I have a network with two IPv6 subnets: one is a native connectivity and one is a Hurricane Electric 6in4 tunnel. When clients initiate a connection towards the Internet, they usually choose a source address by the „use longest matching prefix” rule, which (as I observed) most often results in using the native address, not the HE tunnel. This is actually great. But I'd prefer specific sites to be accessed through the HE tunnel, even if that contradicts the „use longest matching prefix” rule.

Now I wonder whether it's possible to force a preference on the router/firewall. I thought it might be possible to send an ICMP to the client that it should retry the connection with a different prefix.

What I tried so far: block access through the non-preferred route in hope the client falls back to use another address. It doesn't work; the client gives up connection altogether.

The rules I tried on my OpenWRT router (ipv6-test.com is just an example):

ip6tables -I FORWARD 1 -o pppoe-wan -d ipv6-test.com -j REJECT --reject-with icmp6-addr-unreachable

So if the client picks a source address that would be routed through the native connection (pppoe-wan), reject it. I tried all --reject-with options possible. So I want my client (e.g. Firefox) to not give up on this failure, but to try the connection with one of its HE tunnel addresses, which would be routed through the 6in4-wan6henet interface instead of pppoe-wan. Not sure if an ICMPv6 message exists that results in this behaviour. The tunnel address would work, as if I specify the source address explicitly (e.g. --interface argument for curl), the connection is not blocked by the firewall (which is expected).

Maybe ICMP redirects could be used for this purpose? If so, how?

Storytime: the reason why I still have to use a HE tunnel besides my native IPv6 connection is very sad. Although my ISP gives me an IPv6 connection, it is not static. Instead it's dynamic, so I get a different IPv6 prefix each time my ISP forces me to reconnect. Using dyndns for IPv6 for all the various hosts on the network would be a pain in the ass, so I have to use my static HE tunnel prefix for anything serious. Being my native connection dynamic, it's basically only good for casual Internet browsing. Besides, the two connections provide a fallback for each other, so when my native connection fails, I still have IPv6 connectivity through the HE tunnel (it comes handy, knowing my ISP doesn't respond appropriately to IPv6 support requests, as they usually don't care).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.