2

I'm trying to create an IPv6 tunnel using OpenVPN on Debian Sid. IPv4 is working fine, but I can't get IPv6 to work. I can ping the server and other clients using IPv6, but I can't reach the internet from a client.

I've done hours of research but I still don't understand IPv6 completely, so this problem may be something really easy to fix. Some explanation would be nice!

The problem is that I'm using a VPS and I only have one /64 subnet for everything:

2a00:a123:4:b5::/64

So I thought I could add this to my OpenVPN config (create a smaller /112 subnet for OpenVPN):

server-ipv6 2a00:a123:4:b5:80::/112
push "route-ipv6 2000::/3"

Now when I run ifconfig tun0 I get:

inet6 addr: 2a00:d880:6:f2:80::1/112 Scope:Global

And my clients get:

client1,10.8.0.2,2a00:d880:6:f2:80::1000
client2,10.8.0.3,2a00:d880:6:f2:80::1001

I added all these 4 IPs in the SolusVM CP (I don't know if this is necessary, I thought it would be for the routing back to the VPS). I also set net.ipv6.conf.all.forwarding to 1.

Still, I can't reach the internet over IPv6 from the clients. If I run traceroute6 google.com on a client I get to the server IP, but only timeouts after that.

I also found this similar question, but the NDP proxy thing doesn't seem to work for me using the following command:

ip neigh add proxy 2a00:d880:6:f2:80::1000 dev tun0
ip neigh add proxy 2a00:d880:6:f2:80::1001 dev tun0
  • Can you show the IPv6 configuration of your network device (not the OpenVPN TUN one). – ysdx Mar 3 '15 at 9:21
1

I don't think SNAT is the right away about it either. I had a similar question and found I just needed the correct FORWARD rules with a bit of tweaking. Essentially you just need to forward IPv6 traffic from the OpenVPN interface to your external WAN interface that has IPv6 setup.

ip6tables allow IPv6 traffic from OpenVPN through my VPS

In your case I think this should work better:

ip6tables -A FORWARD -m state --state NEW -i tun+ -o $WAN -s 2a00:a123:4:b5::/64 -j ACCEPT
ip6tables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT

I'm assuming you use routing (tun) as opposed to Ethernet bridging (tap)

Seems you only have one /64 block, that should be the only FORWARD rule you need.

$WAN is a placeholder for your external interface with IPv6 connectivity. I don't get native IPv6 on my VPS, so in my case it was the tunnel interface sit1 (CentOS). Seems you get a IPv6 block already, then it will be whatever the external WAN interface is.

Once the correct forward rules are in place IPv6 traffic can flow through without getting blocked by the firewall. NAT shouldn't need to be involved with IPv6 in most cases.

  • Thanks, but after applying these rules I don't have IPv6 connectivity anymore. I get "Transmit error: code 1231." when using tracert on Windows for google.com. – Louis Matthijssen Mar 3 '15 at 21:10
  • Mmm strange. I still think FORWARD chain in the right way about it, but admittedly my setup is different and not Debian. Did you try adding forward rules for other subnets? ifconfig showed something outside of your /64 – James White Mar 5 '15 at 7:07
1

First you need to enable proxy_ndp:

 sysctl -w net.ipv6.conf.all.proxy_ndp=1

(and add the corresponding line in /etc/sysctl.conf).

Then the correct commands are:

ip neigh add proxy 2a00:d880:6:f2:80::1000 dev eth0
ip neigh add proxy 2a00:d880:6:f2:80::1001 dev eth0

assuming that eth0 is the name of your non-OpenVPN network device.

This means that this host should serve a a NDP proxy on device eth0:

  • it should say "yes it's me" when someone is asking for "2a00:d880:6:f2:80::1000" on the dev0 link;

  • this mean that this host will receive the packets for 2a00:d880:6:f2:80::1000 coming from the eth0 link;

  • you do not need to tell him on which interface is the real 2a00:d880:6:f2:80::1000, the IPv6 routing table will take care to route the correct to the suitable destination.

And do not forget to enable IPv6 IP forwarding:

sysctl -w net.ipv6.conf.all.forwarding=1
-1

Okay, after hours of trying I just forgot to do one simple thing. Add a firewall rule.

ip6tables -t nat -A POSTROUTING -s 2a00:a123:4:b5:80::/112 -j SNAT --to 2a00:a123:4:b5::1234

Adding the IPs in the SolusVM CP is not necessary. The NDP proxy thing is also not necessary.

  • 1
    SNAT? Are you sure? You should have no need of NAT here. Are you sure your provider routed a /64 to you? – Michael Hampton Nov 30 '14 at 1:56
  • I can add IPv6 addresses myself, so I guess that the /64 is not routed by default? Is it bad to use SNAT? I thought it was my only option because I don't have access to any routers. Thanks! – Louis Matthijssen Nov 30 '14 at 16:43
  • You sould not use NAT for this. You have public IP addresses, you can use them directly without NAT black magic. – ysdx Mar 3 '15 at 9:33
  • Agreed. NAT shouldn't be needed, in my opinion you just need the correct FORWARD chain rules. – James White Mar 3 '15 at 20:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.