Archlinux as dual-stack (IPv4/v6) gateway/router

unifiedlinux · 2012-11-03 22:16:00

Hello everyone,

i've installed Arch on my PC a few days ago and it works perfectly, the PC is a gaming PC (Asus P8P67 Deluxe, Intel Core i3 2100, 14 GB RAM, 2x Nvidia GTX580) however for specific reasons (i don't have anything else besides IBM PCs with 600Mhz CPUs) i need to use it as a server and a router/gateway for my network (an Archlinux laptop and some Apple products), here's my current network setup :

PPPoE modem is connected to lan0 (ethernet interface) which is configured as 192.168.1.2, gateway 192.168.1.1 (it's the modem's address).
My provider (OVH in France) gives me a /64 IPv6 subnet.
ppp0 interface is created once the lan0 is up (i'm using POST_UP="pon myprovider" in netcfg script, i've already added +ipv6 in /etc/ppp/options to enable IPv6 on the ppp), it gets automatically an IPv4 address and an IPv6 one from my provider, here's the ifconfig ppp0 (i know it's deprecated but i'm so used to it...) :

ppp0: flags=4305<UP,POINTOPOINT,RUNNING,NOARP,MULTICAST>  mtu 1452
        inet 109.190.20.173  netmask 255.255.255.255  destination 178.32.37.16
        inet6 2001:41d0:70:1301:1c1e:882b:1e8b:efd7  prefixlen 64  scopeid 0x0<global>
        inet6 fe80::1c1e:882b:1e8b:efd7  prefixlen 10  scopeid 0x20<link>
        ppp  txqueuelen 3  (Point-to-Point Protocol)
        RX packets 6080  bytes 3571799 (3.4 MiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 4173  bytes 870323 (849.9 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

here's my IPv4 routing table :

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         *               0.0.0.0         U     0      0        0 ppp0
172.16.1.0      *               255.255.255.0   U     0      0        0 lan1
rbx-1-rdb.fr.eu *               255.255.255.255 UH    0      0        0 ppp0
192.168.1.0     *               255.255.255.0   U     0      0        0 lan0

lan1 is my local wired interface which connects to a 1000Mb/s switch, on it there is a Debian machine (the 600Mhz one) which acts as an access point (on it the wired interface is bridged with the wireless one, but all the DHCP/DNS stuff is done on my main computer and i don't think there's anything to do on the access point machine) and my other Archlinux laptop. Forwarding is enabled on both IPv4 and v6 in /etc/sysctl.conf and iptables (not ip6tables) is configured correctly, all works as would like on the IPv4 side (DHCP/DNS/internet access works for all computers on the network) here's my ifconfig lan1 :

lan1: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 9152
        inet 172.16.1.1  netmask 255.255.255.0  broadcast 172.16.1.255
        inet6 fe80::f66d:4ff:fee3:2c96  prefixlen 64  scopeid 0x20<link>
        ether f4:6d:04:e3:2c:96  txqueuelen 1000  (Ethernet)
        RX packets 5060  bytes 701035 (684.6 KiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 10181  bytes 7102665 (6.7 MiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0
        device interrupt 20  memory 0xf5100000-f5120000

Here's my IPv6 routing table (i have experience with computers and networks in general but this is a total non-sense to me) :

Kernel IPv6 routing table
Destination                    Next Hop                   Flag Met Ref Use If
::1/128                        ::                         U    256 0     0 lo
2001:41d0:70:1301::/64         ::                         UA   256 0     0 ppp0
fe80::/64                      ::                         !n   256 0     0 lo
fe80::/64                      ::                         U    256 0     0 lan0
fe80::/64                      ::                         U    256 0     0 lan1
fe80::/64                      ::                         U    256 0     0 ppp0
fe80::/10                      ::                         U    1   0     0 ppp0
fe80::/10                      ::                         U    256 0     0 ppp0
::/0                           fe80::230:88ff:fe04:63d4   UGDAe 1024 1     0 ppp0
::/0                           ::                         !n   -1  1   312 lo
::1/128                        ::                         Un   0   1     2 lo
2001:41d0:70:1301::/128        ::                         Un   0   1     0 lo
2001:41d0:70:1301:1c1e:882b:1e8b:efd7/128 ::                         Un   0   2   102 lo
fe80::/128                     ::                         Un   0   1     0 lo
fe80::/128                     ::                         Un   0   1     0 lo
fe80::/128                     ::                         Un   0   1     0 lo
fe80::1c1e:882b:1e8b:efd7/128  ::                         Un   0   1     0 lo
fe80::f66d:4ff:fee3:2010/128   ::                         Un   0   1     0 lo
fe80::f66d:4ff:fee3:2c96/128   ::                         Un   0   1     0 lo
ff00::/8                       ::                         U    256 0     0 lan0
ff00::/8                       ::                         U    256 0     0 lan1
ff00::/8                       ::                         U    256 0     0 ppp0
::/0                           ::                         !n   -1  1   312 lo

now with that configuration i can ping6 ipv6.google.com and get a reply :

PING ipv6.google.com(wb-in-x69.1e100.net) 56 data bytes
64 bytes from wb-in-x69.1e100.net: icmp_seq=1 ttl=56 time=49.1 ms
64 bytes from wb-in-x69.1e100.net: icmp_seq=2 ttl=56 time=48.5 ms
64 bytes from wb-in-x69.1e100.net: icmp_seq=3 ttl=56 time=48.3 ms
64 bytes from wb-in-x69.1e100.net: icmp_seq=4 ttl=56 time=50.3 ms

--- ipv6.google.com ping statistics ---
4 packets transmitted, 4 received, 0% packet loss, time 3003ms
rtt min/avg/max/mdev = 48.399/49.116/50.393/0.834 ms

but what next ? I need to redistribute that IPv6 to all my network, currently i have isc-dhcp-server (dhcpd) that gives IPv4 addresses on lan1, i also have bind which acts like a DNS resolver/cacher for my local network. I've heard about radvd which is like a dhcpd but for IPv6, however i think there's other stuff to do on the IPv6 routing table (which i don't understand) before hosts on the network can access Internet through IPv6... so here's a summary : ppp0 gets an IPv6 address, i can ping6 from this computer, and that's it...

Sorry for the long post but we're not on IRC so i don't think the usage of Pastebin is required, thanks for reading and have a nice day.

hunterthomson · 2012-11-04 01:09:27

Well with a Dual-Stack setup all interfaces on all devices 'can' have both IPv4 and IPv6 addresses.

So, setup the IPv4 network as you normally would.

Now you need to spend a weekend and learn IPv6.
Basically:
The IPv4 protocol is simple but the implementation is complex.
The IPv6 protocol is complex but the implementation is simple... really you don't do anything.

Then you will have to make the decision.
Do you want LAN clients to have Public Global Unicast addresses?

You only need a DHCPv6 server to hand out things like “What is the NTPD server address”, and “What is the DNS server address”.. and so on but even many of these can be found without a DHCPv6 server.

You do not need DHCP for IPv6. The IPv6 protocol takes care of all the addressing automatically. Like:

Every interfaces automatically gives itself a Link Local address and automatically discovers the network subsets and gives itself an address on the networks it finds.

The only thing that I don't know, because I have not done it is how to configure a Linux box to respond to FF02::2 broadcasts (All routers on the link).

Then, personally I'd use arno-iptables-firewall scripts from the AUR to configure the firewall and routeing.

Last edited by hunterthomson (2012-11-04 01:10:23)

unifiedlinux · 2012-11-04 13:42:10

Thanks for your reply, so what I need is : have an IPv6 address automatically assigned for each host on my network, and that host should be accessible from the Internet (no NAT).

EDIT: i think i actually got it working, after installing radvd and configuring it and manually adding an IPv6 address to lan1 , my laptop (connected to lan1 of the server) got an IPv6 address and was able to ping6 hosts on the local network aswell as hosts on the Internet (ipv6.google.com), however i have a DNS-related question : how do the computers on the network get the IPv6 address of the DNS server ?

Last edited by unifiedlinux (2012-11-04 15:12:23)

hunterthomson · 2012-11-06 09:01:28

Awe, way cool radvd "router advertisement daemon"

Ya, that is what you needed for IPv6 to work Ya, see the IPv6 protocol takes care of addressing for you. No need for DHCP nor NAT/PAT becuase your ISP gives you more IP's then you could ever need. In fact, you can fit every IPv4 address posible into the range of addresses your ISP gives you!

One other VARY cool thing with IPv6 is "Anycast, One-to-nearest". Really just endless super cool stuff with IPv6.

If I remember correctly like all OS's prefer to use IPv6 if avalable.

Okay, so for DNS, well I think you do need DHCP to hand that out... (I'm probaly wrong about that), anyway, I'd simply configure you DNS host by host... but I have a faint memory of some cool way that can work itself out too... in anycase:

Google DNS
/etc/resolv.conf

nameserver 2001:4860:4860::8888
nameserver 2001:4860:4860::8844
nameserver 8.8.8.8
nameserver 8.8.4.4

You know though. For security sake, you may want to configure your LAN with a Private IPv6 netwrok and subnet. All you would need to do is give the interfaces on the router an address starting with FD. Then you can use like arno-iptables-firewall to NAT the address range.

That "Interface ID" is created by the Host automaticaly. It simply takes the MAC address of the interface and puts an "FE" in teh middel to make it 64 bits long.

A Host learns about the network half of the address by picking up the "Router Advertisement messages"

So if the interface on the LAN side of the router has a Private IP address (it starts with "FD"), that is the network the router will put in the Router Advertisement and the Host's will pick up that Network 64bits and add on it's Interface ID 64bit's. Then bam, you got yourself an IPv6 address in a "Unique Local" IPv6 address range.

EDIT:
Awe, Okay, I just re-read my CCNA book. Okay so ya, a Host or Router using stateless autoconfiguration can learn both the IPv6 address prefix and it's default router IP address using NDP RS/RA messages. However, you do need at least a stateless DHCPv6 server to hand out DNS server's IP.

Last edited by hunterthomson (2012-11-06 09:35:54)

Arch Linux

#1 2012-11-03 22:16:00

Archlinux as dual-stack (IPv4/v6) gateway/router

#2 2012-11-04 01:09:27

Re: Archlinux as dual-stack (IPv4/v6) gateway/router

#3 2012-11-04 13:42:10

Re: Archlinux as dual-stack (IPv4/v6) gateway/router

#4 2012-11-06 09:01:28

Re: Archlinux as dual-stack (IPv4/v6) gateway/router

Board footer