Hi all.
I have a working OpenVPN ipv4 setup running but am struggling do get the server working with ipv6 support. I'm using a Digital Ocean droplet and have
- a public ipv6 address: 2a03:xxxx:3:x0::dc3:7001
- a ipv6 gateway: 2a03:xxxx:3:x0::1
- and a configurable ipv6 address range: 2a03:xxxx:3:x0::dc3:7000 - 2a03:xxxx:3:x0::dc3:700f
My eth0 network interface says (ifconfig):
eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet xx.xxx.xxx.xxx netmask 255.255.240.0 broadcast xx.xxx.xxx.255
inet6 fe80::880c:daff:fe93:2188 prefixlen 64 scopeid 0x20<link>
inet6 2a03:xxxx:3:x0::dc3:7001 prefixlen 64 scopeid 0x0<global>
ether x:xx:xx:xx:xx:xx txqueuelen 1000 (Ethernet)
RX packets 245758 bytes 209829279 (209.8 MB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 137803 bytes 52823146 (52.8 MB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
As far as I understand this, I need to focus on the internal ipv6 (link scope) address to setup OpenVPN. Is that correct? And if so, how do I need to set "server-ipv6" and "route-ipv6" and what else might be missing?
port 1194
proto udp4
proto udp6
dev tun
ca ca.crt
cert server.crt
key server.key
tls-auth ta.key 0
dh dh.pem
cipher AES-256-CBC
auth SHA256
server 10.8.0.0 255.255.255.0
server-ipv6 fe80:0000:0000:0000::/64
ifconfig-pool-persist /var/log/openvpn/ipp.txt
push "dhcp-option DNS 10.8.0.1"
push "redirect-gateway def1 bypass-dhcp"
push tun-ipv6
push "route-ipv6 fe80:0000:0000:0000::/64"
push "dhcp6-option DNS fe80::880c:daff:fe93:2188"
keepalive 10 120
user nobody
group nogroup
persist-key
persist-tun
status /var/log/openvpn/openvpn-status.log
log-append /var/log/openvpn/openvpn.log
verb 3
explicit-exit-notify 1
With this config a startup will throw a couple of errors:
Wed Jan 5 12:06:54 2022 /sbin/ip route del 10.8.0.0/24
RTNETLINK answers: Operation not permitted
Wed Jan 5 12:06:54 2022 ERROR: Linux route delete command failed: external program exited with error status: 2
Wed Jan 5 12:06:54 2022 Closing TUN/TAP interface
Wed Jan 5 12:06:54 2022 /sbin/ip addr del dev tun0 local 10.8.0.1 peer 10.8.0.2
RTNETLINK answers: Operation not permitted
Wed Jan 5 12:06:54 2022 Linux ip addr del failed: external program exited with error status: 2
Wed Jan 5 12:06:54 2022 /sbin/ip -6 addr del fe80::1/64 dev tun0
RTNETLINK answers: Operation not permitted
Wed Jan 5 12:06:54 2022 Linux ip -6 addr del failed: external program exited with error status: 2
Wed Jan 5 12:06:54 2022 SIGTERM[hard,] received, process exiting
Wed Jan 5 12:06:54 2022 OpenVPN 2.4.7 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Jul 19 2021
Wed Jan 5 12:06:54 2022 library versions: OpenSSL 1.1.1f 31 Mar 2020, LZO 2.10
Wed Jan 5 12:06:54 2022 Diffie-Hellman initialized with 2048 bit key
Wed Jan 5 12:06:54 2022 Outgoing Control Channel Authentication: Using 256 bit message hash 'SHA256' for HMAC authentication
Wed Jan 5 12:06:54 2022 Incoming Control Channel Authentication: Using 256 bit message hash 'SHA256' for HMAC authentication
Wed Jan 5 12:06:54 2022 ROUTE_GATEWAY xx.xxx.xxx.1/255.255.240.0 IFACE=eth0 HWADDR=x:xx:xx:xx:xx:xx
Wed Jan 5 12:06:54 2022 TUN/TAP device tun0 opened
Wed Jan 5 12:06:54 2022 TUN/TAP TX queue length set to 100
Wed Jan 5 12:06:54 2022 /sbin/ip link set dev tun0 up mtu 1500
Wed Jan 5 12:06:54 2022 /sbin/ip addr add dev tun0 local 10.8.0.1 peer 10.8.0.2
Wed Jan 5 12:06:54 2022 /sbin/ip -6 addr add fe80::1/64 dev tun0
Wed Jan 5 12:06:54 2022 /sbin/ip route add 10.8.0.0/24 via 10.8.0.2
Wed Jan 5 12:06:54 2022 Socket Buffers: R=[212992->212992] S=[212992->212992]
Wed Jan 5 12:06:54 2022 setsockopt(IPV6_V6ONLY=0)
Wed Jan 5 12:06:54 2022 UDPv6 link local (bound): [AF_INET6][undef]:1194
Wed Jan 5 12:06:54 2022 UDPv6 link remote: [AF_UNSPEC]
Wed Jan 5 12:06:54 2022 GID set to nogroup
Wed Jan 5 12:06:54 2022 UID set to nobody
Wed Jan 5 12:06:54 2022 MULTI: multi_init called, r=256 v=256
Wed Jan 5 12:06:54 2022 IFCONFIG POOL IPv6: (IPv4) size=62, size_ipv6=65536, netbits=64, base_ipv6=fe80::1000
Wed Jan 5 12:06:54 2022 IFCONFIG POOL: base=10.8.0.4 size=62, ipv6=1
Wed Jan 5 12:06:54 2022 ifconfig_pool_read(), in='client1,10.8.0.4,fe80::1000', TODO: IPv6
Wed Jan 5 12:06:54 2022 succeeded -> ifconfig_pool_set()
Wed Jan 5 12:06:54 2022 ifconfig_pool_read(), in='client2,10.8.0.8,fe80::1001', TODO: IPv6
Wed Jan 5 12:06:54 2022 succeeded -> ifconfig_pool_set()
Wed Jan 5 12:06:54 2022 ifconfig_pool_read(), in='client3,10.8.0.12,fe80::1002', TODO: IPv6
Wed Jan 5 12:06:54 2022 succeeded -> ifconfig_pool_set()
Wed Jan 5 12:06:54 2022 IFCONFIG POOL LIST
Wed Jan 5 12:06:54 2022 client1,10.8.0.4,fe80::1000
Wed Jan 5 12:06:54 2022 client2,10.8.0.8,fe80::1001
Wed Jan 5 12:06:54 2022 client3,10.8.0.12,fe80::1002
Wed Jan 5 12:06:54 2022 Initialization Sequence Completed
Connecting via ipv4 is still working without any issues. Connecting to my public ipv6 will throw this error on client side
⏎[Jan 5, 2022, 12:10:22] EVENT: RECONNECTING ⏎[Jan 5, 2022, 12:10:22] EVENT: RESOLVE ⏎[Jan 5, 2022, 12:10:22] Contacting [2a03:xxxx:3:x0::dc3:7001]:1194 via UDP
⏎[Jan 5, 2022, 12:10:22] EVENT: WAIT ⏎[Jan 5, 2022, 12:10:22] UnixCommandAgent: transmitting bypass route to /var/run/agent_ovpnconnect.sock
{
"host" : "2a03:xxxx:3:x0::dc3:7001",
"ipv6" : true,
"pid" : 31918
}
⏎[Jan 5, 2022, 12:10:22] Transport Error: UDP connect error on '2a03:xxxx:3:x0::dc3:7001:1194' ([2a03:xxxx:3:x0::dc3:7001]:1194): No route to host
⏎[Jan 5, 2022, 12:10:22] Client terminated, restarting in 2000 ms...
⏎
I really would love to make this work, but I'm a bit lost atm 🙁 Can anybody please give me some advice on where to start getting this straighten out?
Any help is appreciated.
