I've a new (dev) vServer up and running. Unfortunately the provider only hands out single IPv6 addresses (not even /64 subnets). Now I am a bit confused how to achieve the following: I want to use those addresses (which are all from totally different prefixes/subnets) as an address pool for the road warriors of an IPSEC (Strongswan 5.1.3) tunnel.

Right now (no slapping please :P) I am simply doing masquerading, meaning: All road warriors get a "private" IPv6 address. This works to a certain extend but since the address is not global, most programs won't prefer IPv6 over IPv4 (e.g. Firefox). Besides, I would rather have road warriors get a real public IPv6 address for obvious reasons.

So, my problem is: How do I do it? Configuring those single IPv6 addresses on the server interface and also handing them out to the road warriors sounds very wrong since basically two interfaces will have the same IP address. Is it possible at all... and if yes, how?

I would appreciate any help... also pointers to some good and relevant documentation would be of great service. And naturally, hands down practical tips and hints are always welcome.

Some background: The server is Linux based w/ kernel 3.14.x. Road warriors also use Linux exclusively. I am most definitely not afraid of using iproute2 and whatnot. :-)

  • 1
    Have you considered going sane and firing the provider? YOU have a case in them violating IPV6 allocation guidelines which is very clear what network sizes are to be allocated. IIRC you should get a lot more than a /64 upon request (without even a justification) and it is generally not worth playing around the idiotic policies of a business partner in something where it takes an hour to sign up with another partner. – TomTom Jun 15 '14 at 12:58
  • 3
    Many VPS providers do this completely wrong (like the one you have now). It will take you a bit of shopping to find a good one, that provides at least a /64, but you really should. This setup is unmaintainable. – Michael Hampton Jun 15 '14 at 13:01
  • @MichaelHampton I would say each VPS should be getting a routed prefix, but how long should it be? I know of the guideline suggesting a /48 per site, but a VPS is not a site. I don't know if it is really going to make any difference whether a VPS get a /48 or a /60. But I don't think anything smaller than a /60 could be justified. – kasperd Jun 15 '14 at 15:05
  • I absolutely agree that anything smaller than /64 is not acceptable for obvious reasons. In this case, it is a dev machine and the provider will eventually provide /64 subnets once some technical hurdles are taken on their side. In the meantime, though, I really would like to get a solution rolling that does not involve masquerading and actually assigns public IPv6 addresses to the road warriors. The choice for this VPS was very much strategic. A different machine with a different provider gets proper /64 subnets. – khaos Jun 15 '14 at 15:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.