Solved IPv6 routing issue between (client) utun0, (server) tun0 and re0

B

bw1faeh0

Hello,

I have a problem with my FreeBSD 10.1 server, that acts as OpenVPN gateway. It should act as ipv4 and ipv6 gateway for my clients. IPv4 is working very well, but since my clients have a native ipv6 connection, I need ipv6 working on my OpenVPN gateway, too.

So I configured ipv6 on my server itself:
I have got a ipv6 address from my hosting with an /64 subnet:
Code: 
2a01:xxxx:xxxx:xxxx::2/64
My Ethernet interface (re0) has the address
Code: 
2a01:xxxx:xxxx:xxxx::2:1

The ipv6 connection on my server itself works without problems. ifconfig re0 looks like this:
Code: 
re0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
options=8209b<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,VLAN_HWCSUM,WOL_MAGIC,LINKSTATE>
ether 00:1d:92:eb:82:7f
inet xx.xx.xx.xx netmask 0xffffffe0 broadcast xx.xx.xx.xx
inet6 fe80::xxx:xxxx:xxxx:xxxx%re0 prefixlen 64 scopeid 0x1
inet6 2a01:xxxx:xxxx:xxxx::2:[B][I]1[/I][/B] prefixlen 64
nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>
media: Ethernet autoselect (1000baseT <full-duplex>)
status: active
IPv6 traffic goes in and out :D

After that I added to my OpenVPN server config this lines:
(Is this enough??)
Code: 
server-ipv6 2a01:xxxx:xxxx:xxxx::2:[B][I]1[/I][/B]/64
push "route-ipv6 2000::/3"
I read, that the last line causes, that all the traffic from my client is transmitted through the VPN connection.

ifconfig tun0 looks like this:
Code: 
tun0: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> metric 0 mtu 1500
options=80000<LINKSTATE>
inet6 fe80::xxxx:xxxx:xxxx:xxxx%tun0 prefixlen 64 scopeid 0x3
inet 10.8.0.1 --> 10.8.0.1 netmask 0xffffff00
inet6 2a01:xxxx:xxxx:xxxx::2:[B][I]3[/I][/B] prefixlen 64
nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>
Opened by PID 1862
After connecting my client to the server, the ifconfig [I][B]utun0[/B][/I] on my client looks like this:
Code: 
utun0: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> mtu 1500
inet 10.8.0.2 --> 10.8.0.2 netmask 0xffffff00
inet6 fe80::xxxx:xxxx:xxxx:xxxx%utun0 prefixlen 64 scopeid 0xb
inet6 2a01:xxxx:xxxx:xxxx::2:[B][I]1002[/I][/B] prefixlen 64
nd6 options=1<PERFORMNUD>
ipv4 is working without problems:
Code: 
PING google.de (xx.xx.xx.xx): 56 data bytes
64 bytes from xx.xx.xx.xx: icmp_seq=0 ttl=55 time=34.544 ms
64 bytes from xx.xx.xx.xx: icmp_seq=1 ttl=55 time=35.291 ms
64 bytes from xx.xx.xx.xx: icmp_seq=2 ttl=55 time=34.134 ms
64 bytes from xx.xx.xx.xx: icmp_seq=3 ttl=55 time=34.082 ms
But, ipv6 is making trouble:
Code: 
ping6 google.de
PING6(56=40+8+8 bytes) 2a01:xxxx:xxxx:xxxx::2:[B][I]1002[/I][/B] --> 2a00:1450:4001:804::1018
^C
--- google.de ping6 statistics ---
8 packets transmitted, 0 packets received, 100.0% packet loss
So, I tried to ping my tun0 address on my server:
Code: 
ping6 2a01:xxxx:xxxx:xxxx::2:[B][I]3[/I][/B]                                                                                                                        
PING6(56=40+8+8 bytes) 2a01:xxxx:xxxx:xxxx::2:[B][I]1002[/I][/B] --> 2a01:xxxx:xxxx:xxxx::2:[B][I]3[/I][/B]
^C
--- 2a01:xxxx:xxxx:xxxx::2:[B][I]3[/I][/B] ping6 statistics ---
4 packets transmitted, 0 packets received, 100.0% packet loss
But I've got the same problem :(

So, I think I forgot one main switch, or something like this. Perhaps I have to add a static route? But I don't know whether on the server side or on the client side?

The ipv6 configuration in my rc.conf looks like this:
Code: 
ipv6_enable="YES"
ipv6_default_interface="re0"
ifconfig_re0_ipv6="2a01:xxxx:xxxx:xxxx::2:[B][I]1[/I][/B]/64"
ipv6_defaultrouter="fe80::1%re0"

gateway_enable="YES" # enables the gateway
ipv6_gateway_enable="YES" # enables ipv6 gateway
Does anybody has an idea, what I have forgotten?

Cheers, Christian
 
Don't assign the same subnet to multiple interfaces. Typically you can get additional prefixes like a /60, /56, or /48 that can be subdivided into multiple /64's for each internal interface. If you use 2a01:xxxx:xxxx:xxxx::2:1/64 on the re0 then use a different /64 like 2a01:xxxx:xxxx:xxxx::3:1/64 on tun0. With that, push the tun0 address as the IPv6 gateway to your VPN clients and you should be good to go.
 
junovitch said:
Don't assign the same subnet to multiple interfaces.
Click to expand...
Thanks for that hint!
junovitch said:
Typically you can get additional prefixes like a /60, /56, or /48 that can be subdivided into multiple /64's for each internal interface.
Click to expand...
Unfortunately the hosting service asks for more money to get an additional routable ip with subnet :(

On https://community.openvpn.net/openvpn/wiki/IPv6 the author is talking of splitting the subnet. Sadly it isn't as detailed, as it should be for me.

Their subnet is
Code: 
2001:db8:0:123::/64
Translated to me, I'm talking of
Code: 
2a01:xxxx:xxxx:xxxx::2/64
They are changing their subnet like this:
ifconfig igb0 inet6 2001:db8:0:123::/64 -alias
ifconfig igb0 inet6 2001:db8:0:123::/65

I assume, that igb0 is their ethernet interface. I would translate these two lines as follows:
ifconfig re0 inet6 2a01:xxxx:xxxx:xxxx::2/64 -alias
ifconfig re0 inet6 2a01:xxxx:xxxx:xxxx::2/65

First problem: ifconfig re0 2a01:xxxx:xxxx:xxxx::2/64 generates this output:
Code: 
ifconfig: 2a01:xxxx:xxxx:xxxx::2/64: bad value (width too large)
Why?

If I take a look at ifconfig(8) the first line removes the /64 subnet from my ethernet device, the second line adds the new /65 subnet, isn't it?

In the second part, they describe adding a new alias to their ethernet device:
ifconfig igb0 inet6 2001:db8:0:123::dead/128 alias
ifconfig igb0 inet6 2001:db8:0:123::ea:beef/128 alias
I think, I don't need this in my situation. Is this right?

At the end, they are adding
Code: 
server-ipv6 2001:db8:0:123:8000::/65
to their OpenVPN server configuration.

I think they are using :8000 to get in the upper half of the original /64 subnet. :7FFF is the last address in the lower /65 that "belongs" to the ethernet device, :8000 is the first address of my new tun0 device. Right/Wrong?

So, translated to my machine I should change my
Code: 
server-ipv6 2a01:xxxx:xxxx:xxxx::2:1/64
to
Code: 
server-ipv6 2a01:xxxx:xxxx:xxxx::2:8000/65
One last question:

I don't want to run
ifconfig igb0 inet6 2001:db8:0:123::/64 -alias
ifconfig igb0 inet6 2001:db8:0:123::/65
after every reboot, so I have to change my /etc/rc.conf like this:
Code: 
ipv6_enable="YES"
ipv6_default_interface="re0"
ifconfig_re0_ipv6="2a01:xxxx:xxxx:xxxx::2:1/65"
ipv6_defaultrouter="fe80::1%re0"
Is this enough?
 
So with a /64 the break on the subnet would be right on the colon.
Code: 
x:x:x:xxxxxxxxxxxxxxxx:xxxxxxxxxxxxxxxx:x:x:x
1:1:1:111111111111111:000000000000000:0:0:0

With a /65 the break on the subnet would be one digit past the colon. This is where the 0-7ffff and 8000-ffff in the fifth field comes into play.
Code: 
x:x:x:xxxxxxxxxxxxxxxx:xxxxxxxxxxxxxxxx:x:x:x
1:1:1:111111111111111:100000000000000:0:0:0

Therefore with a /65, the correct addresses would be 2a01:x:x:x:x:x:x:1/65 on one interface and 2a01:x:x:x:8000:x:x:1/65 on the other interface. However, as the link for OpenVPN using /65 shows, this effects all kinds of stuff that expects /64 to be the prefix length.
 
The last answer didn't helped me, but nevertheless I mark this thread as solved, because the main problem was pointed out.

I will start a new thread to get help in splitting my ipv6 network, perhaps a better topic attracts more views :)
 
What I was trying to explain is you were putting the subnet splits in the wrong spots. This is what I would expect to see.

openvpn.conf
Code: 
server-ipv6 2a01:xxxx:xxxx:xxxx:8000::1/65
rc.conf
Code: 
ifconfig_re0_ipv6="2a01:xxxx:xxxx:xxxx::1/65"
 
Unfortunately OpenVPN only accepts /64 or /112 subnets. But got it working this way:

rc.conf
Code: 
ifconfig_re0_ipv6="2a01:xxxx:xxxx:xxxx::2:128"
and
openvpn.conf
Code: 
server-ipv6 2a01:xxxx:xxxx:xxxx::2/64
 
Interesting stuff. I'm glad it works and hope you don't run into any issues. It's worth closing out this thread with a quote from the OpenVPN wiki that you linked as a word of warning for anybody searching the forums.

Otherwise, there is a way out. Typically /64 IPv6 netblocks are assigned, leaving a large address space. For an OpenVPN setup, this address space can be broken in 2, /65-prefix parts, the first being assigned to the physical network interface, and the second to the VPN. Warning operating netblocks smaller than /64 might break some network features.

Avoid this setup if you are using any of:

  • SLAAC. If you are using SLAAC and have no way around, ask your ISP for permission to use static address assignment on your VPN server.
  • IPv6 Multicast - RFC3306
  • Cryptographically Generated Address - CGA - RFC3972
  • NAT64 - RFC6052
  • IPv6-to-IPv6 Network Prefix Translation - NPTv6 - RFC6296
  • Identifier-Locator Network Protocol - ILNP - RFC6741
  • Multihoming Shim Protocol for IPv6 - shim6 - RFC5533
Click to expand...
https://community.openvpn.net/openvpn/wiki/IPv6
 
You must log in or register to reply here.
Back
Top