3

I use OpenVPN TUN network. IPv4 works fine. But I have added support for IPv6. I have a problem with IPv6 connections. IPv6 works fine only for short time. When I ping tun0 IPv6 address on my VPN server from client after I can access to all IPv6 websites and I can ping other IPv6 addresses from client. But after very short time I do not access to any IPv6 websites and IPv6 ping to other IPv6 address is unsuccessful from my client. When I again ping tun0 IPv6 address on my VPN server from my client all works ok again for short time. Like client I tried Windows 8 and Linux Debian 8.

I have created /67 subnet from my public IPv6 address MY_PUBLIC_IPv6/64: MY_PUBLIC_IPv6:2000::/67, tun0 on my OpenVPN server has IPv6: MY_PUBLIC_IPv6:2000::1/67 and is achievable always without any problems. For example client has MY_PUBLIC_IPv6:2000::1000.

I created NDP proxy:

ip -6 neigh add proxy MY_PUBLIC_IPv6:2000::1 dev eth0
ip -6 neigh add proxy MY_PUBLIC_IPv6:2000::1000 dev eth0

I allowed:

sysctl -w net.ipv6.conf.all.forwarding=1
sysctl -w net.ipv6.conf.all.proxy_ndp=1 

I added ip6tables rules:

ip6tables -I FORWARD 1 -s MY_PUBLIC_IPv6:2000::/67 -i tun0 -o eth0 -m state --state NEW -j ACCEPT
ip6tables -I FORWARD 2 -d MY_PUBLIC_IPv6:2000::/67 -i eth0 -o tun0 -m state --state NEW -j ACCEPT
ip6tables -I FORWARD 3 -m state --state RELATED,ESTABLISHED -j ACCEPT

OpenVPN server.conf (IPv6 sections):

proto tcp6-server
mode server
tls-server
ifconfig 10.1.1.1 10.1.1.30
ifconfig-pool 10.1.1.2 10.1.1.100
tun-ipv6
push tun-ipv6
ifconfig-ipv6 MY_PUBLIC_IPv6:2000::1 MY_PUBLIC_IPv6:2000::100

push "route 10.1.1.0 255.255.255.0"
push "route-ipv6 MY_PUBLIC_IPv6:2000::1/67"
push "route-ipv6 2000::/3"

push "setenv ipv6dns 2001:4860:4860::8888"

radvd config file:

interface tun0
{
   AdvSendAdvert on;
   prefix MY_PUBLIC_IPv6:2000::/67
   {
   };
};

I get error message: radvd: no linklocal address configured for tun0

  • What is "a short time"? Something like "one minute or less", or more like 5 minutes? Or half an hour? – telcoM Oct 16 '18 at 14:54
  • @telcoM few seconds or within one minute. – Mato Oct 16 '18 at 16:40
  • @telcoM any idea please? – Mato Oct 17 '18 at 21:46
  • IPv6 routes should generally be auto-discovered from the route advisories sent by IPv6 routers. Does your VPN server have radvd running and appropriately configured? The failure at one minute or less sounds like the client system is not receiving appropriate route advisories, or might be receiving other advisories via another network interface and preferring that as a result. – telcoM Oct 18 '18 at 4:01
  • @telcoM Thanks. radvd default config file /etc/radvd.conf missing on my system, please could you post some configuration appropriate example? – Mato Oct 19 '18 at 13:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.