I'm attempting to add IPv6 addresses for my clients. From my provider I got a fixed /64 IPv6 range, I want to subnet it into a /112 range for the OpenVPN clients (I will verify with my internet provider if there are any technical limitations with this idea). The subnetting idea came from several websites, including the OpenVPN documentation regarding IPv6 (all links listed below). My IPv4 setup is working perfectly for at least a year already. So that part is fully tested and functional. For the IPv6 IP allocation I want to use CCD, just like I do with IPv4. Some explanation about the IP's and such. 2001:aaaa:bbbb:1::/64 = Subnet of my provider. 2001:aaaa:bbbb:1:10:1:1::/112 = Subnet I want to use for my OpenVPN clients (reachable for the world). Furthermore, I have 2 tunnel configs. One for UDP and the other for TCP which is routed via my iptable config to use port 443 and share it with Apache. The UDP tunnel is what I use to test IPv6 + IPv4. The TCP tunnel is only IPv4 at the moment. I use OpenVPN 2.4.0-6+deb9u2 on Raspbian 9 (Stretch) which is installed on a Raspberry Pi 3B+. My TCP (IPv4 only) server config. [code] local 10.1.0.1 port 1194 port-share 127.0.0.1 443 proto tcp dev tun ca server/example.com/pki/ca.crt cert server/example.com/pki/issued/vpn.example.com.crt key server/example.com/pki/private/vpn.example.com.key dh server/example.com/dh.pem tls-auth server/example.com/ta.key 0 crl-verify server/example.com/pki/crl.pem server 10.1.1.0 255.255.255.0 push "route 10.1.0.0 255.255.255.0" client-config-dir server/example.com/ccd ccd-exclusive topology subnet learn-address /usr/local/sbin/learn-address.sh script-security 2 push "redirect-gateway def1 bypass-dhcp" push "dhcp-option DNS 10.1.0.1" push "dhcp-option DOMAIN home.lan" push "dhcp-option DOMAIN home.vpn" keepalive 10 30 remote-cert-tls client auth SHA256 cipher AES-128-GCM tls-cipher TLS-DHE-RSA-WITH-AES-128-GCM-SHA256 tls-version-min 1.2 or-highest comp-lzo no push "comp-lzo no" user openvpn group nogroup persist-key persist-tun status /var/log/openvpn-status.log log-append /var/log/openvpn.log verb 3 sndbuf 0 rcvbuf 0 push "sndbuf 0" push "rcvbuf 0" [/code] My UDP (IPv4 + IPv6) server config. The indented stuff is added to the existing IPv4 config. The commented lines will be tested later. [code] local 10.1.0.1 #local 2001:aaaa:bbbb:1:10:1:0:1 port 1194 proto udp #proto udp6 dev tun ca server/example.com/pki/ca.crt cert server/example.com/pki/issued/vpn.example.com.crt key server/example.com/pki/private/vpn.example.com.key dh server/example.com/dh.pem tls-auth server/example.com/ta.key 0 crl-verify server/example.com/pki/crl.pem server 10.1.1.0 255.255.255.0 server-ipv6 2001:aaaa:bbbb:1:10:1:1::/112 push "route 10.1.0.0 255.255.255.0" push "route-ipv6 2001:aaaa:bbbb:1::/64" push "route-ipv6 2000::/3" client-config-dir server/example.com/ccd ccd-exclusive topology subnet learn-address /usr/local/sbin/learn-address.sh script-security 2 push "redirect-gateway def1 bypass-dhcp" #push "redirect-gateway ipv6" push "dhcp-option DNS 10.1.0.1" push "dhcp-option DOMAIN home.lan" push "dhcp-option DOMAIN home.vpn" keepalive 10 30 remote-cert-tls client auth SHA256 cipher AES-128-GCM tls-cipher TLS-DHE-RSA-WITH-AES-128-GCM-SHA256 tls-version-min 1.2 or-highest comp-lzo no push "comp-lzo no" user openvpn group nogroup persist-key persist-tun status /var/log/openvpn-status.log log-append /var/log/openvpn.log verb 5 sndbuf 0 rcvbuf 0 push "sndbuf 0" push "rcvbuf 0" [/code] My mobile phone uses this CCD config to receive a static IPv4 and IPv6 IP. [code] ifconfig-push 10.1.1.3 255.255.255.0 ifconfig-ipv6-push 2001:aaaa:bbbb:1:10:1:1:3/112 2001:aaaa:bbbb:1:10:1:1:1 [/code] eth0 is connected to the internet and is configured with a static IP. [code] source-directory /etc/network/interfaces.d auto lo iface lo inet loopback auto eth0 iface eth0 inet static address 10.1.0.1 netmask 255.255.255.0 gateway 10.1.0.10 dns-nameservers 10.1.0.1 10.1.0.10 dns-search home.lan home.vpn iface eth0 inet6 static address 2001:aaaa:bbbb:1:10:1:0:1 netmask 64 gateway gateway fe80::7eff:aaaa:bbbb:cccc accept_ra 1 privext 2 [/code] This is in my sysctl.conf. [code] #kernel.domainname = example.com #kernel.printk = 3 4 1 3 net.ipv4.conf.default.rp_filter=1 net.ipv4.conf.all.rp_filter=1 net.ipv4.tcp_syncookies=1 net.ipv4.ip_forward=1 #net.ipv6.conf.all.forwarding=1 #net.ipv4.conf.all.accept_redirects = 0 #net.ipv6.conf.all.accept_redirects = 0 #net.ipv4.conf.all.send_redirects = 0 #net.ipv4.conf.all.accept_source_route = 0 #net.ipv6.conf.all.accept_source_route = 0 net.ipv4.conf.all.log_martians = 1 #kernel.sysrq=1 #fs.protected_hardlinks=0 #fs.protected_symlinks=0 net.ipv4.tcp_rfc1337 = 1 net.ipv6.conf.all.forwarding=1 net.ipv6.conf.all.proxy_ndp=1 [/code] Mijn mobiel die verbonden is via de UDP (IPv4 + IPv6) tunnel heeft alleen internet via IPv4. Ik zie in iptables geen drops, ook geen accepts for that matter in de FORWARD chain. Client en server kunnen elkaar niet pingen, internet connectie via IPv6 is voor de client ook niet mogelijk. My phone gets the IPv4 and IPv6 IP's, but connectivity is only possible with IPv4. I don't see any ip6table drops or accepts for that matter (not in INPUT or FORWARD). The client and server can't ping each other. These are the blogs/manuals I consulted. https://community.openvpn.net/openvpn/wiki/IPv6 https://blog.apnic.net/2017/06/09/using-openvpn-ipv6/ https://cuzimageek.wordpress.com/2016/09/21/openvpn-and-ipv6/ https://feeding.cloud.geek.nz/posts/ipv6-and-openvpn-on-linode/ https://techblog.synagila.com/2016/02/24/build-a-openvpn-server-on-ubuntu-to-provide-a-ipv6-tunnel-over-ipv4/ https://blog.kmp.or.at/ipv6-enabled-openvpn/ https://tomsalmon.eu/2013/04/openvpn-ipv6-with-tun-device/ https://blog.angenieux.info/linux/serveur/openvpn-ipv4-ipv6-nat-sans-ndp/ https://forums.openvpn.net/viewtopic.php?t=21051 https://www.bjoerns-techblog.de/2017/07/openvpn-und-ipv6/ My guess is that I'm missing a routing option, here is a relevant snippet of my openvpn.log. [code] rWRwRwRwRwRSat Aug 4 13:48:51 2018 us=319238 intrepid.home.vpn/62.251.111.222:44356 MULTI: bad source address from client [10.1.0.13], packet dropped RwRSat Aug 4 13:48:52 2018 us=640405 intrepid.home.vpn/62.251.111.222:44356 MULTI: bad source address from client [2001:aaa:bbbb:1:10:1:1:3], packet dropped [/code]

See the rest of your logfiles ..

[quote=TinCanTech post_id=80481 time=1533556882 user_id=37053] See the rest of your logfiles .. [/quote] A larger log file can be provided of course, if needed. https://cloud.neobits.nl/s/sjN83GKXanborak

You are not pushing an IPv6 address to for the client tun: [quote]SENT CONTROL [defiant.home.vpn]: 'PUSH_REPLY,route 10.1.0.0 255.255.255.0,route-ipv6 2001:aaaa:bbbb:1::/112,route-ipv6 2000::/3 route-ipv6 2001:aaaa:bbbb:1::/64 1,redirect-gateway def1 bypass-dhcp,redirect-gateway ipv6,dhcp-option DNS 10.1.0.1,dhcp-option DOMAIN home.lan,dhcp-option DOMAIN home.vpn,comp-lzo no,sndbuf 0,rcvbuf 0,tun-ipv6,route-gateway 10.1.1.1,topology subnet,ping 10,ping-restart 30,ifconfig 10.1.1.2 255.255.255.0,peer-id 1,cipher AES-256-GCM' (status=1) [/quote]No --ifconfig-ipv6-push ..

Also, I think you need to reconsider your subnetting: [quote=AquaL1te post_id=80477 time=1533549375 user_id=44728] My TCP (IPv4 only) server config. local 10.1.0.1 [b]port 1194[/b] server [b]10.1.1.0 255.255.255.0[/b] push "route 10.1.0.0 255.255.255.0" [/quote] [quote=AquaL1te post_id=80477 time=1533549375 user_id=44728] My UDP (IPv4 + IPv6) server config local 10.1.0.1 #local 2001:aaaa:bbbb:1:10:1:0:1 [b]port 1194[/b] server [b]10.1.1.0 255.255.255.0[/b] server-ipv6 2001:aaaa:bbbb:1:10:1:1::/112 push "route 10.1.0.0 255.255.255.0" push "route-ipv6 2001:aaaa:bbbb:1::/64" push "route-ipv6 2000::/3" [/quote]

[quote=TinCanTech post_id=80494 time=1533566743 user_id=37053] You are not pushing an IPv6 address to for the client tun: [quote]SENT CONTROL [defiant.home.vpn]: 'PUSH_REPLY,route 10.1.0.0 255.255.255.0,route-ipv6 2001:aaaa:bbbb:1::/112,route-ipv6 2000::/3 route-ipv6 2001:aaaa:bbbb:1::/64 1,redirect-gateway def1 bypass-dhcp,redirect-gateway ipv6,dhcp-option DNS 10.1.0.1,dhcp-option DOMAIN home.lan,dhcp-option DOMAIN home.vpn,comp-lzo no,sndbuf 0,rcvbuf 0,tun-ipv6,route-gateway 10.1.1.1,topology subnet,ping 10,ping-restart 30,ifconfig 10.1.1.2 255.255.255.0,peer-id 1,cipher AES-256-GCM' (status=1) [/quote]No --ifconfig-ipv6-push .. [/quote] On my phone I do see the assigned IPv6 address in the OpenVPN app. I'll post the client logs later today. About the TCP and UDP subnetting, I use a script to support this setup. That (IPv4) works fine. The script below is an old version, the new one checks if IPv4 is used, if so it will continue, otherwise it will exit. [code] #!/bin/bash time_stamp=$(date --rfc-3339=seconds) if [[ $# -lt 3 ]]; then exit 0 else operation=$1 address=$2 common_name=$3 fi case $operation in add|update) echo "$time_stamp $script_type $common_name with $address logged in to $dev" >> /var/log/openvpn-scripts.log sudo ip route del $address/32 sudo ip route add $address/32 dev $dev;; delete) if [[ -n $dev ]]; then echo "$time_stamp $common_name $address deleted from $dev" >> /var/log/openvpn-scripts.log else echo "$time_stamp $common_name $address deleted" >> /var/log/openvpn-scripts.log fi sudo ip route del $address/32 dev $dev ;; *) ;; esac [/code]

I am not going to debug your script but your servers are using overlapping IPv4 .. This will fail.

[quote=TinCanTech post_id=80499 time=1533568171 user_id=37053] I am not going to debug your script but your servers are using overlapping IPv4 .. This will fail. [/quote] IPv4 really works fine, this script handles this overlap. The problem is only IPv6 at the moment ;)

[quote=AquaL1te post_id=80501 time=1533568429 user_id=44728] IPv4 really works fine, this script handles this overlap [/quote]I assure you openvpn does not work fine .. even if it appears to do so. In fact, your complete server logs at verb 4 will probably make interesting reading ..... [quote=AquaL1te post_id=80501 time=1533568429 user_id=44728] The problem is only IPv6 at the moment [/quote]Well, I showed you what is currently wrong with that.

Can`t help you with IPv6. I would follow TinCanTech`s advise. Try to avoid the subnet`s in the list on every network under your control. ;) Met IPv6 kan ik je niet helpen. Het advies van TinCanTech zou ik echter wel volgen. Probeer daarbij de onderstaande subnetten te vermijden op elk netwerk waar je controle over hebt: [code] 10.0.0 10.0.1 10.1.1 10.1.10 10.2.0 10.8.0 10.10.1 10.90.90 10.100.1 10.255.255 169.254 # APIPA # 172.16.0 172.16.16 172.16.42 172.16.68 172.19.3 172.20.10 # IPhone built-in hotspot # 192.168.0 192.168.1 192.168.2 192.168.3 192.168.4 192.168.5 192.168.6 192.168.7 192.168.8 192.168.9 192.168.10 192.168.11 192.168.13 192.168.15 192.168.16 192.168.18 192.168.20 192.168.29 192.168.30 192.168.31 192.168.33 192.168.39 192.168.40 192.168.42 # Android USB tethering # 192.168.43 # Android built-in hotspot # 192.168.50 192.168.55 192.168.61 192.168.62 192.168.65 192.168.77 192.168.80 192.168.85 192.168.88 192.168.98 192.168.99 192.168.100 192.168.101 192.168.102 192.168.111 192.168.123 192.168.126 192.168.129 192.168.137 # Windows Phone built-in hotspot # 192.168.168 192.168.178 192.168.190 192.168.199 192.168.200 192.168.220 192.168.223 192.168.229 192.168.240 192.168.245 192.168.251 192.168.252 192.168.254 200.200.200 [/code]

[quote=TinCanTech post_id=80495 time=1533567350 user_id=37053] Also, I think you need to reconsider your subnetting: [/quote] So with reconsider you mean what Pippin says? Because that does make sense. You didn't specify any specifics, so I assumed you were talking about the double assigned subnets. I can consider Pippin's suggestion later. For now IPv6 is my goal. You did see the CCD config right? That pushes the addresses. This is what I see on my phone: https://cloud.neobits.nl/index.php/apps/files_sharing/ajax/publicpreview.php?x=1920&y=569&a=true&file=Screenshot_OpenVPN_Connect_20180806-201012.png&t=CHszX4DjiSoJxpd&scalingup=0 Here is the log from the client. [code] 20:21:43.288 -- ----- OpenVPN Start ----- 20:21:43.289 -- EVENT: CORE_THREAD_ACTIVE 20:21:43.297 -- Frame=512/2048/512 mssfix-ctrl=1250 20:21:43.313 -- UNUSED OPTIONS 7 [resolv-retry] [infinite] 8 [nobind] 10 [user] [nobody] 11 [group] [nobody] 12 [persist-key] 13 [persist-tun] 15 [auth-nocache] 20 [tls-cipher] [TLS-DHE-RSA-WITH-AES-128-GCM-SHA256] 22 [verb] [3] 23 [sndbuf] [0] 24 [rcvbuf] [0] 20:21:43.318 -- EVENT: RESOLVE 20:21:43.484 -- Contacting xxx.yyy.118.252:1194 via UDP 20:21:43.485 -- EVENT: WAIT 20:21:43.491 -- Connecting to [vpn.example.com]:1194 (xxx.yyy.118.252) via UDPv4 20:21:43.495 -- EVENT: CONNECTING 20:21:43.499 -- Tunnel Options:V4,dev-type tun,link-mtu 1522,tun-mtu 1500,proto UDPv4,comp-lzo,keydir 1,cipher AES-128-GCM,auth SHA256,keysize 128,tls-auth,key-method 2,tls-client 20:21:43.500 -- Creds: UsernameEmpty/PasswordEmpty 20:21:43.500 -- Peer Info: IV_GUI_VER=OC30Android IV_VER=3.2 IV_PLAT=android IV_NCP=2 IV_TCPNL=1 IV_PROTO=2 IV_LZO_STUB=1 IV_COMP_STUB=1 IV_COMP_STUBv2=1 IV_AUTO_SESS=1 20:21:43.602 -- VERIFY OK : depth=0 cert. version : 3 serial number : D0:94:CB:A9:38:BC:4D:1D:9D:6D:1D:2C:E5:7B:EA:2F issuer name : CN=vpn.example.com subject name : CN=vpn.example.com issued on : 2018-06-09 05:07:19 expires on : 2028-06-06 05:07:19 signed using : RSA with SHA-256 RSA key size : 2048 bits basic constraints : CA=false subject alt name : vpn.example.com key usage : Digital Signature, Key Encipherment ext key usage : TLS Web Server Authentication 20:21:43.973 -- SSL Handshake: TLSv1.2/TLS-DHE-RSA-WITH-AES-128-GCM-SHA256 20:21:43.975 -- Session is ACTIVE 20:21:43.977 -- EVENT: GET_CONFIG 20:21:43.984 -- Sending PUSH_REQUEST to server... 20:21:44.165 -- OPTIONS: 0 [route] [10.1.0.0] [255.255.255.0] 1 [route-ipv6] [2001:aaaa:bbbb:1::/64] 2 [route-ipv6] [2001:aaaa:bbbb:1::/112] 3 [route-ipv6] [2000::/3] 4 [redirect-gateway] [def1] [bypass-dhcp] 5 [redirect-gateway] [ipv6] 6 [dhcp-option] [DNS] [10.1.0.1] 7 [dhcp-option] [DOMAIN] [home.lan] 8 [dhcp-option] [DOMAIN] [home.vpn] 9 [comp-lzo] [no] 10 [sndbuf] [0] 11 [rcvbuf] [0] 12 [tun-ipv6] 13 [route-gateway] [10.1.1.1] 14 [topology] [subnet] 15 [ping] [10] 16 [ping-restart] [30] 17 [ifconfig-ipv6] [2001:aaaa:bbbb:1:10:1:1:3/112] [2001:aaaa:bbbb:1:10:1:1:1] 18 [ifconfig] [10.1.1.3] [255.255.255.0] 19 [peer-id] [0] 20 [cipher] [AES-256-GCM] 20:21:44.171 -- PROTOCOL OPTIONS: cipher: AES-256-GCM digest: SHA256 compress: LZO_STUB peer ID: 0 20:21:44.172 -- EVENT: ASSIGN_IP 20:21:44.242 -- TunPersist: saving tun context: Session Name: vpn.example.com Layer: OSI_LAYER_3 Remote Address: xxx.yyy.118.252 Tunnel Addresses: 10.1.1.3/24 -> 10.1.1.1 2001:aaaa:bbbb:1:10:1:1:3/112 -> 2001:aaaa:bbbb:1:10:1:1:1 [IPv6] Reroute Gateway: IPv4=1 IPv6=1 flags=[ ENABLE REROUTE_GW DEF1 BYPASS_DHCP IPv4 IPv6 ] Block IPv6: no Add Routes: 10.1.0.0/24 2001:aaaa:bbbb:1::/64 [IPv6] 2001:aaaa:bbbb:1::/112 [IPv6] 2000::/3 [IPv6] Exclude Routes: DNS Servers: 10.1.0.1 Search Domains: home.lan home.vpn 20:21:44.246 -- Connected via tun 20:21:44.257 -- LZO-ASYM init swap=0 asym=1 20:21:44.261 -- Comp-stub init swap=0 20:21:44.262 -- EVENT: CONNECTED info='@vpn.example.com:1194 (xxx.yyy.118.252) via /UDPv4 on tun/10.1.1.3/2001:aaaa:bbbb:1:10:1:1:3 gw=[10.1.1.1/2001:aaaa:bbbb:1:10:1:1:1]' trans=TO_CONNECTED [/code]

OpenVPN IPv4 + IPv6 tunnel (not working so far...)

AquaL1te

TinCanTech wrote
AquaL1te wrote The IPv6 thing is the problem (which seems semi fixed now).
Looks like it was the firewall then ..

No, because the FORWARD chain didn't have any drops or accepts, as stated in the first post. The config was missing something, which likely was the IPv6 routing I added before I went to bed. Anyway, if this is you leaving, thank you for your criticism. I will keep it in mind if and when sh*t hits the fan.

TinCanTech

As a quick test, you might try without dropping root privileges ..

For example:
Sun Aug 5 09:52:13 2018 us=267119 xxx.yyy.118.252:53338 WARNING: Failed to stat CRL file, not (re)loading CRL.

AquaL1te

TinCanTech wrote As a quick test, you might try without dropping root privileges ..

For example:
Sun Aug 5 09:52:13 2018 us=267119 xxx.yyy.118.252:53338 WARNING: Failed to stat CRL file, not (re)loading CRL.

Or change the ownership of the files 😉 I don't want to run OpenVPN as root, I already run it on a non-SELinux system.

TinCanTech

My point was, that is not all you have over looked .. and I did say "quick test" ......

AquaL1te

It all works now. I now use PREFIX:3::/64 from my PREFIX::/48 range. All I needed to do was to add a static route in my router for this PREFIX:3::/64 to my local-link address on my eth0 of my Raspberry Pi.

« Previous Page