As stated ND-PROXY is a user space IPv6 Neighbor Discovery Proxy.<\/p>\n\n\n\n
According to OPN-Sense documentation and I quote:<\/p>\n\n\n\n
\u201c<\/span>It can proxy SLAAC on-link prefixes to several downstream interfaces by proxying neighbor discovery protocol (NDP), router advertisements (RA) and duplicate address detection (DAD). For each discovered client it installs host routes automatically”.<\/b><\/i><\/span><\/span><\/span><\/span><\/span><\/p>\n\n\n\n Or quoting Cisco in their “IPv6 Neighbor Discovery Proxy” document:<\/p>\n\n\n\n \u201cA device operating as an IPv6 routing proxy listens to all neighbor discovery proxy messages sent on the link and responds unconditionally to neighbor solicitation lookup and neighbor-unreachability-detection messages with neighbor advertisement (setting the SVI MAC address in the TLLA option) on behalf of the destination hosts to attract the traffic to itself\u201d<\/b><\/i><\/span><\/span><\/span>.<\/p>\n\n\n\n If you only got a \/64, you may want to have parts of you network talk to each and also reach the Internet but they are on different segments. They could be for example wireless devices.<\/p>\n\n\n\n This happens because you cannot sub-net a \/64 network. Technically speaking you can and it is done on routers all the time, because you want control of the IP they get.<\/p>\n\n\n\n This breaks SLAAC however, at this point you are not doing SLAAC on those routers.<\/p>\n\n\n\n To properly proxy requests you may also want bi-directional access, if this is for wireless devices that may not be necessary, in general you need to run your proxy on the interfaces that needed on the intermediate router.<\/p>\n\n\n\n We will run the lab in two parts, first we will use a manual configuration, then we will use a daemon to automatically learn the devices and proxy them.<\/p>\n\n\n\n The following diagram shows the network in use:<\/p>\n\n\n\n Fig. Network Diagram.<\/p>\n\n\n\n A few things to consider:<\/p>\n\n\n\n The goal is to proxy devices in \u201cLAN\u201d so they can access \u201cNet\u201d. However we also want devices in \u201cNet\u201d be able to access devices in \u201cLAN and finally devices in \u201cLAN\u201d should be able to access the Internet via Router if allowed.<\/p>\n\n\n\n We need to take care of a couple of things prior. We are using Ubuntu server for Router2. Below needs to be done according to your device OS instructions.<\/p>\n\n\n\n The reason to do a manual configuration first is because it will make a few things clear regarding how NDP works.<\/p>\n\n\n\n A few things:<\/p>\n\n\n\n We give Client a static IPv6 address of fc00::500\/64.<\/p><\/li>\n\n\n\n We are giving server (fc00::250:1ff:fe00:401) and Router2 (fc00::250:1ff:fe00:101) IPv6 addresses via RADVD from Router.<\/p><\/li>\n\n\n\n Router has a static IPv6 addresses (fc00::1\/64, it is a router after all).<\/p><\/li>\n\n\n\n \u201ce1\u201d is ens4, and \u201ce2\u201d is ens5 on the Ubuntu device.<\/p><\/li>\n<\/ul>\n\n\n\n On Router2 we issue as root the following:<\/p>\n\n\n\n The first thing to notice is that we proxy the interface we want the segment to be accessed though.<\/p>\n\n\n\n Here for example fc00::500 is on client via interface ens5, however you proxy it on ens4 because you want devices on \u201cNet\u201d to be able identify it.<\/p>\n\n\n\n Same for all others, which brings us to the first issue, what if you have 10,000 devices you want to proxy. We will fix that next<\/p>\n\n\n\n If you issue the command: \u201cip nd proxy show\u201d, it will show a list of all proxy entries (on Linux of course), on other OSes check the documentation.<\/p>\n\n\n\n You will be able to ping from Client (fc00::500) router (fc00::1) and vice versa.<\/p>\n\n\n\n Of course a reboot will loose the entries, so you could in principle add entries to “rc.local” and have them issued at every reboot. We will use a daemon to fix that next.<\/p>\n\n\n\n Several Operating systems have their own daemons that can be run, and do what we did above.<\/p>\n\n\n\n Cisco has included it in their IOS (for 9000 devices), OPN-Sense and BSD use ndproxy and Linux has the ndppd daemon.<\/p>\n\n\n\n Since I am using Ubuntu, I downloaded ndppd.<\/p>\n\n\n\n I configured it and started the service. Nada, zilch, it was not working.<\/p>\n\n\n\n After several hours of doing TCPDUMPs, trying several arguments on the configuration, etc, it would not work.<\/p>\n\n\n\n Now ndppd has not being updated in a while (on GitHub at least). Someone on the forums stated they had a “go” implementation that was a re-write and claimed it worked.<\/p>\n\n\n\n So I tried it. It did not work either! <\/p>\n\n\n\n![\"\"](\"https:\/\/blog.miguelsarmiento.com\/wp-content\/uploads\/2026\/10\/nd-proxy.png\")
<\/a><\/figure>\n\n\n\n\n
Configuration<\/strong><\/h1>\n\n\n\n
\n
Manual Configuration<\/em><\/strong><\/h2>\n\n\n\n
\n
ip -6 neigh add proxy fc00::250:1ff:fe00:101 dev ens5
ip -6 neigh add proxy fc00::1 dev ens5
ip -6 neigh add proxy fc00::250:1ff:fe00:401 dev ens5
ip -6 neigh add proxy fc00::250:1ff:fe00:201 dev ens4
ip -6 neigh add proxy fc00::500 dev ens4<\/pre>\n\n\n\nAutomatic Configuration<\/em><\/strong><\/h2>\n\n\n\n