Server IPv6 configuration problem

Kolusion

OpenVPN version 2.4.7

I setup my server with IPv4 and got things working to my liking, then I used this article to try and convert it to IPv6:

https://community.openvpn.net/openvpn/wiki/IPv6

The article has a problem as the --server parameter is missing which is required to start the server (when I try to start the server, it exits with the error saying the --server directive is missing).

The OpenVPN 2.4 reference manual says to use the --server directive with an IP address and netmask, but I don't know how to find out what the netmask is for the IP address 0000:0000:0000:0000:0000:0000:0000:0001.

Also, here is my server configuration file. Does everything look functional?

auth-nocache
dev tun
ifconfig-ipv6 0000:0000:0000:0000:0000:0000:0000:0001 0000:0000:0000:0000:0000:0000:0000:0002
secret server/static.key
comp-lzo
user nobody
group nogroup
daemon
server 0000:0000:0000:0000:0000:0000:0000:0000
server-ipv6 0000:0000:0000:0000:0000:0000:0000:0001/64
persist-tun
persist-key
proto udp6

Kolusion

Well I found out about the unique local address space in IPv6, so changed the IP addresses to be in that space, but things still don't work.

This is an image of my servers' configuration file plus the error messages it gives when I try to start the server.

ordex

Hi, --server is for configuring an IPv4 space, while --server-ipv6 is for configuring an IPv6 space.
Sadly your OpenVPN version is too old and IPv6 only configurations are not supported.
If you want to configure IPv6 only I think you should use at least OpenVPN 2.5.0, but I'd recommend to switch directly to a more modern 2.6.x version.

Kolusion

Thanks for telling me about the --server-ipv6 directive.

I now see where the problem is, its OpenVPN's documentation.

https://community.openvpn.net/openvpn/wiki/IPv6

Under the additional OpenVPN config section, it says there is two ways to configure: Using a helper directive or expanding a helper directive. Expanding says to use "stanza".

Well, I never saw the word " stanza" when using the how-to guide, so I thought this section does not apply to me.

https://openvpn.net/community-resources/static-key-mini-howto/

Static Key How-To covers IPv4 only. IPv6 is starting to become more common. It think it would be a good idea to make a seperate section for IPv6. For me, that IPv6 page is just terrible compared to the How-To. It took me just 15 minutes to get OpenVPN working using that How-To, but today is day 3 and I still can't get IPv6 working.

I tried the same version of OpenVPN two years ago but I couldn't get it working because poor documentation. I left feedback, and now the How-To has been updated and I got it working in 15 minutes. This demonstrates the IPv6 problem is a documentation problem.

Also, I never used the --server directive at the start. None of the documents said to use it. I only used it after OpenVPN complained it was missing.

IPv6 is new to me. Perhaps my IPv6 IP address is invalid and OpenVPN interprets it as an IPv4 IP address, which is why it mentioned the --server directive is missing.

No, my version of OpenVPN does supports IPv6. You can see IPv6 mentioned in the reference manual.

https://openvpn.net/community-resources/reference-manual-for-openvpn-2-4/

I will try --server-ipv6 later and report back.

Thanks

Kolusion

So I deleted the --server directive, and of course now OpenVPN is complaining it is missing, like I said before.

So, the IPv6 documentation sucks. Also, like I said. 🙂

And OpenVPN Inc. hopes I will pay for the more complex product when it cannot even get the basic product working. 😛

Kolusion

Maybe OpenVPN thinks I want IPv4 which is why it is demanding I use --server? If I was the engineer, I would not assume the user wants IPv4 unless they have asked for IPv4. But before there was IPv6, there was only IPv4, so perhaps this behaviour is kept for familiarity.

I am looking around now to see if there is a directive to turn off IPv4 or to direct IPv6 only.

Kolusion

I have had enough of the bull shit. I promised myself if I could not get it working today then I would dump OpenVPN and return to Poptop with EAP-TLS. Poptop is based on PPP and not as advanced as OpenVPN, but the difference between Poptop and OpenVPN is that Poptop works and OpenVPN doesn't work... at least not when you follow the instructions. 🙂 And this why PPTP is still the most dominant VPN solution and why Microsoft continue to support it in Windows 11. 🙂

Thanks everyone for the time. See you again in 2 years. 🙂

RemoteOne

FYI - OpenVPN 2.6.5 is still free - It was recommended to you because it is more feature rich and has had many improvements since 2.4.n - I am sure IPv6 support has been vastly improved sinece the early support was added.

https://openvpn.net/community-downloads/

Kolusion

Its the documentation that is the problem, not the code. I can't use what I don't understand and I'm not someone that tinkers anymore. 🙂