I have successfully turned an existing OpenVPN ipv4 tunnel into an ipv6 one with the following configuration files:


port 22062
proto tcp6
dev tun
ca /etc/openvpn/easy-rsa/keys/ca.crt
cert /etc/openvpn/easy-rsa/keys/server.crt
key /etc/openvpn/easy-rsa/keys/server.key
dh /etc/openvpn/easy-rsa/keys/dh2048.pem
topology subnet
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS"
push "dhcp-option DNS"
keepalive 5 60
cipher AES-256-CBC
user nobody
group nobody
status openvpn-status.log
log-append /var/log/openvpn.log
verb 3
resolv-retry infinite

server-ipv6 2001:db8:f00:bebe::/64
push "route-ipv6 ::/0"
push "route-metric 2000"
push "dhcp-option DNS6 2001:4860:4860::8888"
push "dhcp-option DNS6 2001:4860:4860::8844"


dev tun-ipv6
proto tcp
remote xxx.xxx.xxx.xxx 22062
resolv-retry infinite
ca ca.crt
cert client.crt
key client.key
--remote-cert-tls server
cipher AES-256-CBC
verb 3

But when the tunnel is active not all internet traffic connects.

I have noticed that ipleak.net shows that when tunnel is NOT active there is a fallback for ipv4 traffic (my local ISP uses ipv6), but when I turn on the tunnel I get the following information from ipleak.net:

  • IPv4 test not reachable. (timeout) [with tunnel NOT active it shows my local ipv4 address]
  • Fallback: Fail (error) [with tunnel NOT active it shows: Fallback: IPv4 (152 ms)]

I confess to being a little out of my depth here. Any ideas how to resolve this issue?

  • What does your route tables look like on the client when you aren't connected vs. when you are. What does a traceroute look like from your system to Google. – Zoredache Mar 28 at 7:39

Solved my own question: the main issue was resolved by reading this: https://community.openvpn.net/openvpn/wiki/IPv6

The public ipv6 address of the server was in the bottom half of 2001:db8:f00:bebe::/64 so changed the server line in server.conf to:

server-ipv6 2001:db8:f00:bebe:8000::/65

Also - to ensure that all internet traffic on ipv6 goes through OpenVPN server - added this line to server.conf:

push "redirect-gateway ipv6 def1 bypass-dhcp"

And deleted:

push "route-metric 2000"

that was optional and would take some ipv6 traffic outside OpenVPN server, if I understand well

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.