OpenVPN over IPv6 transport

mrgenie

First of all, inside the tunnel I'd like to use IPv4 (for LAN 56k+ addresses are reserved and I don't think anyone who deploys virtual LAN will need more addresses, maybe enterprise would need it, don't know.)

But the openVPN Server is behind a DualStack Lite, which means only the IPv6 Address is published to the internet.
the IPv4 is natted through the ISP and thus completely blocked from the outside world. Practically IPv4 is non existing except as fallback to reach webhosts that don't yet support 20 year old standards (webhosts reading this, it's time to move on!)

Anyway I''ve copied past my server settings and crt/key/etc from a working connection over IPv4 which obviously doesn't work on IPv6.
I've even stripped the IPv6 down to a minimum on settings, doesn't work.

So here's my settings from server and client and what errors I get reported in the hope someone can recognize why this doesn't work on IPv6 but does on IPv4.

SERVER:

config openvpn 'Server_IPV6'
        option enabled                  '1'
        option _description             'Server configuration for IPv6 Networking'
#        option _role                    'server'
#       option server                   '1'
        option tls_server               '1'
        option port                     '1198'
        option proto                    'udp6'
        option dev                      'tap1'
        option tun_mtu                  '1200'
        option tun_mtu_extra            '32'
        option server_bridge            '172.22.51.1 255.255.0.0 172.22.51.2 172.22.51.49'
        option ca                       '/etc/openvpn/server/ca.crt'
        option cert                     '/etc/openvpn/server/s-ipv6.crt'
        option key                      '/etc/openvpn/server/s-ipv6.key'
        option dh                       '/etc/openvpn/server/dh2048.pem'
#       option tls_crypt                '/etc/openvpn/server/ta.key'
#       option remote_cert_tls          'client'
#       option tls_version_min          '1.2'
#       option tls_cipher               'TLS-ECDHE-RSA-WITH-AES-256-GCM-SHA384'
#       option cipher                   'AES-256-GCM'
#       option auth                     'SHA384'
        option keepalive                '10 60'
        option comp_lzo                 'no'
        option persist_key              '1'
        option persist_tun              '1'
        option status                   '/etc/openvpn/server/status 5'
        option log                      '/etc/openvpn/server/log'
        option verb                     '5'

CLIENT

config openvpn 'IPv6'
        option enabled                  '1'
        option tls_client               '1'
        option remote                   'ipv6.domain.com'
#       option _role                    'client'
        option port                     '1198'
        option proto                    'udp6'
        option dev                      'tap0'
        option tun_mtu                  '1200'
        option tun_mtu_extra            '32'
        option ca                       '/etc/openvpn/ca.crt'
        option cert                     '/etc/openvpn/client-ipv6.crt'
        option key                      '/etc/openvpn/client-ipv6.key'
#       option tls_crypt                '/etc/openvpn/ta.key'
#       option remote_cert_tls          'server'
#       option verify_x509_name         'S-SERVER name'
#       option tls_version_min          '1.2'
#       option tls_cipher               'TLS-ECDHE-RSA-WITH-AES-256-GCM-SHA384'
#       option cipher                   'AES-256-GCM'
#       option auth                     'SHA384'
        option comp_lzo                 'no'
        option persist_key              '1'
        option persist_tun              '1'
#       option nobind                   '1'
#       option float                    '1'
        option resolv_retry             'infinite'
        option status                   '/etc/openvpn/status 5'
        option log                      '/etc/openvpn/log'
        option verb                     '7'

Error on client

us=35758 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
us=35798 Re-using SSL/TLS context
us=35810 crypto_adjust_frame_parameters: Adjusting frame parameters for crypto by 40 bytes
us=35820 WARNING: normally if you use --mssfix and/or --fragment, you should also set --tun-mtu 1500 (currently it is 1200)
us=35863 Control Channel MTU parms [ L:1274 D:1212 EF:38 EB:0 ET:0 EL:3 ]
us=35947 Preserving previous TUN/TAP instance: tap0
us=35964 Data Channel MTU parms [ L:1274 D:1274 EF:42 EB:348 ET:32 EL:3 ]
us=35983 Local Options String (VER=V4): 'V4,dev-type tap,link-mtu 1274,tun-mtu 1232,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
us=35993 Expected Remote Options String (VER=V4): 'V4,dev-type tap,link-mtu 1274,tun-mtu 1232,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
us=36004 TCP/UDP: Preserving recently used remote address: [AF_INET6]2003:xx:xxxx:xxxx:xxx:xx:xxxx:xxxx:1198
us=36014 Socket Buffers: R=[212992->212992] S=[212992->212992]
us=36020 setsockopt(IPV6_V6ONLY=0)
us=36031 UDPv6 link local (bound): [AF_INET6][undef]:1198
us=36039 UDPv6 link remote: [AF_INET6]2003:xx:xxxx:xxxx:xxx:xx:xxxx:xxxx:1198
us=36084 UDPv6 WRITE [14] to [AF_INET6]2003:xx:xxxx:xxxx:xxx:xx:xxxx:xxxx:1198: P_CONTROL_HARD_RESET_CLIENT_V2 kid=0 [ ] pid=0 DATA len=0
us=71654 UDPv6 WRITE [14] to [AF_INET6]2003:xx:xxxx:xxxx:xxx:xx:xxxx:xxxx:1198: P_CONTROL_HARD_RESET_CLIENT_V2 kid=0 [ ] pid=0 DATA len=0
us=64854 UDPv6 WRITE [14] to [AF_INET6]2003:xx:xxxx:xxxx:xxx:xx:xxxx:xxxx:1198: P_CONTROL_HARD_RESET_CLIENT_V2 kid=0 [ ] pid=0 DATA len=0
us=713194 UDPv6 WRITE [14] to [AF_INET6]2003:xx:xxxx:xxxx:xxx:xx:xxxx:xxxx:1198: P_CONTROL_HARD_RESET_CLIENT_V2 kid=0 [ ] pid=0 DATA len=0
us=43457 UDPv6 WRITE [14] to [AF_INET6]2003:xx:xxxx:xxxx:xxx:xx:xxxx:xxxx:1198: P_CONTROL_HARD_RESET_CLIENT_V2 kid=0 [ ] pid=0 DATA len=0
us=134792 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
us=134828 TLS Error: TLS handshake failed
us=134875 TCP/UDP: Closing socket
us=134894 SIGUSR1[soft,tls-error] received, process restarting
us=134906 Restart pause, 5 second(s)

Error on the server:

us=341479 OpenVPN 2.4.0 x86_64-openwrt-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [MH/PKTINFO] [AEAD]
us=341503 library versions: OpenSSL 1.0.2k  26 Jan 2017, LZO 2.10
us=341538 NOTE: when bridging your LAN adapter with the TAP adapter, note that the new bridge adapter will often take on its own IP address that is different from what the LAN adapter was previously set to
us=341722 Diffie-Hellman initialized with 2048 bit key
us=341981 WARNING: normally if you use --mssfix and/or --fragment, you should also set --tun-mtu 1500 (currently it is 1200)
us=341998 TLS-Auth MTU parms [ L:1354 D:1212 EF:38 EB:0 ET:0 EL:3 ]
us=342155 TUN/TAP device tap1 opened
us=342171 TUN/TAP TX queue length set to 100
us=342195 Data Channel MTU parms [ L:1354 D:1354 EF:122 EB:361 ET:32 EL:3 ]
us=342210 Socket Buffers: R=[212992->212992] S=[212992->212992]
us=342218 setsockopt(IPV6_V6ONLY=0)
us=342248 UDPv6 link local (bound): [AF_INET6][undef]:1198
us=342258 UDPv6 link remote: [AF_UNSPEC]
us=342268 MULTI: multi_init called, r=256 v=256
us=342288 IFCONFIG POOL: base=172.22.51.2 size=48, ipv6=0
us=342308 Initialization Sequence Completed
us=46803 MULTI: multi_create_instance called
us=46843 2003:xx:xxxx:xxxx:xxxx:xx:xx:xxx Re-using SSL/TLS context
us=46863 2003:xx:xxxx:xxxx:xxxx:xx:xx:xxx WARNING: normally if you use --mssfix and/or --fragment, you should also set --tun-mtu 1500 (currently it is 1200)
us=46920 2003:xx:xxxx:xxxx:xxxx:xx:xx:xxx Control Channel MTU parms [ L:1354 D:1212 EF:38 EB:0 ET:0 EL:3 ]
us=46933 2003:xx:xxxx:xxxx:xxxx:xx:xx:xxx Data Channel MTU parms [ L:1354 D:1354 EF:122 EB:361 ET:32 EL:3 ]
us=46957 2003:xx:xxxx:xxxx:xxxx:xx:xx:xxx Local Options String (VER=V4): 'V4,dev-type tap,link-mtu 1274,tun-mtu 1232,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
us=46966 2003:xx:xxxx:xxxx:xxxx:xx:xx:xxx Expected Remote Options String (VER=V4): 'V4,dev-type tap,link-mtu 1274,tun-mtu 1232,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
R
us=46990 2003:xx:xxxx:xxxx:xxxx:xx:xx:xxx TLS: Initial packet from [AF_INET6]2003:xx:xxxx:xxxx:xxxx:xx:xx:xxx:1198, sid=f9e0065e 3c4f3c44
WWWWRWWR
us=818139 2003:xx:xxxx:xxxx:xxxx:xx:xx:xxx TLS: new session incoming connection from [AF_INET6]2003:xx:xxxx:xxxx:xxxx:xx:xx:xxx:1198
WWRWWRW
us=202081 2003:xx:xxxx:xxxx:xxxx:xx:xx:xxx TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
us=202118 2003:xx:xxxx:xxxx:xxxx:xx:xx:xxx TLS Error: TLS handshake failed
us=202173 2003:xx:xxxx:xxxx:xxxx:xx:xx:xxx SIGUSR1[soft,tls-error] received, client-instance restarting

mrgenie

Ok, I found out using

	option local 		'ip6 address here' fixes the problem..

but the ip6 address is dynamic. So not an option.

--local host
Local host name or IP address for bind. If specified, OpenVPN will bind to this address only. If unspecified, OpenVPN will bind to all interfaces.

so what would the local host name be?
wan
wan6
eth0
eth0.1
tap
tap0

guess I'll just have to trial and error.. But just so others know when you see this problem, it's not about your network connectivity, well it is but not what you'd expect, but the "binding" of ovpn to your interface.

TinCanTech

mrgenie wrote--local host
Local host name or IP address for bind.

Local host name .. looks like it is a pfSense router ?
IP address .. speaks for itself.

Interface name is not supported, at this time.

mrgenie

No, it's a LEDE Router

Branch of openWRT.

mrgenie

Anyway. if "interace name" isn't supported. I have a problem. Because I only have IPv6 and it's dynamic.

So it might just change when I'm not there and then the connection is gone if the IP changes.

Could "interface name" be top priority for next build?

Pippin

DDNS is an option?
https://wiki.openwrt.org/doc/uci/ddns

mrgenie

The problem hasn't anything to do with DDNS.

Of course for the remote option I use a ddns service.

vpn per default binds to any interface which obviously in my setup leads to the wrong routing if the first one it binds to is not the one you want it
to bind to.
therefore you set the local host to bind the vpn to a specific interface.
thus you either enter the IP or to interface(which isn't implemented according to TincanTech)
and a DDNS is not an ip. It's an address for which you need a DNS to resolve the IP first.

But the manpage specifically states IP and not name address. So the name address won't work as it won't be resolved.
Best is of course simply to implement the interface bind to the local option.

I mean, it's in the manpages and thus they should implement it. Or say so in the manpages that it's not implemented but on the todo list.

Ehm, I assume name addresses don't work because it's not written in the manpages! If it does work, someone needs to update those manpages.

TinCanTech

Pippin wroteDDNS is an option?
https://wiki.openwrt.org/doc/uci/ddns

mrgenie wroteThe problem hasn't anything to do with DDNS.

Pippin suggests that DDNS name is an option to bind to .. eg:

TinCanTech wrote
mrgenie wrote--local host
Local host name or IP address for bind.
Local host name .. looks like it is a pfSense router ?
IP address .. speaks for itself.

Interface name is not supported, at this time.

mrgenie wroteCould "interface name" be top priority for next build?

It is something that the devs are considering but it is a fair way off at this time. This is due to the specific call to getaddr() which openvpn uses which does not return an interface name. Other methods which do return an interface name are more platform specific and so are unsuitable for openvpn usage. (That's how I understand it)

The bottom line on your problem is this:

mrgenie wroteBecause I only have IPv6 and it's dynamic.

So it might just change when I'm not there and then the connection is gone if the IP changes

This is something which openWRT need to be made aware of (if they are not already). And they probably do have a solution, so I would ask them. Either that or your router manual/website.