You are not logged in.

Pages: 1

#1 2012-07-15 09:14:13

dextro_
Member
Registered: 2009-09-07
Posts: 24

Acting as a ipv6 gateway.

I have followed the guide at https://wiki.archlinux.org/index.php/Internet_Share and my Internet works using the machine as a gateway but not the "Intranet". There is a ipv6 tun0 interface that lets me access some private things which work fine on the machine itself. I can wget http://[fc3a:2804:615a:b34f:abfe:c7d5:65d6:f50c]/ but can not access it from computers using the machine as a gateway.

Anyone know why not?

P.S. I did do the extra `echo 1 > /proc/sys/net/ipv6/conf/default/forwarding` and `echo 1 > /proc/sys/net/ipv6/conf/all/forwarding` commands.

Offline

#2 2012-07-15 22:44:58

fukawi2
Ex-Administratorino
From: .vic.au
Registered: 2007-09-28
Posts: 6,237
Website

Re: Acting as a ipv6 gateway.

Do your ip6tables rules allow forwarding? iptables only applies to IPv4 traffic.

Are you familiar with our Forum Rules, and How To Ask Questions The Smart Way?

BlueHackers // fscanary // resticctl

Offline

#3 2012-07-16 00:16:27

dextro_
Member
Registered: 2009-09-07
Posts: 24

Re: Acting as a ipv6 gateway.

fukawi2 wrote:

Do your ip6tables rules allow forwarding? iptables only applies to IPv4 traffic.

[root@alarm ~]# ip6tables -t nat -A POSTROUTING -o tun0 -j MASQUERADE
ip6tables v1.4.14: can't initialize ip6tables table `nat': Table does not exist (do you need to insmod?)
Perhaps ip6tables or your kernel needs to be upgraded.
[root@alarm ~]#

Edit: http://docs.redhat.com/docs/en-US/Red_H … ables.html

Most directives for this command are identical to those used for iptables, except the nat table is not yet supported. This means that it is not yet possible to perform IPv6 network address translation tasks, such as masquerading and port forwarding.

sad

Last edited by dextro_ (2012-07-16 00:18:38)

Offline

#4 2012-07-16 08:28:01

Gcool
Member
Registered: 2011-08-16
Posts: 1,456

Re: Acting as a ipv6 gateway.

Nat shouldn't be of any concern here.
What does you entire iptables config look like (particulary the FORWARD chain would be interesting)?

Burninate!

Offline

#5 2012-07-16 23:13:40

fukawi2
Ex-Administratorino
From: .vic.au
Registered: 2007-09-28
Posts: 6,237
Website

Re: Acting as a ipv6 gateway.

Gcool wrote:

Nat shouldn't be of any concern here.

Correct; that's the whole point of IPv6; we don't have to be quite so conservative with addresses anymore wink

Gcool wrote:

What does you entire iptables config look like (particulary the FORWARD chain would be interesting)?

That was what I was getting at, sorry. I should have been clearer.

Are you familiar with our Forum Rules, and How To Ask Questions The Smart Way?

BlueHackers // fscanary // resticctl

Offline

#6 2012-07-17 01:09:00

dextro_
Member
Registered: 2009-09-07
Posts: 24

Re: Acting as a ipv6 gateway.

Gcool wrote:

Nat shouldn't be of any concern here.
What does you entire iptables config look like (particulary the FORWARD chain would be interesting)?

Only commands I have entered on the machine are

echo 1 > /proc/sys/net/ipv4/ip_forward
echo 1 > /proc/sys/net/ipv6/conf/default/forwarding
echo 1 > /proc/sys/net/ipv6/conf/all/forwarding

iptables -t nat -A POSTROUTING -o tun0 -j MASQUERADE
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

Edit: I have just learned I could be leasing IPv6 to my clients as well with dnsmasq which I am already using. I don't understand all this www.tunnelbroker.net crap though why can't I just pick a range like IPv4?

Last edited by dextro_ (2012-07-17 03:40:15)

Offline

#7 2012-07-17 23:21:10

fukawi2
Ex-Administratorino
From: .vic.au
Registered: 2007-09-28
Posts: 6,237
Website

Re: Acting as a ipv6 gateway.

dextro_ wrote:

Only commands I have entered on the machine are

echo 1 > /proc/sys/net/ipv4/ip_forward
echo 1 > /proc/sys/net/ipv6/conf/default/forwarding
echo 1 > /proc/sys/net/ipv6/conf/all/forwarding

iptables -t nat -A POSTROUTING -o tun0 -j MASQUERADE
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

You also need to ensure ip6tables is allowing the traffic:

ip6tables -I FORWARD -j ACCEPT
dextro_ wrote:

....why can't I just pick a range like IPv4?

Because of 2 reasons:
1) IPv6 addresses are globally unique and you don't want to conflict with someone else.
2) IPv6 addresses are globally unique and therefore need to be routed appropriately upstream from you so you can send/receive packets successfully.

Are you familiar with our Forum Rules, and How To Ask Questions The Smart Way?

BlueHackers // fscanary // resticctl

Offline

#8 2012-07-18 04:09:10

dextro_
Member
Registered: 2009-09-07
Posts: 24

Re: Acting as a ipv6 gateway.

fukawi2 wrote:

You also need to ensure ip6tables is allowing the traffic:

ip6tables -I FORWARD -j ACCEPT

Still doesn't work after that command I assume because the clients don't have IPv6?

fukawi2 wrote:

Because of 2 reasons:
1) IPv6 addresses are globally unique and you don't want to conflict with someone else.
2) IPv6 addresses are globally unique and therefore need to be routed appropriately upstream from you so you can send/receive packets successfully.

There is not private network range?

I already have a globally unique IPv6 on my tun0 interface that was assigned by upstream and everything works on the machine itself but the machines using it as a gateway can't access tun0

Last edited by dextro_ (2012-07-18 04:10:22)

Offline

#9 2012-07-18 23:58:14

fukawi2
Ex-Administratorino
From: .vic.au
Registered: 2007-09-28
Posts: 6,237
Website

Re: Acting as a ipv6 gateway.

dextro_ wrote:

There is not private network range?

There should be no need to; NAT was a hack designed as a workaround to the address shortage problem in IPv4. That problem doesn't exist with IPv6, so NAT is not longer required.

dextro_ wrote:

I already have a globally unique IPv6 on my tun0 interface that was assigned by upstream and everything works on the machine itself but the machines using it as a gateway can't access tun0

They should have assigned you at least a /64, if not a /56. You'll need to split that up into smaller subnets (/56 into /64's or /64 into /96's etc) to assign to your internal network. This is an article I wrote about the mechanics of addressing your internal network(s): http://ipv6business.blogspot.com.au/201 … -ipv6.html

Last edited by fukawi2 (2012-07-18 23:58:41)

Are you familiar with our Forum Rules, and How To Ask Questions The Smart Way?

BlueHackers // fscanary // resticctl

Offline

#10 2012-07-19 15:46:11

Gnarl
Member
Registered: 2010-11-18
Posts: 63

Re: Acting as a ipv6 gateway.

I've recently done this with my network.

fe80:: is your internal address and is not world routable.

Each machine you want to be able to access outside world needs a world routable address

Each interface you want to route world routable traffic through needs is own world routable address and subnetting rules still apply.

You can get another subnet through tunnelborker.net probably a /48.

My Config:

he-ipv6 is my external
eth0 is my internal

radvd serves the eth0 subnet so my clients auto configure (based on their mac in linux)

eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 40:61:86:f4:5d:b3 brd ff:ff:ff:ff:ff:ff
    inet 192.168.2.1/24 brd 192.168.2.255 scope global eth0
    inet6 2001:XXXX:XXXX::1/64 scope global 
       valid_lft forever preferred_lft forever
    inet6 fe80::4261:86ff:fef4:5db3/64 scope link 
       valid_lft forever preferred_lft forever
6: sit0: <NOARP> mtu 1480 qdisc noop state DOWN 
    link/sit 0.0.0.0 brd 0.0.0.0
7: he-ipv6: <POINTOPOINT,NOARP,UP,LOWER_UP> mtu 1472 qdisc noqueue state UNKNOWN 
    link/sit 192.168.2.1 peer 216.66.38.58
    inet6 2001:YYYY:YYYY:YYYY::2/64 scope global 
       valid_lft forever preferred_lft forever
    inet6 fe80::c0a8:201/128 scope link 
       valid_lft forever preferred_lft forever

radvd.conf

interface eth0 { 
        AdvSendAdvert on;
	MinRtrAdvInterval 3; 
        MaxRtrAdvInterval 10;
        prefix 2001:XXXX:XXXX::1/64 { 
                AdvOnLink on; 
		AdvRouterAddr on;
                AdvAutonomous on; 
        };
	clients {
		fe80::21a:92ff:fe20:fbaa;
		fe80::a00:27ff:fe57:51df;
		fe80::6508:8d39:59e6:31b3;
		fe80::346f:1c19:f5ff:fdf0;	
	};
	RDNSS 2001:YYYY:YYYY:YYYY::2 {   # I have 2 DNS servers
        };
};

And be sure to setup an ip6tables firewall as your router will not filter this traffic through a tunnel

#!/bin/bash
IPT6="/usr/sbin/ip6tables"
PUBIF="he-ipv6"
echo "Starting IPv6 firewall..."
$IPT6 -F
$IPT6 -X
$IPT6 -t mangle -F
$IPT6 -t mangle -X
 
#unlimited access to loopback
$IPT6 -A INPUT -i lo -j ACCEPT
$IPT6 -A OUTPUT -o lo -j ACCEPT
 
# DROP all incomming traffic
$IPT6 -P INPUT DROP
$IPT6 -P OUTPUT DROP
$IPT6 -P FORWARD DROP
 
# Allow internal ingerfaces
$IPT6 -A INPUT -i eth0 -j ACCEPT
$IPT6 -A OUTPUT -o eth0 -j ACCEPT



# Allow full outgoing connection but no incomming stuff
$IPT6 -A INPUT -i $PUBIF -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPT6 -A FORWARD -i $PUBIF -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPT6 -A FORWARD -o $PUBIF -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
$IPT6 -A OUTPUT -o $PUBIF -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
 
# allow incoming ICMP ping pong stuff
$IPT6 -A INPUT -i $PUBIF -p ipv6-icmp -j ACCEPT
$IPT6 -A OUTPUT -o $PUBIF -p ipv6-icmp -j ACCEPT
 
############# add your custom rules below ############
### open IPv6  port 80 
#$IPT6 -A INPUT -i $PUBIF -p tcp --destination-port 80 -j ACCEPT
### open IPv6  port 22
#$IPT6 -A INPUT -i $PUBIF -p tcp --destination-port 22 -j ACCEPT
### open IPv6  port 25
#$IPT6 -A INPUT -i $PUBIF -p tcp --destination-port 25 -j ACCEPT
############ End custom rules ################
 
#### no need to edit below ###
# log everything else
$IPT6 -A INPUT -i $PUBIF -j LOG
$IPT6 -A INPUT -i $PUBIF -j DROP

Last edited by Gnarl (2012-07-19 15:49:05)

Offline

Pages: 1

Board footer

Powered by FluxBB