Classic Setup Flow (Static IP)

This documentation is still being edited and may differ from the actual version.

The key idea: buying a static IP does not mean your existing MAP-E / DS-Lite path must stop being used.

You can keep ordinary LAN clients on Flet'H IPoE, while handing the static public IPv4 address only to a DMZ-side device such as a firewall, business router, or server. Flet’H static IP passthrough is designed for this.

Recommended layout: normal exit + static IP DMZ

Internet / NTT NGN
        |
        v
       ONU
        |
        v
OpenWrt WAN  ->  wan6
        |
        +-- Flet'H IPoE
        |      |
        |      +-- ordinary LAN / Wi-Fi
        |          PCs, phones, TVs, IoT
        |          continue using MAP-E / DS-Lite
        |
        +-- Flet'H Static IP (Passthrough)
               |
               +-- dedicated DMZ port or VLAN
                   firewall / business router / server
                   uses the static public IPv4

This keeps normal home devices away from the public static IPv4, while giving the fixed address to the equipment that actually needs it.

What passthrough solves

Many static IP services still use an IPv6 / IPIP6 tunnel underneath. The usual approach is to make OpenWrt own the public IPv4 address and handle all port forwarding and firewalling there.

Sometimes that is not what you want. You may want the public IPv4 to be used directly by a DMZ-side firewall, business router, server, or virtualization host.

Flet'H Static IP (Passthrough) solves this by letting OpenWrt terminate the IPv6 tunnel while a DMZ-side device uses the static public IPv4 address.

When to use normal static IP

Choose Flet'H Static IP when OpenWrt itself should own the public IPv4 address.

OpenWrt WAN  ->  Flet'H Static IP tunnel
OpenWrt owns the static public IPv4
OpenWrt LAN  ->  ordinary LAN clients

Prepare:

BR Address
Public IPv4 Address
IPv6 Interface ID, if required by the ISP
Tunnel Link, usually wan6
ファイアウォール設定: leave it unspecified; do not assign any firewall zone

IPIP6H firewall warning: Flet'H Static IP uses IPIP6H. Do not assign its new IPIP6H interface to any firewall zone, especially the wan zone. Doing so creates conflicting firewall rules, so the interface may appear connected while IPv4 communication fails completely. This warning applies to the Flet'H Static IP interface; the upstream wan6 interface should remain in the wan zone.

If a zone is already assigned, open Network -> Interfaces -> Flet'H Static IP -> Edit -> Firewall Settings, remove the interface from every zone, and leave it unspecified. Save and apply, then restart the static IP interface.

When to use static IP passthrough

Choose Flet'H Static IP (Passthrough) when a DMZ-side device should use the public IPv4 address.

OpenWrt WAN  ->  Flet'H Static IP (Passthrough)
OpenWrt DMZ  ->  firewall / business router / server
DMZ-side device uses the static public IPv4

Use a dedicated port or VLAN for the DMZ when possible.

Setup order

1. Make normal Flet’H IPoE work first

Follow the classic setup flow until wan6 has IPv6 and ordinary Flet'H IPoE works.

2. Prepare a DMZ port or VLAN

Use a port or VLAN that only connects to the DMZ-side device that should use the static public IPv4 address.

3. Create the static IP passthrough interface

In Network -> Interfaces, create a new interface and choose Flet'H Static IP (Passthrough).

Main fields:

BR Address
Client IPv4 Address
Client IPv4 CIDR prefix length
Client Gateway IPv4 Address
IPv6 Interface ID, if required by the ISP
Tunnel Link: usually wan6
Passthrough device: the DMZ port or VLAN

4. Configure the DMZ-side device with static IPv4

IP address:      Client IPv4 Address
Prefix length:  Client IPv4 CIDR prefix length
Gateway:        Client Gateway IPv4 Address
DNS:            ISP DNS, public DNS, or internal DNS

Ordinary LAN / Wi-Fi should continue using Flet'H IPoE. Do not point the whole home LAN at the DMZ device unless you intentionally want all traffic to pass through that DMZ-side firewall.