Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

We now have 2013 and I thought it is long overdue to activate IPv6 on my server. But unfortunately, I ran in some problems. To be honest I only have litte experience with IPv6 So I hope you can help me with my "small" problem.

A small remark: The following addresses are obfuscated, it is not what I've used in my configs ;)

I am running a Debian squeeze (Debian 2.6.32-46) and I got a /64 IPv6 block from my provider: 2a01:4f8:a0:aaaa::/64

So I changed the /etc/network/interfaces file as follows (which is also the way my provider recommends it):

# Loopback device:
auto lo
iface lo inet loopback

# device: eth0
auto  eth0
iface eth0 inet static
  address   85.10.xxx.zz
  broadcast 85.10.xxx.yy
  netmask   255.255.255.224
  gateway   85.10.xxx.1


iface eth0 inet6 static
  # Main IPv6 Address of the server
  address 2a01:4f8:a0:aaaa::2
  netmask 64
  gateway fe80::1


auto eth0:1
iface eth0:1 inet static
        address 85.10.xxxx.uu
        netmask 255.255.255.224

# default route to access subnet
up route add -net 85.10.xxx.0 netmask 255.255.255.224 gw 85.10.xxx.1 eth0

After a reboot (I am lazy and don't wanted to add everyhthing using route or ip) my eth0 interface looks like this:

eth0      < first line removed >  
          inet addr:85.10.xxx.zz  Bcast:85.10.xxx.yy  Mask:255.255.255.224
          inet6 addr: 2a01:4f8:a0:aaaa::2/64 Scope:Global
          inet6 addr: fe80::bbbb:cccc:dddd:eeee/64 Scope:Link <--- from MAC address
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:24133 errors:0 dropped:0 overruns:0 frame:0
          TX packets:21712 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:3464246 (3.3 MiB)  TX bytes:5776451 (5.5 MiB)
          Interrupt:25 Base address:0x2000 

and the routes ip -6 route look like this:

2a01:4f8:a0:aaaa::/64 dev eth0  metric 1024  mtu 1500 advmss 1440 hoplimit 4294967295
fe80::/64 dev eth0  proto kernel  metric 256  mtu 1500 advmss 1440 hoplimit 4294967295
fe80::/64 dev vboxnet0  proto kernel  metric 256  mtu 1500 advmss 1440 hoplimit 4294967295
default via fe80::1 dev eth0  metric 1024  mtu 1500 advmss 1440 hoplimit 4294967295

Now, my problem is that my IPv6 isn't working properly. If I try to ping an IPv6 address e.g. ping6 ipv6.google.com. I get: "Destination unreachable: Address unreachable"

Which looks like this in tcpdump -i eth0 ip6:

00:29:05.386500 IP6 2a01:4f8:a0:aaaa::2 > ff02::1:ff00:1: ICMP6, neighbor solicitation, who has fe80::1, length 32
00:29:05.390869 IP6 2a01:4f8:a0:bbbb::1 > 2a01:4f8:a0:aaaa::2: ICMP6, neighbor advertisement, tgt is fe80::1, length 32

2a01:4f8:a0:bbbb::1 is btw. listed as my gateway (at my provider's online admin console).

I think, the reason for all this is the missing NDP entry / the missing MAC address of fe80::1. Because ip -6 neigh gives me:

fe80::1 dev eth0  router FAILED 

I think so because if I do: ping6 -I eth0 fe80::1 I get a proper echo reply and the desired mac address for my fe80::1 address as well as a perfectly working IPv6 stack:

$ip -6 neigh
fe80::1 dev eth0 lladdr ll:mm:nn:oo:pp:qq router REACHABLE

Here is also again the dump from tcpdump -i eth0 ip6:

00:30:37.555702 IP6 fe80::bbbb:cccc:dddd:eeee > fe80::1: ICMP6, echo request, seq 1, length 64
00:30:37.560219 IP6 fe80::1 > fe80::bbbb:cccc:dddd:eeee: ICMP6, echo reply, seq 1, length 64

(again: fe80::bbbb:cccc:dddd:eeee is my link-local address, derived from the MAC address)

From this point on, I can use IPv6: I can ping6 websites, I can connect to services using IPv6 or even connect to my server via ssh using IPv6.

So, what am I doing wrong here? I've spend a lot of time trying to find out how to "fix" this. I bet it can be solved using two commands. This is by the way the first time I am dealing with IPv6 on a server. So please forgive me for my inexperience. Btw. I also tried to alter some sysctl net.ipv6.* flags, but without success. If it is necessary for the solution, I can also post my configuration here.

Every hint is more than welcome!

Thank you very much in advance!

share|improve this question

4 Answers 4

up vote 1 down vote accepted

I gave the whole problem another try today, a couple of weeks later. And what can I say, I fixed it. Can someone please explain me why adding a ipv6 loopback fixed my problem? Here is what I've added to my /etc/network/interfaces file:

iface lo inet6 loopback

I have no ideas why I've forgot to add it in the first place!^^ Thank you all for your responses!

share|improve this answer
    
Because Debian is crazy for not already having that in there? –  Michael Hampton Feb 23 '13 at 9:29
    
The file was provided by hetzner: "### Hetzner Online AG - installimage" But it is definitely my fault, not seeing it in the first place :D. –  dexstar Feb 23 '13 at 9:31
    
Bizarre things happen when the loopback interface isn't configured. We can add this to the list, I suppose... :) –  Michael Hampton Feb 23 '13 at 9:36

Try using one of the actual addresses of the router as the default gateway, instead of fe80::1.

share|improve this answer
    
Which would be the gateway's IP address: 2a01:4f8:a0:bbbb::1. I already tried that. Unfortunately, that does not work either. –  dexstar Feb 11 '13 at 0:40
    
You sure about that? That's on a different subnet than your IP address. –  Michael Hampton Feb 11 '13 at 0:44
    
You mean if I am sure about the address? I know what you mean, but that's what I've got from my provider. Just for fun I try the same network with ::1. Don't know why I haven't tried that yet. –  dexstar Feb 11 '13 at 0:49
    
UPDATE: 2a01:4f8:a0:aaaa::1 (same subnet) does not work either. –  dexstar Feb 11 '13 at 0:56
1  
Oh yes, if it's Hetzner all bets are off; they do so much strange stuff that your best bet is to have them sort it. –  Michael Hampton Feb 11 '13 at 2:11

I am looking at the bit of your question where you say:

Now, my problem is that my IPv6 isn't working properly. If I try to ping an IPv6 address e.g. ping6 ipv6.google.com. I get: "Destination unreachable: Address unreachable"

Which looks like this in tcpdump -i eth0 ip6:

00:29:05.386500 IP6 2a01:4f8:a0:aaaa::2 > ff02::1:ff00:1: ICMP6, neighbor solicitation, who has fe80::1, length 32 00:29:05.390869 IP6
2a01:4f8:a0:bbbb::1 > 2a01:4f8:a0:aaaa::2: ICMP6, neighbor advertisement, tgt is fe80::1, length 32

This is strange. Your system sends a correct (as far as I can see from your tcpdump) neighbor solicitation and the router sends back a correct (again AFAICT) neighbor advertisement. That would indicate a problem on your local machine.

Do you do any firewalling on that machine? ICMPv6 filtering is very different than ICMP filtering. Much more parts of IPv6 communication need properly working ICMPv6. If you filter too much or in the wrong way you get problems exactly like you are seeing now.

If you want to know more details please take a look at RFC 4890.

share|improve this answer
    
Thank you for your response. At the beginning I had no firewall running at all. Later on I activated ip6tables and inserted: -A INPUT -p ipv6-icmp -j ACCEPT. But neither of this approaches worked. There is no other firewall configured. Only shorewall which is for IPv4 only since shorewall6 deals with IPv6. And it does not really make sense at all, because it works like a charm after pining fe80::1. If I send a packet to fe80::1 with ping6 -I eth0 fe80::1 I see other packages in tcpdump i.e. a neighbor solicitation from my link local address and not the global one, as I mentioned before. –  dexstar Feb 11 '13 at 11:18
    
Using link-local for neighbor solicitation messages is perfectly fine and nothing to worry about. Something makes your machine ignore certain incoming ICMPv6 messages though... Might be a kernel bug, might be something else... –  Sander Steffann Feb 12 '13 at 14:20

your gateway for IPv6 should be in the same subnet

iface eth0 inet6 static
  # Main IPv6 Address of the server
  address 2a01:4f8:a0:aaaa::2
  netmask 64
  gateway fe80::1

something like 2a01:4f8:a0:aaaa::1 this is set in the router or VLAN configuration, please check what you have in your router. a sample:

interface GigabitEthernet0/0/1.201
 encapsulation dot1Q 201
 ipv6 address 2A00:7XXX:100::1/48
!
share|improve this answer
1  
This is not correct. While the gateway address is generally in the same subnet, this is not a requirement for IPv6. –  devicenull May 23 at 21:25

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.