I would like to redirect all ipv6 traffic from my local network to a VPN interface. Eth1 is a local interface on the local server, while eth0 is used for internet connection from my home router.

So the packets should go like this: any local client -> local server -> remote vpn -> open world. I've had this setup using ipv4 only for quite some time and it works fine. For ipv6 I believe I'd have to add a routing rule on my local server, but I have no clue how it should be done properly.

Local server interfaces:

eth0      Link encap:Ethernet  HWaddr 9e:17:d2:87:42:95
          inet addr:  Bcast:  Mask:
          inet6 addr: fe80::d217:c2ff:fe87:5295/64 Scope:Link

eth1      Link encap:Ethernet  HWaddr 00:13:3b:0f:e5:04
          inet addr:  Bcast:  Mask:
          inet6 addr: fe80::213:3bff:fe0f:e504/64 Scope:Link

tap0      Link encap:Ethernet  HWaddr 7a:fa:d6:54:38:09
          inet addr:  Bcast:  Mask:
          inet6 addr: fe80::64fa:c6ff:fe54:3809/64 Scope:Link

Besides the routing rule, is there anything else that should be done either on the local environment or the remote vpn machine? I believe ipv6 forwarding is enabled everywhere.

I'll appreciate any help and I would be glad to answer any follow-up questions that need to be answered. Cheers

Edit: The vpn server uses OpenVPN. It's currently all set up to work with ipv4 I believe. Is there anything that I should be specifically modifying in the config of openvpn server or the clients to make it work?


Assign unique local IPv6 address for your tap0 interface:

ip -6 addr add dev tap0 fd00::1/126 nodad

Assign unique local IPv6 address on the other side:

ip -6 addr add dev tap0 fd00::2/126 nodad

Then create default ipv6 route via your remote site:

ip -6 ro add default via fd00::2 dev tap0

Then you probably would like to add specific host routes from remote endpoint to your host behind local endpoint.

Actually you can use link local for default route, but unique one is usually more convenient.

| improve this answer | |
  • What does 'nodad' do? – vane41 May 2 '17 at 9:30
  • It disables duplicate address detection. I've seen some issues with IPv6 reachability failed because of DAD has failed to run on virtual interface. – ar_ May 2 '17 at 9:54
  • From ef-in-x65.1e100.net icmp_seq=1 Destination unreachable: No route That's the result I'm getting after setting it up like you said (pinging from local client). Pings were not returning anything before, so that's an upgrade still. Any idea what could be wrong? Also, I forgot to add that the vpn server uses OpenVPN. Are there any specific things I should be changing in the config over there or on the local machine? It's all set up to work with ipv4 only at the moment. – vane41 May 2 '17 at 10:05
  • Oh, OpenVPN changes things. You should make additional configuration for the server. Check out community.openvpn.net/openvpn/wiki/IPv6 – ar_ May 2 '17 at 10:30
  • @artem_d93 The page you linked to only covers a routed setup ("a bridged (dev tap) setup is not recommended in general, and users doing so are presumably advanced enough to know what they're doing.") A bridged setup is required in this case, though, since a routed setup needs publicly routed addresses, which the fd00::* addresses are not. – Johan Myréen May 2 '17 at 14:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.