Network

Introduction

An OpenWrt upgrade can complete successfully while still leaving behind configuration warnings, transitional IPv6 state, or service messages that appear more serious than they actually are.

A useful post-upgrade review should therefore answer two separate questions:

  1. Is the router operationally healthy?
  2. Does the current configuration still reflect the intended network design?

This distinction matters especially on networks where the ISP does not provide IPv6 and all local devices are intentionally operated over IPv4.

The example environment used throughout this article is deliberately generic:

Router LAN:     192.168.10.1
PVE host:       192.168.10.10
PBS host:       192.168.10.20
LAN subnet:     192.168.10.0/24

All names, addresses, identifiers, domains, and other deployment-specific details are sanitized.

1. Start With a Read-Only Audit

A post-upgrade audit should begin without changing anything.

Useful commands include:

cat /etc/openwrt_release
uname -a
uptime
free
df -h
ip -br addr
ip route
ip -6 route
logread
dmesg
service list

Important areas to review include:

  • kernel version;
  • uptime and boot history;
  • memory and flash usage;
  • DHCP service;
  • DNS service;
  • firewall4/nftables;
  • WAN state;
  • LAN bridge state;
  • PPPoE state if used;
  • static DHCP mappings;
  • port-forwarding rules;
  • service failures;
  • kernel panic or OOM evidence;
  • repeated interface resets.

A healthy router may still contain warnings. The goal is not an empty log. The goal is to distinguish harmless warnings from active faults.

2. Common IPv6 Warning on an IPv4-Only Network

A common message is:

odhcpd: No default route present, setting ra_lifetime to 0!

This message frequently appears when:

  • LAN IPv6 services remain enabled;
  • the WAN has no usable IPv6 default route;
  • the router still attempts to generate Router Advertisements.

The message does not mean IPv4 routing is broken.

It means the router cannot advertise itself as a valid IPv6 default gateway.

If the ISP provides no IPv6 and IPv6 is not needed on the LAN, the configuration should reflect that design explicitly.

3. Disable Unused IPv6 Distribution on LAN

For an intentionally IPv4-only LAN, disable:

  • IPv6 assignment on LAN;
  • Router Advertisement;
  • DHCPv6;
  • NDP proxy.

The resulting UCI configuration should contain no LAN ip6assign entry:

uci show network.lan

Expected form:

network.lan=interface
network.lan.device='br-lan'
network.lan.proto='static'
network.lan.ipaddr='192.168.10.1'
network.lan.netmask='255.255.255.0'

The DHCP section should remain IPv4-only:

uci show dhcp.lan

Example:

dhcp.lan=dhcp
dhcp.lan.interface='lan'
dhcp.lan.start='100'
dhcp.lan.limit='150'
dhcp.lan.leasetime='12h'
dhcp.lan.dhcpv4='server'

If WAN6 is unused, keeping it explicitly disabled is appropriate:

network.wan6.disabled='1'

4. Remove an Unused ULA Prefix

OpenWrt often generates a ULA prefix automatically:

fdxx:xxxx:xxxx::/48

It can be inspected with:

uci show network.globals

Example:

network.globals=globals
network.globals.ula_prefix='fd12:3456:789a::/48'
network.globals.packet_steering='1'

When LAN IPv6 assignment has already been disabled, the remaining ULA prefix may produce:

You have delegated IPv6-prefixes but haven't assigned them to any interface.

For a deliberately IPv4-only network, removing the unused ULA prefix is reasonable:

uci delete network.globals.ula_prefix
uci commit network
/etc/init.d/network reload

Only the unused ULA prefix should be removed.

Other global settings such as packet steering or default DUID should remain untouched unless there is a separate reason to change them.

5. Why Old IPv6 Addresses May Remain Temporarily

After IPv6 is disabled, a command such as:

ip -6 addr show dev br-lan

may still show an old ULA address:

inet6 fd12:3456:789a::1/60 scope global deprecated dynamic
valid_lft 6900sec preferred_lft 0sec

This is normal.

The important fields are:

deprecated
preferred_lft 0sec

The address is no longer preferred for new connections.

A non-zero valid_lft means the kernel is retaining it temporarily so existing state is not destroyed abruptly.

The corresponding route may also remain:

fd12:3456:789a::/60 dev br-lan

It disappears naturally when the valid lifetime expires.

No manual route deletion is necessary.

6. DHCPv6 Leases Can Also Remain Temporarily

The LuCI status page may continue showing old DHCPv6 leases after DHCPv6 has been disabled.

These entries are historical state with remaining lease lifetimes.

They should disappear naturally.

The important test is whether new IPv6 leases continue to appear after the old lifetimes have expired.

If no new leases appear, the IPv6 cleanup is working correctly.

7. Link-Local IPv6 Should Remain

Even on an IPv4-only operational network, interfaces may still show:

fe80::/64

These are IPv6 link-local addresses.

Their presence does not mean DHCPv6, Router Advertisement, or public IPv6 routing is active.

There is normally no reason to disable the IPv6 stack globally or remove link-local addressing.

Global kernel-level IPv6 disabling is unnecessary for most OpenWrt installations and creates additional maintenance complexity.

8. Interpreting Other Upgrade Warnings

Several warnings often appear during boot without indicating a fault.

Examples include:

Not supported (-95)

during wireless initialization, or:

possible DNS-rebind attack detected

from dnsmasq.

The first may simply indicate a driver feature probe that is not supported.

The second generally means DNS rebind protection successfully blocked a suspicious or inappropriate DNS response.

Context matters more than keywords.

A message containing warning, failed, or error is not automatically an operational failure.

9. Final IPv4-Only State

A clean IPv4-only OpenWrt configuration should look conceptually like this:

ISP
 |
 | IPv4 / PPPoE
 |
WAN
 |
OpenWrt
 |
LAN 192.168.10.1/24
 |
IPv4 clients

Expected state:

WAN6                         disabled
LAN IPv6 assignment         disabled
Router Advertisement        disabled
DHCPv6                      disabled
NDP proxy                   disabled
Global ULA prefix           absent
IPv4 DHCP                   enabled
IPv4 NAT                    enabled
IPv4 forwarding             enabled

The router may still retain fe80:: link-local addresses.

That is normal.

Conclusion

A successful OpenWrt upgrade does not require removing every IPv6-related package or suppressing every warning.

A better approach is to make the configuration accurately reflect the intended network design.

For an IPv4-only deployment:

  • disable unused IPv6 distribution;
  • remove the unused ULA prefix;
  • retain the standard IPv6 stack;
  • allow deprecated addresses and leases to expire naturally;
  • verify firewall, DHCP, DNS, NAT, and routing independently.

The result is a cleaner configuration with fewer misleading warnings and no unnecessary kernel-level modifications.

Leave a Reply

Your email address will not be published. Required fields are marked *