RPi associating two IPs with its one and only wifi interface

Yes, that is the kind of thing but.. there was a bug in the pfSense firewall rules. pfSense is a freeBSD firewall/router.

The bug was that pfSense allows you to predicate firewall rules on an "alias", which can be a list of Full Qualified Domain Names. Something like if the source host FQDN is in this alias, route over this gateway to the WAN. The FQDNs resolve to an IPv4 and IPv6 addresses and then checks the IP value in a packet and routes accordingly. This works fine for a WAN FQDN, like e.g.

Then there is the issue of the extra random IPv6 addresses it was creating, which aren't included in DNS, in the FQDN at all.

That is the second IPv6 bug in pfSense, after the MTU/packet fragmentation bug I mentioned earlier, which I'm still trying to get to the bottom of.

IPv6 seems surprisingly hard. Surprising if a significant proportion of people are using it.

pfSense is built on FreeBSD and uses that network stack instead of Linux, isn’t it?

If your network hardware handles VLAN tags.

I have numerous switches (unmanaged) and WiFi access points, none of the ones I tested were compatible with VLAN tags (i.e. The network device stripped the VLAN tag off packets rather than dumbly passed the packet through with VLAN tag intact).

VLANs also aren't ideal as you may wish to implement policy routing on a protocol (e.g. VoIP) or WAN destination, not just upon a LAN host.

Yeah, I wasn't pointing out the bugs as directly relevant to Linux. I was mentioning them to support my suspicions about a general lack of maturity of IPv6 in products.

There does seem to be a lot of variation in how different switches behave. The HP 1820 and 1810 series web managed switches along with a variety of Netgear web managed switches all propagate vlan tags in their default state. They can can be configured to detag vlans on specific ports if necessary. I have some Allied Telesis managed switches that block vlans by default.

John

I’m sure this could be done using a Linux box as your network switch/router.

Indeed. I wish I could do that easily in Linux but it seems a bit of a chore. But looks like nftables packet marking and policy based routing together can accomplish it. So all I need is the marking part and a little tweaking of my policy routing to use those marks instead of source IPv6 addresses.

Something to do later, I'm working on something else right now.