Thread FTD can't ping external IPv6 addresses and resolve DNS when connected to OpenThread Border Router

[mvataleu]

Hi there! 

I have the following setup:

1. A Raspberry Pi 3 B and a nRF52840 Development Kit acting as a Border Router as described in the official documentation;
2. Another nRF52840 PDK flashed with the CLI example as described here;
3. I have an ethernet connection going to the Raspberry Pi to connect it to the outside world;

After joining the Border Router Thread network I'm able to ping other Thread devices (other FTD and router itself) also I'm able to ping NAT64 address (with prefix) and DNS64 (bind9) but I'm unable to ping external IPv6 addresses (public google IPv6 address) and resolve external DNS addresses (ipv6.google.com).

I'm able to ping external IPv6 addresses and DNS (v6) inside the Border Router. It's default setup out of the box. There no additional modification/configuration of Border Router image/NCP firmware/CLI firmware. There no any firewalls on the router side.

What can cause such behavior?

Please see the output from Border Router below:

pi@raspberrypi:~ $ ifconfig
eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 172.27.5.125  netmask 255.255.0.0  broadcast 172.27.255.255
        inet6 2a00:6440:173:104:ba27:ebff:fed0:7761  prefixlen 64  scopeid 0x0<global>
        inet6 fe80::ba27:ebff:fed0:7761  prefixlen 64  scopeid 0x20<link>
        ether b8:27:eb:d0:77:61  txqueuelen 1000  (Ethernet)
        RX packets 2673501  bytes 143017876 (136.3 MiB)
        RX errors 0  dropped 964  overruns 0  frame 0
        TX packets 10999  bytes 2429913 (2.3 MiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536
        inet 127.0.0.1  netmask 255.0.0.0
        inet6 ::1  prefixlen 128  scopeid 0x10<host>
        loop  txqueuelen 1  (Local Loopback)
        RX packets 31958  bytes 2482090 (2.3 MiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 31958  bytes 2482090 (2.3 MiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

nat64: flags=4305<UP,POINTOPOINT,RUNNING,NOARP,MULTICAST>  mtu 1500
        inet 192.168.255.1  netmask 255.255.255.255  destination 192.168.255.1
        inet6 fdaa:bb:1::1  prefixlen 128  scopeid 0x0<global>
        inet6 fe80::5fe:be35:28c:14b5  prefixlen 64  scopeid 0x20<link>
        unspec 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  txqueuelen 500  (UNSPEC)
        RX packets 0  bytes 0 (0.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 4  bytes 304 (304.0 B)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

wlan0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 10.42.0.1  netmask 255.255.255.0  broadcast 10.42.0.255
        inet6 fe80::ba27:ebff:fe85:2234  prefixlen 64  scopeid 0x20<link>
        ether b8:27:eb:85:22:34  txqueuelen 1000  (Ethernet)
        RX packets 0  bytes 0 (0.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 22522  bytes 5728739 (5.4 MiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

wpan0: flags=4305<UP,POINTOPOINT,RUNNING,NOARP,MULTICAST>  mtu 1280
        inet6 fe80::f072:4004:6bc1:bc3f  prefixlen 64  scopeid 0x20<link>
        inet6 fe80::afda:7fa0:1bb7:2893  prefixlen 64  scopeid 0x20<link>
        inet6 fdde:ad00:beef:0:69e9:5974:9ffc:8e64  prefixlen 64  scopeid 0x0<global>
        inet6 fd11:22::f072:4004:6bc1:bc3f  prefixlen 64  scopeid 0x0<global>
        unspec 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  txqueuelen 500  (UNSPEC)
        RX packets 4  bytes 299 (299.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 17  bytes 1496 (1.4 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0
pi@raspberrypi:~ $ ping ipv6.google.com
PING ipv6.google.com(fra16s20-in-x0e.1e100.net (2a00:1450:4001:821::200e)) 56 data bytes
64 bytes from fra16s20-in-x0e.1e100.net (2a00:1450:4001:821::200e): icmp_seq=1 ttl=55 time=26.2 ms
64 bytes from fra16s20-in-x0e.1e100.net (2a00:1450:4001:821::200e): icmp_seq=2 ttl=55 time=25.5 ms
64 bytes from fra16s20-in-x0e.1e100.net (2a00:1450:4001:821::200e): icmp_seq=3 ttl=55 time=25.5 ms
64 bytes from fra16s20-in-x0e.1e100.net (2a00:1450:4001:821::200e): icmp_seq=4 ttl=55 time=25.5 ms
64 bytes from fra16s20-in-x0e.1e100.net (2a00:1450:4001:821::200e): icmp_seq=5 ttl=55 time=25.6 ms
64 bytes from fra16s20-in-x0e.1e100.net (2a00:1450:4001:821::200e): icmp_seq=6 ttl=55 time=25.5 ms
64 bytes from fra16s20-in-x0e.1e100.net (2a00:1450:4001:821::200e): icmp_seq=7 ttl=55 time=25.6 ms
^C
--- ipv6.google.com ping statistics ---
7 packets transmitted, 7 received, 0% packet loss, time 9997ms
rtt min/avg/max/mdev = 25.526/25.676/26.251/0.265 ms
pi@raspberrypi:~ $ ping6 2a00:1450:4001:821::200e
PING 2a00:1450:4001:821::200e(2a00:1450:4001:821::200e) 56 data bytes
64 bytes from 2a00:1450:4001:821::200e: icmp_seq=1 ttl=55 time=26.2 ms
64 bytes from 2a00:1450:4001:821::200e: icmp_seq=2 ttl=55 time=25.6 ms
64 bytes from 2a00:1450:4001:821::200e: icmp_seq=3 ttl=55 time=25.6 ms
64 bytes from 2a00:1450:4001:821::200e: icmp_seq=4 ttl=55 time=25.5 ms
^C
--- 2a00:1450:4001:821::200e ping statistics ---
4 packets transmitted, 4 received, 0% packet loss, time 3004ms
rtt min/avg/max/mdev = 25.592/25.762/26.218/0.308 ms

Please see the output from CLI device below:

> facrotyreset
> ifconfig up
Done
> thread start
Done
> state
router
Done
> ipaddr
fdde:ad00:beef:0:0:ff:fe00:3800
fd11:22:0:0:64bc:a601:d15:fd03
fe80:0:0:0:7c2a:1e72:c097:fe3b
fdde:ad00:beef:0:4b4:1e93:3d0e:cac5
Done
> ping fdde:ad00:beef:0:69e9:5974:9ffc:8e64
> 8 bytes from fdde:ad00:beef:0:69e9:5974:9ffc:8e64: icmp_seq=2 hlim=64 time=73ms
> ping 64:ff9b::0808:0808
> 8 bytes from 64:ff9b:0:0:0:0:808:808: icmp_seq=3 hlim=55 time=61ms
> dns resolve ipv4.google.com fdaa:bb:1::1
> DNS response for ipv4.google.com - [64:ff9b:0:0:0:0:acd9:134e] TTL: 300
> dns resolve ipv6.google.com
> DNS response for ipv6.google.com - Error 28: ResponseTimeout
> ping 2a00:1450:401b:802:0:0:0:200e
>

Thanks in advance.

[Jørgen Holmefjord]

Hi,

It looka like the Thread node have not been assigned a global IPv6 address from the border router. A global IPv6 address is required for accessing IPv6 devices online, otherwise you will only be able to access IPv4 devices through the NAT64 interface. The reason that your Thread node do not get a global IPv6 address is that your border router have a /64 prefix IPv6 address. The Thread specifications requires a /64 subnet for the Thread network, meaning that the border router needs a /62 or lower prefix in order to further divide the network into the Thread subnetwork. Please make sure you have a /62 or lower prefix from your ISP, and that your network infrastructure is able to provide your border ruter with correct prefix address. Have a look at this thread for more details.

Best regards,
Jørgen 

[Jørgen Holmefjord]

Do which part?