I am trying to get OSPFv3 (IPv6) working over my OpenVPN point-to-point tunnels. I am using BIRD as the routing daemon. The problem I seem to be running into is that when BIRD attempts to send DBDES packets to the link-local address of the other end of the tunnel, it gets a network unreachable socket error. My OpenVPN configuration is a simple ptp, manually-keyed tunnel. IPv4 routing works ok, and I am able to ping6 between the endpoints. Below is my OpenVPN configuration, the resulting FreeBSD routing table, ifconfig output, BIRD logging, and OpenVPN logging.
Is there some magic bit of configuration I'm missing? Does OpenVPN simply not handle link-local traffic properly?
daemon
dev tun1
tun-ipv6
proto udp
remote myhost 1198
port 1198
float
ifconfig 172.26.26.40 100.200.165.220
ifconfig-ipv6 2001:2001:c003:3::1/124 2001:2001:c001:c5::1
route-ipv6 2001:2001:c001:c5::1
link-mtu 1400
secret static.key
keepalive 5 30
persist-key
persist-tun
status /var/openvpn/openvpn-status-a1a-ss2.log 15
verb 4
management 127.0.0.1 1198
root@:/usr/local/etc-> netstat -rn -f inet6
Routing tables
Internet6:
Destination Gateway Flags Netif Expire
::/96 ::1 UGRS lo0
::1 link#8 UH lo0
::ffff:0.0.0.0/96 ::1 UGRS lo0
2001:2001:c001:c5::/64 tun1 US tun1
2001:2001:c003:3::/64 link#14 U tun1
2001:2001:c003:3::1 link#14 UHS lo0
fe80::/10 ::1 UGRS lo0
fe80::%re0/64 link#5 U re0
fe80::2e0:40ff:fe68:7472%re0 link#5 UHS lo0
fe80::%lo0/64 link#8 U lo0
fe80::1%lo0 link#8 UHS lo0
fe80::%vlan70/64 link#9 U vlan70
fe80::2e0:40ff:fe68:7472%vlan70 link#9 UHS lo0
fe80::%vlan200/64 link#10 U vlan200
fe80::2e0:40ff:fe68:7472%vlan200 link#10 UHS lo0
fe80::%tun0/64 link#13 U tun0
fe80::2e0:40ff:fe68:7472%tun0 link#13 UHS lo0
fe80::2e0:40ff:fe68:7472%tun1 link#14 UHS lo0
ff01::%re0/32 fe80::2e0:40ff:fe68:7472%re0 U re0
ff01::%lo0/32 ::1 U lo0
ff01::%vlan70/32 fe80::2e0:40ff:fe68:7472%vlan70 U vlan70
ff01::%vlan200/32 fe80::2e0:40ff:fe68:7472%vlan200 U vlan200
ff01::%tun0/32 fe80::2e0:40ff:fe68:7472%tun0 U tun0
ff01::%tun1/32 fe80::2e0:40ff:fe68:7472%tun1 U tun1
ff02::/16 ::1 UGRS lo0
ff02::%re0/32 fe80::2e0:40ff:fe68:7472%re0 U re0
ff02::%lo0/32 ::1 U lo0
ff02::%vlan70/32 fe80::2e0:40ff:fe68:7472%vlan70 U vlan70
ff02::%vlan200/32 fe80::2e0:40ff:fe68:7472%vlan200 U vlan200
ff02::%tun0/32 fe80::2e0:40ff:fe68:7472%tun0 U tun0
ff02::%tun1/32 fe80::2e0:40ff:fe68:7472%tun1 U tun1
root@:/usr/local/etc-> ifconfig tun1
tun1: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> metric 0 mtu 1356
options=80000<LINKSTATE>
inet6 fe80::2e0:40ff:fe68:7472%tun1 prefixlen 64 scopeid 0xe
inet 172.26.26.40 --> 100.200.165.220 netmask 0xffffffff
inet6 2001:2001:c003:3::1 prefixlen 124
nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>
Opened by PID 66870
10:29:13 bird6: ospf: HELLO packet received from fe80::8c65:c309:d425:aa47 via tun1
10:29:13 bird6: ospf: New neighbor found: fe80::8c65:c309:d425:aa47 on tun1
10:29:13 bird6: ospf: Neighbor fe80::8c65:c309:d425:aa47 changes state from " down" to " init".
10:29:13 bird6: ospf: Neighbor fe80::8c65:c309:d425:aa47 changes state from " init" to " 2way".
10:29:13 bird6: ospf: Neighbor fe80::8c65:c309:d425:aa47 changes state from " 2way" to " exstart".
10:29:14 bird6: ospf: HELLO packet sent via tun1
10:29:15 bird6: ospf: HELLO packet received from fe80::8c65:c309:d425:aa47 via tun1
10:29:16 bird6: ospf: HELLO packet sent via tun1
10:29:17 bird6: ospf: HELLO packet received from fe80::8c65:c309:d425:aa47 via tun1
10:29:18 bird6: ospf: DBDES packet sent to fe80::8c65:c309:d425:aa47 via tun1
10:29:18 bird6: ospf: length 28
10:29:18 bird6: ospf: router 10.70.0.3
10:29:18 bird6: ospf: imms MS M I
10:29:18 bird6: ospf: ddseq 3736877790
10:29:18 bird6: OSPF: Socket error on tun1: Network is unreachable
12:59:02 openvpn_1198[16311]: Current Parameter Settings:
12:59:02 openvpn_1198[16311]: config = '/usr/local/etc/openvpn/server_ss2_a1a.conf'
12:59:02 openvpn_1198[16311]: mode = 0
12:59:02 openvpn_1198[16311]: show_ciphers = DISABLED
12:59:02 openvpn_1198[16311]: show_digests = DISABLED
12:59:02 openvpn_1198[16311]: show_engines = DISABLED
12:59:02 openvpn_1198[16311]: genkey = DISABLED
12:59:02 openvpn_1198[16311]: key_pass_file = '[UNDEF]'
12:59:02 openvpn_1198[16311]: show_tls_ciphers = DISABLED
12:59:02 openvpn_1198[16311]: Connection profiles [default]:
12:59:02 openvpn_1198[16311]: proto = udp
12:59:02 openvpn_1198[16311]: local = '[UNDEF]'
12:59:02 openvpn_1198[16311]: local_port = 1198
12:59:02 openvpn_1198[16311]: remote = 'myhost'
12:59:02 openvpn_1198[16311]: remote_port = 1198
12:59:02 openvpn_1198[16311]: remote_float = ENABLED
12:59:02 openvpn_1198[16311]: bind_defined = DISABLED
12:59:02 openvpn_1198[16311]: bind_local = ENABLED
12:59:02 openvpn_1198[16311]: connect_retry_seconds = 5
12:59:02 openvpn_1198[16311]: connect_timeout = 10
12:59:02 openvpn_1198[16311]: connect_retry_max = 0
12:59:02 openvpn_1198[16311]: socks_proxy_server = '[UNDEF]'
12:59:02 openvpn_1198[16311]: socks_proxy_port = 0
12:59:02 openvpn_1198[16311]: socks_proxy_retry = DISABLED
12:59:02 openvpn_1198[16311]: tun_mtu = 1500
12:59:02 openvpn_1198[16311]: tun_mtu_defined = DISABLED
12:59:02 openvpn_1198[16311]: link_mtu = 1400
12:59:02 openvpn_1198[16311]: link_mtu_defined = ENABLED
12:59:02 openvpn_1198[16311]: tun_mtu_extra = 0
12:59:02 openvpn_1198[16311]: tun_mtu_extra_defined = DISABLED
12:59:02 openvpn_1198[16311]: mtu_discover_type = -1
12:59:02 openvpn_1198[16311]: fragment = 0
12:59:02 openvpn_1198[16311]: mssfix = 1450
12:59:02 openvpn_1198[16311]: explicit_exit_notification = 0
12:59:02 openvpn_1198[16311]: Connection profiles END
12:59:02 openvpn_1198[16311]: remote_random = DISABLED
12:59:02 openvpn_1198[16311]: ipchange = '[UNDEF]'
12:59:02 openvpn_1198[16311]: dev = 'tun1'
12:59:02 openvpn_1198[16311]: dev_type = '[UNDEF]'
12:59:02 openvpn_1198[16311]: dev_node = '[UNDEF]'
12:59:02 openvpn_1198[16311]: lladdr = '[UNDEF]'
12:59:02 openvpn_1198[16311]: topology = 1
12:59:02 openvpn_1198[16311]: tun_ipv6 = ENABLED
12:59:02 openvpn_1198[16311]: ifconfig_local = '172.26.26.40'
12:59:02 openvpn_1198[16311]: ifconfig_remote_netmask = '100.200.165.220'
12:59:02 openvpn_1198[16311]: ifconfig_noexec = DISABLED
12:59:02 openvpn_1198[16311]: ifconfig_nowarn = DISABLED
12:59:02 openvpn_1198[16311]: ifconfig_ipv6_local = '2001:2001:c003:3::1'
12:59:02 openvpn_1198[16311]: ifconfig_ipv6_netbits = 124
12:59:02 openvpn_1198[16311]: ifconfig_ipv6_remote = '2001:2001:c001:c5::1'
12:59:02 openvpn_1198[16311]: shaper = 0
12:59:02 openvpn_1198[16311]: mtu_test = 0
12:59:02 openvpn_1198[16311]: mlock = DISABLED
12:59:02 openvpn_1198[16311]: keepalive_ping = 5
12:59:02 openvpn_1198[16311]: keepalive_timeout = 30
12:59:02 openvpn_1198[16311]: inactivity_timeout = 0
12:59:02 openvpn_1198[16311]: ping_send_timeout = 5
12:59:02 openvpn_1198[16311]: ping_rec_timeout = 30
12:59:02 openvpn_1198[16311]: ping_rec_timeout_action = 2
12:59:02 openvpn_1198[16311]: ping_timer_remote = DISABLED
12:59:02 openvpn_1198[16311]: remap_sigusr1 = 0
12:59:02 openvpn_1198[16311]: persist_tun = ENABLED
12:59:02 openvpn_1198[16311]: persist_local_ip = DISABLED
12:59:02 openvpn_1198[16311]: persist_remote_ip = DISABLED
12:59:02 openvpn_1198[16311]: persist_key = ENABLED
12:59:02 openvpn_1198[16311]: passtos = DISABLED
12:59:02 openvpn_1198[16311]: resolve_retry_seconds = 1000000000
12:59:02 openvpn_1198[16311]: username = '[UNDEF]'
12:59:02 openvpn_1198[16311]: groupname = '[UNDEF]'
12:59:02 openvpn_1198[16311]: chroot_dir = '[UNDEF]'
12:59:02 openvpn_1198[16311]: up_script = '[UNDEF]'
12:59:02 openvpn_1198[16311]: down_pre = DISABLED
12:59:02 openvpn_1198[16311]: daemon = ENABLED
12:59:02 openvpn_1198[16311]: suppress_timestamps = DISABLED
12:59:02 openvpn_1198[16311]: gremlin = 0
12:59:02 openvpn_1198[16311]: status_file_update_freq = 15
12:59:02 openvpn_1198[16311]: fast_io = DISABLED
12:59:02 openvpn_1198[16311]: route_default_gateway = '[UNDEF]'
12:59:02 openvpn_1198[16311]: route_delay_window = 30
12:59:02 openvpn_1198[16311]: route_gateway_via_dhcp = DISABLED
12:59:02 openvpn_1198[16311]: management_addr = '127.0.0.1'
12:59:02 openvpn_1198[16311]: management_client_group = '[UNDEF]'
12:59:02 openvpn_1198[16311]: key_direction = 0
12:59:02 openvpn_1198[16311]: authname = 'SHA1'
12:59:02 openvpn_1198[16311]: keysize = 0
12:59:02 openvpn_1198[16311]: engine = DISABLED
12:59:02 openvpn_1198[16311]: replay_window = 64
12:59:02 openvpn_1198[16311]: use_iv = ENABLED
12:59:02 openvpn_1198[16311]: tls_client = DISABLED
12:59:02 openvpn_1198[16311]: ca_path = '[UNDEF]'
12:59:02 openvpn_1198[16311]: verify_x509_type = 0
12:59:02 openvpn_1198[16311]: ns_cert_type = 0
12:59:02 openvpn_1198[16311]: remote_cert_ku[i] = 0
12:59:02 openvpn_1198[16311]: renegotiate_bytes = 0
12:59:02 openvpn_1198[16311]: handshake_window = 60
12:59:02 openvpn_1198[16311]: transition_window = 3600
12:59:02 openvpn_1198[16311]: server_network = 0.0.0.0
12:59:02 openvpn_1198[16311]: server_netbits_ipv6 = 0
12:59:02 openvpn_1198[16311]: server_bridge_pool_start = 0.0.0.0
12:59:02 openvpn_1198[16311]: ifconfig_pool_defined = DISABLED
12:59:02 openvpn_1198[16311]: ifconfig_pool_netmask = 0.0.0.0
12:59:02 openvpn_1198[16311]: ifconfig_ipv6_pool_base = ::
12:59:02 openvpn_1198[16311]: tcp_queue_limit = 64
12:59:02 openvpn_1198[16311]: client_connect_script = '[UNDEF]'
12:59:02 openvpn_1198[16311]: ccd_exclusive = DISABLED
12:59:02 openvpn_1198[16311]: push_ifconfig_ipv6_local = ::/0
12:59:02 openvpn_1198[16311]: duplicate_cn = DISABLED
12:59:02 openvpn_1198[16311]: cf_max = 0
12:59:02 openvpn_1198[16311]: max_clients = 1024
12:59:02 openvpn_1198[16311]: port_share_host = '[UNDEF]'
12:59:02 openvpn_1198[16311]: pull = DISABLED
12:59:02 openvpn_1198[16311]: MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:1198
12:59:02 openvpn_1198[16311]: NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
12:59:02 openvpn_1198[16311]: Static Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
12:59:02 openvpn_1198[16311]: Static Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
12:59:02 openvpn_1198[16311]: Static Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
12:59:02 openvpn_1198[16311]: Static Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
12:59:02 openvpn_1198[16311]: WARNING: normally if you use --mssfix and/or --fragment, you should also set --tun-mtu 1500 (currently it is 1356)
12:59:02 openvpn_1198[16311]: Socket Buffers: R=[42080->65536] S=[9216->65536]
12:59:02 openvpn_1198[16311]: WARNING: potential conflict between --remote address [100.200.165.197] and --ifconfig address pair [172.26.26.40, 100.200.165.220] -- this is a warning only that is triggered when local/remote addresses exist within the same /24 subnet as --ifconfig endpoints. (silence this warning with --ifconfig-nowarn)
12:59:02 openvpn_1198[16311]: ROUTE6: default_gateway=UNDEF
12:59:02 openvpn_1198[16311]: TUN/TAP device tun1 exists previously, keep at program end
12:59:02 openvpn_1198[16311]: TUN/TAP device /dev/tun1 opened
12:59:02 openvpn_1198[16311]: do_ifconfig, tt->ipv6=1, tt->did_ifconfig_ipv6_setup=1
12:59:02 openvpn_1198[16311]: /sbin/ifconfig tun1 172.26.26.40 100.200.165.220 mtu 1356 netmask 255.255.255.255 up
12:59:02 openvpn_1198[16311]: /sbin/ifconfig tun1 inet6 2001:2001:c003:3::1/124
12:59:02 openvpn_1198[16311]: add_route_ipv6(2001:2001:c001:c5::/64 -> 2001:2001:c001:c5::1 metric -1) dev tun1
12:59:02 openvpn_1198[16311]: /sbin/route add -inet6 2001:2001:c001:c5::/64 -iface tun1
12:59:02 openvpn_1198[16311]: Data Channel MTU parms [ L:1400 D:1400 EF:44 EB:4 ET:0 EL:0 ]
12:59:02 openvpn_1198[16311]: Local Options String: 'V4,dev-type tun,link-mtu 1400,tun-mtu 1356,proto UDPv4,tun-ipv6,ifconfig 100.200.165.220 172.26.26.40,cipher BF-CBC,auth SHA1,keysize 128,secret'
12:59:02 openvpn_1198[16311]: Expected Remote Options String: 'V4,dev-type tun,link-mtu 1400,tun-mtu 1356,proto UDPv4,tun-ipv6,ifconfig 172.26.26.40 100.200.165.220,cipher BF-CBC,auth SHA1,keysize 128,secret'
12:59:02 openvpn_1198[16311]: Local Options hash (VER=V4): 'e6406294'
12:59:02 openvpn_1198[16311]: Expected Remote Options hash (VER=V4): '6d3f5717'
12:59:02 openvpn_1198[16315]: UDPv4 link local (bound): [undef]
12:59:02 openvpn_1198[16315]: UDPv4 link remote: [AF_INET]100.200.165.197:1198
12:59:02 openvpn_1198[16315]: Peer Connection Initiated with [AF_INET]100.200.165.197:1198
12:59:03 openvpn_1198[16315]: Initialization Sequence Completed
