tunnel with IPv6 working but without redirect all v6 host's traffic

Scripts to manage certificates or generate config files
Post Reply
OpenVPN User
Posts: 10
Joined: Mon Feb 07, 2011 1:38 pm

tunnel with IPv6 working but without redirect all v6 host's traffic

Post by s7r » Sun Apr 29, 2018 8:05 pm

Taking the following context:

1. Server running Linux, 1 public IPv4 address (no IPv6 from ISP).
2. OpenVPN tunnel with tap (bridged) that connects to an IPv4 OpenVPN server via UDP and gets: a) 1 dedicated public IPv4 address; b) a /64 public IPv6 subnet to use.

Goal: have the IP addresses (both v4 and v6) of the tunnel lifted and working on the server, to be able to bind to them and listen to them (receive traffic from the internet) but without routing ALL server's traffic via the tunnel.

In IPv4, this can be easily solved by not adding redirect-gateway def1 in config file. This way the public IPv4 address of the tunnel is working on the server, server can listen on it and receive traffic on it but server's own traffic goes via the default ISP gateway . - good.

For IPv6, it only works with route-ipv6 ::\0. What this means it that ALL server's v6 traffic goes via the tunnel. And since (naturally) v6 is preferred over v4, all destinations on the internet (like update mirrors) are accessed using the tunnel. I don't want this. I want to be able to listen to IPv6 address of the tunnel, but not affect server's own traffic in any way.

If I remove ::\0 route, the server cannot be reached any more on v6 address of the tunnel, it does not reply to pings, etc. I tried replacing the route ::\0 with <ipv6>/64 and with Ipv6 gateway (IP with ::1 in the end). These 2 replacements don't work as v6 connectivity is not working entirely (the v6 address of the tunnel is not ping-able from the outside world).

How can this be fixed? I'd also like to connect more config files (tap0, tap1) that assign more /64 IPv6 subnets and use them concurrently, but as I said not for server's own traffic, only for received traffic.


Post Reply