router: add ping-ipv6 hack

flake.lock

@@ -510,11 +510,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1720021052,
-        "narHash": "sha256-tu8IQn8Kj7S0xRg0L2ej7S65FzXqSX7LI7M2pbLdQJU=",
+        "lastModified": 1720913908,
+        "narHash": "sha256-AZ0AcL1ze6gS8EmwRpuR04MXCLb/NDLjp9n+Gs4IhFQ=",
         "owner": "chayleaf",
         "repo": "nixos-router",
-        "rev": "4c132c4c5fc09b3c3317b960ec1533c4a5ebe41f",
+        "rev": "38088dc1745350db709e9f2cf777979b5217f671",
         "type": "github"
       },
       "original": {

system/hosts/router/default.nix

@@ -718,6 +718,10 @@ in {
     ];
   };
   router.networkNamespaces.wan = {
+    sysctl = {
+      "net.ipv4.conf.all.forwarding" = true;
+      "net.ipv6.conf.all.forwarding" = true;
+    };
     # this is the even more boring nftables config
     nftables.jsonRules = let
       wans = [ "wan" ] ++ lib.optional (cfg.vpn.tunnel.mode == "sit") "sittun0";
@@ -788,6 +792,19 @@ in {
       interfaceNamespace = "init";
     });
 
+  # see https://pavluk.org/blog/2022/01/26/nixos_router.html
+  # (ipv6 doesn't work without this, for whatever reason)
+  systemd.services.ping-ipv6 = {
+    after = [ "network.target" "netns-wan.service" ];
+    wants = [ "netns-wan.service" ];
+    wantedBy = [ "default.target" ];
+    serviceConfig = {
+      ExecStart = "${pkgs.iputils}/bin/ping -q ${netAddresses.netnsWan6}";
+      Restart = "on-failure";
+      RestartSec = "30s";
+    };
+  };
+
   systemd.services.vpn-tunnel = lib.mkIf (cfg.vpn.tunnel.mode == "ssh") {
     description = "VPN Tunnel";
     wantedBy = [