3

I'm trying to understand the following statement from the OpenVPN manual.

https://community.openvpn.net/openvpn/wiki/IPv6

In a routed setup, you cannot use your on-link network; you must use a unique routed network range, just like when routing with IPv4.

In short, this is saying that to run IPv6 through open VPN (without hiding it behind a NAT) you need to have two IPv6 /64 blocks. Or at least one block and a completely separate IPv6 address.

Can anyone explain why this is?


I'm struggling to get my head round this as I have a server with a /64 block assigned to it. From the network's point of view all traffic in that block must be sent to my server (?). On that server all traffic to that block would be sent via VPN if not its own IP. From the VPN client's point of view all traffic to that block would be sent via VPN if not its own IP.

I can't see why having the same /64 block assigned to two interfaces would cause a problem where the entire block is assigned to one server.

6

You cannot have two separate networks that use the same address space. If the uplink ethernet port of your server has the /64, then the OpenVPN interface can't have the same one, because it is a separate network.

Technically your server also doesn't have the whole /64. It will have one or more addresses of the /64 configured on its ethernet interface. It has no way to know that your provider has reserved the whole /64 for it. There are also providers that put multiple customers in a shared /64. The server can't know.

So to do it properly you need to have a separate /64 for your OpenVPN network, and that /64 has to be routed through your server (notice the "through", it doesn't belong to the server, the server merely routes traffic for it, some of the addresses will belong to VPN clients). That will require your provider to set that up for you. They will configure a /64 on the network between their router and your server (which is the /64 you already have) and configure a route for the other /64 that has your server as the next hop (router).

Another solution would be to configure OpenVPN in layer-2 mode, and create an ethernet bridge between your server's ethernet port and the OpenVPN tap interface. That way you won't have two separate networks that each need their separate /64. You will have one network with a bridge in it. One network only needs one /64. You can bridge the existing network to your VPN clients. You'll have to decide whether that is a possible solution for you.

  • The more I read this the less certain I am. You can have two devices on the same sub-net. The routing table will force all traffic for the one sub-net to go to a single device. That's fine because there are no external machines in my /64 block so all traffic to that block can be routed via tun. – Philip Couling Jun 29 '17 at 8:59
  • Your subnet is your external network interface. There are at least two devices in there: your default gateway and your server. You can have multiple devices in there, including your VPN clients. To do that you need to bridge them. – Sander Steffann Jun 29 '17 at 12:15
  • No. I've checked and re-rechecked this. My server IP is NOT in the same /64 as my default gateway. The server does not know how big the subnet is for that interface. – Philip Couling Jun 29 '17 at 13:02
0

A third solution would be using NDP-proxys.

ip neigh add proxy fd00::1:1001 dev eth0 ip neigh add proxy fd00::1:1002 dev eth0 ...

I use it successful at my dsl-connection at home to avoid DHCPv6-PD.

more details here (German) http://www.thomas--schaefer.de/openvpn-fuer-altlasten.html

  • Don't do this unless you absolutely must. It is ultimately better and cleaner to follow Sander's advice. – countermode Jun 29 '17 at 6:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.