Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I've got a MikroTik router set up with the latest stable OS on it, and I just set up an ipv6 tunnel with Hurricane Electric, but I'm having an odd issue with it. I can't ping anything until I first ping the tunnel endpoint on HE's side. After that I can ping any ipv6 address fine, but give it a little time (say, maybe 30 sec) and I can't ping any ipv6 addresses again. Whenever it stops allowing ping to go through I notice the counter on my firewall rule that drops invalid connections goes up.

this is my ipv6 firewall config:

add action=accept chain=input comment="" connection-state=established \
    disabled=no in-interface=sit1
add action=accept chain=input comment="" connection-state=related disabled=no \
    in-interface=sit1
add action=accept chain=input comment="" disabled=no in-interface=bridge \
    src-address=ipv6_address_here/64
add action=drop chain=input comment="" connection-state=invalid disabled=no \
    in-interface=sit1
add action=drop chain=input comment="" disabled=no in-interface=sit1

Any ideas on what it could be?

share|improve this question
    
How about rules in IPv4 firewall blocking 6to4 protocol after while (6to4 is IP protocol 41, not listed in "protocol" value of firewall rule). Look for dropped IPv4 packets when IPv6 packets starts to being drop. –  mkudlacek Mar 8 '11 at 7:19
    
I reset the counters on my ipv4 firewall, and no substantial packets are hitting any of the drop rules. (2 packets in several minutes of pinging) –  MikeSmitty Mar 8 '11 at 15:41

1 Answer 1

What about the default ipv6 route? have you tried to set the 2000::/3 gateway=sit1? can you add a ipv4 firewall log rule to see ip protocol 41 transit?

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.