0

I have a vps with a /64 IPv6 prefix and I'm trying to use it to bring IPv6 connectivity to a host using openvpn.

I first used the layer-2 "tap" method, I created a permanent tap tunnel and configured radvd on that interface.

The client could obtain an ipv6 address, and packets arrived at the server, but I didn't configure routing or something else correctly I think, so on the server's eth0 interface I would see

2a01:7f00::f03c:91ff:fedb:6541 > ff02::1:ff86:a71: ICMP6, neighbor solicitation, who has 2a01:7f00::2daa:ad77:2286:a71, length 32

I decided to try with tun.

This is my conf (with a minor edit to the ipv6 prefix)

dev tun0
tun-ipv6
server-ipv6 2a01:7f00::/112
server 10.0.0.0 255.255.255.0
push "route-ipv6 2a01:7f00::/64"
comp-lzo
status openvpn-status.log
log-append /var/log/openvpn.log
verb 3 
tls-server
ca /etc/openvpn/keys/ca.crt
cert /etc/openvpn/keys/server.crt
key /etc/openvpn/keys/server.key
dh /etc/openvpn/keys/dh2048.pem

the client obtains an IPv6 address, but you can see that something is wrong:

2a01:7f00::1000/64

it obtains a /64 address when I wanted a /112 subnet. And when I try "ping6 google.com" I obtain "Network is unreachable"

I'm new to IPv6, what I'm doing wrong? All of the examples I see are with a server having a /48 prefix, and delegating a /64 prefix to the client.

1 Answer 1

2

Part of IPv6 is that you aren't supposed to subnet with prefixes any larger than 64 bits. This is in part because mechanisms like SLAAC and privacy extensions generate the lower 64 bits of the address.

According to RFC 4862 section 5.5.3, autoconfiguration should have failed, so you may have hit a bug (unsurprisingly, as you're doing stuff that you oughtn't). However, either way, this is not a configuration which would reasonably be expected to work.

The common interpretation of RFC 2373 section 2.4 is that prefix lengths longer than 64 bits are basically forbidden for non-multicast addresses, though it says this in a complex way.

4
  • Thanks. So, the bottom line is that with a /64 prefix I'm not going anywhere. I really need to find a server with a /48 prefix, right?
    – user193565
    Oct 14, 2013 at 10:33
  • It would really depend on what you're trying to do. Hurricane (tunnelbroker.net) is still offering /48s free of charge in a similar schema to what you are using. That's if you need to subnet at all; you may not need to. But, if you want to, you do indeed need a shorter prefix. Oct 14, 2013 at 10:36
  • My problem is that I don't know the public ip addresses of the network my host will be part of, nor I do know if the tunneling mechanism used by tunnelbroker will be allowed in the network. SixXs rejected me because they think my home address is invalid. Are there any other tunnel brokers/hosting providers that assign a /48 prefix?
    – user193565
    Oct 14, 2013 at 10:59
  • I don't know of any besides HE, though as long as your address isn't an RFC1918 one, it should be accepted by them. If it is, you don't have many options besides perhaps teredo. Oct 14, 2013 at 11:01

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .