000:01e6:1111:1111:1111:1111/64"

          via: "2a01:1234:e000:01e5:1111:1111:1111:1111/64"

          on-link: true

netplan apply succeeds. journalctl --no-pager -lu systemd-networkd shows the following error:

Feb 25 20:19:20 gnss-sdr systemd-networkd[694]: /run/systemd/network/10-netplan-eth0.network:9: Route is invalid, ignoring assignment: 2a01:1234:e000:01e5:1111:1111:1111:1111/64

Feb 25 20:19:20 gnss-sdr systemd-networkd[694]: Route section without Gateway field configured in /run/systemd/network/10-netplan-eth0.network. Ignoring

Clearly you're aware that this route doesn't match the netmask of the host address, which is why you've added the on-link: true to your config; but even with this set, which generates GatewayOnlink=true in the config output to networkd at /run/systemd/network/10-netplan-eth0.network, networkd is refusing to apply this route. I don't know if we should expect this to work with networkd, but either it should work, or the systemd.network(5) manpage should document that it doesn't and netplan should refuse to accept this yaml. I would recommend filing a bug report against netplan.

To work around this behavior (and give results that are generally speaking more understandable in terms of routing rules), you should either add an additional address to your local machine on the 2a01:XXXX:e000:01e5::/64 network so that the 2a01:XXXX:e000:01e5:1111:1111:1111:1111 gateway is reachable, or else give your 2a01:XXXX:e000:01e5:1111:1111:1111:1111 gateway an additional address on the 2a01:XXXX::/64 network and use that as your via address instead.