Commissioning failing on "FindOperational" and "ThreadNetworkSetup".

[saramonteiro]

Hi!
I am using chip-tool from Matter project running on a raspberry Pi 4 for commissioning a new device.
The OTBR is running in a docker container and chip tool outside it.
I used the following command to start the docker container:

docker run --sysctl "net.ipv6.conf.all.disable_ipv6=0 net.ipv4.conf.all.forwarding=1 net.ipv6.conf.all.forwarding=1" -p 8080:80 --dns=127.0.0.1 -it --volume /dev/ttyACM0:/dev/ttyACM0 --privileged openthread/otbr --radio-url spinel+hdlc+uart:///dev/ttyACM0
(only did the necessary changes for my USB port and baudrate)

However, the commissioning doesn´t complete successfully, and some times chip tool indicates failure on Step 18 - Find Operational with OS error = "Network is unreachable", and other times it stops before on Step 15 - ThreadNetworkSetup with OS error = Internal error.

I would like to understand better what these errors means or any ideas on how to debug or investigate it.
One point that I suspected is about IPV6 routing configuration, but I haven´t seen any kind of necessary additional configuration from the documentation.

Thanks in advance,
Sara

[jwhui]

Discussion is happening here: project-chip/connectedhomeip#25526

[saramonteiro]

ok, Thanks!
I am not 100% sure if it is the same issue,
because in my case I can ping the OTBR OMR address from inside the docker container.
But I can´t from the RPI host - where chip-tool is running.

One thing that I noticed later in the logs from OTBR when initializing it:

+ ip6tables -C FORWARD -o wpan0 -j OTBR_FORWARD_INGRESS
ip6tables v1.6.1: Couldn't load target `OTBR_FORWARD_INGRESS':No such file or directory

Try `ip6tables -h' or 'ip6tables --help' for more information.
+ ip6tables -L OTBR_FORWARD_INGRESS
ip6tables: No chain/target/match by that name.
+ ipset_destroy_if_exist otbr-ingress-deny-src
+ ipset list otbr-ingress-deny-src
ipset v6.34: Kernel support protocol versions 6-7 while userspace supports protocol versions 6-6
The set with the given name does not exist
+ ipset_destroy_if_exist otbr-ingress-deny-src-swap
+ ipset list otbr-ingress-deny-src-swap
ipset v6.34: Kernel support protocol versions 6-7 while userspace supports protocol versions 6-6
The set with the given name does not exist
+ ipset_destroy_if_exist otbr-ingress-allow-dst
+ ipset list otbr-ingress-allow-dst
ipset v6.34: Kernel support protocol versions 6-7 while userspace supports protocol versions 6-6
The set with the given name does not exist
+ ipset_destroy_if_exist otbr-ingress-allow-dst-swap
+ ipset list otbr-ingress-allow-dst-swap
ipset v6.34: Kernel support protocol versions 6-7 while userspace supports protocol versions 6-6
The set with the given name does not exist
+ ipset create -exist otbr-ingress-deny-src hash:net family inet6
+ ipset create -exist otbr-ingress-deny-src-swap hash:net family inet6
+ ipset create -exist otbr-ingress-allow-dst hash:net family inet6
+ ipset create -exist otbr-ingress-allow-dst-swap hash:net family inet6
+ ip6tables -N OTBR_FORWARD_INGRESS
+ ip6tables -I FORWARD 1 -o wpan0 -j OTBR_FORWARD_INGRESS
+ ip6tables -A OTBR_FORWARD_INGRESS -m pkttype --pkt-type unicast -i wpan0 -j DROP
+ ip6tables -A OTBR_FORWARD_INGRESS -m set --match-set otbr-ingress-deny-src src -j DROP
+ ip6tables -A OTBR_FORWARD_INGRESS -m set --match-set otbr-ingress-allow-dst dst -j ACCEPT
+ ip6tables -A OTBR_FORWARD_INGRESS -m pkttype --pkt-type unicast -j DROP
+ ip6tables -A OTBR_FORWARD_INGRESS -j ACCEPT

[jwhui]

You should specify the backbone interface when starting docker. Add the --backbone-interface <netif> to your docker run command.

[saramonteiro]

Hi @jwhui!
Thanks for adding this information for me, it didn`t change the log outputs, but it should be missing anyway.
I think I am missing some IPv6 route configuration that I am not aware.

[saramonteiro]

Solved in openthread/ot-br-posix#1789