How to properly set up an IPv6 gateway?

jonfr · May 3, 2013

I am trying to set up an IPv6 gateway on FreeBSD. I got radvd to work properly, since it handles the IPv6 address properly from the look of it.

I can only ping IPv6 computers from the FreeBSD computer. But not from other computers on my network.

Code:

root@saturn:/usr/home/jonfr # ping6 -c 4 google.com
PING6(56=40+8+8 bytes) 2001:16d8:dd00:1a1::2 --> 2a00:1450:4001:c02::8b
16 bytes from 2a00:1450:4001:c02::8b, icmp_seq=0 hlim=56 time=41.435 ms
16 bytes from 2a00:1450:4001:c02::8b, icmp_seq=1 hlim=56 time=41.415 ms
16 bytes from 2a00:1450:4001:c02::8b, icmp_seq=2 hlim=56 time=41.170 ms
16 bytes from 2a00:1450:4001:c02::8b, icmp_seq=3 hlim=56 time=41.390 ms

--- google.com ping6 statistics ---
4 packets transmitted, 4 packets received, 0.0% packet loss
round-trip min/avg/max/std-dev = 41.170/41.352/41.435/0.107 ms

From my Gentoo Linux computer.

Code:

ping6 -c 4 google.com
PING google.com(fa-in-x8b.1e100.net) 56 data bytes

--- google.com ping statistics ---
4 packets transmitted, 0 received, 100% packet loss, time 2999ms

Here is the ifconfig output on the FreeBSD server computer.

Code:

ifconfig -a 
vr0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
        options=82808<VLAN_MTU,WOL_UCAST,WOL_MAGIC,LINKSTATE>
        ether 00:11:09:ef:20:ea
        inet 192.168.1.1 netmask 0xffffff00 broadcast 192.168.1.255
        inet6 fe80::211:9ff:feef:20ea%vr0 prefixlen 64 scopeid 0x6 
        inet6 2001:16d8:dd00:df::1 prefixlen 64 
        nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>
        media: Ethernet autoselect (100baseTX <full-duplex>)
        status: active
plip0: flags=8810<POINTOPOINT,SIMPLEX,MULTICAST> metric 0 mtu 1500
        nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>
lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> metric 0 mtu 16384
        options=600003<RXCSUM,TXCSUM,RXCSUM_IPV6,TXCSUM_IPV6>
        inet6 ::1 prefixlen 128 
        inet6 fe80::1%lo0 prefixlen 64 scopeid 0x8 
        inet 127.0.0.1 netmask 0xff000000 
        nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>
gif0: flags=8011<UP,POINTOPOINT,MULTICAST> metric 0 mtu 1280
        inet6 fe80::211:9ff:feef:20ea%gif0 prefixlen 64 scopeid 0x9 
        nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>
        options=1<ACCEPT_REV_ETHIP_VER>
tun0: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> metric 0 mtu 1280
        options=80000<LINKSTATE>
        inet6 fe80::211:9ff:feef:20ea%tun0 prefixlen 64 scopeid 0xa 
        inet6 fe80::14d8:dd00:1a1:2%tun0 prefixlen 64 scopeid 0xa 
        inet6 2001:16d8:dd00:1a1::2 --> 2001:16d8:dd00:1a1::1 prefixlen 128 
        nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>
        Opened by PID 1311

Here is my current configuration for IPv6 in rc.conf. I do think the problem is there. But I am not sure how routing works in FreeBSD, I have been trying to find information about this on the internet and on the FreeBSD web site. But I have not had any luck with finding useful information that I can make sense of. I did read the FreeBSD documentation on this, but it did not work for some reason.

My current IPv6 part of rc.conf

Code:

ipv6_gateway_enable="YES"
ipv6_enable="YES"
ipv6_defaultrouter="2001:16d8:dd00:81a1::1"
ipv6_ifconfig_vr0="2001:16d8:dd00:df::1/64"

[...]

sixxs_aiccu_enable="YES"
gif_interfaces="gif0"
gifconfig_gif0="UP"
radvd_enable="yes"

I just need to know what is wrong so I can fix it. A config sample that is working would be a good way to do so. It seems that radvd is working without any issue, along with sixxs-aiccu.

Thanks for the help.

SirDice · May 3, 2013

How is rtadvd(8) configured? What addresses and gateway are assigned to the clients?

The gif(4) interface doesn't look like it's being used. The tunnel is set up using tun(4).

kpa · May 3, 2013

Leave out ipv6_defaultrouter, net/sixxs-aiccu should take care of setting it correctly.

jonfr · May 3, 2013

SirDice said:
How is rtadvd(8) configured? What addresses and gateway are assigned to the clients?

The gif(4) interface doesn't look like it's being used. The tunnel is set up using tun(4).

I did not find rtadvd, so I am using radvd. I have used that before.

Here is the config file from radvd.conf.

Code:

interface vr0
{
#        (Send advertisement messages to other hosts)
        AdvSendAdvert on;
#        (Fragmentation is bad(tm))
        AdvLinkMTU 1280;
        MaxRtrAdvInterval 300;
#        (IPv6 subnet prefix we've been assigned by our PoP)
        prefix 2001:16d8:dd00:81a1::/64
        {
                AdvOnLink on;
                AdvAutonomous on;

        };
};

I have also updated the config files to use tun0, rather then gif0. I do not know if it works, but I can test it anyway.

SirDice · May 3, 2013

It works just fine here with rtadvd(8) (it's part of the base OS).

My /etc/rtadvd.conf looks like this:

Code:

re0:\
        :addr="2001:zzzz:yyyy:bcd::":prefixlen#64:\
        :rdnss="2001:zzzz:yyyy:bcd::1":\
        :dnssl="dicelan.home":

The re0 interface has a static address 2001:zzzz:yyyy:bcd::1.

kpa · May 3, 2013

Are you going to SLAAC or DHCPv6 for configuring the LAN hosts?

With SLAAC it would be a matter of specifying the correct interface in rc.conf(5)

Code:

rtadvd_enable="YES"
rtadvd_interfaces="vr0"

Edit: If you want to have DNS server information and DNS searchlist information included you have to use a /etc/rtadvd.conf file as @SirDice pointed out.

jonfr · May 3, 2013

kpa said:
Leave out ipv6_defaultrouter, net/sixxs-aiccu should take care of setting it correctly.

I did do this change. Now ifconfig gives me this output. But routing still does not work as it should do.

Code:

ifconfig -a
vr0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
        options=82808<VLAN_MTU,WOL_UCAST,WOL_MAGIC,LINKSTATE>
        ether 00:11:09:ef:20:ea
        inet 192.168.1.1 netmask 0xffffff00 broadcast 192.168.1.255
        inet6 fe80::211:9ff:feef:20ea%vr0 prefixlen 64 scopeid 0x6 
        inet6 2001:16d8:dd00:df::1 prefixlen 64 
        nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>
        media: Ethernet autoselect (100baseTX <full-duplex>)
        status: active
plip0: flags=8810<POINTOPOINT,SIMPLEX,MULTICAST> metric 0 mtu 1500
        nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>
lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> metric 0 mtu 16384
        options=600003<RXCSUM,TXCSUM,RXCSUM_IPV6,TXCSUM_IPV6>
        inet6 ::1 prefixlen 128 
        inet6 fe80::1%lo0 prefixlen 64 scopeid 0x8 
        inet 127.0.0.1 netmask 0xff000000 
        nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>
tun0: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> metric 0 mtu 1280
        options=80000<LINKSTATE>
        inet6 fe80::211:9ff:feef:20ea%tun0 prefixlen 64 scopeid 0x9 
        inet6 fe80::14d8:dd00:1a1:2%tun0 prefixlen 64 scopeid 0x9 
        inet6 2001:16d8:dd00:1a1::2 --> 2001:16d8:dd00:1a1::1 prefixlen 128 
        nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>
        Opened by PID 1206

I am also no closer what I need to change to fix this routing issue.

kpa · May 3, 2013

What does the routing table look like? netstat -nr.

SirDice · May 3, 2013

Also verify if you can ping both tunnel end-points on the FreeBSD host. Then take a look at the addresses the clients are given. Ping their default gateway (which should be your FreeBSD host).

SirDice · May 3, 2013

kpa said:
Edit: If you want to have DNS server information and DNS searchlist information included you have to use a /etc/rtadvd.conf file as @SirDice pointed out.

I've added them because they were in the example file. Unfortunately none of my clients, Windows 7, OS-X or FreeBSD seem to use them

Not sure why that is though.

Edit: If there's no default gateway on the FreeBSD host try setting it like this:

Code:

ipv6_defaultrouter="-iface tun0"

I don't have much experience with SixXS, I find their solution a bit tricky. My tunnel is from HE.net which uses a basic gif(4) setup. But if the host is up and running on IPv6 this shouldn't matter much.

kpa · May 3, 2013

OS X version 10.8 seems to use them on my systems. Check if you have left DNS settings to manual accidentally.

SirDice · May 3, 2013

kpa said:
OS X version 10.8 seems to use them on my systems.

Ah, mine are a little older. Off-topic: I never bothered to upgrade them because I don't like the direction OS-X is going. I only have 10.6.

jonfr · May 3, 2013

kpa said:
What does the routing table look like? netstat -nr.

Here is the routing table. I am going to remove radvd and use rtadvd. Since it is installed by default. All I have to do then is to adjust the config file for it.

Code:

netstat -nr
Routing tables

Internet:
Destination        Gateway            Flags    Refs      Use  Netif Expire
default            192.168.1.254      UGS         0     4207    vr0
127.0.0.1          link#8             UH          0        0    lo0
192.168.1.0/24     link#6             U           0     2209    vr0
192.168.1.1        link#6             UHS         0        0    lo0

Internet6:
Destination                       Gateway                       Flags      Netif Expire
::/96                             ::1                           UGRS        lo0 =>
default                           2001:16d8:dd00:1a1::1         UGS        tun0
::1                               link#8                        UH          lo0
::ffff:0.0.0.0/96                 ::1                           UGRS        lo0
2001:16d8:dd00:df::/64            link#6                        U           vr0
2001:16d8:dd00:df::1              link#6                        UHS         lo0
2001:16d8:dd00:1a1::1             link#9                        UH         tun0
2001:16d8:dd00:1a1::2             link#9                        UHS         lo0
fe80::/10                         ::1                           UGRS        lo0
fe80::%vr0/64                     link#6                        U           vr0
fe80::211:9ff:feef:20ea%vr0       link#6                        UHS         lo0
fe80::%lo0/64                     link#8                        U           lo0
fe80::1%lo0                       link#8                        UHS         lo0
fe80::%tun0/64                    link#9                        U          tun0
fe80::211:9ff:feef:20ea%tun0      link#9                        UHS         lo0
fe80::14d8:dd00:1a1:2%tun0        link#9                        UHS         lo0
ff01::%vr0/32                     fe80::211:9ff:feef:20ea%vr0   U           vr0
ff01::%lo0/32                     ::1                           U           lo0
ff01::%tun0/32                    fe80::211:9ff:feef:20ea%tun0  U          tun0
ff02::/16                         ::1                           UGRS        lo0
ff02::%vr0/32                     fe80::211:9ff:feef:20ea%vr0   U           vr0
ff02::%lo0/32                     ::1                           U           lo0
ff02::%tun0/32                    fe80::211:9ff:feef:20ea%tun0  U          tun0

jonfr · May 3, 2013

kpa said:
Are you going to SLAAC or DHCPv6 for configuring the LAN hosts?

With SLAAC it would be a matter of specifying the correct interface in rc.conf(5)

Code:

rtadvd_enable="YES" rtadvd_interfaces="vr0"

Edit: If you want to have DNS server information and DNS searchlist information included you have to use a /etc/rtadvd.conf file as @SirDice pointed out.

I am using stateless configuration. I do have a Sixxs PoP and a tunnel from them at the moment.

jonfr · May 3, 2013

I have made the changes as suggested. But it does not work. Here is the routing table as it is now.

Code:

netstat -nr
Routing tables

Internet:
Destination        Gateway            Flags    Refs      Use  Netif Expire
default            192.168.1.254      UGS         0     2230    vr0
127.0.0.1          link#8             UH          0        0    lo0
192.168.1.0/24     link#6             U           0     1001    vr0
192.168.1.1        link#6             UHS         0        0    lo0

Internet6:
Destination                       Gateway                       Flags      Netif Expire
::/96                             ::1                           UGRS        lo0 =>
default                           2001:16d8:dd00:1a1::1         UGS        tun0
::1                               link#8                        UH          lo0
::ffff:0.0.0.0/96                 ::1                           UGRS        lo0
2001:16d8:dd00:df::/64            link#6                        U           vr0
2001:16d8:dd00:df::1              link#6                        UHS         lo0
2001:16d8:dd00:1a1::1             link#9                        UH         tun0
2001:16d8:dd00:1a1::2             link#9                        UHS         lo0
fe80::/10                         ::1                           UGRS        lo0
fe80::%vr0/64                     link#6                        U           vr0
fe80::211:9ff:feef:20ea%vr0       link#6                        UHS         lo0
fe80::%lo0/64                     link#8                        U           lo0
fe80::1%lo0                       link#8                        UHS         lo0
fe80::%tun0/64                    link#9                        U          tun0
fe80::211:9ff:feef:20ea%tun0      link#9                        UHS         lo0
fe80::14d8:dd00:1a1:2%tun0        link#9                        UHS         lo0
ff01::%vr0/32                     fe80::211:9ff:feef:20ea%vr0   U           vr0
ff01::%lo0/32                     ::1                           U           lo0
ff01::%tun0/32                    fe80::211:9ff:feef:20ea%tun0  U          tun0
ff02::/16                         ::1                           UGRS        lo0
ff02::%vr0/32                     fe80::211:9ff:feef:20ea%vr0   U           vr0
ff02::%lo0/32                     ::1                           U           lo0
ff02::%tun0/32                    fe80::211:9ff:feef:20ea%tun0  U          tun0

Here is the ifconfig output.

Code:

ifconfig -a
vr0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
        options=82808<VLAN_MTU,WOL_UCAST,WOL_MAGIC,LINKSTATE>
        ether 00:11:09:ef:20:ea
        inet 192.168.1.1 netmask 0xffffff00 broadcast 192.168.1.255
        inet6 fe80::211:9ff:feef:20ea%vr0 prefixlen 64 scopeid 0x6 
        inet6 2001:16d8:dd00:df::1 prefixlen 64 
        nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>
        media: Ethernet autoselect (100baseTX <full-duplex>)
        status: active
plip0: flags=8810<POINTOPOINT,SIMPLEX,MULTICAST> metric 0 mtu 1500
        nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>
lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> metric 0 mtu 16384
        options=600003<RXCSUM,TXCSUM,RXCSUM_IPV6,TXCSUM_IPV6>
        inet6 ::1 prefixlen 128 
        inet6 fe80::1%lo0 prefixlen 64 scopeid 0x8 
        inet 127.0.0.1 netmask 0xff000000 
        nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>
tun0: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> metric 0 mtu 1280
        options=80000<LINKSTATE>
        inet6 fe80::211:9ff:feef:20ea%tun0 prefixlen 64 scopeid 0x9 
        inet6 fe80::14d8:dd00:1a1:2%tun0 prefixlen 64 scopeid 0x9 
        inet6 2001:16d8:dd00:1a1::2 --> 2001:16d8:dd00:1a1::1 prefixlen 128 
        nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>
        Opened by PID 1206

Here is the rc.conf for IPv6.

Code:

ipv6_gateway_enable="YES"
ipv6_enable="YES"
#ipv6_defaultrouter="2001:16d8:dd00:81a1::1/64"
ipv6_ifconfig_vr0="2001:16d8:dd00:df::1/64"
rtadvd_enable="YES"
rtadvd_interfaces="vr0"

[...]

sixxs_aiccu_enable="YES"
#gif_interfaces="gif0"
#gifconfig_gif0="UP"
#radvd_enable="yes"

I am testing few things. I am also going to re-install radvd and see if I can get that to work properly. Since it provides gateway functions that I want to use. This is stateless IPv6 configuration that I am using.

kpa · May 3, 2013

Does the SixXS tunnel work properly? Can you do ping6 [url]http://www.sixxs.net[/url] on the FreeBSD machine?

Also double check that IPv6 forwarding is really on with this:

sysctl net.inet6.ip6.forwarding

It should output 1.

jonfr · May 3, 2013

kpa said:
Does the SixXS tunnel work properly? Can you do ping6 [url]http://www.sixxs.net[/url] on the FreeBSD machine?

Also double check that IPv6 forwarding is really on with this:

sysctl net.inet6.ip6.forwarding

It should output 1.

I can ping properly on the FreeBSD server (the router).

Code:

ping6 -c 4 sixxs.net
PING6(56=40+8+8 bytes) 2001:16d8:dd00:1a1::2 --> 2001:1af8:4050::2
16 bytes from 2001:1af8:4050::2, icmp_seq=0 hlim=58 time=33.011 ms
16 bytes from 2001:1af8:4050::2, icmp_seq=1 hlim=58 time=32.783 ms
16 bytes from 2001:1af8:4050::2, icmp_seq=2 hlim=58 time=32.826 ms
16 bytes from 2001:1af8:4050::2, icmp_seq=3 hlim=58 time=32.832 ms

--- sixxs.net ping6 statistics ---
4 packets transmitted, 4 packets received, 0.0% packet loss
round-trip min/avg/max/std-dev = 32.783/32.863/33.011/0.088 ms

I have updated the sysctl.conf file. I am going to do a reboot and see if this work.

kpa · May 3, 2013

The sysctl(8) is set automatically if you have ipv6_gateway_enable="YES" in rc.conf(5). Can you get a LAN host working with IPv6 if you set the IPv6 address and IPv6 default route on it manually?

jonfr · May 3, 2013

I guess this is the problem. When I try to ping6 the FreeBSD server from my Gentoo Linux computer, I get this result.

Code:

ping6 -c 4 2001:16d8:dd00:df::1
PING 2001:16d8:dd00:df::1(2001:16d8:dd00:df::1) 56 data bytes

--- 2001:16d8:dd00:df::1 ping statistics ---
4 packets transmitted, 0 received, 100% packet loss, time 2999ms

When I try to ping6 the Gentoo Linux computer from the FreeBSD server. I get this results.

Code:

 ping6 -c 4 2001:16d8:dd00:81a1:221:85ff:fe3f:14a1
PING6(56=40+8+8 bytes) 2001:16d8:dd00:1a1::2 --> 2001:16d8:dd00:81a1:221:85ff:fe3f:14a1

--- 2001:16d8:dd00:81a1:221:85ff:fe3f:14a1 ping6 statistics ---
4 packets transmitted, 0 packets received, 100.0% packet loss

I am going to try and see if I can solve this issue on with this in mind. Not sure what the problem is however. Might just be the IPv6 address that my FreeBSD server has, rather then something else.

jonfr · May 4, 2013

I do not yet know why IPv6 connections are blocked on the FreeBSD server. I am sure this has something to do with firewall settings that are default with FreeBSD. I am testing more options based on what I have been reading online. I am not sure if it is going to help with this issue.

jonfr · May 4, 2013

I did manage to get ping working between my desktop computer and the FreeBSD server computer. Then what is left to do is to change enable radvd and turn it into an IPv6 router.

jonfr · May 4, 2013

I have resolved this problem. Turns out I was having issue with the IPv6 subnet. Fixing that and I did not have any more problem with this issue.

Here is a # ping6 from my desktop computer.

Code:

ping6 -c 4 google.com
PING google.com(fa-in-x65.1e100.net) 56 data bytes
64 bytes from fa-in-x65.1e100.net: icmp_seq=1 ttl=55 time=33.3 ms
64 bytes from fa-in-x65.1e100.net: icmp_seq=2 ttl=55 time=33.3 ms
64 bytes from fa-in-x65.1e100.net: icmp_seq=3 ttl=55 time=33.4 ms
64 bytes from fa-in-x65.1e100.net: icmp_seq=4 ttl=55 time=33.3 ms

--- google.com ping statistics ---
4 packets transmitted, 4 received, 0% packet loss, time 3003ms
rtt min/avg/max/mdev = 33.324/33.377/33.468/0.230 ms

For anyone that might run into this issue in the future. Check your subnet in your IPv6 address. They need to be in order. I am also using radvd, rather then rtadvd that FreeBSD provides. I find it easier to use and its setup is a straightforward matter.

Here is my current radvd configuration file.

Code:

interface <your network card>
{
#        (Send advertisement messages to other hosts)
        AdvSendAdvert on;
#        (Fragmentation is bad(tm))
        AdvLinkMTU 1280;
        MaxRtrAdvInterval 300;
#        (IPv6 subnet prefix we've been assigned by our PoP)
        prefix <your ipv6 subnet address from your PoP>/64
        {
                AdvOnLink on;
                AdvAutonomous on;
 
        };
};

I also want to point out that in my test I found out that rtadvd] was able to block all internet connectivity on my LAN if I rebooted my desktop computer (Gentoo Linux). I do not know why that is, or what the issue might be. For that reason I did do a clean re-install of FreeBSD in order to remove any user errors that I might have created.

I want to thank everyone for there suggestions and help in solving this issue.

How to properly set up an IPv6 gateway?

jonfr

SirDice

Administrator

kpa

jonfr

SirDice

Administrator

kpa

jonfr

kpa

SirDice

Administrator

SirDice

Administrator

kpa

SirDice

Administrator

jonfr

jonfr

jonfr

kpa

jonfr

kpa

jonfr

jonfr

jonfr

jonfr