I would like to redirect all ipv6 traffic from my local network to a VPN interface. Eth1 is a local interface on the local server, while eth0 is used for internet connection from my home router.

So the packets should go like this: any local client -> local server -> remote vpn -> open world. I've had this setup using ipv4 only for quite some time and it works fine. For ipv6 I believe I'd have to add a routing rule on my local server, but I have no clue how it should be done properly.

Local server interfaces:

eth0      Link encap:Ethernet  HWaddr 9e:17:d2:87:42:95
          inet addr:  Bcast:  Mask:
          inet6 addr: fe80::d217:c2ff:fe87:5295/64 Scope:Link

eth1      Link encap:Ethernet  HWaddr 00:13:3b:0f:e5:04
          inet addr:  Bcast:  Mask:
          inet6 addr: fe80::213:3bff:fe0f:e504/64 Scope:Link

tap0      Link encap:Ethernet  HWaddr 7a:fa:d6:54:38:09
          inet addr:  Bcast:  Mask:
          inet6 addr: fe80::64fa:c6ff:fe54:3809/64 Scope:Link

Besides the routing rule, is there anything else that should be done either on the local environment or the remote vpn machine? I believe ipv6 forwarding is enabled everywhere.

I'll appreciate any help and I would be glad to answer any follow-up questions that need to be answered. Cheers

Edit: The vpn server uses OpenVPN. It's currently all set up to work with ipv4 I believe. Is there anything that I should be specifically modifying in the config of openvpn server or the clients to make it work?

1 Answer 1


Assign unique local IPv6 address for your tap0 interface:

ip -6 addr add dev tap0 fd00::1/126 nodad

Assign unique local IPv6 address on the other side:

ip -6 addr add dev tap0 fd00::2/126 nodad

Then create default ipv6 route via your remote site:

ip -6 ro add default via fd00::2 dev tap0

Then you probably would like to add specific host routes from remote endpoint to your host behind local endpoint.

Actually you can use link local for default route, but unique one is usually more convenient.

  • What does 'nodad' do?
    – vane41
    May 2, 2017 at 9:30
  • It disables duplicate address detection. I've seen some issues with IPv6 reachability failed because of DAD has failed to run on virtual interface.
    – ar_
    May 2, 2017 at 9:54
  • From ef-in-x65.1e100.net icmp_seq=1 Destination unreachable: No route That's the result I'm getting after setting it up like you said (pinging from local client). Pings were not returning anything before, so that's an upgrade still. Any idea what could be wrong? Also, I forgot to add that the vpn server uses OpenVPN. Are there any specific things I should be changing in the config over there or on the local machine? It's all set up to work with ipv4 only at the moment.
    – vane41
    May 2, 2017 at 10:05
  • Oh, OpenVPN changes things. You should make additional configuration for the server. Check out community.openvpn.net/openvpn/wiki/IPv6
    – ar_
    May 2, 2017 at 10:30
  • @artem_d93 The page you linked to only covers a routed setup ("a bridged (dev tap) setup is not recommended in general, and users doing so are presumably advanced enough to know what they're doing.") A bridged setup is required in this case, though, since a routed setup needs publicly routed addresses, which the fd00::* addresses are not. May 2, 2017 at 14:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .