2

I found out I had a leak in my VPN connection from test-ipv6.com, showing my VPN's IPv4 address but my home router's IPv6 address.

I setup my VPN connection using the .ovpn file below, which I downloaded from privateinternetaccess.com

client
dev tun
proto udp
remote ireland.privateinternetaccess.com 1197
resolv-retry infinite
nobind
persist-key
persist-tun
cipher aes-256-cbc
auth sha256
tls-client
remote-cert-tls server
auth-user-pass
comp-lzo
verb 1
reneg-sec 0
crl-verify crl.rsa.4096.pem
ca ca.rsa.4096.crt
disable-occ

How do I configure and/or what flags do I pass onto openvpn to enable IPv6 routing?

Improve this question

1 Answer 1

Reset to default
6

Currently, OpenVPN requires that you have IPv4 configured inside the tunnel, which you can add IPv6 to as dual stack. What you do outside the tunnel is up to you (1).

That being said, here is your answer: OpenVPN 2.3 (and most likely 2.4) will not work IPv6-only (2).

Furthermore (3), here are two device types supported by OpenVPN: tun and tap.

Tun devices receive raw IP packets and give them to a user space program. In the case of OpenVPN this program encrypts those packets and sends them on to the other end of the tunnel where they get decrypted and sent back to the tun device on that side. In other words a tun device behaves like a virtual Point-to-Point network connection.

Tap devices use raw ethernet frames instead of IP packets. A tap device is like a virtual ethernet card - any packet sent to it goes through the tunnel and back up the ethernet stack on the other side. So an OpenVPN connection using tap is like a virtual ethernet bus with exactly two ethernet cards connected - one on each side of the tunnel. The downside of using tap is that for each packet 14 more bytes (the ethernet header) are used up, the upside is that we can use any protocol over it without having to think about OpenVPN support for it.

The first article that describes IPv6 support in OpenVPN using tun. The second one uses tap:

  1. https://community.openvpn.net/openvpn/wiki/IPv6 (though IPv6 will not work with some mobile devices unless you are using 2.4+, see (4))

  2. http://silmor.de/ipv6.openvpn.php (note that since this article was written, OpenVPN has enabled transport over IPv6—we are now in version 2.2+)

Improve this answer
3
  • 1
    Very good, and enough detail to answer many questions in the future.
    – user396327
    Apr 17, 2017 at 4:18
  • i tried setting proto udp6 but i'm getting could not determine IPv4/IPv6 protocol does that mean my VPN provider does not support IPv6 routing?
    – jzeus
    Apr 17, 2017 at 7:22
  • 1
    Most VPN services do not support IPv6. I'd be surprised if you found one that does. In fact they tell you to disable IPv6 to avoid leaks.
    – Gaia
    Apr 17, 2017 at 15:08

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .