0

I've got a /64 IPv6 subnet and I'd like to use additional v6 addresses now. => /etc/network/interfaces:

iface ens18 inet6 static
    address asdf:asdf:asdf:asdf::1
    netmask 64
    gateway fe80::1
    accept_ra 0
    autoconf 0
    privext 0
    dns-nameservers ::1 xxxx:xxxx::1:53 xxxx:xxxx:2:53

iface ens18 inet6 static
    address asdf:asdf:asdf:asdf::2
    netmask 64

iface ens18 inet6 static
    address asdf:asdf:asdf:asdf::3
    netmask 64

However, as soon as I add asdf:asdf:asdf:asdf::2 and/or asdf:asdf:asdf:asdf::3, I cannot ping any other IPv6 address.
When I remove these blocks and reboot, I can use IPv6 again.

# ip addr show ens18
2: ens18: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
    link/ether [...] brd ff:ff:ff:ff:ff:ff
    inet [...]/24 brd 79.143.178.255 scope global ens18
    valid_lft forever preferred_lft forever
    inet6 asdf:asdf:asdf:asdf::1/64 scope global 
    valid_lft forever preferred_lft forever
    inet6 fe80::[...]/64 scope link 
    valid_lft forever preferred_lft forever
# ip -6 route
asdf:asdf:asdf:asdf::/64 dev ens18 proto kernel metric 256  pref medium
fe80::/64 dev ens18 proto kernel metric 256  pref medium
default via fe80::1 dev ens18 metric 1024  pref medium

What is the problem here?

  • Please show the output of ip a and ip -6 r while the system is having the problem. It's not very useful to see them while the system is working properly. – Michael Hampton Oct 26 '18 at 2:39
  • The problem were ICMPv6 messages. I did not know that these are very different to normal ICMP packages. – Hoeze Oct 26 '18 at 11:16
0

I found the problem: ICMPv6 messages! -.-

  1. You have to accept -p ipv6-icmp instead of -p icmp
  2. Do not use stateful allow for ICMP, e.g.:
    ip6tables -A OUTPUT -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
    This will keep ICMPv6 packages from being caught by that rule

I had a pretty hard time to debug this, since it was more or less working randomly...

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.