I'm trying to set up multiple Apache SSL vhosts, each on a different IPv6 address.
My CentOS7 VPS has a routed /64 IPv6 block assigned to it, let's say
2001:db8:acac:acac::/64, and I can already see packets coming in (
tcpdump -nn -i eth0 'ip6 and src or dst net 2001:db8:acac:acac::/64' shows the packets fine).
I am aware I can assign as many individual addresses as I like to eth0 (
ip -6 addr add 2001:db8:acac:acac::1234 dev eth0), but I want to get the interface allow apps to bind to any of the 2^64 addresses.
Following advice (see links at bottom), I added a rule (
ip -6 rule add from 2001:db8:acac:acac::/64 iif eth0 lookup 200) and a route (
ip route add local 2001:db8:acac:acac::/64 dev lo table 200) and now I can
ping6 any IP address in the /64 block, and I can connect to services listening on wildcard (e.g.
:::22 for ssh) using any address in the /64 block.
The question is: how can I make a program bind to a single address in the /64 block? As no interface owns any of the addresses in the block, I see the following in the apache logs:
... AH00072: make_sock: could not bind to address [2001:db8:acac:acac::1234]:443
I have seen mentions of
IP_TRANSPARENT as a possible solution, but cannot find this mentioned in Apache source, only in
bits/in.h, included by
Has anyone got this to work, either for Apache or for other apps (in particular: dovecot, postfix, bind)?
Relevant articles read before posting this question:
- Serverfault: Can I bind a (large) block of addresses to an interface?
- git.kernel.org: Implementing Any-IP support for IPv6