Hi,
I've created a server at DigitalOcean from scratch with Debian. Nothing changed but updates, openvpn and easy-rsa installed.
Steps done:
- created easy-rsa CA, server key/cert and DH params with default config
- downloaded default ovpn config from
https://github.com/OpenVPN/openvpn/blob/master/sample/sample-config-files/server.conf
port 1194
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key # This file should be kept secret
dh dh2048.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
keepalive 10 120
tls-auth ta.key 0 # This file is secret
cipher AES-256-CBC
persist-key
persist-tun
status openvpn-status.log
verb 3
explicit-exit-notify 1
The server is running up normal, everything is good. Then I added the following directive to the config. This should add IPv6 connectivity inside the tunnel. It is a randomly created ULA prefix. But when I started the server with this active, it breaks the IPv6 connectivity of the whole server.
server-ipv6 fda6:b39a:4037::/64
Test:
before:
root@debian-s-1vcpu-1gb-fra1-01:/etc/openvpn/server# ping6 2001:4860:4860::8888
PING 2001:4860:4860::8888(2001:4860:4860::8888) 56 data bytes
64 bytes from 2001:4860:4860::8888: icmp_seq=1 ttl=61 time=0.638 ms
64 bytes from 2001:4860:4860::8888: icmp_seq=2 ttl=61 time=0.335 ms
64 bytes from 2001:4860:4860::8888: icmp_seq=3 ttl=61 time=0.351 ms
64 bytes from 2001:4860:4860::8888: icmp_seq=4 ttl=61 time=0.361 ms
^C
--- 2001:4860:4860::8888 ping statistics ---
4 packets transmitted, 4 received, 0% packet loss, time 3075ms
rtt min/avg/max/mdev = 0.335/0.421/0.638/0.126 ms
Started OpenVPN server:
root@debian-s-1vcpu-1gb-fra1-01:/etc/openvpn/server# openvpn --config server.conf
Sun Mar 25 07:42:11 2018 OpenVPN 2.4.0 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Jul 18 2017
Sun Mar 25 07:42:11 2018 library versions: OpenSSL 1.0.2l 25 May 2017, LZO 2.08
Sun Mar 25 07:42:11 2018 Diffie-Hellman initialized with 2048 bit key
Sun Mar 25 07:42:11 2018 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Sun Mar 25 07:42:11 2018 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Sun Mar 25 07:42:11 2018 ROUTE_GATEWAY 167.99.128.1/255.255.240.0 IFACE=eth0 HWADDR=7e:24:69:3c:1d:ce
Sun Mar 25 07:42:11 2018 TUN/TAP device tun0 opened
Sun Mar 25 07:42:11 2018 TUN/TAP TX queue length set to 100
Sun Mar 25 07:42:11 2018 do_ifconfig, tt->did_ifconfig_ipv6_setup=1
Sun Mar 25 07:42:11 2018 /sbin/ip link set dev tun0 up mtu 1500
Sun Mar 25 07:42:11 2018 /sbin/ip addr add dev tun0 local 10.8.0.1 peer 10.8.0.2
Sun Mar 25 07:42:11 2018 /sbin/ip -6 addr add fda6:b39a:4037::1/64 dev tun0
Sun Mar 25 07:42:11 2018 /sbin/ip route add 10.8.0.0/24 via 10.8.0.2
Sun Mar 25 07:42:11 2018 Could not determine IPv4/IPv6 protocol. Using AF_INET
Sun Mar 25 07:42:11 2018 Socket Buffers: R=[212992->212992] S=[212992->212992]
Sun Mar 25 07:42:11 2018 UDPv4 link local (bound): [AF_INET][undef]:1194
Sun Mar 25 07:42:11 2018 UDPv4 link remote: [AF_UNSPEC]
Sun Mar 25 07:42:11 2018 MULTI: multi_init called, r=256 v=256
Sun Mar 25 07:42:11 2018 IFCONFIG POOL IPv6: (IPv4) size=62, size_ipv6=65536, netbits=64, base_ipv6=fda6:b39a:4037::1000
Sun Mar 25 07:42:11 2018 IFCONFIG POOL: base=10.8.0.4 size=62, ipv6=1
Sun Mar 25 07:42:11 2018 IFCONFIG POOL LIST
Sun Mar 25 07:42:11 2018 Initialization Sequence Completed
After:
root@debian-s-1vcpu-1gb-fra1-01:/etc/openvpn/server# ping6 2001:4860:4860::8888
PING 2001:4860:4860::8888(2001:4860:4860::8888) 56 data bytes
^C
--- 2001:4860:4860::8888 ping statistics ---
4 packets transmitted, 0 received, 100% packet loss, time 3051ms
Why does server-ipv6 break the IPv6 connection, or did I forget to do something? From my understanding it should only give IPv6 connectivity inside the tunnel, that's why I'm using this ULA prefix.
