1

I have a Debian Jessie powered server which acts as router for our home network. I have succesfully managed to set up an IPv6 tunnel using TunnelBroker and traceroute commands return succesfully.

Below are my route tables and the ouput of ip -6 addr

~$ ip -6 route
::/96 dev sit0  proto kernel  metric 256
2001:470:1f14:904::1 dev he-ipv6  metric 1024
2001:470:1f14:904::2 dev sit1  proto kernel  metric 256
2001:470:1f14:904::/64 dev he-ipv6  proto kernel  metric 256
fe80::/64 dev eth0  proto kernel  metric 256
fe80::/64 dev eth1  proto kernel  metric 256
fe80::/64 dev he-ipv6  proto kernel  metric 256
default via 2001:470:1f14:904::1 dev he-ipv6  metric 1024
~$ ip -6 addr
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536
    inet6 ::1/128 scope host
       valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qlen 1000
    inet6 fe80::5a6d:8fff:febf:1147/64 scope link
       valid_lft forever preferred_lft forever
3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qlen 1000
    inet6 fe80::218:71ff:feea:f57b/64 scope link
       valid_lft forever preferred_lft forever
4: sit0: <NOARP,UP,LOWER_UP> mtu 1480
    inet6 ::192.168.10.1/96 scope global
       valid_lft forever preferred_lft forever
    inet6 ::188.142.102.214/96 scope global
       valid_lft forever preferred_lft forever
    inet6 ::127.0.0.1/96 scope host
       valid_lft forever preferred_lft forever
5: he-ipv6: <POINTOPOINT,NOARP,UP,LOWER_UP> mtu 1480
    inet6 2001:470:1f14:904::2/64 scope global
       valid_lft forever preferred_lft forever
    inet6 fe80::bc8e:66d6/64 scope link
       valid_lft forever preferred_lft forever
6: sit1: <POINTOPOINT,NOARP> mtu 1480
    inet6 2001:470:1f14:904::2/128 scope global
       valid_lft forever preferred_lft forever

A simple traceroute command returns this:

~$ traceroute ipv6.google.com
traceroute to ipv6.google.com (2a00:1450:4013:c00::65), 30 hops max, 80 byte packets
 1  roelof-1.tunnel.tserv11.ams1.ipv6.he.net (2001:470:1f14:904::1)  7.770 ms  10.780 ms  7.698 ms
 2  v213.core1.ams1.he.net (2001:470:0:7d::1)  10.738 ms  20.527 ms  20.511 ms
 3  amsix-router.google.com (2001:7f8:1::a501:5169:1)  11.302 ms  11.284 ms  11.257 ms
 4  2001:4860::1:0:8 (2001:4860::1:0:8)  11.487 ms  20.417 ms  11.447 ms
 5  2001:4860::8:0:519f (2001:4860::8:0:519f)  11.194 ms 2001:4860::8:0:51a0 (2001:4860::8:0:51a0)  11.178 ms 2001:4860::8:0:519f (2001:4860::8:0:519f)  11.163 ms
 6  2001:4860::8:0:519e (2001:4860::8:0:519e)  14.235 ms 2001:4860::8:0:517a (2001:4860::8:0:517a)  12.216 ms 2001:4860::8:0:519e (2001:4860::8:0:519e)  12.179 ms
 7  2001:4860::2:0:66f (2001:4860::2:0:66f)  10.875 ms 2001:4860::2:0:66e (2001:4860::2:0:66e)  10.566 ms  13.118 ms
 8  * * *
 9  ee-in-x65.1e100.net (2a00:1450:4013:c00::65)  12.799 ms  13.025 ms  12.635 ms

I seem to have successfully configured radvd to hand out IPv6 addresses, as is shown in the ipconfig response of my Windows 8.1 Pro desktop:

Ethernet adapter Ethernet:

   Connection-specific DNS Suffix  . : example.com
   IPv6 Address. . . . . . . . . . . : 2001:470:1f14:904:a05b:6fd2:b36b:f9af
   Temporary IPv6 Address. . . . . . : 2001:470:1f14:904:d40d:78ad:a2db:30cc
   Link-local IPv6 Address . . . . . : fe80::a05b:6fd2:b36b:f9af%2
   IPv4 Address. . . . . . . . . . . : 192.168.10.6
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Default Gateway . . . . . . . . . : fe80::218:71ff:feea:f57b%2
                                       192.168.10.1

However, when I try to do a tracert to ipv6.google.com, the request times out;

C:\>tracert -6 -h 10 ipv6.google.com

Tracing route to ipv6.l.google.com [2a00:1450:4013:c00::64]
over a maximum of 10 hops:

  1     *        *        *     Request timed out.
  2     *        *        *     Request timed out.
  3     *        *        *     Request timed out.
  4     *        *        *     Request timed out.
  5     *        *        *     Request timed out.
  6     *        *        *     Request timed out.
  7     *        *        *     Request timed out.
  8     *        *        *     Request timed out.
  9     *        *        *     Request timed out.
 10     *        *        *     Request timed out.

Now the question is: How do I get my LAN clients to use the tunnel on my linux router?

I have done some digging about, but probably just can't come up with the right search terms to solve my question.

Edit: Added radvd configuration

interface eth1
{

    AdvSendAdvert on;

    MinRtrAdvInterval 5;
    MaxRtrAdvInterval 15;

    prefix 2001:470:1f14:904::2/64
    {
        AdvOnLink on;
        AdvAutonomous on;
    };
};
  • ping really isn't a useful tool here. If you want to know why packets are failing to get from point a to point be you need to look at the output of traceroute. AKA tracert on Windows. You should also post your route tables p -6 route. While I am here, I also strongly suggest you stop using ifconfig. It would be more useful if you gave us the output of ip -6 addr. Ifconfig is deprecated, and provides deceptively invalid output in some corner cases. – Zoredache Aug 10 '14 at 21:59
  • I had used traceroutes before, but didn't include them, I have replaced the ping calls with traceroute calls and added the route tables as requested. Thank you for the tip about ifconfig. – Roelof Aug 10 '14 at 23:50
  • You realize you have no publicly routable address on your eth1 interface right? What does your radvd.conf look like? – Zoredache Aug 11 '14 at 3:42
  • I have added the radvd configuration. I am, sadly, a bit oblivious of how to exactly configure it (since a lot of tutorials and help guides follow different routes) so I have tried my best to get the right configuration. – Roelof Aug 11 '14 at 11:52
  • In any case, HE tunnelbroker.net will give you a /48 routed network. Get that, use a /64 subnet out of that range on your internal network. Setup routing. – Zoredache Aug 11 '14 at 16:17
0

A few ideas:

  • Have you enabled ipv6 routing (sysctl -w net.ipv6.conf.all.forwarding=1); might need to do that for each intf
  • Will your he-net tunnel forward/accept the IPv6 addresses you're giving out to your clients? If not, you will need to NAT.
  • NAT and IPv6 do not belong in the same sentence. Ever. Linux doesn't support NAT for IPv6. – Zoredache Aug 11 '14 at 15:36
  • 1
    @zoredache You are incorrect sir: "Since at least Linux kernel version 3.9.0 and using ip6tables since 1.4.18 also Network Address Translation (NAT) is usable." mirrors.bieringer.de/Linux+IPv6-HOWTO/nat-netfilter6..html – Konrads Aug 11 '14 at 20:51
  • Ok, I am half incorrect. I still strongly stand by the first statement. NAT is evil. It should not be used. – Zoredache Aug 11 '14 at 21:00
  • I almost upvoted this, except you still have the NAT statement in there. This is at best a red herring, as there is no reason for NAT in this scenario, and at worst very bad advice. – Michael Hampton Aug 15 '14 at 19:36
  • Nat isn't because it is a good practice it is because it is a necessity. IPv6 needs no nat if network is planned well, but if tunnel allows IP only, then NAT is necessary. – Konrads Aug 15 '14 at 23:53

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.