Openstack Instance IPv6 configuration

dgonzalezh

Hello guys,

I've got the following setup:

Cisco 2821 Router w/ HE.net Tunnel and routes to Openstack Networks v4 and v6 working
CentOS 7 Openstack Mitaka (packstack) Server received SLAAC IPv6 from Cisco Router - working
Instance with Ubuntu 14.04 with dual stack - working

LDAP Auth against a FreeIPA server - working

root@as:~# ip -6 addr sh eth0
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1400 qlen 1000
    inet6 2001:470:XXXX:5000:f816:3eff:fe8a:3e02/64 scope global dynamic
       valid_lft 86393sec preferred_lft 14393sec
    inet6 fe80::f816:3eff:fe8a:3e02/64 scope link
       valid_lft forever preferred_lft forever

I've setup the IPv6 options as per the docs here: https://docs.openvpn.net/docs/access-server/openvpn-access-server-command-line-tools.html#ipv6-config-keys

ISSUES:

As soon as I restart AS with these settings (amended)

cd /usr/local/openvpn_as/scripts
./confdba -mk "vpn.routing6.enable" -v "true"
./confdba -mk "vpn.client.routing6.reroute_gw" -v "true"
./confdba -mk "vpn.server.daemon.vpn_network6.0" -v "fd4a:e7ae:b84b:09c2::/112"
./confdba -mk "ip6tables.vpn.disable.filter" -v "true"
./confdba -mk "ip6tables.vpn.disable.mangle" -v "true"
./confdba -mk "vpn.server.nat6" -v "false"

I restart AS adn network is rearranged as follows

2: ens3: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1400 state UP qlen 1000
    inet6 2001:470:XXXX:5100:cafe::10/80 scope global
       valid_lft forever preferred_lft forever
    inet6 2001:470:XXXX:5000:f816:3eff:feea:5562/64 scope global mngtmpaddr dynamic
       valid_lft 84938sec preferred_lft 12938sec
    inet6 fe80::f816:3eff:feea:5562/64 scope link
       valid_lft forever preferred_lft forever
5: as0t0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 state UNKNOWN qlen 200
    inet6 2001:470:XXXX:5100:cafe::/81 scope global
       valid_lft forever preferred_lft forever
6: as0t1: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 state UNKNOWN qlen 200
    inet6 2001:470:XXXX:5100:cafe:8000::/81 scope global
       valid_lft forever preferred_lft forever

root@osas:/usr/local/openvpn_as/scripts# ip -6 route sh
2001:470:XXXX:5000::/64 dev ens3  proto kernel  metric 256  expires 84676sec mtu 1400 pref medium
2001:470:XXXX:5100:cafe::/81 dev as0t0  proto kernel  metric 256  pref medium
2001:470:XXXX:5100:cafe:8000::/81 dev as0t1  proto kernel  metric 256  pref medium
2001:470:XXXX:5100:cafe::/80 dev ens3  proto kernel  metric 256  pref medium
fe80::/64 dev ens3  proto kernel  metric 256  mtu 1400 pref medium

Then I lose IPv6 connectivity from/to the AS instance. I'm Using the SAME network /80 I'm using on my instance.

Plain and simple, when user logs in he gets v4 and v6 IPs but v6 is not reachable.

Is there any cleaner way -- using Tunnelbroker to accomplish this?, any documentation I can follow apart from the official?.

There must be something I'm missing or otherwise doing wrong and haven't noticed, so I'm asking for your help as this is my first AS IPv6 setup and I'm kinda lost.

Thanks in advance.

a0b0c0

Hi dgonzalezh,

Some weeks ago I have also configured IPv6 on my OpenVPN Access Server using IPv6 from Tunnelbroker. I have used the same settings as you, except for the subnet size (/63 -> 2 x /64). In my case everything works fine.

I am just an enthusiast, but it seems to me that on your server you don't have a default gateway for the ipv6 traffic. Also, you could try to debug your problem using ping6 or/and tcpdump:

tcpdump -i as0t1 'icmp6'  # On the server

ping6 2001:470:XXXX:5100:cafe:8000:: # On the client

By doing this you can check if the ipv6 traffic 'is going' where it should go.
You could also try to ping from exterior an IPv6 address from your /80 subnet and using tcpdump (or wireshark) check for the ping on different interfaces.

dgonzalezh

Hey "a0b0c0", thanks for your reply, so cool to see it.

I'm also no guru, I do like IPv6 and I'm studying and investigating it, so no sweat, we're equals LoL.

Indeed, I have no default GW fpr v6 traffic, because I assumed the link-local address I get from the SLAAC info I've got from my brider router was enough. I'll try to add the GW as you suggest and will post the ping6 and tcpdump results.

Again, thanks for your valuable input.

a0b0c0 wroteHi dgonzalezh,

Some weeks ago I have also configured IPv6 on my OpenVPN Access Server using IPv6 from Tunnelbroker. I have used the same settings as you, except for the subnet size (/63 -> 2 x /64). In my case everything works fine.

I am just an enthusiast, but it seems to me that on your server you don't have a default gateway for the ipv6 traffic. Also, you could try to debug your problem using ping6 or/and tcpdump:
tcpdump -i as0t1 'icmp6'  # On the server

ping6 2001:470:XXXX:5100:cafe:8000:: # On the client
By doing this you can check if the ipv6 traffic 'is going' where it should go.
You could also try to ping from exterior an IPv6 address from your /80 subnet and using tcpdump (or wireshark) check for the ping on different interfaces.