OpenVPN with IPv6 link -- can only ping6 one endpoint

pgnd

I've built & installed

	openvpn --version | head -n 1
		OpenVPN 2.3.2 x86_64-suse-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [MH] [IPv6] built on Nov 31 2013

on two machines, 'server' & 'client'

The OpenVPN link is established over IPv6.

Currently, I'm only able to ping6 one end of the link, not both.

Specifically:

BOTH client and server can ping6 the server's end of the OpenVPN IPv6 link.
NEITHER client nor server can ping6 the server's end of the OpenVPN IPv6 link.

What's missing in the following config that's preventing ping6 to the client end of the link? I'd guess it's routing. If so, I'm not sure what's additionally needed in config, &/or if I need to add something externally/manually.

I've substituted mnemonics for actual IP addresses for ease of reading.

OPENVPN CONFIGS:
@ server

		cat server.conf
			local <SERVER_IPv6_REAL_SEGMENT>:1111
			bind
			daemon
			port 1194
			management 127.0.0.1 1195
			mode server
			dev tun1
			tun-ipv6
			proto tcp6-server
			server-ipv6   <OPENVPN_IPv6_LINK_SEGMENT>:0/112
			server        <OPENVPN_IPv4_LINK_SEGMENT>.0 255.255.255.0
			client-config-dir /usr/local/etc/openvpn/ccd/
			push "route <SERVER_IPv4_LAN_SEGMENT>.0 255.255.255.0"
			route       <CLIENT_IPv4_LAN_SEGMENT>.0 255.255.252.0
			client-to-client
			push "route <CLIENT_IPv4_LAN_SEGMENT>.0 255.255.252.0"
			...

		server ccd/client_CN
			iroute <CLIENT_IPv4_LAN_SEGMENT>.0 255.255.252.0

@ client

		cat client.conf
			local <CLIENT_IPv6_REAL_SEGMENT>:9999
			bind
			daemon
			port 1194
			management 127.0.0.1 1195
			dev tun1
			tun-ipv6
			proto-force tcp6-client
			<connection>
			    remote <SERVER_IPv6_REAL_SEGMENT>:1111 1194 tcp6-client
			</connection>
			explicit-exit-notify
			...

FIREWALLS:
@ server

		iptables -L -v -n | egrep "tun|1194"
		    0     0 ACCEPT     all  --  tun1   eth0    0.0.0.0/0            0.0.0.0/0
		    0     0 ACCEPT     all  --  eth0   tun1    0.0.0.0/0            0.0.0.0/0
		    0     0 _Policy4_1  tcp  --  *      *       <CLIENT_IPv4_REAL_SEGMENT>.65       <SERVER_IPv4_REAL_SEGMENT>.101        tcp dpt:1194 ctstate NEW
		    0     0 _Policy4_2  tcp  --  *      *       <SERVER_IPv4_REAL_SEGMENT>.101        <CLIENT_IPv4_REAL_SEGMENT>.65       tcp dpt:1194 ctstate NEW

		ip6tables -L -v -n | egrep "tun|1194"
		    0     0 ACCEPT     all      tun1   eth0    ::/0                 ::/0
		    0     0 ACCEPT     all      eth0   tun1    ::/0                 ::/0
		    1    80 _Policy6_1  tcp      *      *       <CLIENT_IPv6_REAL_SEGMENT>:9999  <SERVER_IPv6_REAL_SEGMENT>:1111  tcp dpt:1194 ctstate NEW
		    0     0 _Policy6_2  tcp      *      *       <SERVER_IPv6_REAL_SEGMENT>:1111  <CLIENT_IPv6_REAL_SEGMENT>:9999  tcp dpt:1194 ctstate NEW

@ client

		iptables -L -v -n | egrep "tun|1194"
		    0     0 ACCEPT     all  --  tun1   eth0    0.0.0.0/0            0.0.0.0/0
		    0     0 ACCEPT     all  --  eth0   tun1    0.0.0.0/0            0.0.0.0/0
		    0     0 _Policy4_18  tcp  --  *      *       <SERVER_IPv4_REAL_SEGMENT>.101        <CLIENT_IPv4_REAL_SEGMENT>.65       tcp dpt:1194 ctstate NEW
		    0     0 _Policy4_17  tcp  --  *      *       <CLIENT_IPv4_REAL_SEGMENT>.65       <SERVER_IPv4_REAL_SEGMENT>.101        tcp dpt:1194 ctstate NEW

		ip6tables -L -v -n | egrep "tun|1194"
		    0     0 ACCEPT     all      tun1   eth0    ::/0                 ::/0
		    0     0 ACCEPT     all      eth0   tun1    ::/0                 ::/0
		    0     0 _Policy6_15  tcp      *      *       <SERVER_IPv6_REAL_SEGMENT>:1111  <CLIENT_IPv6_REAL_SEGMENT>:9999  tcp dpt:1194 ctstate NEW
		    0     0 _Policy6_14  tcp      *      *       <CLIENT_IPv6_REAL_SEGMENT>:9999  <SERVER_IPv6_REAL_SEGMENT>:1111  tcp dpt:1194 ctstate NEW

OPENVPN LOGS:
@ server

		egrep "ifconfig_ipv6_local|ifconfig_ipv6_remote" /var/log/openvpn/openvpn.log
			Sun Dec  1 12:40:51 2013 us=317504   ifconfig_ipv6_local = '<OPENVPN_IPv6_LINK_SEGMENT>:1'
			Sun Dec  1 12:40:51 2013 us=317530   ifconfig_ipv6_remote = '<OPENVPN_IPv6_LINK_SEGMENT>:2'
			Sun Dec  1 12:40:51 2013 us=319988   push_ifconfig_ipv6_local = ::/0
			Sun Dec  1 12:40:51 2013 us=320002   push_ifconfig_ipv6_remote = ::

@ client

		egrep "ifconfig_ipv6_local|ifconfig_ipv6_remote" /var/log/openvpn/openvpn.log
			Sun Dec  1 13:46:27 2013 us=37890   ifconfig_ipv6_local = '[UNDEF]'
			Sun Dec  1 13:46:27 2013 us=38118   ifconfig_ipv6_remote = '[UNDEF]'
			Sun Dec  1 13:46:27 2013 us=49032   push_ifconfig_ipv6_local = ::/0
			Sun Dec  1 13:46:27 2013 us=49095   push_ifconfig_ipv6_remote = ::

PINGS:
@ server

		ping6 <OPENVPN_IPv6_LINK_SEGMENT>:1
			PING <OPENVPN_IPv6_LINK_SEGMENT>:1(<OPENVPN_IPv6_LINK_SEGMENT>:1) 56 data bytes
			64 bytes from <OPENVPN_IPv6_LINK_SEGMENT>:1: icmp_seq=1 ttl=64 time=0.064 ms
			64 bytes from <OPENVPN_IPv6_LINK_SEGMENT>:1: icmp_seq=2 ttl=64 time=0.066 ms
			...

		ping6 <OPENVPN_IPv6_LINK_SEGMENT>:2
			PING <OPENVPN_IPv6_LINK_SEGMENT>:2(<OPENVPN_IPv6_LINK_SEGMENT>:2) 56 data bytes
			(no reponse)

@ client

		ping6 <OPENVPN_IPv6_LINK_SEGMENT>:1
			PING <OPENVPN_IPv6_LINK_SEGMENT>:1(<OPENVPN_IPv6_LINK_SEGMENT>:1) 56 data bytes
			64 bytes from <OPENVPN_IPv6_LINK_SEGMENT>:1: icmp_seq=1 ttl=59 time=10.9 ms
			64 bytes from <OPENVPN_IPv6_LINK_SEGMENT>:1: icmp_seq=2 ttl=59 time=11.1 ms
			...

		ping6 <OPENVPN_IPv6_LINK_SEGMENT>:2
			PING <OPENVPN_IPv6_LINK_SEGMENT>:2(<OPENVPN_IPv6_LINK_SEGMENT>:2) 56 data bytes
			(no reponse)

pgnd

> If this is your complete client config then you need to add --pull otherwise the pushed options will not be imported.

Yep, that's it! Completely missed it, mistakenly thinking PUSH on the server end is sufficient.

After adding 'pull' to client.conf, BOTH ends of the link are ping6-able from both 'client' & 'server' (details below).

One question: Whereas the server-end's link IP is statically assigned as = "<VPN_LINK_IPv6_SEGMENT>:1", the client-end is assigned (randomly?) from the pool as "<VPN_LINK_IPv6_SEGMENT>:1000".

Iiuc, I CAN fix that client-end to a static value, e.g., "<VPN_LINK_IPv6_SEGMENT>:2". Where's that properly done in the config I have? In the server-ipv6 directive? In the ccd/client.conf?

If it's a change in the "server-ipv6" directive, since IPv4 "server" directive is REQUIRED (currently) when using IPv6 even if just dummy addresses, is it necessary to similarly change the "server" directive to a fixed IP?

Thanks for the catch on 'pull' !

@ server

	...
	Mon Dec  2 15:15:15 2013 client.vpn/<CLIENT_REAL_IPv6_SEGMENT>:2 PUSH: Received control message: 'PUSH_REQUEST'
	Mon Dec  2 15:15:15 2013 client.vpn/<CLIENT_REAL_IPv6_SEGMENT>:2 send_push_reply(): safe_cap=940
	Mon Dec  2 15:15:15 2013 client.vpn/<CLIENT_REAL_IPv6_SEGMENT>:2 SENT CONTROL [client.vpn]: 'PUSH_REPLY,ifconfig-ipv6 <VPN_LINK_IPv6_SEGMENT>:1000/112 <VPN_LINK_IPv6_SEGMENT>:1,route <SERVER_LAN_IPv4_SEGMENT>.0 255.255.255.0,route <CLIENT_LAN_IPv4_SEGMENT>.0 255.255.252.0,tun-ipv6,route <VPN_LINK_IPv4_SEGMENT>.0 255.255.255.0,topology net30,ping 10,ping-restart 120,ifconfig <VPN_LINK_IPv4_SEGMENT>.6 <VPN_LINK_IPv4_SEGMENT>.5' (status=1)
	...

@ client

	Mon Dec  2 15:15:15 2013 client.vpn/<CLIENT_REAL_IPv6_SEGMENT>:2 PUSH: Received control message: 'PUSH_REQUEST'
	Mon Dec  2 15:15:15 2013 client.vpn/<CLIENT_REAL_IPv6_SEGMENT>:2 send_push_reply(): safe_cap=940
	Mon Dec  2 15:15:15 2013 client.vpn/<CLIENT_REAL_IPv6_SEGMENT>:2 SENT CONTROL [client.vpn]: 'PUSH_REPLY,ifconfig-ipv6 <VPN_LINK_IPv6_SEGMENT>:1000/112 <VPN_LINK_IPv6_SEGMENT>:1,route <SERVER_LAN_IPv4_SEGMENT>.0 255.255.255.0,route <CLIENT_LAN_IPv4_SEGMENT>.0 255.255.252.0,tun-ipv6,route <VPN_LINK_IPv4_SEGMENT>.0 255.255.255.0,topology net30,ping 10,ping-restart 120,ifconfig <VPN_LINK_IPv4_SEGMENT>.6 <VPN_LINK_IPv4_SEGMENT>.5' (status=1)
	...
	Mon Dec  2 07:15:15 2013 SENT CONTROL [edge.server.openvpn.presence-group.net]: 'PUSH_REQUEST' (status=1)
	Mon Dec  2 07:15:16 2013 PUSH: Received control message: 'PUSH_REPLY,ifconfig-ipv6 <VPN_LINK_IPv6_SEGMENT>:1000/112 <VPN_LINK_IPv6_SEGMENT>:1,route <SERVER_LAN_IPv4_SEGMENT>.0 255.255.255.0,route <CLIENT_LAN_IPv4_SEGMENT>.0 255.255.252.0,tun-ipv6,route <VPN_LINK_IPv4_SEGMENT>.0 255.255.255.0,topology net30,ping 10,ping-restart 120,ifconfig <VPN_LINK_IPv4_SEGMENT>.6 <VPN_LINK_IPv4_SEGMENT>.5'
	Mon Dec  2 07:15:16 2013 OPTIONS IMPORT: timers and/or timeouts modified
	Mon Dec  2 07:15:16 2013 OPTIONS IMPORT: --ifconfig/up options modified
	Mon Dec  2 07:15:16 2013 OPTIONS IMPORT: route options modified
	Mon Dec  2 07:15:16 2013 ROUTE_GATEWAY <CLIENT_REAL_IPv4_SEGMENT>.1/255.255.255.0 IFACE=eth0 HWADDR=6c:f0:49:cc:cc:cc
	Mon Dec  2 07:15:16 2013 TUN/TAP device tun1 opened
	Mon Dec  2 07:15:16 2013 TUN/TAP TX queue length set to 100
	Mon Dec  2 07:15:16 2013 do_ifconfig, tt->ipv6=1, tt->did_ifconfig_ipv6_setup=1
	Mon Dec  2 07:15:16 2013 /usr/local/openvpn-unpriv/unpriv-ip link set dev tun1 up mtu 1500
	Mon Dec  2 07:15:16 2013 /usr/local/openvpn-unpriv/unpriv-ip addr add dev tun1 local <VPN_LINK_IPv4_SEGMENT>.6 peer <VPN_LINK_IPv4_SEGMENT>.5
	Mon Dec  2 07:15:16 2013 /usr/local/openvpn-unpriv/unpriv-ip -6 addr add <VPN_LINK_IPv6_SEGMENT>:1000/112 dev tun1
	Mon Dec  2 07:15:16 2013 /usr/local/openvpn-unpriv/unpriv-ip route add <SERVER_LAN_IPv4_SEGMENT>.0/24 via <VPN_LINK_IPv4_SEGMENT>.5
	Mon Dec  2 07:15:16 2013 /usr/local/openvpn-unpriv/unpriv-ip route add <CLIENT_LAN_IPv4_SEGMENT>.0/22 via <VPN_LINK_IPv4_SEGMENT>.5
	Mon Dec  2 07:15:16 2013 /usr/local/openvpn-unpriv/unpriv-ip route add <VPN_LINK_IPv4_SEGMENT>.0/24 via <VPN_LINK_IPv4_SEGMENT>.5
	Mon Dec  2 15:15:16 2013 chroot to '/usr/local/etc/openvpn' and cd to '/' succeeded
	Mon Dec  2 15:15:16 2013 GID set to nobody
	Mon Dec  2 15:15:16 2013 UID set to nobody
	Mon Dec  2 15:15:16 2013 Initialization Sequence Completed

after restart, the client-end of the link now correctly appears as:

	<VPN_LINK_IPv6_SEGMENT>:1000/112

and is ping6-able from both ends

@ client

		ifconfig tun1
		tun1      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  
		          inet addr:<VPN_LINK_IPv4_SEGMENT>.6  P-t-P:<VPN_LINK_IPv4_SEGMENT>.5  Mask:255.255.255.255
		          inet6 addr: <VPN_LINK_IPv6_SEGMENT>:1000/112 Scope:Global
		          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
		          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
		          TX packets:2 errors:0 dropped:0 overruns:0 carrier:0
		          collisions:0 txqueuelen:100 
		          RX bytes:0 (0.0 b)  TX bytes:208 (208.0 b)

		ping6 <VPN_LINK_IPv6_SEGMENT>:1000
			PING <VPN_LINK_IPv6_SEGMENT>:1000(<VPN_LINK_IPv6_SEGMENT>:1000) 56 data bytes
			64 bytes from <VPN_LINK_IPv6_SEGMENT>:1000: icmp_seq=1 ttl=64 time=0.131 ms
			64 bytes from <VPN_LINK_IPv6_SEGMENT>:1000: icmp_seq=2 ttl=64 time=0.093 ms
			...

@ server

		ping6 <VPN_LINK_IPv6_SEGMENT>:1000
			PING <VPN_LINK_IPv6_SEGMENT>:1000(<VPN_LINK_IPv6_SEGMENT>:1000) 56 data bytes
			64 bytes from <VPN_LINK_IPv6_SEGMENT>:1000: icmp_seq=1 ttl=64 time=15.8 ms
			64 bytes from <VPN_LINK_IPv6_SEGMENT>:1000: icmp_seq=2 ttl=64 time=13.1 ms
			...