Hi there.
I successfully managed to create a LAN with IPV6. Clients on the LAN get an IPV6 address and can resolve names. The IPV6 subnet is provided by sixxs.
Openvpn also works as expected as far as IPV4 is concerned. The openvpn server is different from the IPV6 server/gateway.
When clients (Linux and win7) outside the LAN connect to the openvpn server they already get an IPV6 address (the tap-device). But they cannot resolve names and Firefox is not using IPV6. They can ping IPV6 addresses though and can also be pinged from within the LAN (with IPV6).
I followed this tutorial:
http://www.fangfufu.co.uk/create-an-openvpn-based-ipv6-tunnel-broker
The idea is to simply assign an IPV6 address to the bridge device br0 on the server.
So how do I get dns to work? Any ideas? Can I push it somehow? The mentioned tutorial suggests to issue "dhclient -6 tap0" on the Linux client but after that I have no IPV6 at all.
Tried this as well with the same result - cannot resolve names and browser not using IPV6:
https://blog.dest-unreach.be/2011/06/27/configuring-openvpn-to-support-ipv6
Here a script assigns an IPV6 address to the tap-interface on the client. So the result is the same only with more scripting involved.
My config files:
server.conf:
mode server
tls-server
local abc.aa.bb.ccc
port abcd
proto udp
dev tap0
up "/etc/openvpn/up.sh br0 tap0 1500"
down "/etc/openvpn/down.sh br0 tap0"
script-security 2
persist-key
persist-tun
ca ca.crt
cert server.crt
key server.key
dh dh1024.pem
tls-auth ta.key 0
cipher BF-CBC
comp-lzo
ifconfig-pool-persist ipp.txt
server-bridge abc.aa.bb.ddd 255.255.255.224 abc.aa.bb.eee abc.aa.bb.fff
push "route abc.aa.bb.ggg 255.255.255.224"
push "redirect-gateway"
push "dhcp-option DNS abc.aa.bb.k"
push "dhcp-option DOMAIN something"
max-clients 5
duplicate-cn
user nobody
group nogroup
keepalive 10 120
status openvpn-status.log
verb 3
up.sh
#!/bin/sh
BR=$1
DEV=$2
MTU=$3
/sbin/ip link set "$DEV" up promisc on mtu "$MTU"
/sbin/brctl addif $BR $DEV
down.sh
#!/bin/sh
BR=$1
DEV=$2
/sbin/brctl delif $BR $DEV
/sbin/ip link set "$DEV" down
interfaces:
auto lo
iface lo inet loopback
iface lo inet6 loopback
auto br0
iface br0 inet static
address abc.aa.bb.ccc
netmask 255.255.255.224
network abc.aa.bb.0
gateway abc.aa.bb.ggg
broadcast abc.aa.bb.159
dns-nameservers abc.aa.bb.k
dns-search something
bridge_ports eth0
bridge_fd 9
bridge_hello 2
bridge_maxage 12
bridge_stp off
iface br0 inet6 static
address 2001:abcd:abcd:abcd::abcd:abcd
netmask 64
iface eth0 inet manual
up ip link set $IFACE up promisc on
down ip link set $IFACE down promisc off
client.conf
client
dev tap
script-security 2
remote 160.aa.bb.cc abcd
nobind
resolv-retry infinite
persist-key
persist-tun
ca ca.crt
cert client1_daniel_home.crt
key client1_daniel_home.key
tls-auth ta.key 1
cipher BF-CBC
comp-lzo
verb 3
radvd.conf (not on openvpn server!):
interface eth0 {
AdvSendAdvert on ;
# Advertise at least every 30 seconds
MaxRtrAdvInterval 30;
# in order to force non RFC 6106 compliant clients to get a dns address
AdvOtherConfigFlag on ;
AdvManagedFlag on;
prefix 2001:abcd:abcd:abcd::/64 {
AdvOnLink on;
AdvAutonomous on;
};
RDNSS 2001:abcd:abcd:abcd:abcd:abcd:abcd:abcd 2001:abcd:abcd:abcd:abcd:abcd:abcd:abcd {
};
};
/etc/wide-dhcpv6/dhcp6s.conf (not on openvpn server! with real addresses):
option domain-name-servers IPv6_ADDRESS_OF_SIXXSNSCACHE_1 IPv6_ADDRESS_OF_SIXXSNSCACHE_2 ;
Thanks in advance for suggestions.
