Good afternoon!
We've been trying to get an OpenVPN Community Edition server setup to route all traffic through IPv6, but listen on IPv4.
Originally the server was running 2.4.9 and everything was running successfully. We had a server and server-ipv6 line and the tunnel had an ipv4 address and ipv6 address. However we weren't able to configure it with just server-ipv6. We upgraded the server to 2.5.5 and then we were able to to remove the server line and configure it to only have server-ipv6 and once we started up OpenVPN on the server the tunnel only had an ipv6 address (ran ifconfig and tun0 shows only an inet6 address). Unfortunately on the client end the tunnel isn't coming up (no tun showing up in ifconfig or route and we can't ping across) even though the service is able to start up successfully. The client is currently running 2.4.0.
port 443
proto tcp6-server
dev tun0
ca /etc/openvpn/server/ca_crt.pem
cert /etc/openvpn/server/crt.pem
key /etc/openvpn/server/pr.pem # This file should be kept secret
dh /etc/openvpn/server/dh2048.pem
topology subnet
server-ipv6 <remote server removed>/64
ifconfig-pool-persist ipp.txt
push "route <remote server dns name removed> 255.255.255.255 net_gateway 0"
push "route 10.0.0.0 255.0.0.0 net_gateway"
push "route 172.16.0.0 255.240.0.0 net_gateway"
push "route 192.168.0.0 255.255.0.0 net_gateway"
push "redirect-gateway def1 bypass-dhcp"
keepalive 10 120
tls-auth /etc/openvpn/server/ta.key 0 # This file is secret
key-direction 0
auth SHA256
cipher AES-256-GCM
comp-lzo
max-clients 10
user openvpn
group openvpn
persist-key
persist-tun
status /var/log/openvpn-service-status.log
verb 4
explicit-exit-notify 0
client
dev tun
proto tcp-client
remote <remote server ip removed> 443 tcp4
remote <remote server ip removed> 443 tcp6
verify-x509-name <remote server dns name removed> name
resolv-retry infinite
nobind
allow-pull-fqdn
user nobody
group nogroup
persist-key
persist-tun
cipher AES-256-GCM
auth SHA256
key-direction 1
comp-lzo
verb 4
cert /etc/nginx/certs/crt.pem
key /etc/nginx/certs/pr.pem
ca /etc/nginx/certs/ca_crt.pem
tls-auth /etc/openvpn/client/ta.key 1
Additional Details:
OpenVPN Server Version:
OpenVPN 2.5.5 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Dec 15 2021
library versions: OpenSSL 1.1.1 11 Sep 2018, LZO 2.08
Originally developed by James Yonan
Copyright (C) 2002-2021 OpenVPN Inc <sales@openvpn.net>
Compile time defines: enable_async_push=no enable_comp_stub=no enable_crypto_ofb_cfb=yes enable_debug=yes enable_def_auth=yes enable_dependency_tracking=no enable_dlopen=unknown enable_dlopen_self=unknown enable_dlopen_self_static=unknown enable_fast_install=needless enable_fragment=yes enable_iproute2=yes enable_libtool_lock=yes enable_lz4=yes enable_lzo=yes enable_maintainer_mode=no enable_management=yes enable_multihome=yes enable_pam_dlopen=no enable_pedantic=no enable_pf=yes enable_pkcs11=yes enable_plugin_auth_pam=yes enable_plugin_down_root=yes enable_plugins=yes enable_port_share=yes enable_selinux=no enable_shared=yes enable_shared_with_static_runtimes=no enable_silent_rules=no enable_small=no enable_static=yes enable_strict=no enable_strict_options=no enable_systemd=yes enable_werror=no enable_win32_dll=yes enable_x509_alt_username=yes with_aix_soname=aix with_crypto_library=openssl with_gnu_ld=yes with_mem_check=no with_sysroot=no
OpenVPN Client Version:
OpenVPN 2.4.0 arm-unknown-linux-gnueabihf [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Oct 14 2018
library versions: OpenSSL 1.0.2u 20 Dec 2019, LZO 2.08
Originally developed by James Yonan
Copyright (C) 2002-2017 OpenVPN Technologies, Inc. <sales@openvpn.net>
Compile time defines: enable_async_push=no enable_comp_stub=no enable_crypto=yes enable_crypto_ofb_cfb=yes enable_debug=yes enable_def_auth=yes enable_dependency_tracking=no enable_dlopen=unknown enable_dlopen_self=unknown enable_dlopen_self_static=unknown enable_fast_install=yes enable_fragment=yes enable_iproute2=yes enable_libtool_lock=yes enable_lz4=yes enable_lzo=yes enable_maintainer_mode=no enable_management=yes enable_multi=yes enable_multihome=yes enable_pam_dlopen=no enable_password_save=yes enable_pedantic=no enable_pf=yes enable_pkcs11=yes enable_plugin_auth_pam=yes enable_plugin_down_root=yes enable_plugins=yes enable_port_share=yes enable_selinux=no enable_server=yes enable_shared=yes enable_shared_with_static_runtimes=no enable_silent_rules=no enable_small=no enable_static=yes enable_strict=no enable_strict_options=no enable_systemd=yes enable_werror=no enable_win32_dll=yes enable_x509_alt_username=yes with_crypto_library=openssl with_gnu_ld=yes with_mem_check=no with_plugindir='${prefix}/lib/openvpn' with_sysroot=no
Server's openvpn-server-status.log:
TITLE,OpenVPN 2.5.5 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Dec 15 2021
TIME,2022-02-10 23:14:43,1644534883
HEADER,CLIENT_LIST,Common Name,Real Address,Virtual Address,Virtual IPv6 Address,Bytes Received,Bytes Sent,Connected Since,Connected Since (time_t),Username,Client ID,Peer ID,Data Channel Cipher
CLIENT_LIST,<client name>,<ip removed>:35266,,<ip removed>,3505,5771,2022-02-10 23:12:29,1644534749,UNDEF,4,0,AES-256-GCM
HEADER,ROUTING_TABLE,Virtual Address,Common Name,Real Address,Last Ref,Last Ref (time_t)
ROUTING_TABLE,<ip removed>,<client name>,<ip removed>:35266,2022-02-10 23:12:31,1644534751
GLOBAL_STATS,Max bcast/mcast queue length,2
END
Server ifconfig:
ens5: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 9001
inet <removed> netmask 255.255.240.0 broadcast <removed>
inet6 <removed> prefixlen 64 scopeid 0x20<link>
ether <removed> txqueuelen 1000 (Ethernet)
RX packets 3290918 bytes 2330341778 (2.3 GB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 3020636 bytes 958455172 (958.4 MB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
lo: flags=73<UP,LOOPBACK,RUNNING> mtu 65536
inet 127.0.0.1 netmask 255.0.0.0
inet6 ::1 prefixlen 128 scopeid 0x10<host>
loop txqueuelen 1000 (Local Loopback)
RX packets 22498 bytes 1868445 (1.8 MB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 22498 bytes 1868445 (1.8 MB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
tun0: flags=4305<UP,POINTOPOINT,RUNNING,NOARP,MULTICAST> mtu 1500
inet6 <removed> prefixlen 64 scopeid 0x0<global>
inet6 <removed> prefixlen 64 scopeid 0x20<link>
unspec 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00 txqueuelen 500 (UNSPEC)
RX packets 0 bytes 0 (0.0 B)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 9 bytes 432 (432.0 B)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
Server uname -a:
Linux server 4.15.0-1019-aws #19-Ubuntu SMP Fri Aug 10 09:34:35 UTC 2018 x86_64 x86_64 x86_64 GNU/Linux
Client ifconfig:
eth0: flags=4099<UP,BROADCAST,MULTICAST> mtu 1500
ether <removed> txqueuelen 1000 (Ethernet)
RX packets 0 bytes 0 (0.0 B)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 0 bytes 0 (0.0 B)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
lo: flags=73<UP,LOOPBACK,RUNNING> mtu 65536
inet 127.0.0.1 netmask 255.0.0.0
inet6 ::1 prefixlen 128 scopeid 0x10<host>
loop txqueuelen 1000 (Local Loopback)
RX packets 3790363 bytes 259973778 (247.9 MiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 3790363 bytes 259973778 (247.9 MiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
wlan0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet <removed> netmask 255.255.255.0 broadcast <removed>
inet6 <removed> prefixlen 64 scopeid 0x20<link>
inet6 <removed> prefixlen 64 scopeid 0x0<global>
ether <removed> txqueuelen 1000 (Ethernet)
RX packets 63661 bytes 8256204 (7.8 MiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 54629 bytes 9447339 (9.0 MiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
Client uname -a:
Linux client 4.19.66-v7+ #1253 SMP Thu Aug 15 11:49:46 BST 2019 armv7l GNU/Linux
I may have gone a little overboard on removing IPs so if there isn't enough information, please lease let me know.
Thank you!
