I have a dedicated server that has been assigned a /48 IPv6 address block. That server is running several Linux guests with macvtap networking. I want each guest to have a /64 block, but I can't seem to pin down the right configuration. I can assign the whole /48 to a guest and it works fine, but anything else and I get various results (all ping responses are lost on their way to the server, or simply a connect: Network is unreachable error when I try to run ping6).

My service provider has given me the usable address (2604:XXXX:XX14::2/48) and a gateway address (2604:XXXX:XX14::1). They seem to be using a Hurricane Electric tunnel to provide the IPv6 service, if that changes anything.

  • Why do you need to assign more that one IPv6 address to a guest? IPv6 delegation gives you a prefix smaller than the standard network /64. Many business-grade routers can then automatically assign individual /64 networks from the smaller prefix. You can use these for separate router interfaces. With a /48 delegation, you can create 65,536 different /64 networks, and each network can have 18,446,744,073,709,551,616 hosts per /64 network.
    – Ron Maupin
    Feb 25 '18 at 2:48
  • Some routers have issues with "nested subnets", even with IPv6 (but especially so with IPv4). The HE system is very complete, but if they are truly using a 6to4 tunnel, that has quite a few limitations. Some information about this provider and your instance and whether they're using a 6to4 tunnel would help this question quite a bit.
    – Spooler
    Feb 25 '18 at 3:46
  • I did a traceroute from my local network (running a HE 6to4 tunnel) to the /48, and all the hosts along the way resolved to some.thing.he.net. The traceroute died out in the datacenter's network but before hitting the gateway IP I was given. Feb 25 '18 at 4:12
  • 2
    You're approaching this from the wrong direction. Instead of assigning to hosts, you generally should assign subnets to each virtual network. Feb 25 '18 at 4:19
  • 2
    Why use macvtap instead of routing normally, then? Feb 25 '18 at 20:40

Your upstream provider has gone outside the normal v6 addressing scheme, each while they assigned you a 48 your network connection should be a 64 and a route added for the 48 to your v6/64 address, others may use a /126 for P2P links.

Then each container you add with a /64 address will be locally connected and routed. You can also request that they accept route advertisements (RA) or setup a bgp peer and use exabgp, gobgp, frr, etc to establish the routes.

With IPv6 you assign subnets, which many of us a are lazy and don't do with v4 (although you can route a v4/32 same as a v6/64

Macvtap is not a dumb switch, it's a pass through port and won't work the way you've attempted.

  • If the provider had in fact configured the /48 as a link prefix, then that would indeed be a bad configuration. But it's not clear from the provided information that that is actually what the provider did.
    – kasperd
    Feb 25 '18 at 18:18
  • Agreed there's a lot of missing details, but if it works when he assigns an address in the same /48 I made the assumption. Feb 25 '18 at 18:20
  • I'll try to clarify a little: Given an address 2604:XXXX:XX14::2/48, if I configure a guest's /etc/network/interfaces to use that address, I can ping it as 2604:XXXX:XX14::2. If I configure a guest with any address except 2604:XXXX:XX14::2 (such as 2604:XXXX:XX14:abcd::2) it doesn't work (and the guest decides there is no IPv6 connection at all). Feb 25 '18 at 20:22
  • Are you still using /48 masks for both? Feb 25 '18 at 20:49
  • Yes, I am. It's the only way it works at all. Feb 26 '18 at 6:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.