u/stonesco

The version of Debian I am running is 13.

I placed a file called 99-forwarding.conf with the following contents within /etc/sysctl.d:

net.ipv4.conf.all.forwarding = 1

net.ipv6.conf.all.forwarding = 1

I applied the file using the command sysctl -p /etc/sysctl.d/99-forwarding.conf. It will apply temporarily but when I reboot my machine, it refuses to apply upon boot.

Any ideas of what could be causing this?

SOLVED: Had to run sysctl —system and then do a reboot afterwards.

I have been scratching my head, for some time on the issue below.

Lets say that I have been given a 2000:db8:aaaa::/48 PI Prefix and I want to announce it from my home router but can only do so from a VPS via Wireguard.

Below is my Intended Network Flow:

• Incoming Traffic towards addresses within my PI Prefix: Internet -> Upstream Providers Router -> VPS -> Wireguard Tunnel -> Home Router

• Outgoing Traffic from addresses within my PI Prefix announced on my Home Router: Home Router -> Wireguard -> VPS -> Upstream Provider Router -> Internet

Setup Right Now:

VPS - eBGP between my upstreams and iBGP to neighbour (which is the home router) which can only be accessed by a Wireguard Tunnel being up.

eBGP - Receiving Default Route and sending my PI Prefixes. The neighbor IP connected to my upstream can only be accessed by eth0 (the physical network interface).

iBGP - Uses my ASN Number.

2000:db8:cccc:ccc:/56 - Routed to my VPS via eth0 via eth0 IPv6 Address by my Upstream provider router, although only one /64 is used on the VPS for eth0 purposes. I intended to allocate another /64 subnet from the /56 for the Wireguard Connection between my VPS and Home router but I have found that hasn't worked.

Wireguard Tunnel - Running on the VPS which as one Public IPv4 Address and a GUA IPv6 Address (that I intended to allocate from /64 subnet from 2000:db8:cccc:ccc:/56). I can only connect via IPv4 to the wireguard from my home router due to CGNAT from my ISP and no native IPv6.

• Wireguard Interface uses NAT from wg0 to eth0 interface running on the VPS for IPv4 based traffic.

next-hop-self is set on the IBGP Neighbor which is the home router (accessible only when wg0 is up) via FRR

Default Route is only accessible via eth0.

Software & Hardware in Use:

• FRR running on the VPS

• Mikrotik as the home router

My Ideal Requirements:

• Avoid NAT and any translation technologies such as NPTv6, if possible.

• Ideally use GUAs, instead of ULAs, for the Wireguard Tunnel interface IPv6 addresses.

Additional Questions:

• Should I continue to announce my IPv6 PI Prefix via the home router or the VPS instead, while having a blackhole static route on my home router?
• Is Table = off needed in the Wireguard config on the VPS?
• Is Policy Based Routing via FRR needed in some form?