Make it work between the client and the server
First you need to route the packets to the TUN device on the server:
route-ipv6 $PREFIX
Additionaly, you need to ask the OpenVPN server to route this prefix to your client:
# This one needs to be in a CCD file:
iroute-ipv6 $PREFIX
With that, the server should be able to route the packets of this prefix to the client.
On the client, you need to configure (manually) some IPv6 address from this prefix. (On Linux: ip -6 addr $PREFIX dev tun0
).
At this point you should be able to
Route this prefix to the subnet
If your native interface on the server is a point-to-point interface, it should work. The router already forwards all the packets for this prefix to your server and the server will forward them to your client.
If your native interface is not a point-to-point interface, you're in trouble. When trying to forward packets to an IP of your prefix, the hosts on the native link will try to find the MAC address associated with this IPv6 address using NDP. Your server will not respond to them (because this IPv6 addres is not one of its addresses). The client is not on the same link and do not see the NDP requests (it could not answer to them anyway). So noone will answer to those NDP requests and the packet will not be sent to your server.
You could either:
Add a route on the router in order to use your server as a gateway for this prefix (ip -6 route add $PREFIX via $ipv6_of_the_server
). However if this is not your router, you might not be able to do that.
Add NDP proxy rules (ip -neigh add proxy $some_ipv6 dev eth0
). This will make the server respond to NDP requests on behalf on the client. However (at least on Linux), you cannot add a whole IPV6 subnet as a NDP proxy so you'd have to add a rule for each IPv6 address you want to delegate.
Using a TAP tunnel
If your native interface is an Ethernet one, another possibility is to use a TAP (Ethernet-based) OpenVPN tunnel instead of a TUN (IP-based) one and bridge the virtual tap device with the native one. This way, the client will be on the same link as the router and will be able to respond to NDP requests.
server-ipv6 2a03:4000:6:b11b:2::/80
which means that your server address is within the pool of IPv6 addresses. If the client gets the entire IPv6 /64 space, then what address will the server have? In your case it might be better to take a look at tunnelbroker.net and get a tunnel from them to your router. Works perfectly with many routers, including OpenWRT.