IPV6 over OpenVPN tunnel

This post is a fast tutorial on how I created my own IPV6 tunnel over OpenVPN.

I have a Xen VPS with VR.org – 256 MB RAM, 10 GB disk space, 200GB data transfer/month and Debian Squeeze installed, with IPV6 connectivity. This is perfect for my needs.

I am not going to go into the details of how to install and configure OpenVPN over Debian – for that, refer to this article.

Once you have you OpenVPN server up and running, here is how to get IPV6 working:

Server side modifications

1. Edit your OpenVPN server configuration and change dev tun to dev tap – yes we will use the tap device to get IPv6 working.

Also add the following line as the very first line of the configuration:

script-security 3 system

This line allows OpenVPN to execute user-defined scripts.

2. Add the following lines to the end of the server configuration:

client-connect /etc/openvpn/client-connect.sh
client-disconnect /etc/openvpn/client-disconnect.sh

These two scripts build/destroy the IPv6 tunnel each time a client connects/disconnects.

Here is the content of client-connect.sh

#!/bin/bash

BASERANGE="2a00:dd80:003d:000c"
ifconfig $dev up
ifconfig $dev add ${BASERANGE}:1001::1/64
ip -6 neigh add proxy 2a00:dd80:003d:000c:1001::2 dev eth0
exit 0

My host assigns me IPV6 addresses from the 2a00:dd80:003d:000c::/64 block. Hence, I use
2a00:dd80:003d:000c as the BASERANGE. Modify this value as per what your host has assigned you.

Each time a client connects to OpenVPN, this script assigns the address 2a00:dd80:003d:000c:1001::1 as the IPV6 address of the tap0 interface of the server.

The last line sets up Neighbor Discovery for our tunnel. I have added the IPv6 address of the client side tap0 connection as the proxy address. Read all about IPv6 Neighbor Discovery…

Here is the content of client-disconnect.sh


#!/bin/bash

BASERANGE="2a00:dd80:003d:000c"
/sbin/ip -6 addr del ${BASERANGE}::1/64 dev $dev
exit 0

This just deletes the IPv6 tunnel address of the server, when the client disconnects. Modify the value of BASERANGE as appropriate.

3. Make the scripts executable:

chmod 700 /etc/openvpn/client-connect.sh
chmod 700 /etc/openvpn/client-disconnect.sh

4. Add the following entries to /etc/rc.local (You can also modify the appropriate sysctls in /etc/sysctl.conf)

echo 1 >/proc/sys/net/ipv6/conf/all/proxy_ndp
echo 1 > /proc/sys/net/ipv4/ip_forward
echo 1 > /proc/sys/net/ipv6/conf/all/forwarding

/etc/init.d/firewall stop && /etc/init.d/firewall start

These entries activate Neighbor Discovery and Forwarding. I have also added a firewall.

5. Create /etc/init.d/firewall and put in the following content:

#!/bin/sh
# description: Firewall

IPT=/sbin/iptables
IPT6=/sbin/ip6tables

case "$1" in
start)
$IPT -F INPUT
$IPT -A INPUT -i eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPT -A INPUT -i eth0 -p tcp --dport 22 -j ACCEPT
$IPT -A INPUT -i eth0 -p icmp -j ACCEPT
$IPT -A INPUT -i eth0 -p udp --dport 1194 -j ACCEPT
$IPT -A INPUT -i tap+ -j ACCEPT
$IPT -A FORWARD -i tap+ -j ACCEPT
$IPT -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPT -t nat -F POSTROUTING
$IPT -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
$IPT -A INPUT -i eth0 -j DROP

$IPT6 -F INPUT
$IPT6 -A INPUT -i eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPT6 -A INPUT -i eth0 -p tcp --dport 22 -j ACCEPT
$IPT6 -A INPUT -i eth0 -p icmpv6 -j ACCEPT
$IPT6 -A FORWARD -s 2a00:dd80:003d:000c::/64 -i tap0 -o eth0 -j ACCEPT
$IPT6 -A INPUT -i eth0 -j DROP

exit 0
;;

stop)
$IPT -F
$IPT6 -F
exit 0
;;
*)
echo "Usage: /etc/init.d/firewall {start|stop}"
exit 1
;;
esac

Modify the BASERANGE as appropriate.

6. Run /etc/rc.local and start the firewall:

sh /etc/rc.local

This completes the server side modifications.

Client side modifications

1. Edit your OpenVPN client configuration and change dev tun to dev tap – yes we will use the tap device to get IPv6 working.

Also add the following line as the very first line of the configuration:

script-security 3 system

This line allows OpenVPN to execute user-defined scripts.

2. Add the following as the last lines of your client configuration:

# create the ipv6 tunnel
up /etc/openvpn/up.sh
down /etc/openvpn/down.sh

# need this so when the client disconnects it tells the server
explicit-exit-notify

The up and down scripts build/destroy the IPV6 client end points of the client tap0 connection each time a client connects/disconnects to or from the OpenVPN server.

Here is the content of up.sh

#!/bin/bash

IPV6BASE="2a00:dd80:3d:c"
ifconfig $dev up
ifconfig $dev add ${IPV6BASE}:1001::2/64
ip -6 route add default via ${IPV6BASE}:1001::1
exit 0

The script assigns the IPV6 address 2a00:dd80:3d:c:1001::2 as the client IPV6 address and sets the default IPV6 route through the server.

Modify IPV6BASE to be the same as BASERANGE in the server configuration.

Here is the content of down.sh

#!/bin/bash

IPV6BASE="2a00:dd80:3d:c"
/sbin/ip -6 addr del ${IPV6BASE}::2/64 dev $dev
/sbin/ip link set dev $dev down
/sbin/ip route del ::/0 via ${IPV6BASE}::1
exit 0

This just deletes the IPV6 address of the client and tears down the IPV6 route when the client disconnects from the server.

Modify IPV6BASE to be the same as BASERANGE in the server configuration.

3. Make these scripts executable:

chmod 700 /etc/openvpn/up.sh
chmod 700 /etc/openvpn/down.sh

4. Optionally, modify /etc/resolv.conf and add Google’s IPV6 nameservers for DNS resolution:

nameserver 2001:4860:4860::8888
nameserver 2001:4860:4860::8844

Connect and Enjoy

Restart openvpn on the server and then connect to it from the client. You should be connected.

Visit test-ipv6.com to see that your IPV6 connectivity over OpenVPN is working.

Here is my result…

Just for information, here are my OpenVPN server and client configurations.

Enjoy.

Written by Michael R.M. David

VN:F [1.9.22_1171]
Rating: 9.8/10 (5 votes cast)
IPV6 over OpenVPN tunnel, 9.8 out of 10 based on 5 ratings

Leave a Reply

Your email address will not be published. Required fields are marked *

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong>

8 visitors online now
1 guests, 7 bots, 0 members
Max visitors today: 16 at 12:46 am UTC
This month: 16 at 11-01-2014 12:46 am UTC
This year: 44 at 02-10-2014 11:09 am UTC
All time: 269 at 12-05-2012 07:53 am UTC