I'm trying to tunnel IPv6 connection from my VPS using OpenVPN, because my ISP don't support IPv6. My VPS has a /64 IPv6 subner. I'm using my OpenWRT router as client, so I want the OpenVPN server to asign full IPv6 subnet, which then the router can use. My current config looks like this:

port myport
proto udp
dev tun
ca /etc/openvpn/keys/ca.crt
cert /etc/openvpn/keys/server.crt
key /etc/openvpn/keys/server.key
dh /etc/openvpn/keys/dh2048.pem
server-ipv6 2a03:4000:6:b11b:2::/80
push "redirect-gateway def1 bypass-dhcp"
push "route-ipv6 2000::/3"
push "dhcp-option DNS"
push "dhcp-option DNS"
keepalive 20 60
log-append /var/log/myvpn/openvpn.log
verb 3

But OpenVPN server only asignes IPv6 address like this: 2a03:4000:6:b11b:2::1000.

So, my question is, how to setup OpenVPN server to asign full IPv6 subnet to the client?

  • AFAIK, OpenVPN server will only assign a single IPv6 address to clients. Also, you have server-ipv6 2a03:4000:6:b11b:2::/80 which means that your server address is within the pool of IPv6 addresses. If the client gets the entire IPv6 /64 space, then what address will the server have? In your case it might be better to take a look at tunnelbroker.net and get a tunnel from them to your router. Works perfectly with many routers, including OpenWRT. Aug 26, 2016 at 1:07
  • @SACHINGARG Unfortunately I don't have public IPv4, and afaik HE tunner broker works only with public IP. OpenVPN just works behind ISP level nat.
    – user176999
    Aug 26, 2016 at 6:55

1 Answer 1


Make it work between the client and the server

First you need to route the packets to the TUN device on the server:

route-ipv6 $PREFIX

Additionaly, you need to ask the OpenVPN server to route this prefix to your client:

# This one needs to be in a CCD file:
iroute-ipv6 $PREFIX

With that, the server should be able to route the packets of this prefix to the client.

On the client, you need to configure (manually) some IPv6 address from this prefix. (On Linux: ip -6 addr $PREFIX dev tun0).

At this point you should be able to

  • ping one this client IP from the server;

  • ping the server from this client IP.

Route this prefix to the subnet

If your native interface on the server is a point-to-point interface, it should work. The router already forwards all the packets for this prefix to your server and the server will forward them to your client.

If your native interface is not a point-to-point interface, you're in trouble. When trying to forward packets to an IP of your prefix, the hosts on the native link will try to find the MAC address associated with this IPv6 address using NDP. Your server will not respond to them (because this IPv6 addres is not one of its addresses). The client is not on the same link and do not see the NDP requests (it could not answer to them anyway). So noone will answer to those NDP requests and the packet will not be sent to your server.

You could either:

  • Add a route on the router in order to use your server as a gateway for this prefix (ip -6 route add $PREFIX via $ipv6_of_the_server). However if this is not your router, you might not be able to do that.

  • Add NDP proxy rules (ip -neigh add proxy $some_ipv6 dev eth0). This will make the server respond to NDP requests on behalf on the client. However (at least on Linux), you cannot add a whole IPV6 subnet as a NDP proxy so you'd have to add a rule for each IPv6 address you want to delegate.

Using a TAP tunnel

If your native interface is an Ethernet one, another possibility is to use a TAP (Ethernet-based) OpenVPN tunnel instead of a TUN (IP-based) one and bridge the virtual tap device with the native one. This way, the client will be on the same link as the router and will be able to respond to NDP requests.

  • Thank you for your answer! Unfortunately I've been pretty bussy now, I will try to get it to work with your answer tomorow. Thanks!
    – user176999
    Sep 6, 2016 at 17:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy