Hi,
I already have a VPN server running where all internet traffic is going via the VPN. However, I have recently noticed that there's an "IPv6 leakage" problem, as IPv6 doesn't use the VPN connection.
So I think the best thing is to just give users a working IPv6 address and push the default IPv6 route to the clients, so IPv6 also uses the VPN connection.
However, there were some problems during set up.
The version I am using is: OpenVPN 2.3.2 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [eurephia] [MH] [IPv6] built on Jul 12 2013
The relevant parts of the server conf about network stuff is this (I:P:v:6: is the prefix I got from my provider):
dev tun
tun-ipv6
proto udp
port 1194
server-ipv6 I:P:v:6:cafe::1/80
push "route-ipv6 2000::/3"
server 10.8.0.0 255.255.255.0
push "route-method exe"
push "route-delay 1 10"
push "route-metric 512"
push "route 0.0.0.0 0.0.0.0"
push "redirect-gateway def1"
#set the dns servers
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
keepalive 10 60
I got a /64 IPv6 subnet assigned from my provider, which also works fine. Here's how my /etc/network/interfaces file looks like for IPv6 stuff:
iface eth0 inet6 static
address I:P:v:6::1
netmask 64
post-up /sbin/ip -f inet6 route add I:P:v:6:ff:ff:ff:ff dev eth0
post-up /sbin/ip -f inet6 route add default via I:P:v:6:ff:ff:ff:ff
pre-down /sbin/ip -f inet6 route del default via I:P:v:6:ff:ff:ff:ff
pre-down /sbin/ip -f inet6 route del I:P:v:6:ff:ff:ff:ff dev eth0
IPv4 works fine, so there's no need to explain this any further.
With this configuration, my tun0 device loos like this:
8: tun0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UNKNOWN qlen 100
link/none
inet 10.8.0.1 peer 10.8.0.2/32 scope global tun0
valid_lft forever preferred_lft forever
inet6 I:P:v:6:cafe::2/80 scope global
valid_lft forever preferred_lft forever
However, with this configuration IPv6 on the client doesn't work yet.
So to get this working, every time a user connects, I am executing the following:
ip -6 neigh add proxy <ifconfig_ipv6_local> dev eth0
ip -6 neigh add proxy <ifconfig_ipv6_remote> dev eth0
I have no idea what is actually needed here, so I just tried with both addresses. (The ipv6_remote by the way isn't the address the client gets assigned, but I don't know if this is important here)
With this method, the clients are able to access the v6 Internet most of the time. However, just MOST OF THE TIME, not always!
The client get IPv6 addresses like this: I:P:v:6:cafe::100x
Also the route seems to be okay:
2000::/3 gets routed via fe80::8
I:P:v:6:cafe::/80 also via fe80::8, both via the tun interface.
However,
I:P:v:6::/64 goes via localhost, so I think I have to also push a route for the network I got assigned from my server provider.
And now the major problem I have:
If the IPv6 connection works (as I already mentioned above it randomly fails), it stops working after some time. I haven't measured after how long it breaks, but it definitely stops working after some time. Must be about an hour or so, but I can't tell the exact time.
So here a few questions:
- Is there any working solution on how to get IPv6 internet access via the VPN working reliable, to avoid the v6 leakage problem?
- Is there a known bug with the IPv6 implementation?
- Would it be easier/better to assign ULA addresses to the clients, and NAT it through the server's v6 address, as it already gets done with IPv4?
Thank you in advance for your answers!
