0

I'm renting a dedicated server at Hetzner and installed Ubuntu server 18.04 LTS on it. I've got two public IPv4 addresses named x.x.x.x and y.y.y.y and one IPv6 /64 block for connecting my private networks to the internet. I use NAT for IPv4.

XEN Schema My network is configured using Netplan as follows:

network:    
  version: 2
  renderer: networkd
  ethernets:
    eth0:
      addresses:
        - x.x.x.x/32
        - y.y.y.y/32
        - a.a.a.a::2/64
      routes:
        - on-link: true
          to: 0.0.0.0/0
          via: z.z.z.z
      gateway6: fe80::1
      nameservers:
        addresses:
          - 1.1.1.1
          - 1.0.0.1
          - 2606:4700:4700::1111
          - 2606:4700:4700::1001
  bridges:
    xenbr0:
      interfaces: []
      addresses:
        - 192.168.0.1/24
        - a.a.a.a::3/64
      parameters:
        forward-delay: 0
        stp: false
    xenbr1:
      interfaces: []
      addresses:
        - 192.168.1.1/24
        - a.a.a.a::4/64
      parameters:
        forward-delay: 0
        stp: false

The installation and configuration of XEN:

sudo apt-get install xen-hypervisor-amd64 xen-tools
sudo reboot
sudo vim /etc/default/grub
   GRUB_CMDLINE_XEN_DEFAULT="dom0_mem=min:1024M,max:1024M dom0_max_vcpus=2 dom0_vcpus_pin"
sudo vim /etc/xen/xl.conf
   autoballoon=0
sudo update-grub
sudo reboot

VM's should be accessible to and from the Internet using IP forwarding and NAT.

sudo vim /etc/sysctl.conf
   net.ipv4.ip_forward=1
sudo sysctl -p /etc/sysctl.conf
sudo apt-get install iptables-persistent

The NAT part:

sudo iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

Forward HTTP and HTTPS requests to our VM2 server:

sudo iptables -A PREROUTING -t nat -p tcp -i eth0 -d x.x.x.x --dport 80 -j DNAT --to 192.168.0.11:80
sudo iptables -A PREROUTING -t nat -p tcp -i eth0 -d x.x.x.x --dport 443 -j DNAT --to 192.168.0.11:443

We don't want any traffic between 192.168.0.x <-> 192.168.0.y so we drop all data packages with some simple rules. This Blocks communication between the bridges:

sudo iptables -P FORWARD DROP
sudo iptables -A FORWARD -i eth0 -o xenbr0 -j ACCEPT
sudo iptables -A FORWARD -i xenbr0 -o eth0 -s 192.168.0.0/24 -j ACCEPT
sudo iptables -A FORWARD -i eth0 -o xenbr1 -j ACCEPT
sudo iptables -A FORWARD -i xenbr1 -o eth0 -s 192.168.1.0/24 -j ACCEPT

The IPv4 part works perfectly but the IPv6 doesn't. I've assigned an IPv6 address manually to my VM's.When logged in to VM1 i can ping xenbr0 at address ::3 and VM2 at address ::11 but can't ping eth0 at address ::2. It's like the bridge prevents the IPv6 traffic from leaving the network but can't figure out why.

  • 1
    If you are trying to create a guide, the re-write to be a question, and answer it. (self answered questions are encouraged). – ctrl-alt-delor Jan 20 at 15:57
0

I've managed to figure it out. The key is to use an ipv6 address with /128 netmask that will function as a gateway for your VM's. Let's start with modifying the Netplan config:

network:    
  version: 2
  renderer: networkd
  ethernets:
    eth0:
      addresses:
        - x.x.x.x/32
        - y.y.y.y/32
        - a.a.a.a::00/128
        - a.a.a.a::10/128
      routes:
        - on-link: true
          to: 0.0.0.0/0
          via: z.z.z.z
      gateway6: fe80::1
      nameservers:
        addresses:
          - 1.1.1.1
          - 1.0.0.1
          - 2606:4700:4700::1111
          - 2606:4700:4700::1001
  bridges:
    xenbr0:
      interfaces: []
      addresses:
        - 192.168.0.1/24
        - a.a.a.a::00/125
      parameters:
        forward-delay: 0
        stp: false
    xenbr1:
      interfaces: []
      addresses:
        - 192.168.1.1/24
        - a.a.a.a::10/125
      parameters:
        forward-delay: 0
        stp: false

Pay attention to the ipv6 addresses assigned to the eth0, xenbr0 and xenbr1 interfaces. Eth0 gets two single ipv6 (/128) addresses while xenbr0 and xenbr1 gets a block of eight addresses (/125) that can be used for your VM's. VM1 network config looks like this:

# The loopback network interface
auto lo
iface lo inet loopback
iface lo0 inet6 loopback

# The primary network interface
auto eth0
iface eth0 inet static
    address 192.168.0.10
    netmask 255.255.255.0
    broadcast 192.168.0.255
    network 192.168.0.0
    gateway 192.168.0.1

iface eth0 inet6 static
    address a:a:a:a::01
    netmask 125
    gateway a:a:a:a::00

And VM3 config which uses another bridge:

# The loopback network interface
auto lo
iface lo inet loopback
iface lo0 inet6 loopback

# The primary network interface
auto eth0
iface eth0 inet static
    address 192.168.1.10
    netmask 255.255.255.0
    broadcast 192.168.1.255
    network 192.168.1.0
    gateway 192.168.1.1

iface eth0 inet6 static
    address a:a:a:a::11
    netmask 125
    gateway a:a:a:a::10

Last but not least don't forget to enable ip forwarding for ipv6.

sudo vim /etc/sysctl.conf
    net.ipv6.conf.all.forwarding=1
sudo sysctl -p /etc/sysctl.conf

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.