Hi,
Have been using openvpn for several years, however now I'd like to be able to tunnel IPv6 over IPv4. I was excited to find out about the improved support for IPv6 in today's release.
Today I installed OpenVPN 2.3rc2 on both my windows 7 client machine and centos 6 server.
The Problem: I am currently able to connect to the server and ping the IPv6 address which is assigned to my client and I can also ping the tun0 interface. However, I cannot ping the eth0 interface directly from my client, and I can also not browse to any IPv6 websites.
My vps provider has given me this:
2607:f740:0044:0022:0000:0000:0000:0000/64 is routed to this server (2607:f740:0:3f:0:0:0:eda).
After connecting I can ping -6 2607:f740:44:22:0:0:88:1 and also ping -6 2607:f740:44:22:0:0:88:1000 (this address is assinged to me by the server):
OpenVPN CLIENT LIST
Updated,Wed Dec 19 00:45:57 2012
Common Name,Real Address,Bytes Received,Bytes Sent,Connected Since
client1,58.34.229.189:50099,1442588,4818426,Wed Dec 19 00:26:57 2012
ROUTING TABLE
Virtual Address,Common Name,Real Address,Last Ref
2607:f740:44:22::88:1000,client1,58.34.229.189:50099,Wed Dec 19 00:27:01 2012
10.8.0.6,client1,58.34.229.189:50099,Wed Dec 19 00:45:55 2012
GLOBAL STATS
Max bcast/mcast queue length,1
END
Here's the details of the setup:
Server.conf:
server-ipv6 2607:f740:44:22:0:0:88:0/64
server 10.8.0.0 255.255.255.0
port 1195
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key
dh dh2048.pem
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 208.67.222.222"
push "dhcp-option DNS 208.67.220.220"
keepalive 10 60
tls-auth ta.key 0
cipher AES-256-CBC
comp-lzo
user nobody
group nobody
persist-key
persist-tun
status openvpn-status.log
log-append openvpn.log
verb 5
Client.conf:
client
dev tun
nobind
keepalive 10 60
hand-window 15
remote 208.111.39.160 1195 udp
persist-key
persist-tun
ca ca.crt
key client1.key
cert client1.crt
remote-cert-tls server
tls-auth ta.key 1
comp-lzo
verb 3
cipher AES-256-CBC
ifconfig on server:
[root@baobei ~]# ifconfig
eth0 Link encap:Ethernet HWaddr 00:16:3E:12:77:54
inet addr:208.111.39.160 Bcast:208.111.39.255 Mask:255.255.255.0
inet6 addr: 2607:f740:0:3f::eda/64 Scope:Global
inet6 addr: fe80::216:3eff:fe12:7754/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:48327 errors:0 dropped:140 overruns:0 frame:0
TX packets:25137 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:11697355 (11.1 MiB) TX bytes:10179851 (9.7 MiB)
Interrupt:29
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:16436 Metric:1
RX packets:32 errors:0 dropped:0 overruns:0 frame:0
TX packets:32 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:2692 (2.6 KiB) TX bytes:2692 (2.6 KiB)
tun0 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
inet addr:10.8.0.1 P-t-P:10.8.0.2 Mask:255.255.255.255
inet6 addr: 2607:f740:44:22::88:1/64 Scope:Global
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1
RX packets:8874 errors:0 dropped:0 overruns:0 frame:0
TX packets:9747 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:100
RX bytes:1279104 (1.2 MiB) TX bytes:6107166 (5.8 MiB)
Connection log from client:
Wed Dec 19 13:27:00 2012 OpenVPN 2.3_rc2 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [eurephia] [IPv6] built on Dec 17 2012
Enter Management Password:
Wed Dec 19 13:27:00 2012 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Wed Dec 19 13:27:00 2012 Need hold release from management interface, waiting...
Wed Dec 19 13:27:01 2012 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
Wed Dec 19 13:27:01 2012 MANAGEMENT: CMD 'state on'
Wed Dec 19 13:27:01 2012 MANAGEMENT: CMD 'log all on'
Wed Dec 19 13:27:01 2012 MANAGEMENT: CMD 'hold off'
Wed Dec 19 13:27:01 2012 MANAGEMENT: CMD 'hold release'
Wed Dec 19 13:27:01 2012 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Wed Dec 19 13:27:01 2012 Control Channel Authentication: using 'ta.key' as a OpenVPN static key file
Wed Dec 19 13:27:01 2012 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Dec 19 13:27:01 2012 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Dec 19 13:27:01 2012 Socket Buffers: R=[8192->8192] S=[8192->8192]
Wed Dec 19 13:27:01 2012 UDPv4 link local: [undef]
Wed Dec 19 13:27:01 2012 UDPv4 link remote: [AF_INET]208.111.39.160:1195
Wed Dec 19 13:27:01 2012 MANAGEMENT: >STATE:1355894821,WAIT,,,
Wed Dec 19 13:27:01 2012 MANAGEMENT: >STATE:1355894821,AUTH,,,
Wed Dec 19 13:27:01 2012 TLS: Initial packet from [AF_INET]208.111.39.160:1195, sid=3ec11ac4 506248f2
Wed Dec 19 13:27:02 2012 VERIFY OK: depth=1, C=US, ST=CA, L=SanJose, O=baobei, CN=baobei, emailAddress=whitelines2@hotmail.com
Wed Dec 19 13:27:02 2012 Validating certificate key usage
Wed Dec 19 13:27:02 2012 ++ Certificate has key usage 00a0, expects 00a0
Wed Dec 19 13:27:02 2012 VERIFY KU OK
Wed Dec 19 13:27:02 2012 Validating certificate extended key usage
Wed Dec 19 13:27:02 2012 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Wed Dec 19 13:27:02 2012 VERIFY EKU OK
Wed Dec 19 13:27:02 2012 VERIFY OK: depth=0, C=US, ST=CA, L=SanJose, O=baobei, CN=server, emailAddress=whitelines2@hotmail.com
Wed Dec 19 13:27:04 2012 Data Channel Encrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Wed Dec 19 13:27:04 2012 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Dec 19 13:27:04 2012 Data Channel Decrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Wed Dec 19 13:27:04 2012 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Dec 19 13:27:04 2012 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Wed Dec 19 13:27:04 2012 [server] Peer Connection Initiated with [AF_INET]208.111.39.160:1195
Wed Dec 19 13:27:05 2012 MANAGEMENT: >STATE:1355894825,GET_CONFIG,,,
Wed Dec 19 13:27:06 2012 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Wed Dec 19 13:27:06 2012 PUSH: Received control message: 'PUSH_REPLY,ifconfig-ipv6 2607:f740:44:22::88:1000/64 2607:f740:44:22::88:1,redirect-gateway def1 bypass-dhcp,dhcp-option DNS 208.67.222.222,dhcp-option DNS 208.67.220.220,tun-ipv6,route 10.8.0.1,topology net30,ping 10,ping-restart 60,ifconfig 10.8.0.6 10.8.0.5'
Wed Dec 19 13:27:06 2012 OPTIONS IMPORT: timers and/or timeouts modified
Wed Dec 19 13:27:06 2012 OPTIONS IMPORT: --ifconfig/up options modified
Wed Dec 19 13:27:06 2012 OPTIONS IMPORT: route options modified
Wed Dec 19 13:27:06 2012 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Wed Dec 19 13:27:06 2012 do_ifconfig, tt->ipv6=1, tt->did_ifconfig_ipv6_setup=1
Wed Dec 19 13:27:06 2012 MANAGEMENT: >STATE:1355894826,ASSIGN_IP,,10.8.0.6,
Wed Dec 19 13:27:07 2012 NETSH: C:\Windows\system32\netsh.exe interface ipv6 set address Local Area Connection 2607:f740:44:22::88:1000 store=active
Wed Dec 19 13:27:07 2012 add_route_ipv6(2607:f740:44:22::/64 -> 2607:f740:44:22::88:1000 metric 0) dev Local Area Connection
Wed Dec 19 13:27:07 2012 C:\Windows\system32\netsh.exe interface ipv6 add route 2607:f740:44:22::/64 Local Area Connection fe80::8 store=active
Wed Dec 19 13:27:07 2012 env_block: add PATH=C:\Windows\System32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
Ok.
Wed Dec 19 13:27:07 2012 open_tun, tt->ipv6=1
Wed Dec 19 13:27:07 2012 TAP-WIN32 device [Local Area Connection] opened: \\.\Global\{7940D776-C147-4A69-9899-19A819433CB8}.tap
Wed Dec 19 13:27:07 2012 TAP-Windows Driver Version 9.9
Wed Dec 19 13:27:07 2012 Notified TAP-Windows driver to set a DHCP IP/netmask of 10.8.0.6/255.255.255.252 on interface {7940D776-C147-4A69-9899-19A819433CB8} [DHCP-serv: 10.8.0.5, lease-time: 31536000]
Wed Dec 19 13:27:07 2012 Successful ARP Flush on interface [40] {7940D776-C147-4A69-9899-19A819433CB8}
Wed Dec 19 13:27:12 2012 TEST ROUTES: 2/2 succeeded len=1 ret=1 a=0 u/d=up
Wed Dec 19 13:27:12 2012 C:\Windows\system32\route.exe ADD 208.111.39.160 MASK 255.255.255.255 192.168.1.1
Wed Dec 19 13:27:12 2012 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=20 and dwForwardType=4
Wed Dec 19 13:27:12 2012 Route addition via IPAPI succeeded [adaptive]
Wed Dec 19 13:27:12 2012 C:\Windows\system32\route.exe ADD 192.168.1.1 MASK 255.255.255.255 192.168.1.1 IF 14
Wed Dec 19 13:27:12 2012 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=20 and dwForwardType=4
Wed Dec 19 13:27:12 2012 Route addition via IPAPI succeeded [adaptive]
Wed Dec 19 13:27:12 2012 C:\Windows\system32\route.exe ADD 0.0.0.0 MASK 128.0.0.0 10.8.0.5
Wed Dec 19 13:27:12 2012 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Wed Dec 19 13:27:12 2012 Route addition via IPAPI succeeded [adaptive]
Wed Dec 19 13:27:12 2012 C:\Windows\system32\route.exe ADD 128.0.0.0 MASK 128.0.0.0 10.8.0.5
Wed Dec 19 13:27:12 2012 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Wed Dec 19 13:27:12 2012 Route addition via IPAPI succeeded [adaptive]
Wed Dec 19 13:27:12 2012 MANAGEMENT: >STATE:1355894832,ADD_ROUTES,,,
Wed Dec 19 13:27:12 2012 C:\Windows\system32\route.exe ADD 10.8.0.1 MASK 255.255.255.255 10.8.0.5
Wed Dec 19 13:27:12 2012 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Wed Dec 19 13:27:12 2012 Route addition via IPAPI succeeded [adaptive]
Wed Dec 19 13:27:12 2012 Initialization Sequence Completed
Wed Dec 19 13:27:12 2012 MANAGEMENT: >STATE:1355894832,CONNECTED,SUCCESS,10.8.0.6,208.111.39.160
Routing table on windows after connecting client:
Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.
C:\Users\baobei>route print
===========================================================================
Interface List
40...00 ff 79 40 d7 76 ......TAP-Windows Adapter V9
14...bc 5f f4 45 55 82 ......Broadcom NetLink (TM) Gigabit Ethernet
1...........................Software Loopback Interface 1
11...00 00 00 00 00 00 00 e0 Teredo Tunneling Pseudo-Interface
18...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #2
16...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #3
===========================================================================
IPv4 Route Table
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 192.168.1.1 192.168.1.5 20
0.0.0.0 128.0.0.0 10.8.0.5 10.8.0.6 30
10.8.0.1 255.255.255.255 10.8.0.5 10.8.0.6 30
10.8.0.4 255.255.255.252 On-link 10.8.0.6 286
10.8.0.6 255.255.255.255 On-link 10.8.0.6 286
10.8.0.7 255.255.255.255 On-link 10.8.0.6 286
127.0.0.0 255.0.0.0 On-link 127.0.0.1 306
127.0.0.1 255.255.255.255 On-link 127.0.0.1 306
127.255.255.255 255.255.255.255 On-link 127.0.0.1 306
128.0.0.0 128.0.0.0 10.8.0.5 10.8.0.6 30
192.168.1.0 255.255.255.0 On-link 192.168.1.5 276
192.168.1.1 255.255.255.255 192.168.1.1 192.168.1.5 20
192.168.1.5 255.255.255.255 On-link 192.168.1.5 276
192.168.1.255 255.255.255.255 On-link 192.168.1.5 276
208.111.39.160 255.255.255.255 192.168.1.1 192.168.1.5 20
224.0.0.0 240.0.0.0 On-link 127.0.0.1 306
224.0.0.0 240.0.0.0 On-link 192.168.1.5 276
224.0.0.0 240.0.0.0 On-link 10.8.0.6 286
255.255.255.255 255.255.255.255 On-link 127.0.0.1 306
255.255.255.255 255.255.255.255 On-link 192.168.1.5 276
255.255.255.255 255.255.255.255 On-link 10.8.0.6 286
===========================================================================
Persistent Routes:
None
IPv6 Route Table
===========================================================================
Active Routes:
If Metric Network Destination Gateway
14 276 ::/0 fe80::200:ff:fe00:0
1 306 ::1/128 On-link
11 58 2001::/32 On-link
11 306 2001:0:4137:9e76:2409:2575:2f90:d85f/128
On-link
14 28 2001:da8:4000:24::/64 On-link
14 276 2001:da8:4000:24:d1a0:8a72:f946:5aa3/128
On-link
14 276 2001:da8:4000:24:e0c8:250f:5150:770a/128
On-link
40 286 2607:f740:44:22::/64 fe80::8
40 286 2607:f740:44:22::88:1000/128
On-link
14 276 fe80::/64 On-link
40 286 fe80::/64 On-link
11 306 fe80::/64 On-link
11 306 fe80::2409:2575:2f90:d85f/128
On-link
40 286 fe80::589b:10b9:cb30:3f6d/128
On-link
14 276 fe80::e0c8:250f:5150:770a/128
On-link
1 306 ff00::/8 On-link
11 306 ff00::/8 On-link
14 276 ff00::/8 On-link
40 286 ff00::/8 On-link
===========================================================================
Persistent Routes:
None
I was told in the irc networking channel that there must be some problem with the routing on my client windows machine, as apparently I should be able to ping the eth0 IPv6 address (2607:f740:0:3f::eda) whereas I cannot. He suggested I ask here if "push default-route" applies to IPv6 in this case. Does anyone have any suggetions or could perhaps point out where I am going wrong? This is new software, there isn't much on google to search for either. Also in all the configs I've only mentioned IPv6 once, which is the first line in the server.conf. Perhaps it really is that simple, or perhaps I'm missing something obvious?
It might also just be my firewall:
#!/bin/sh
#
# iptables configuration script
#
# Flush all current rules from iptables
#
iptables -F
iptables -t nat -F
#
# Allow SSH connections on tcp port 22
#
iptables -A INPUT -i eth0 -p tcp --dport 22 -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp --sport 22 -j ACCEPT
#
# Set access for localhost
#
iptables -A INPUT -i lo -j ACCEPT
#
# Accept connections on 1195 for vpn access from client
#
iptables -A INPUT -i eth0 -p udp --dport 1195 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o eth0 -p udp --sport 1195 -m state --state ESTABLISHED -j ACCEPT
#
# Apply forwarding for OpenVPN Tunneling
#
iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -s 10.8.0.0/24 -j ACCEPT
iptables -t nat -A POSTROUTING -o eth0 -j SNAT --to 208.111.39.160
iptables -A FORWARD -j REJECT
#
# Enable forwarding
#
echo 1 > /proc/sys/net/ipv4/ip_forward
#
# Set default policies for INPUT, FORWARD and OUTPUT chains
#
iptables -P INPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -P OUTPUT ACCEPT
#
# IPv6
#
IP6TABLES=/sbin/ip6tables
$IP6TABLES -F INPUT
$IP6TABLES -F FORWARD
$IP6TABLES -F OUTPUT
echo -n "1" >/proc/sys/net/ipv6/conf/all/forwarding
echo -n "1" >/proc/sys/net/ipv6/conf/all/proxy_ndp
echo -n "0" >/proc/sys/net/ipv6/conf/all/autoconf
echo -n "0" >/proc/sys/net/ipv6/conf/all/accept_ra
$IP6TABLES -A INPUT -i eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT
$IP6TABLES -A INPUT -i eth0 -p tcp --dport 22 -j ACCEPT
$IP6TABLES -A INPUT -i eth0 -p icmpv6 -j ACCEPT
$IP6TABLES -P INPUT ACCEPT
$IP6TABLES -P FORWARD ACCEPT
$IP6TABLES -P OUTPUT ACCEPT
#
# List rules
#
clear
iptables -L -v
Thanks for your time and help.
