Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm having an ipv6 problem that's plagued me for some time. ( the goal is to use a HurricaneElectric v6 tunnel to get v6 on my laptop, no matter where I am by using my VPN.

I'm going to be overly-detailed here, so settle in.

Network layout:

svr1 --- vpn --- laptop

  • svr1 is a Linux OpenVPN client with a static v4 and HE's ipv6 tunnel.

  • vpn is a Linux OpenVPN server (amongst other things). it has a dynamic v4 address and as such, cant be used with HurricaneElectric's tunnel.

  • laptop is an OSX laptop and OpenVPN client


  • HE gateway: 2001:470:a:ed::1

  • svr1 v6: 2001:470:a:ed::2

  • srv1-tap: 2001:470:a:ed::20

  • laptop-tap: 2001:470:a:ed::99

what I'd like:

HE --- svr1 --- (vpn) --- laptop

the problem hinges on the fact that I can make this set up work, but only under certain conditions.

for example, I connect up everything, ping6 2001:470:a:ed::2 (and beyond) is ICMP unreachable. as soon as I ping6 2001:470:a:ed::20 (the next hop). this kind of problem existed when I first set up the tunnel on srv1, but appears to have gone away with the addition of 'metric 1' to the interface declaration. I have however replicated this on vpn, although I havent yet tested the 'metric 1' component. I have been unable to find the 'metric' command on OSX, but I have found a number of people having issues with ipv6 on OSX

I'm looking for some sort of solution. I'd prefer static routes, no extra prefixes, but at this point, I'm willing to try anything. I've tried radvd, ipv6 on vpn, prefix (albeit probably incorrectly). I have almost no ipv6 experience, so assume I know nothing.

share|improve this question

All your routing tables (ip -6 ro) and more precise description of what (pings) work and what don't would quite help to understand what's going on,

but I can guess you either have problems with ipv6 forwarding setup on the srv1 (sysctl's net.ipv6.conf.all.forwarding) or with ip6tables (there might be a default DROP policy).

share|improve this answer
its not a sysctl or firewall issue. I did describe what pings work. – neoice Nov 12 '10 at 13:08
up vote 0 down vote accepted

the solution wound up being the difference between the tunnel broker tunnel and the routed /64 they provide. this addressing scheme is correct.


  • HE gateway: 2001:470:a:ed::1

  • svr1 v6: 2001:470:a:ed::2

  • srv1-tap: 2001:470:b:ed::1

  • laptop-tap: 2001:470:b:ed::2

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.