up vote 2 down vote favorite
share [g+] share [fb]

I'm having an ipv6 problem that's plagued me for some time. (http://serverfault.com/questions/73241/ipv6-routing-over-vpn) the goal is to use a HurricaneElectric v6 tunnel to get v6 on my laptop, no matter where I am by using my VPN.

I'm going to be overly-detailed here, so settle in.

Network layout:

svr1 --- vpn --- laptop

  • svr1 is a Linux OpenVPN client with a static v4 and HE's ipv6 tunnel.

  • vpn is a Linux OpenVPN server (amongst other things). it has a dynamic v4 address and as such, cant be used with HurricaneElectric's tunnel.

  • laptop is an OSX laptop and OpenVPN client

Interfaces:

  • HE gateway: 2001:470:a:ed::1

  • svr1 v6: 2001:470:a:ed::2

  • srv1-tap: 2001:470:a:ed::20

  • laptop-tap: 2001:470:a:ed::99

what I'd like:

HE --- svr1 --- (vpn) --- laptop

the problem hinges on the fact that I can make this set up work, but only under certain conditions.

for example, I connect up everything, ping6 2001:470:a:ed::2 (and beyond) is ICMP unreachable. as soon as I ping6 2001:470:a:ed::20 (the next hop). this kind of problem existed when I first set up the tunnel on srv1, but appears to have gone away with the addition of 'metric 1' to the interface declaration. I have however replicated this on vpn, although I havent yet tested the 'metric 1' component. I have been unable to find the 'metric' command on OSX, but I have found a number of people having issues with ipv6 on OSX

I'm looking for some sort of solution. I'd prefer static routes, no extra prefixes, but at this point, I'm willing to try anything. I've tried radvd, ipv6 on vpn, prefix (albeit probably incorrectly). I have almost no ipv6 experience, so assume I know nothing.

link|improve this question
80% accept rate
feedback

3 Answers

up vote 0 down vote

All your routing tables (ip -6 ro) and more precise description of what (pings) work and what don't would quite help to understand what's going on,

but I can guess you either have problems with ipv6 forwarding setup on the srv1 (sysctl's net.ipv6.conf.all.forwarding) or with ip6tables (there might be a default DROP policy).

link|improve this answer
its not a sysctl or firewall issue. I did describe what pings work. – neoice Nov 12 '10 at 13:08
feedback
up vote 0 down vote accepted

the solution wound up being the difference between the tunnel broker tunnel and the routed /64 they provide. this addressing scheme is correct.

Interfaces:

  • HE gateway: 2001:470:a:ed::1

  • svr1 v6: 2001:470:a:ed::2

  • srv1-tap: 2001:470:b:ed::1

  • laptop-tap: 2001:470:b:ed::2

link|improve this answer
feedback
up vote -1 down vote

does openvpn support IPv6?

link|improve this answer
if you have a question to ask, then please click the "ask a question" button, not the "post an answer" button – Mark Henderson♦ Nov 25 '10 at 3:06
OpenVPN has 2 modes of operation, tap and tun. tun is layer-3 emulation, basically being a virtual TCP/IP device. tap is layer-2 emulation, a virtual ethernet device. if you can shove packets on a physical wire, you can probably get them onto a tap device. I originally started using tap since it supports broadcast packets (tun does not because broadcast isnt routed) and the nice bonus is that it's protocol-agnostic. – neoice Nov 27 '10 at 9:01
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.