What I'm trying to do is to route IPv6 traffic through a vpn tunnel. That way, I should be able to use IPv6 in a network that doesn't support IPv6.
I have a VPS which has an IPv6 block assigned. Part of this block I want to use for openvpn clients. The range I had in mind was
2001:db8::111:800:0/112 (prefix is anonymized), because openvpn only supports /64 and /112 as subnets.
IPv6 through the tunnel is already working, from the client, I can ping the server (
2001:db8::111:800:1), and also interfaces on the server (
Though, when trying to ping google.com from the client, I get no response (ping timeout). In order to debug this issue, I have used tcpdump to capture traffic on the server, and I can see the ping packets going out, but no replies comming back. Adding log rules to ip6tables shows the same, packets going out, but nothing comming in.
I used an online traceroute tool which gets a timeout from my server. I also tried to set the ip directly on the interface, which does result in the ip (
2001:db8::111:800:1001) to be reachable, so I think this is a routing problem.
I have enabled forwarding for ipv6 through
/proc/sys/net/ipv6/conf/all/forwarding. ip6tables has policy allow for all chains.
My question is, what exactly is needed for linux to accept that packet for an ip that is not assigned to an interface and route it further? Just a route that exists doesn't seem enough.
Here is the setup for my client and server. Please let it know if more information is needed.
# ip -6 addresses 10: tun0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qlen 100 inet6 2001:db8::111:800:1001/112 scope global valid_lft forever preferred_lft forever # ip -6 routes 2001:db8::111:800:0/112 dev tun0 proto kernel metric 256 2000::/3 dev tun0 metric 1024
# ip -6 address 2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qlen 1000 inet6 2001:db8:216:3dfa:f1d4:81c0/64 scope global dynamic valid_lft 86254sec preferred_lft 14254sec inet6 2001:db8::111:100:100/128 scope global valid_lft forever preferred_lft forever 12: tun0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qlen 100 inet6 2001:db8::111:800:1/112 scope global valid_lft forever preferred_lft forever # ip -6 route 2001:db8::111:100:100 dev eth0 proto kernel metric 256 2001:db8::111:800:0/112 dev tun0 proto kernel metric 256 2001:db8::/64 dev eth0 proto kernel metric 256 expires 86194sec default via fe80::230:48ff:fe94:d6c5 dev eth0 proto ra metric 1024 expires 1594sec