MacOS IPv6 not functioning without custom static route

[Adam Cooper]

As an additional datapoint it looks like if I remove '::/0' at all
(either replaced with the ::/1 8000:/1 rules or just removed outright)
I appear to lose outbound traffic UNLESS I'm allowing 0.0.0.0/0. Which
doesn't make much sense as one is an IPv4 rule and the other isn't.
This is what it currently look like (pseudocode for brevity)

$IPV4_IPS = 0.0.0.0/5, 8.0.0.0/7, 11.0.0.0/8, 12.0.0.0/6, 16.0.0.0/4,
32.0.0.0/3, 64.0.0.0/2, 128.0.0.0/3, 160.0.0.0/5, 168.0.0.0/6,
172.0.0.0/12, 172.32.0.0/11, 172.64.0.0/10, 172.128.0.0/9,
173.0.0.0/8, 174.0.0.0/7, 176.0.0.0/4, 192.0.0.0/9, 192.128.0.0/11,
192.160.0.0/13, 192.169.0.0/16, 192.170.0.0/15, 192.172.0.0/14,
192.176.0.0/12, 192.192.0.0/10, 193.0.0.0/8, 194.0.0.0/7, 196.0.0.0/6,
200.0.0.0/5, 208.0.0.0/4

AllowedIPs = $IPV4_IPS, ::/0, fd82:88::1/128 -- IPv4 WORKS, IPv6 ONLY
ROUTES fd82:88::1
AllowedIPs = $IPV4_IPS, fd82:88::1/128 -- IPv4 AND IPv6 DO NOT WORK
AllowedIPs = $IPV4_IPS, ::/1, 8000::/1, fd82:88::1/128 --  IPv4 AND
IPv6 DO NOT WORK
AllowedIPs = 0.0.0.0/0, ::/1, 8000::/1 --  IPv4 AND IPv6 WORK

On Tue, 21 Jul 2020 at 14:29, Adam Cooper <adam at acpr.dev> wrote:
>
> Mmm. It looks like unticking "Exclude Private IPs" and entering
> "0.0.0.0/0, ::/1, 8000::/1" gives me a functional setup. Trouble is I
> don't want to route the private IPs and ticking the box (whilst
> retaining '::/1, 8000::/1') allows no traffic at all. There's
> something odd about the way the client is configuring routes but I've
> not got the expertise to figure it out :(
>
> On Tue, 21 Jul 2020 at 14:12, Hasan Berkay Çağır <berkay at cagir.me> wrote:
> >
> > On 15/07/2020 14:14, Adam Cooper wrote:
> > > ...
> > > Probably worth mentioning that I tried to replace ::/0 with ::/1,
> > > 8000::/1 but that just results in completely broken connectivity in
> > > IPv6 and IPv4 - which may be another issue in and of itself.
> >
> > Did you try only having "::/1, 8000::/1" in the AllowedIPs option? I had
> > a default route creation issue myself where I'm only trying to tunnel
> > IPv6 through; and having this actually solved it.
> >
> > $ netstat -nr
> > Routing tables
> > Internet:
> > ...
> > Internet6:
> > Destination                             Gateway
> > Flags         Netif Expire
> > ::/1                                    link#14
> > UCS           utun2
> > default                                 fe80::%utun0
> > UGcI          utun0
> > default                                 fe80::%utun1
> > UGcI          utun1
> > default                                 fe80::%utun3
> > UGcI          utun3
> > default                                 [ public IPv6 ]
> > UGcI          utun2
> >
> > If just "::/1, 8000::/1" solves the IPv6 issue, I guess you can give it
> > a try with "0.0.0.0/0, ::/1, 8000::/1" to see if both routes are created
> > properly?
> >
> > Best,
> > Berkay