Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have an OpenBSD PF firewall that I have added a IPv6 tunnel to (using tunnelbroker).

I can ping/traceroute IPv6 addresses from the firewall. Now I want to provide IPv6 services to the servers behind my firewall. They all have public IP addresses (I'm not using any sort of NAT). So I want to be able to give them IPv6 addresses on the routed IPv6 prefix given by the Tunnel and have traffic properly routed through the tunnel (gif0 interface) on OpenBSD.

Some other details. This is basically a transparent firewall, though the external interface does have an IP address for administration. Would I need to add an IPv6 address to the internal interface as well to provide routing or could I just transparently route everything through the tunnel interface? What would PF rules look like for IPv6 traffic and how would they differ from normal IPv4 PF rules?

I've found this page, but it is so old (for OpenBSD 2.9, almost 10 years old). I'm looking for updated instructions that would fit my situation.

Edit: Along with the below accepted answer I needed to add the following PF rule to get incoming traffic to work:

tunnelserveripv4address="xx.xx.xx.xx" # This is the IPv4 tunnel endpoint
pass in proto 41 from $tunnelserveripv4address to $ext_if keep state
pass out proto 41 from $ext_if to $tunnelserveripv4address keep state
share|improve this question
HE gives you an entire /64. Just configure radvd or whatever OpenBSD uses to provide addresses across your network. – Ignacio Vazquez-Abrams Jan 24 '11 at 21:42
And how should I configure rtadvd? Like I asked, do I need to add an IPv6 address to my internal interface for this to work? – thelsdj Jan 24 '11 at 22:03
up vote 4 down vote accepted

First, you should configure the LAN NIC to an address from the routed(!) /64; the ::1 is an ideal candidate. Then, fire up radvd on the LAN interface---it should not need any configuration.

PF doesn't play any role in it, or rather, make sure that it doesn't get in the way.

share|improve this answer
Looks like my tunnel provider takes up ::1 as the gateway on their end. ::2 is my side of the tunnel. Would ::3 be fine on my end? – thelsdj Jan 24 '11 at 22:16
radvd does need at least the appropriate prefix added to the configuration. – Ignacio Vazquez-Abrams Jan 24 '11 at 22:18
You are looking at the wrong addresses. These two addresses are used by HE as p-t-p endpoints. Check their config sample, your ROUTED /64 differs by a digit in the middle. That's the one you can use on your LAN, neither of the two p-t-p IPs. – mad_vs Jan 24 '11 at 22:26
Thanks! I think that fixed my issues. – thelsdj Jan 24 '11 at 22:31

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.