(re-asked from here)

I'm trying to add IPv6 tunnel support to a OpenVPN server (i.e. clients can access the IPv6 internet through VPN).

The router that runs OpenVPN (Netgear WNDR4500v1 running Tomato v1.28-140) has IPv6 through Hurricane Electric (both a routed /64 and a routed /48) - 2001:xxxx:7:3b3::2 is the WAN IPv6 address - 2001:xxxx:8:3b3::1/64 is routed to the LAN interface (br0) - 2001:xxxx:e1ca::/48 is routed to the OpenVPN interface (tun21)

IPv6 works from the LAN, test-ipv6.com returns 10/10.

I can connect from a client to the OpenVPN server over IPv4 or IPv6, and the client gets a v6 address that's in the 2001:xxxx:e1ca::/48 prefix. However, the client has no IPv6 connectivity at all. I've tried this with multiple clients (Tunnelblick/macOS, OpenVPN for Android, OpenVPN Connect/iOS). test-ipv6.com says "No IPv6 address detected". Also, this shows up in the server logs:

SM-N910V/2610:xxxx:7f97 MULTI: bad source address from client [2610:xxxx:7f97], packet dropped

I've looked at the OpenVPN IPv6 wiki, as well as Jacob D Evans' guide, among other resources. The server/client configs are below.

Server config:

# Automatically generated configuration
daemon
server 192.168.2.0 255.255.255.0
proto udp
port 1194
dev tun21
cipher AES-256-CBC
comp-lzo adaptive
keepalive 15 60
verb 3
push "route 192.168.1.0 255.255.255.0"
push "dhcp-option DNS 192.168.1.1"
push "redirect-gateway def1"
tls-auth static.key 0
ca ca.crt
dh dh.pem
cert server.crt
key server.key
status-version 2
status status

# Custom Configuration
proto udp6

topology subnet
push "topology subnet"

server-ipv6 2001:xxxx:e1ca::/64
push "route-ipv6 2001:xxxx:8:3b3::/64"
push "route-ipv6 2001:xxxx:e1ca::/48"

push "comp-lzo adaptive"
verb 4

auth sha256

Client config:

client
dev tun

remote vpn.server.com 1194 udp6
float
nobind

persist-key
persist-tun

remote-cert-tls server
cipher AES-256-CBC
key-direction 1
auth sha256

explicit-exit-notify
comp-lzo adaptive
pull

<ca>...</ca>
<cert>...</cert>
<key>...</key>
<tls-auth>...</tls-auth>

ip -6 route before connecting to the VPN:

2001:xxxx:7:3b3::2 via fe80::6c5:a4ff:feea:9cc1 dev enp0s3 proto static metric 100 pref medium
2610:xxxx::/64 dev enp0s3 proto ra metric 100 pref medium
fe80::6c5:a4ff:feea:9cc1 dev enp0s3 proto static metric 100 pref medium
fe80::/64 dev enp0s3 proto kernel metric 100 pref medium
fe80::/64 dev enp0s3 proto kernel metric 256 pref medium
default via fe80::6c5:a4ff:feea:9cc1 dev enp0s3 proto ra metric 100 pref medium

ip -6 route after connecting to the VPN:

2001:xxxx:7:3b3::2 via fe80::6c5:a4ff:feea:9cc1 dev enp0s3 proto static metric 100 pref medium
2001:xxxx:8:3b3::/64 via 2001:xxxx:e1ca::1 dev tun0 proto static metric 50 pref medium
2001:xxxx:e1ca::1 dev tun0 proto kernel metric 50 pref medium
2001:xxxx:e1ca::1 dev tun0 proto kernel metric 256 pref medium
2001:xxxx:e1ca::1000 dev tun0 proto kernel metric 50 pref medium
2001:xxxx:e1ca::/48 via 2001:xxxx:e1ca::1 dev tun0 proto static metric 50 pref medium
2610:xxxx::/64 dev enp0s3 proto ra metric 100 pref medium
fe80::6c5:a4ff:feea:9cc1 dev enp0s3 proto static metric 100 pref medium
fe80::/64 dev enp0s3 proto kernel metric 100 pref medium
fe80::/64 dev enp0s3 proto kernel metric 256 pref medium
default dev tun0 proto static metric 50 pref medium
default via fe80::6c5:a4ff:feea:9cc1 dev enp0s3 proto ra metric 100 pref medium

ip -6 route after running the commands posted by @grawity below:

default from 2001:xxxx:e1ca::/64 dev tun0 metric 1024 pref medium
default from 2610:xxxx::/64 via 2610:xxxx::1 dev enp0s3 metric 1024 pref medium
2001:xxxx:7:3b3::2 via fe80::6c5:a4ff:feea:9cc1 dev enp0s3 proto static metric 100 pref medium
2001:xxxx:8:3b3::/64 via 2001:xxxx:e1ca::1 dev tun0 proto static metric 50 pref medium
2001:xxxx:e1ca::1 dev tun0 proto kernel metric 50 pref medium
2001:xxxx:e1ca::1 dev tun0 proto kernel metric 256 pref medium
2001:xxxx:e1ca::1000 dev tun0 proto kernel metric 50 pref medium
2001:xxxx:e1ca::/48 via 2001:xxxx:e1ca::1 dev tun0 proto static metric 50 pref medium
2610:xxxx::/64 dev enp0s3 proto ra metric 100 pref medium
fe80::6c5:a4ff:feea:9cc1 dev enp0s3 proto static metric 100 pref medium
fe80::/64 dev enp0s3 proto kernel metric 100 pref medium
fe80::/64 dev enp0s3 proto kernel metric 256 pref medium
default dev tun0 proto static metric 50 pref medium
default via fe80::6c5:a4ff:feea:9cc1 dev enp0s3 proto ra metric 100 pref medium

Anybody have any ideas as to what is going on?

OpenVPN logs: https://gist.github.com/abraha2d/f339ff163dd93e20ba3b499c69d6abe3

  • So the OV server is able to communicate via IPv6, but not the client? - Have any IPv6 addresses been assigned to the client machine, and is the client machine dual-stack (ie: IPv4 and IPv6)? Also, do you have (IPv6) packet routing disabled in the router configuration, as this can prevent networked machines from being able to communicate with each other via IPv6 packets? – Y Treehugger Cymru Oct 8 at 22:32
  • @YTreehuggerCymru The client is being assigned an IPv6 address by the OpenVPN server (2001:xxxx:e1ca::1000). The client is definitely dual stack, as IPv6 works fine outside the VPN (according to test-ipv6.com). IPv6 routing is enabled in the router config. – Kevin Abraham Oct 9 at 0:01
  • All that comes to mind, then, are issues related to local networks: OpenVPN is an absolute something unmentionable in relation to these, and I had to switch to a 10.200.0 subnet because my implementation of OV would not play nice with 192.168 subnets. – Y Treehugger Cymru Oct 9 at 4:05
  • @YTreehuggerCymru I figured IPv6 wouldn't have such issues, since addresses are unique everywhere. My gut tells me the MULTI: bad source address is the key to solving this. Maybe some configuration detail I'm overlooking? – Kevin Abraham Oct 9 at 4:08
  • Do you have a plain Linux client available, and can you test on it with some additional routes manually added after establishing the connection? (Connect, then add ip route add ::/0 from 2001:xxxx:e1ca::/64 dev tun0 and ip route add ::/0 from 2610:xxx/64 via <langw> dev eth0.) – grawity Oct 9 at 4:50

You're missing a push option in your server configuration.

You have:

push "redirect-gateway def1"

You need to also have the ipv6 option, i.e.:

push "redirect-gateway def1 ipv6"
  • I tried with/without the push "redirect-gateway def1 ipv6" option. No change. – Kevin Abraham Oct 13 at 14:52

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.