mwan3: DHCPv6 on wan does not recognise routable IPv6 address as "directly connected" causing stray packet forwards

Package Name

mwan3

Maintainer

@aaronjg @feckert

OpenWrt Version

24.10.1

OpenWrt Target/Subtarget

mediatek/filogic

Steps to Reproduce

1. I have an ISP-provided public routable /64 which is smaller than the /56 I'm using for subnetting in my network. The only workable solution for my use case then is to perform an IPv4-like NAT66 without prefix translation (hence I've requested for a single /128 address).
2. The WAN link has addresses via DHCPv6:

21: br-wan: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 state UP qlen 1000
    inet6 xxxx:xxxx:xxxx::xxxx/128 scope global dynamic noprefixroute
       valid_lft 154832sec preferred_lft 154832sec
    inet6 fe80::yyyy:yyyy:yyyy:yyyy/64 scope link proto kernel_ll
       valid_lft forever preferred_lft forever

3. Use NAT66:

nft add rule inet fw4 srcnat oifname "br-wan" meta nfproto ipv6 masquerade

4. Set a mwan3 rule to send traffic via br-wan:

config interface 'wan6b'
        option enabled '1'
        option family 'ipv6'
        option reliability '1'
        option count '1'
        list track_ip '2404:6800:4003:c1c::71'

config member 'wan6b_m1_w1'
        option interface 'wan6b'
        option metric '1'
        option weight '1'

config policy 'wan6_fallback'
        list use_member 'wan_m1_w1'
        list use_member 'wan6b_m1_w1'

config rule 'default'
        option use_policy 'wan6_fallback'

Actual Behaviour

1. On one of my nodes in br-lan, I see stray packets that are destined for my WAN IPv6 address being routed into my internal network. Eg:

[Jun28 08:40] [UFW BLOCK] IN=br-lan.vlan2 OUT=br-lan.vlan1 MAC=xx SRC=public-IPV6 DST=xxxx:xxxx:xxxx::xxxx LEN=68 TC=40 HOPLIMIT=112 FLOWLBL=1017120 PROTO=UDP SPT=abc DPT=def LEN=28 MARK=0x10000

2. Essentially, a NATted packet destined for my router's public IPv6 has been passed through without NAT translation, causing a loop.
3. mwan3 status does not show my public IPv6 address in list of directly-connected networks. I see link-local addresses, my other 6in4 tunnel addresses, but not the /128 address from my ISP
4. Suspect that because the directly connected list is incorrect, connmark is set wrongly and thus NAT doesn't apply correctly.
5. Manually adding my ISP's /128 address greatly reduces the number of stray packets.

Confirmation Checklist

• The package is maintained in this repository.
• I understand that issues related to the base OpenWrt repository or LuCI repository will be closed.
• I am reporting an issue for OpenWrt, not an unsupported fork.

Start with the mwan3 package and the mwan3 status entry point, reproducing the DHCPv6 WAN setup with a routable /128 and NAT66 described here. Trace how directly-connected networks and connmark handling treat that address; done means the /128 appears in the connected list and the reported stray forwards no longer occur.