1

Current setup: OpenVPN server with IPv4 and IPv6:

[...]
port 1234
proto udp6
dev tun
server 10.9.8.0 255.255.255.0
server-ipv6 2001:1af8:3100:a00a:0021:a:b:0000/112
client-to-client
[...]

Clients get IPs via CCD:

ifconfig-ipv6-push 2001:1af8:3100:a00a:21:a:b:0006
ifconfig-push 10.9.8.6 10.9.8.5

On a side note: this seems to only work on Linux (including 2.2 oVPN on Debian); the IPv6 line breaks everything on Tunnelblick (OS X) and Windows (=> clients cannot even ping eachother over IPv4).

The connected clients get two IPs; an IPv4 address and an IPv6 address:

10.9.8.6,pc1,::ffff:212.3.2.1,Fri Dec 19 23:26:02 2014
2001:1af8:3100:a00a:21:a:b:6,pc1,::ffff:212.3.2.1,Fri Dec 19 23:21:22 2014

10.9.8.102,pc2,2001:1af8:b:a00a:21::4,Fri Dec 19 23:25:34 2014
2001:1af8:3100:a00a:21:a:b:102,pc2,2001:1af8:b:a00a:21::4,Fri Dec 19 23:06:11 2014

Pinging the IPv6 address (ie: 2001:1af8:3100:a00a:21:a:b:102) from the VPN server works fine. Pinging between clients doesn't work:

pc1 ~ # ping6 2001:1af8:3100:a00a:21:a:b:102
PING 2001:1af8:3100:a00a:21:a:b:102 (2001:1af8:3100:a00a:21:a:b:102): 56 data bytes
64 bytes from 2a02:578:854f:100:7271:a:1b11: Destination unreachable: Address unreachable
64 bytes from 2a02:578:854f:100:7271:a:1b11: Destination unreachable: Address unreachable
64 bytes from 2a02:578:854f:100:7271:a:1b11: Destination unreachable: Address unreachable
^C--- 2001:1af8:3100:a00a:21:a:b:102 ping statistics ---
5 packets transmitted, 0 packets received, 100% packet loss

But IPv4 works:

pc1 ~ # ping 10.9.8.102
PING 10.9.8.102 (10.9.8.102): 56 data bytes
64 bytes from 10.9.8.102: icmp_seq=0 ttl=64 time=32.217 ms
64 bytes from 10.9.8.102: icmp_seq=1 ttl=64 time=31.641 ms
^C--- 10.9.8.102 ping statistics ---
2 packets transmitted, 2 packets received, 0% packet loss
round-trip min/avg/max/stddev = 31.641/31.929/32.217/0.288 ms

What am I missing ? iptables ? some sysctl option ? Thanks.

vpn-server # cat /proc/sys/net/ipv6/conf/all/forwarding
1

trace (goes as far as my own IPv6 address):

pc1 ~ # traceroute6 2001:1af8:3100:a00a:21:a:b:102
traceroute to 2001:1af8:3100:a00a:21:a:b:102 (2001:1af8:3100:a00a:21:a:b:102), 30 hops max, 80 byte packets
 1  2a02:578:854f:100:7271:bcff:f:1b11 (2a02:578:854f:100:7271:bcff:f:1b11)  3008.038 ms !H  3008.020 ms !H  3007.985 ms !H
pc1 ~ #

routes:

pc1 ~ # ip -6 route show
2001:1af8:3100:a00a::/64 dev eth0  proto kernel  metric 256  expires 51sec mtu 1492 advmss 1432 hoplimit 0
2001:1af8:3100:a00a::/64 dev wlan0  proto kernel  metric 256  expires 51sec mtu 1492 advmss 1432 hoplimit 0
2001:1af8:3100:a00a::/64 dev tun0  proto kernel  metric 256  mtu 1500 advmss 1440 hoplimit 0
2a02:578:854f:100::/64 dev eth0  proto kernel  metric 256  expires 7177sec mtu 1492 advmss 1432 hoplimit 0
2a02:578:854f:100::/64 dev wlan0  proto kernel  metric 256  expires 7177sec mtu 1492 advmss 1432 hoplimit 0
fe80::/64 dev eth0  proto kernel  metric 256  mtu 1492 advmss 1432 hoplimit 0
fe80::/64 dev wlan0  proto kernel  metric 256  mtu 1492 advmss 1432 hoplimit 0
fe80::/64 dev tun0  proto kernel  metric 256  mtu 1500 advmss 1440 hoplimit 0
default via fe80::3631:c4ff:fe3d:eac2 dev eth0  proto kernel  metric 1024  expires 1777sec mtu 1492 advmss 1432 hoplimit 255
default via fe80::3631:c4ff:fe3d:eac2 dev wlan0  proto kernel  metric 1024  expires 1777sec mtu 1492 advmss 1432 hoplimit 255
4
  • Sigh, this is going to sound condescending, but if you have if you have a problem with getting packets from one place to another then you have a routing problem. And when you have a routing problem you should include route tables, and traceroute. Also why a /112? I suspect OpenVPN will support it, but you really should give your VPN a full /64.
    – Zoredache
    Dec 20, 2014 at 0:13
  • If you don't want to be condescending, try not to be. I don't have a /64 all by myself to use for this. That's also a lot of IPs and OpenVPN supports smaller than /64 (with 2.3+). The traceroute has been added.
    – Tuinslak
    Dec 20, 2014 at 0:40
  • So if you look at your route table you will notice that there is no route for 2001:1af8:3100:a00a:0021:a:b:0000/112. Either OpenVPN is not configured to add it, or it is refusing it to add it because you already have 2001:1af8:3100:a00a::/64 locally configured. See your OpenVPN log files. Bump up the log verbosity to 4 will probably give you more info as well.
    – Zoredache
    Dec 20, 2014 at 0:59
  • VPN log don't seem to show anything useful: Learn: 2001:1af8:3100:a00a:21:a:b:1001 -> test-phone/::ffff:210.79.114.x I've tried this which doesn't seem to help: push "route-ipv6 2001:1af8:3100:a00a:0021:a:b:0000/112"
    – Tuinslak
    Dec 24, 2014 at 22:38

0

You must log in to answer this question.

Browse other questions tagged .