3

I have an OpenBSD PF firewall that I have added a IPv6 tunnel to (using HE.net tunnelbroker).

I can ping/traceroute IPv6 addresses from the firewall. Now I want to provide IPv6 services to the servers behind my firewall. They all have public IP addresses (I'm not using any sort of NAT). So I want to be able to give them IPv6 addresses on the routed IPv6 prefix given by the Tunnel and have traffic properly routed through the tunnel (gif0 interface) on OpenBSD.

Some other details. This is basically a transparent firewall, though the external interface does have an IP address for administration. Would I need to add an IPv6 address to the internal interface as well to provide routing or could I just transparently route everything through the tunnel interface? What would PF rules look like for IPv6 traffic and how would they differ from normal IPv4 PF rules?

I've found this page, but it is so old (for OpenBSD 2.9, almost 10 years old). I'm looking for updated instructions that would fit my situation.

Edit: Along with the below accepted answer I needed to add the following PF rule to get incoming traffic to work:

tunnelserveripv4address="xx.xx.xx.xx" # This is the IPv4 HE.net tunnel endpoint
ext_if="em0"
pass in proto 41 from $tunnelserveripv4address to $ext_if keep state
pass out proto 41 from $ext_if to $tunnelserveripv4address keep state
Improve this question
2
  • HE gives you an entire /64. Just configure radvd or whatever OpenBSD uses to provide addresses across your network.
    – Ignacio Vazquez-Abrams
    Jan 24, 2011 at 21:42
  • And how should I configure rtadvd? Like I asked, do I need to add an IPv6 address to my internal interface for this to work?
    – thelsdj
    Jan 24, 2011 at 22:03

1 Answer 1

Reset to default
4

First, you should configure the LAN NIC to an address from the routed(!) /64; the ::1 is an ideal candidate. Then, fire up radvd on the LAN interface---it should not need any configuration.

PF doesn't play any role in it, or rather, make sure that it doesn't get in the way.

Improve this answer
3
  • Looks like my tunnel provider takes up ::1 as the gateway on their end. ::2 is my side of the tunnel. Would ::3 be fine on my end?
    – thelsdj
    Jan 24, 2011 at 22:16
  • radvd does need at least the appropriate prefix added to the configuration.
    – Ignacio Vazquez-Abrams
    Jan 24, 2011 at 22:18
  • 2
    You are looking at the wrong addresses. These two addresses are used by HE as p-t-p endpoints. Check their config sample, your ROUTED /64 differs by a digit in the middle. That's the one you can use on your LAN, neither of the two p-t-p IPs.
    – Volker Stolz
    Jan 24, 2011 at 22:26

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .