TCP/IPv6 thru ssh tunnel

Question

i am wondering how to tunnel tcp/ipv6 traffic over the ssh/ipv4 tunnel (ptp connection). Is it possible? How can i achieve that?

Answer 1

Yes, it is possible and not too difficult, but the solution is very suboptimal, since SSH runs over TCP and has a sensible overhead.

The server must have in its configuration file sshd_config:

PermitTunnel point-to-point

Then, you need to be root on both machines. You connect to the server using:

ssh -w any root@server

After connection, use the command ip link in both systems to know which tunN device was created in each one, and use it in the following commands. Note that I'm using example site-local addresses, which are obsolete, but ok for this introduction.

On the server:

server# ip link set tun0 up
server# ip addr add fec0:1::1/112 dev tun0

On the client:

client# ip link set tun0 up
client# ip addr add fec0:1::2/112 dev tun0

This is enough so that you can ping the other side through the tunnel, if there is no firewall rule blocking. The next step is to set routes over the tunnel (don't forget net.ipv6.conf.default.forwarding=1), and then adjust the link MTU to get optimal performance.

server# sysctl net.ipv6.conf.all.forwarding=1

client# ip -6 route add default via fec0:1::1

This will allow your client to ping other networks that the server has access to, given that the targets have routes back to your remote client.

You'll also have to fix the link MTU so that the client doesn't send packets that the server won't be able to transmit forward. This depends on the MTU of the IPv6 link of the server itself. Do not rely on path MTU discovery since it won't work correctly over the SSH tunnel. If in doubt, start with a low MTU value, like 1280 (minimum MTU allowed for IPv6).