up vote 2 down vote favorite
share [g+] share [fb]

Following (roughly) the instructions https://www.zagbot.com/openvpn_ipv6_tunnel.html at I now have the following:

Client

martin@theoria:~$ ifconfig 
eth0      Link encap:Ethernet  HWaddr 00:50:8d:b3:fd:f4  
          inet addr:192.168.0.2  Bcast:192.168.0.255  Mask:255.255.255.0
          inet6 addr: fe80::250:8dff:feb3:fdf4/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:31372164 errors:0 dropped:0 overruns:0 frame:0
          TX packets:33131753 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:15453951555 (15.4 GB)  TX bytes:26797262646 (26.7 GB)
          Interrupt:23 Base address:0xa000 

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:1985259 errors:0 dropped:0 overruns:0 frame:0
          TX packets:1985259 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:347645379 (347.6 MB)  TX bytes:347645379 (347.6 MB)

sit1      Link encap:IPv6-in-IPv4  
          inet6 addr: 2001:41d0:2:b353::10/64 Scope:Global
          inet6 addr: fe80::a08:a/128 Scope:Link
          UP POINTOPOINT RUNNING NOARP  MTU:1480  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

tun0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  
          inet addr:10.8.0.10  P-t-P:10.8.0.9  Mask:255.255.255.255
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
          RX packets:9 errors:0 dropped:0 overruns:0 frame:0
          TX packets:14 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100 
          RX bytes:1106 (1.1 KB)  TX bytes:1598 (1.5 KB)

virbr0    Link encap:Ethernet  HWaddr 12:86:9c:16:08:fd  
          inet addr:192.168.122.1  Bcast:192.168.122.255  Mask:255.255.255.0
          UP BROADCAST MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

wlan0     Link encap:Ethernet  HWaddr 00:0e:2e:4e:94:8a  
          UP BROADCAST MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

Server

root@martineve:~# ifconfig 
eth0      Link encap:Ethernet  HWaddr e0:69:95:72:85:77  
          inet addr:188.165.232.xxx  Bcast:188.165.232.255  Mask:255.255.255.0
          inet6 addr: fe80::e269:95ff:fe72:8577/64 Scope:Link
          inet6 addr: 2001:41d0:2:b353::1/64 Scope:Global
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:49817 errors:0 dropped:6 overruns:0 frame:0
          TX packets:51419 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:21105790 (20.1 MiB)  TX bytes:36400780 (34.7 MiB)
          Interrupt:20 Memory:fe500000-fe520000 

eth0:0    Link encap:Ethernet  HWaddr e0:69:95:72:85:77  
          inet addr:87.98.254.xxx  Bcast:87.255.255.255  Mask:255.255.255.255
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          Interrupt:20 Memory:fe500000-fe520000 

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:14274 errors:0 dropped:0 overruns:0 frame:0
          TX packets:14274 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:10206299 (9.7 MiB)  TX bytes:10206299 (9.7 MiB)

sit10     Link encap:IPv6-in-IPv4  
          inet6 addr: 2001:41d0:2:b353::3/64 Scope:Global
          inet6 addr: fe80::a08:1/128 Scope:Link
          UP POINTOPOINT RUNNING NOARP  MTU:1480  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

tun0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  
          inet addr:10.8.0.1  P-t-P:10.8.0.2  Mask:255.255.255.255
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
          RX packets:16000 errors:0 dropped:0 overruns:0 frame:0
          TX packets:13254 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100 
          RX bytes:9839924 (9.3 MiB)  TX bytes:5791219 (5.5 MiB)

Each device can ping the other over the IPv6 network between them:

Client:

PING 2001:41d0:2:b353::3(2001:41d0:2:b353::3) 56 data bytes
64 bytes from 2001:41d0:2:b353::3: icmp_seq=1 ttl=64 time=25.3 ms

Server:

PING 2001:41d0:2:b353::10(2001:41d0:2:b353::10) 56 data bytes
64 bytes from 2001:41d0:2:b353::10: icmp_seq=1 ttl=64 time=94.7 ms

However, from the client, I cannot access anywhere outside.

Client:

martin@theoria:~$ ip -6 route show
2001:41d0:2:b353::/64 via :: dev sit1  proto kernel  metric 256 
fe80::/64 dev eth0  proto kernel  metric 256 
fe80::/64 via :: dev sit1  proto kernel  metric 256 
default via 2001:41d0:2:b353::1 dev sit1  metric 1024 
martin@theoria:~$ sudo route -A inet6
[sudo] password for martin: 
Kernel IPv6 routing table
Destination                    Next Hop                   Flag Met Ref Use If
2001:41d0:2:b353::/64          ::                         Un   256 0     1 sit1
fe80::/64                      ::                         U    256 0     0 eth0
fe80::/64                      ::                         Un   256 0     0 sit1
::/0                           2001:41d0:2:b353::1        UG   1024 0     0 sit1
::/0                           ::                         !n   -1  1   520 lo
::1/128                        ::                         Un   0   2    56 lo
2001:41d0:2:b353::10/128       ::                         Un   0   1     3 lo
fe80::a08:a/128                ::                         Un   0   1     0 lo
fe80::250:8dff:feb3:fdf4/128   ::                         Un   0   1     0 lo
ff00::/8                       ::                         U    256 0     0 eth0
ff00::/8                       ::                         U    256 0     0 sit1
::/0                           ::                         !n   -1  1   520 lo

Server:

root@martineve:~# ip -6 route show
2001:41d0:2:b353::10 dev sit10  metric 1024 
2001:41d0:2:b353::/64 dev eth0  proto kernel  metric 256 
2001:41d0:2:b353::/64 via :: dev sit10  proto kernel  metric 256 
2001:41d0:2:b300::/56 dev eth0  proto kernel  metric 256  expires 2590467sec
fe80::/64 dev eth0  proto kernel  metric 256 
fe80::/64 via :: dev sit10  proto kernel  metric 256 
ff00::/8 dev eth0  metric 256 
ff00::/8 dev sit10  metric 256 
default via fe80::5:73ff:fea0:0 dev eth0  metric 1024 
root@martineve:~# route -A inet6 
Kernel IPv6 routing table
Destination                    Next Hop                   Flag Met Ref Use If
::1/128                        ::                         Un   0   1   196 lo
2001:41d0:2:b353::/128         ::                         Un   0   1     0 lo
2001:41d0:2:b353::/128         ::                         Un   0   1     0 lo
2001:41d0:2:b353::1/128        ::                         Un   0   1   101 lo
2001:41d0:2:b353::3/128        ::                         Un   0   1     3 lo
2001:41d0:2:b353::10/128       ::                         U    1024 0     0 sit10
2001:41d0:2:b353::/64          ::                         U    256 0     0 eth0
2001:41d0:2:b353::/64          ::                         Un   256 0     0 sit10
2001:41d0:2:b300::/56          ::                         UAe  256 0     2 eth0
fe80::/128                     ::                         Un   0   1     0 lo
fe80::a08:1/128                ::                         Un   0   1     0 lo
fe80::e269:95ff:fe72:8577/128  ::                         Un   0   1    49 lo
fe80::/64                      ::                         U    256 0     0 eth0
fe80::/64                      ::                         Un   256 0     0 sit10
ff00::/8                       ::                         U    256 0     0 eth0
ff00::/8                       ::                         U    256 0     0 sit10
::/0                           fe80::5:73ff:fea0:0        UG   1024 0     0 eth0
::/0                           ::                         !n   -1  1   113 lo

The server has IPv6 general connectivity:

PING aaaa.test-ipv6.com(jason-fesler.f0-8.switch2a.fmt.he.net) 56 data bytes
64 bytes from jason-fesler.f0-8.switch2a.fmt.he.net: icmp_seq=1 ttl=53 time=164 ms

The client does not:

PING aaaa.test-ipv6.com(jason-fesler.f0-8.switch2a.fmt.he.net) 56 data bytes
^C
--- aaaa.test-ipv6.com ping statistics ---
3 packets transmitted, 0 received, 100% packet loss, time 2015ms

I've tried this to no avail:

root@martineve:~# cat /proc/sys/net/ipv6/conf/all/forwarding 
1

What do I need to do to allow the client to access the big outside world of IPv6?

link|improve this question
feedback

2 Answers

up vote 2 down vote

You have a lot of routes with the same priority and different devices. You are routing your /64 out eth0 which may cause you problems. It is generally easier to have different /64s for different subnets.

Verify IPv6 connectivity within your network before you try reaching out. Can the client and host ping each other over IPv6. That must be working before you can route.

Some providers dedicate a /64 for routing between your server and their network. These connections may only support one address which should be allocated to your external interface. They should also provide a /48, /56, or /60 for your internal network needs.

EDIT: I reviewed your routing again and compared it to mine. I would suggest checking your ip -6 neigh output. In my case I have a IPv6 point-to-point link over a tunnel, and it doesn't show my external router. It appears you have an external adderess 2001:41d0:2:b353::/64 for External routing and 2001:41d0:2:b300::/56 for internal network. Try using 2001:41d0:2:b300::/64 for your routers internal network block and 2001:41d0:2:b301::/64 for your remote servers block. Try a configuration more like this.

Server: (sit0 - 2001:41d0:2:b300::2)

default dev eth0   metric 1024  mtu 1480 advmss 1420 hoplimit 0
2000::/3  dev eth0  metric 1024  mtu 1480 advmss 1420 hoplimit 0
2001:41d0:2:b301::/64  via 2001:41d0:2:b301::3 dev sit0  proto kernel  metric 256  mtu 1480 advmss 1420 hoplimit 0

Client: (sit1 - 2001:41d0:2:b301::3)

default dev sit1   metric 1024  mtu 1480 advmss 1420 hoplimit 0
2000::/3  dev via 2001:41d0:2:b3010::2sit1 metric 1024  mtu 1480 advmss 1420 hoplimit 0
link|improve this answer
Hi Bill; as I said in the post, the client and server can ping one another over IPv6 on their assigned addresses (also tested using ssh). The problem seems to be in the routing between the outside and the client and I wondered whether there was some additional forwarding setting that I needed to use? – Martin Eve Jan 21 at 15:02
Use your /56 on the internal network. I specified some possible address and routing configuration in my edit. – BillThor Jan 21 at 23:53
feedback
up vote 0 down vote accepted

Ok, the eventual answer was in the original link I had!

When you're doing this kind of routing, you have to specify "ip add neigh proxy [ip] eth0" bit.

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.