1

Please help with setting up ipv6 network on linux gate. I want to give clients a static ipv6 address from the HE routed 2001:471:70c8::/48 pool. I took the first /64 subnet (2001:471:70c8:1::/64) from there and I want to distribute addresses from there to clients.

ipv6 forwarding is on, ip6tables accept FORWARD. From gate i can ping6 clients and internet, from clients i can ping gate, but cannot ping6 internet. Tell me please, what am I doing wrong?

radvd:

gate ~ # cat /etc/dhcp/radvd.conf          

interface internal_0
{
    AdvSendAdvert on;
    AdvManagedFlag on;
    AdvOtherConfigFlag on;

    prefix 2001:471:70c8:1::/64
    {
        AdvOnLink on;
        AdvAutonomous on;
        AdvRouterAddr off;
    };

    RDNSS 2001:471:70c8:1::1
    {
    };

    DNSSL domain-home.local
    {
    };
};

dhcpv6

ddns-update-style none;
authoritative;
option dhcp6.name-servers 2001:471:70c8:1::1;
option dhcp6.domain-search "domain-home.local";
default-lease-time 3600;
max-lease-time 14400;
option client-class-information code  97 = string;
deny duplicates;
ping-check true;
update-optimization false;

shared-network "domain-home"
{
  interface internal_0;
  subnet6 2001:471:70c8:1::/64
  {
    pool6
    {
      # Range for clients
      range6 2001:471:70c8:1::1 2001:471:70c8:1::fe;

      # Range for clients requesting a temporary address
      range6 2001:471:70c8:1::/64 temporary;

      # Prefix range for delegation to sub-routers
      prefix6 2001:471:70c8:1:: 2001:471:70c8:1:: /64;
    }
  }
}

host spc_94_de_80_7c_8b_ee
  {
    hardware ethernet 94:de:80:7c:8b:ee;
    host-identifier option dhcp6.client-id 00:02:00:00:ab:11:7a:1c:61:eb:ac:c3:f0:f3;
    fixed-address6 2001:471:70c8:1::a;
  } # Interface name: internal_0 (Internal)

gate:

gate ~ # ip -6 a l
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 state UNKNOWN qlen 1000
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: external_kis_0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 state UP qlen 1000
    inet6 fe80::523e:aaff:fe04:8fb0/64 scope link 
       valid_lft forever preferred_lft forever
3: internal_0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 state UP qlen 1000
    inet6 2001:471:70c8:1:96de:80ff:fe6c:66b0/64 scope global dynamic mngtmpaddr noprefixroute 
       valid_lft 86225sec preferred_lft 14225sec
    inet6 2001:471:70c8:1::1/0 scope global 
       valid_lft forever preferred_lft forever
    inet6 fe80::96de:80ff:fe6c:66b0/64 scope link 
       valid_lft forever preferred_lft forever
7: external_he_0@external_kis_0: <POINTOPOINT,NOARP,UP,LOWER_UP> mtu 1480 state UNKNOWN qlen 1000
    inet6 2001:471:1f0a:1880::2/0 scope global 
       valid_lft forever preferred_lft forever
    inet6 fe80::5bd2:623e/64 scope link 
       valid_lft forever preferred_lft forever
gate ~ # ip -6 r l
anycast 2001:471:70c8:1:: dev internal_0 proto kernel metric 0 pref medium
2001:471:70c8:1::/64 dev internal_0 proto ra metric 1024 pref medium
2001:471:70c8::/48 dev internal_0 proto ra metric 1024 pref medium
anycast fe80:: dev external_he_0 proto kernel metric 0 pref medium
anycast fe80:: dev external_kis_0 proto kernel metric 0 pref medium
anycast fe80:: dev internal_0 proto kernel metric 0 pref medium
fe80::/64 dev external_he_0 proto kernel metric 256 pref medium
fe80::/64 dev external_kis_0 proto kernel metric 256 pref medium
fe80::/64 dev internal_0 proto kernel metric 256 pref medium
ff00::/8 dev external_he_0 metric 256 pref medium
ff00::/8 dev internal_0 metric 256 pref medium
default dev external_he_0 proto kernel metric 256 pref medium
default dev internal_0 proto kernel metric 256 pref medium
default via 2001:471:1f0a:1880::1 dev external_he_0 proto static metric 1024 pref medium

client:

spc ~ # ip -6 a l
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 state UNKNOWN qlen 1000
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: dummy0: <BROADCAST,NOARP,UP,LOWER_UP> mtu 1500 state UNKNOWN qlen 1000
    inet6 fe80::24df:7f80:e175:c322/64 scope link 
       valid_lft forever preferred_lft forever
3: internal_0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 state UP qlen 1000
    inet6 2001:471:70c8:1::a/128 scope global dynamic noprefixroute 
       valid_lft 3592sec preferred_lft 2242sec
    inet6 2001:471:70c8:1:96de:80ff:fe7c:8bee/64 scope global dynamic mngtmpaddr noprefixroute 
       valid_lft 86391sec preferred_lft 14391sec
    inet6 2001:471:70c8:1:7aed:e36d:f089:ad33/64 scope global dynamic mngtmpaddr noprefixroute 
       valid_lft 86391sec preferred_lft 14391sec
    inet6 fe80::b492:58c4:b12d:b2e0/64 scope link 
       valid_lft forever preferred_lft forever
spc ~ # ip -6 r l
2001:471:70c8:1::/64 dev internal_0 proto ra metric 203 pref medium
2001:471:70c8:1::/64 dev internal_0 proto ra metric 1024 pref medium
fe80::/64 dev dummy0 proto kernel metric 256 pref medium
fe80::/64 dev internal_0 proto kernel metric 256 pref medium
ff00::/8 dev dummy0 metric 256 pref medium
ff00::/8 dev internal_0 metric 256 pref medium
default via fe80::96de:80ff:fe6c:66b0 dev internal_0 proto ra metric 203 pref medium
default via fe80::96de:80ff:fe6c:66b0 dev internal_0 proto ra metric 1024 pref medium

And here it is also interesting. I give only one address to the client (2001:471:70c8:1::a). Where did the second two (2001:471:70c8:1:96de:80ff:fe7c:8bee, 2001:471:70c8:1:7aed:e36d:f089:ad33) come from?

upd: tunnel and gate interfaces configuration

gate ~ # cat /etc/systemd/network/external_he_0.network 
[Match]
Name=external_he_0

[Network]
Address=2001:471:1f0a:1880::2
Gateway=2001:471:1f0a:1880::1

gate ~ # cat /etc/systemd/network/external_he_0.netdev 
[Match]

[NetDev]
Name=external_he_0
Kind=sit
MTUBytes=1480

[Tunnel]
Local=91.200.98.62
Remote=216.66.80.30
TTL=255

gate ~ # cat /etc/systemd/network/internal_0.network  
[Match]
Name=internal_0
MACAddress=94:de:80:6c:66:b0

[Network]
Description=Internal
DHCP=no
Address=10.100.100.1
Address=2001:471:70c8:1::1
Domains=domain-home.local

gate ~ # cat /etc/systemd/network/external_kis_0.network 
[Match]
Name=external_kis_0
MACAddress=50:3e:aa:04:8f:b0

[Network]
Description=External KIS
DHCP=no
Address=91.200.98.62
Gateway=91.200.98.61
Tunnel=external_he_0
Improve this question
2
  • 1
    Um, why are you configuring the subnet and tunnel addresses with /0 prefixlen?
    – u1686_grawity
    Dec 31, 2018 at 20:27
  • It configured by systemd. Or I incorrectly specified the addresses in the systemd files? (I added a configuration to the post)
    – Sheridan
    Dec 31, 2018 at 20:43

1 Answer 1

Reset to default
1

3: internal_0:
inet6 2001:471:70c8:1::1/0 scope global

Even though your tunnel and subnet addresses belong to /64 prefixes, you've configured them as /0's for some reason. Using the wrong subnet mask can already cause various strange problems, but /0 is twice as bad because it is interpreted as "The whole world is my subnet". Notice how you ended up with two extra default routes, such as the nonsensical ::/0 dev internal_0.

Because you have two routes for same destination (::/0 aka 'default') and same metric, you essentially end up with a single load-balanced route. It's up to chance whether each packet chooses the "dev internal_0" nexthop or the "dev external_he_0" one. (Completely by accident, the latter is actually valid and works, due to pointing at a tunnel device. I'm guessing that is why some of your packets go through, while others don't.)

Fix your configuration to specify the correct prefix length for addresses on both interfaces (it's /64).

Send a bug report about your network configuration tool: a missing /prefixlen should either abort or default to maximum length (/128 for v6), instead of zero.

I give only one address to the client (2001:471:70c8:1::a). Where did the second two (2001:471:70c8:1:96de:80ff:fe7c:8bee, 2001:471:70c8:1:7aed:e36d:f089:ad33) come from?

DHCPv6 is not the only address auto-configuration mechanism (indeed not even supported by some systems). Alongside it, you have Router Advertisements with the AdvAutonomous prefix flag set – this enables SLAAC and indicates to clients receiving these Advertisements that they can self-assign an address from the prefix.

(The first address is based on the EUI64 or MAC address; the second appears to be RFC7217 hash-based. It seems that this client actually has two programs processing Router Advertisements – probably the kernel + dhcpcd, or kernel + systemd-networkd. That's why it has two default routes too.)

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .