1

I have a Debian Jessie powered server which acts as router for our home network. I have succesfully managed to set up an IPv6 tunnel using TunnelBroker and traceroute commands return succesfully.

Below are my route tables and the ouput of ip -6 addr

~$ ip -6 route
::/96 dev sit0  proto kernel  metric 256
2001:470:1f14:904::1 dev he-ipv6  metric 1024
2001:470:1f14:904::2 dev sit1  proto kernel  metric 256
2001:470:1f14:904::/64 dev he-ipv6  proto kernel  metric 256
fe80::/64 dev eth0  proto kernel  metric 256
fe80::/64 dev eth1  proto kernel  metric 256
fe80::/64 dev he-ipv6  proto kernel  metric 256
default via 2001:470:1f14:904::1 dev he-ipv6  metric 1024
~$ ip -6 addr
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536
    inet6 ::1/128 scope host
       valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qlen 1000
    inet6 fe80::5a6d:8fff:febf:1147/64 scope link
       valid_lft forever preferred_lft forever
3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qlen 1000
    inet6 fe80::218:71ff:feea:f57b/64 scope link
       valid_lft forever preferred_lft forever
4: sit0: <NOARP,UP,LOWER_UP> mtu 1480
    inet6 ::192.168.10.1/96 scope global
       valid_lft forever preferred_lft forever
    inet6 ::188.142.102.214/96 scope global
       valid_lft forever preferred_lft forever
    inet6 ::127.0.0.1/96 scope host
       valid_lft forever preferred_lft forever
5: he-ipv6: <POINTOPOINT,NOARP,UP,LOWER_UP> mtu 1480
    inet6 2001:470:1f14:904::2/64 scope global
       valid_lft forever preferred_lft forever
    inet6 fe80::bc8e:66d6/64 scope link
       valid_lft forever preferred_lft forever
6: sit1: <POINTOPOINT,NOARP> mtu 1480
    inet6 2001:470:1f14:904::2/128 scope global
       valid_lft forever preferred_lft forever

A simple traceroute command returns this:

~$ traceroute ipv6.google.com
traceroute to ipv6.google.com (2a00:1450:4013:c00::65), 30 hops max, 80 byte packets
 1  roelof-1.tunnel.tserv11.ams1.ipv6.he.net (2001:470:1f14:904::1)  7.770 ms  10.780 ms  7.698 ms
 2  v213.core1.ams1.he.net (2001:470:0:7d::1)  10.738 ms  20.527 ms  20.511 ms
 3  amsix-router.google.com (2001:7f8:1::a501:5169:1)  11.302 ms  11.284 ms  11.257 ms
 4  2001:4860::1:0:8 (2001:4860::1:0:8)  11.487 ms  20.417 ms  11.447 ms
 5  2001:4860::8:0:519f (2001:4860::8:0:519f)  11.194 ms 2001:4860::8:0:51a0 (2001:4860::8:0:51a0)  11.178 ms 2001:4860::8:0:519f (2001:4860::8:0:519f)  11.163 ms
 6  2001:4860::8:0:519e (2001:4860::8:0:519e)  14.235 ms 2001:4860::8:0:517a (2001:4860::8:0:517a)  12.216 ms 2001:4860::8:0:519e (2001:4860::8:0:519e)  12.179 ms
 7  2001:4860::2:0:66f (2001:4860::2:0:66f)  10.875 ms 2001:4860::2:0:66e (2001:4860::2:0:66e)  10.566 ms  13.118 ms
 8  * * *
 9  ee-in-x65.1e100.net (2a00:1450:4013:c00::65)  12.799 ms  13.025 ms  12.635 ms

I seem to have successfully configured radvd to hand out IPv6 addresses, as is shown in the ipconfig response of my Windows 8.1 Pro desktop:

Ethernet adapter Ethernet:

   Connection-specific DNS Suffix  . : example.com
   IPv6 Address. . . . . . . . . . . : 2001:470:1f14:904:a05b:6fd2:b36b:f9af
   Temporary IPv6 Address. . . . . . : 2001:470:1f14:904:d40d:78ad:a2db:30cc
   Link-local IPv6 Address . . . . . : fe80::a05b:6fd2:b36b:f9af%2
   IPv4 Address. . . . . . . . . . . : 192.168.10.6
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Default Gateway . . . . . . . . . : fe80::218:71ff:feea:f57b%2
                                       192.168.10.1

However, when I try to do a tracert to ipv6.google.com, the request times out;

C:\>tracert -6 -h 10 ipv6.google.com

Tracing route to ipv6.l.google.com [2a00:1450:4013:c00::64]
over a maximum of 10 hops:

  1     *        *        *     Request timed out.
  2     *        *        *     Request timed out.
  3     *        *        *     Request timed out.
  4     *        *        *     Request timed out.
  5     *        *        *     Request timed out.
  6     *        *        *     Request timed out.
  7     *        *        *     Request timed out.
  8     *        *        *     Request timed out.
  9     *        *        *     Request timed out.
 10     *        *        *     Request timed out.

Now the question is: How do I get my LAN clients to use the tunnel on my linux router?

I have done some digging about, but probably just can't come up with the right search terms to solve my question.

Edit: Added radvd configuration

interface eth1
{

    AdvSendAdvert on;

    MinRtrAdvInterval 5;
    MaxRtrAdvInterval 15;

    prefix 2001:470:1f14:904::2/64
    {
        AdvOnLink on;
        AdvAutonomous on;
    };
};
6
  • ping really isn't a useful tool here. If you want to know why packets are failing to get from point a to point be you need to look at the output of traceroute. AKA tracert on Windows. You should also post your route tables p -6 route. While I am here, I also strongly suggest you stop using ifconfig. It would be more useful if you gave us the output of ip -6 addr. Ifconfig is deprecated, and provides deceptively invalid output in some corner cases.
    – Zoredache
    Aug 10, 2014 at 21:59
  • I had used traceroutes before, but didn't include them, I have replaced the ping calls with traceroute calls and added the route tables as requested. Thank you for the tip about ifconfig.
    – Roelof
    Aug 10, 2014 at 23:50
  • You realize you have no publicly routable address on your eth1 interface right? What does your radvd.conf look like?
    – Zoredache
    Aug 11, 2014 at 3:42
  • I have added the radvd configuration. I am, sadly, a bit oblivious of how to exactly configure it (since a lot of tutorials and help guides follow different routes) so I have tried my best to get the right configuration.
    – Roelof
    Aug 11, 2014 at 11:52
  • In any case, HE tunnelbroker.net will give you a /48 routed network. Get that, use a /64 subnet out of that range on your internal network. Setup routing.
    – Zoredache
    Aug 11, 2014 at 16:17

1 Answer 1

0

A few ideas:

  • Have you enabled ipv6 routing (sysctl -w net.ipv6.conf.all.forwarding=1); might need to do that for each intf
  • Will your he-net tunnel forward/accept the IPv6 addresses you're giving out to your clients? If not, you will need to NAT.
5
  • NAT and IPv6 do not belong in the same sentence. Ever. Linux doesn't support NAT for IPv6.
    – Zoredache
    Aug 11, 2014 at 15:36
  • 1
    @zoredache You are incorrect sir: "Since at least Linux kernel version 3.9.0 and using ip6tables since 1.4.18 also Network Address Translation (NAT) is usable." mirrors.bieringer.de/Linux+IPv6-HOWTO/nat-netfilter6..html
    – Konrads
    Aug 11, 2014 at 20:51
  • Ok, I am half incorrect. I still strongly stand by the first statement. NAT is evil. It should not be used.
    – Zoredache
    Aug 11, 2014 at 21:00
  • I almost upvoted this, except you still have the NAT statement in there. This is at best a red herring, as there is no reason for NAT in this scenario, and at worst very bad advice. Aug 15, 2014 at 19:36
  • Nat isn't because it is a good practice it is because it is a necessity. IPv6 needs no nat if network is planned well, but if tunnel allows IP only, then NAT is necessary.
    – Konrads
    Aug 15, 2014 at 23:53

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .