I've been trying to figure out if its possible to setup a Hurricane Electric IPv6 tunnel to be configured on a CentOS VPS server, but not make it the default gateway for all IPv6 traffic, but also to be able to utilise the /64 subnet delegated via the tunnel.
Using the CentOS 7 example with a few modifications in this guide (Its a Linode VPS):
https://www.linode.com/docs/networking/set-up-an-ipv6-tunnel-on-your-linode
The reason for the tunnel to not be the default gateway is I have native IPv6 via SLAAC and a delegated /64 already, but was hoping to add the IPv6 tunnel as a bit of a failover scenario/additional IPv6 network route to services running on this server.
All configurations I have seen in regards to setting up a "he-ipv6" interface, basically take over the default gateway, which makes my native IPv6 address space no longer pingable to the WAN side, but connectivity like ping and traceroute still works within the server on both interfaces, tested by specifying the specific interface on tests.
traceroute -6 -i eth0 ipv6.google.com
traceroute to ipv6.google.com (2a00:1450:400b:801::200e), 30 hops max, 80 byte packets
1 2a01:7e00::xxxx:xxxx:xxxx:xxxx (2a01:7e00::8678:acff:fe5a:1a41) 0.919 ms 1.358 ms 1.425 ms
2 2a01:7e00:7777:6::1 (2a01:7e00:7777:6::1) 0.832 ms 2a01:7e00:7777:1::1 (2a01:7e00:7777:1::1) 0.893 ms 2a01:7e00:7777:3::1 (2a01:7e00:7777:3::1) 2.858 ms
3 2001:7f8:4::3b41:1 (2001:7f8:4::3b41:1) 1.489 ms 1.489 ms 1.470 ms
4 2001:4860:0:1102::2 (2001:4860:0:1102::2) 1.768 ms 2001:4860:0:1103::3 (2001:4860:0:1103::3) 2.129 ms 2.306 ms
5 2607:f8b0:e000:8000::6 (2607:f8b0:e000:8000::6) 11.461 ms 2001:4860::c:4000:dd7a (2001:4860::c:4000:dd7a) 30.924 ms 30.940 ms
6 2001:4860::1:0:b04f (2001:4860::1:0:b04f) 12.182 ms 14.449 ms 13.446 ms
7 2001:4860:0:1::1223 (2001:4860:0:1::1223) 10.631 ms 10.818 ms 11.042 ms
8 dub08s01-in-x0e.1e100.net (2a00:1450:400b:801::200e) 11.695 ms 12.338 ms 11.674 ms
traceroute -6 -i he-ipv6 ipv6.google.com
traceroute to ipv6.google.com (2a00:1450:400b:c00::8b), 30 hops max, 80 byte pac kets
1 jamesnetworks-3.tunnel.tserv1.lon2.ipv6.he.net (2001:470:1f1c:xxx::1) 5.321 ms 8.443 ms 11.440 ms
2 ge3-20.core1.lon2.he.net (2001:470:0:320::1) 11.657 ms 11.635 ms 11.610 m s
3 2001:7f8:4::3b41:1 (2001:7f8:4::3b41:1) 12.799 ms 12.776 ms 12.745 ms
4 2001:4860:0:1::2484 (2001:4860:0:1::2484) 12.380 ms 2001:4860:0:1103::3 (20 01:4860:0:1103::3) 13.500 ms 2001:4860:0:1103::2 (2001:4860:0:1103::2) 12.769 ms
5 2001:4860::c:4000:dd7a (2001:4860::c:4000:dd7a) 12.871 ms 2607:f8b0:e000:80 00::6 (2607:f8b0:e000:8000::6) 22.566 ms 2001:4860::c:4000:dd7a (2001:4860::c:4 000:dd7a) 13.663 ms
6 2001:4860::1:0:af90 (2001:4860::1:0:af90) 20.897 ms 11.010 ms 12.375 ms
7 2001:4860::2:0:b051 (2001:4860::2:0:b051) 12.114 ms 22.411 ms 11.200 ms
8 * * *
9 * * *
10 * * *
11 * * *
12 * * *
13 * * *
14 * * *
15 * * *
16 * * *
17 * * *
18 dg-in-x8b.1e100.net (2a00:1450:400b:c00::8b) 11.499 ms 11.035 ms 11.800 ms
I've set up the tunnel and confirm it works, but my two /64 IPv6 address spaces don't work when both enabled. I'm looking for further guidance on what routing config I need to have to get this to work, possibly slightly outside the scope covered in the docs above.
The default gateway on the eth0
device it setup as:
default via fe80::1 dev eth0 proto ra metric 1024 expires 1796sec
When enabling the he-ipv6
interface, this is added in addition to the above:
default via 2001:470:1fxx:xx::1 dev he-ipv6 metric 1
The metric being higher, all traffic then tries to go through the he-ipv6
interface, which is not what I want. Equally, having two "default" routes seems like a bad idea.
What I'm trying to do is keep the native IPv6 connectivity working, while having the he-ipv6 active and available for traffic to be routed to the configured IPv6 addresses in my routed /64 via the tunnel, in addition to the existing /64 from Linode.
I believe I'll need to potentially do some static routing here, but unsure of how to tackle it.
So far, with being able to control the metric properly as per the guidance below, this is what the IPv6 routing table looks like:
unreachable ::/96 dev lo metric 1024 error -113
unreachable ::ffff:0.0.0.0/96 dev lo metric 1024 error -113
# Additional route added by he-ipv6
2001:470:1f1c:xxx::/64 dev he-ipv6 proto kernel metric 256
# Adding any IPv6 in the HE routed /64 to eth0 adds the route below
2001:470:1f1d:xxx::/64 dev eth0 proto kernel metric 256
unreachable 2002:a00::/24 dev lo metric 1024 error -113
unreachable 2002:7f00::/24 dev lo metric 1024 error -113
unreachable 2002:a9fe::/32 dev lo metric 1024 error -113
unreachable 2002:ac10::/28 dev lo metric 1024 error -113
unreachable 2002:c0a8::/32 dev lo metric 1024 error -113
unreachable 2002:e000::/19 dev lo metric 1024 error -113
# Linode SLAAC IPv6
2a01:7e00::/64 dev eth0 proto kernel metric 256 expires 14395sec
2a01:7e00:xxxx:xxx::/64 dev eth0 proto kernel metric 256
unreachable 3ffe:ffff::/32 dev lo metric 1024 error -113
# Having fe80::/64 for both interfaces seems wrong?
fe80::/64 dev eth0 proto kernel metric 256
fe80::/64 dev he-ipv6 proto kernel metric 256
# eth0 (Linode IPv4/IPv6)
default via fe80::1 dev eth0 proto ra metric 1024 expires 1795sec hoplimit 64
# he-ipv6
default via 2001:470:1f1c:xxx::1 dev he-ipv6 metric 1025
The two references for fe80::/64
don't seem right here, I don't think the he-ipv6 would need this set in this case and I possibly need additional static routes to allow the routed /64 addresses to be externally accessible.
Any advice or solutions would be appreciated on getting this working!
fe80::/10
network is the link-local network for all interfaces in IPv6. You should not have a route for the link-local network. Yo use link-local addressing, you must use it with a scope identifier, e.g.fe80::1%eth0
.IPV6_DEFAULTGW
withfe80::1%eth0
on eth0, that then adds the default with a metric of 1, which is fine, but then I still can't get any ping response externally from any HE address in my router /64. The issue is having the connectivity from both /64 subnets at the same time.