Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have been trying to get IPv6 working on my tap OpenVPN network. The server already has IPv6, however it only has a /64 and the biggest range available is a /116 (which breaks autoconf). I am getting a 6-in-4 /48 from he.net to provide addresses to my VPN.

IPv6 Tunnel Endpoints

Server IPv6 Address:2001:470:xxxx:xxxx::1/64
Client IPv6 Address:2001:470:xxxx:xxxx::2/64

Routed IPv6 Prefixes

Routed 2001:470:yyyy::/48:

My network structure (internet => server => client) is:

Internet
 ||
OpenVPN server
eth0 (Native ipv6): 2600:3c01::xxxx:xxxx:xxxx:xxxx/64
he-ipv6 (6-in-4): 2001:470:xxxx:xxxx::2/64
tap0 (VPN): 2001:470:yyyy:zzzz::1/64
 ||
OpenVPN client
wlan0 (ipv4)
tap0 (VPN - autconf): 2001:470:yyyy:zzzz:wwww:wwww:wwww:wwww/64

Config of server:

server # ip -6 route
2001:470:xxxx:xxxx::/64 via :: dev he-ipv6  proto kernel  metric 256 
2001:470:yyyy:zzzz::/64 dev tap0  proto kernel  metric 256 
2600:3c01::xxxx:xxxx:xxxx:xxxx dev eth0  proto kernel  metric 256 
fe80::/64 dev eth0  proto kernel  metric 256 
fe80::/64 dev tap0  proto kernel  metric 256 
fe80::/64 via :: dev he-ipv6  proto kernel  metric 256 
default dev he-ipv6  metric 1024 
default via fe80::xxxx:xxxx:xxxx:xxxx dev tap0  proto kernel  metric 1024  expires 4748sec

Config of client:

client # ip -6 route                                           
2001:470:xxxx:xxxx::/64 via 2001:470:yyyy:zzzz::1 dev tap0  metric 1 
2001:470:yyyy:zzzz::/64 dev tap0  proto kernel  metric 256  expires 86388sec
fe80::/64 dev wlan0  proto kernel  metric 256 
fe80::/64 dev tap0  proto kernel  metric 256 
default via fe80::xxxx:xxxx:xxxx:xxxx dev tap0  proto kernel  metric 1024  expires 5383sec hoplimit 64

Ping results

Internet => 2600:3c01::xxxx:xxxx:xxxx:xxxx           Works
Internet => 2001:470:yyyy:zzzz::1                    Works
Internet => 2001:470:yyyy:zzzz:wwww:wwww:wwww:wwww   Timed Out

Server => 2600:3c01::xxxx:xxxx:xxxx:xxxx             Works
Server => 2001:470:yyyy:zzzz::1                      Works
Server => 2001:470:yyyy:zzzz:wwww:wwww:wwww:wwww     Works
Server => 2404:6800:4006:802::1011 (ipv6.google.com) Works

Client => 2600:3c01::xxxx:xxxx:xxxx:xxxx             Works
Client => 2001:470:yyyy:zzzz::1                      Works
Client => 2001:470:yyyy:zzzz:wwww:wwww:wwww:wwww     Works
Client => 2404:6800:4006:802::1011 (ipv6.google.com) Destination unreachable: Address unreachable

What should the routes be so that the client can be properly online with ipv6?

I know there should be a default route on the client for dev tap0, however no gateway I have tried has worked. I have been trying to work this out (through both research and experimentation) however I have not found a solution that works (though this seems to come close).

share|improve this question

2 Answers 2

Are you sure the problem is on the client and not the server? The client routes look fine. Does a trace route to ipv6.google.com reach 2001:470:yyyy:zzzz::1? If it does than IPv6 traffic is using the VPN as its default gateway and your client routes are all set.

I think the problem may be forwarding packets between tap0 and he-ipv6 on the server. I'm not very familiar with OpenVPN, but normally that kind of thing is controlled by policies in addition to the routing table.

I think OpenVPN uses iptables, and so allowing forwarding in both directions between the two ipv6 interfaces would require something like this.

iptables -I FORWARD -i tap0 -o he-ipv6 -j ACCEPT
iptables -I FORWARD -i he-ipv6 -o tap0 -j ACCEPT
share|improve this answer
up vote 0 down vote accepted

I ended up changing the setup and so the question does not apply any more.

However, I was thinking that you need to make sure that the kernel has been setup to forward IPv6 packets for all devices.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.