Hi there,
I am trying to setup IPv6 for OpenVPN. I do not need to reach the server via IPv6, but mainly want to tunnel my IPv6 traffic as I do with my IPv4. It does not make sense to have the VPN only on IPv4, if it gets bypassed in IPv6 Networks. So both should be active.
My IPv4 Setup was working now for several years without as well as within docker, however I fail to properly setup the IPv6 part.
Within my IPv4 Setup, I have a local subnet for the VPN and I am trying to setup the same with IPv6 (so no routable IPv6, using NAT as with IPv4). I manage to get the Server running and have my client connect to it, however I do not get internet access for IPv6. I can ping the server, however nothing else gets through)
It feels like I read half the internet on this, but can't figure out a working setup. Can anyone help?
Here my config and routes:
server 192.168.255.0 255.255.255.0
server-ipv6 fd00::192:168:255:0/112
log-append /dev/stdout
verb 3
key /etc/openvpn/pki/private/server.key
ca /etc/openvpn/pki/ca.crt
cert /etc/openvpn/pki/issued/server.crt
dh /etc/openvpn/pki/dh.pem
tls-crypt /etc/openvpn/pki/ta.key
remote-cert-eku "TLS Web Client Authentication"
keepalive 10 60
persist-key
persist-tun
tun-ipv6
proto tcp
# Rely on Docker to do port mapping, internally always 1194
port 1194
port-share webserver 8443
dev tun0
user nobody
group nogroup
### Route Configurations Below
route 192.168.255.0 255.255.255.0
### Push Configurations Below
push 'redirect-gateway def1 bypass-dhcp ipv6'
push 'route 192.168.255.0 255.255.255.0'
push 'route-ipv6 fd00::192:168:255:0/112'
push 'dhcp6-option DNS fd00::192:168:255:1'
push 'route-ipv6 2000::/3'
push 'block-outside-dns'
### Extra Configurations Below
tls-version-min 1.2
script-security 2
tls-cipher TLS-ECDHE-ECDSA-WITH-AES-256-GCM-SHA384:TLS-ECDHE-RSA-WITH-AES-256-GCM-SHA384:TLS-DHE-RSA-WITH-AES-256-GCM-SHA384
cipher AES-256-GCM
ncp-disable
auth SHA512
client
remote '[my server]'
tun-ipv6
ca '/home/chris/.cert/nm-openvpn/laptop-ca.pem'
cert '/home/chris/.cert/nm-openvpn/laptop-cert.pem'
key '/home/chris/.cert/nm-openvpn/laptop-key.pem'
cipher AES-256-GCM
dev tun
dev-type tun
proto tcp
port 1194
remote-cert-tls server
tls-crypt '/home/chris/.cert/nm-openvpn/laptop-tls-auth.pem'
nobind
auth-nocache
script-security 2
persist-key
persist-tun
user nm-openvpn
group nm-openvpn
I am using "kylemanna/openvpn" container with ndpd on the host and "robbertkl/ipv6nat" to mimic IPV4 docker NAT rules. My docker compose:
version: "2.4"
services:
openvpn:
image: kylemanna/openvpn
container_name: openvpn
hostname: [my server]
restart: always
privileged: true
ports:
- "1194:1194/tcp"
cap_add:
- NET_ADMIN
volumes:
- type: bind
source: /srv/etc/openvpn
target: /etc/openvpn
sysctls:
- net.ipv6.conf.all.disable_ipv6=0
- net.ipv6.conf.default.forwarding=1
- net.ipv6.conf.all.forwarding=1
logging:
driver: syslog
options:
tag: "docker/{{.Name}}"
networks:
server-network:
ipv4_address: 192.168.4.3
ipv6_address: fd00::192:168:4:3
aliases:
- openvpn
networks:
server-network:
external: true
After connection my client has following IPv6 and routes (I removed some private info)
7: tun0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 state UNKNOWN qlen 100
inet6 fd00::192:168:255:1000 peer fd00::192:168:255:1/112 scope global noprefixroute
valid_lft forever preferred_lft forever
inet6 fe80::5c17:de54:1a16:2116/64 scope link stable-privacy
valid_lft forever preferred_lft forever
------------
::1 dev lo proto kernel metric 256 pref medium
[prefix]::/64 dev wlp4s0 proto ra metric 600 pref medium
2000::/4 via fd00::192:168:255:1 dev tun0 proto static metric 50 pref medium
3000::/4 via fd00::192:168:255:1 dev tun0 proto static metric 50 pref medium
2000::/3 via fd00::192:168:255:1 dev tun0 proto static metric 50 pref medium
fd00::192:168:255:1 dev tun0 proto kernel metric 50 pref medium
fd00::192:168:255:1 dev tun0 proto kernel metric 256 pref medium
fd00::192:168:255:1000 dev tun0 proto kernel metric 50 pref medium
fd00::192:168:255:0/112 via fd00::192:168:255:1 dev tun0 proto static metric 50 pref medium
fc00::/7 via fd00::192:168:255:1 dev tun0 proto static metric 50 pref medium
fe80::/64 dev wlp4s0 proto kernel metric 256 pref medium
fe80::/64 dev wlp4s0 proto kernel metric 600 pref medium
default dev tun0 proto static metric 50 pref medium
default via fe80::[MAC based] dev wlp4s0 proto ra metric 600 pref medium
