Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #202821

Re: Fwd: openvpn over ipv6 /65

Show all headers | View raw

On 27/11/2018 13:34, Reco wrote:
> 	Hi.
> 
> On Tue, Nov 27, 2018 at 01:20:25PM +0100, tony wrote:
>> On 27/11/2018 12:44, Reco wrote:
>>> 	Hi.
>>>
>>> On Tue, Nov 27, 2018 at 12:26:03PM +0100, tony wrote:
>>>> OK, that fixed it, thanks. Almost there. I had expected the host's
>>>> openVPN ip (2a03:9800:10:54:8000::1000) to propagate, but I'm seeing my
>>>> server's address:
>>>>
>>>> tony@tony-fr:~$ dig +short any myip.opendns.com @resolver1.opendns.com
>>>> 2a03:9800:10:54::2
>>>>
>>>> Is that fixable?
>>>
>>> Probably. My suspicion is that openvpn has configured NAT66 for you,
>>> along with the routing.
>>> Can I see the result of "ip6tables-save" from your openvpn server?
>>
>> OK:
>> root@shell:~# ip6tables-save
>> # Generated by ip6tables-save v1.6.0 on Tue Nov 27 11:50:18 2018
>> *nat
>> :PREROUTING ACCEPT [12346:1595144]
>> :INPUT ACCEPT [1726:141923]
>> :OUTPUT ACCEPT [743:66648]
>> :POSTROUTING ACCEPT [743:66648]
>> -A POSTROUTING -s 2a03:9800:10:54:8000::/65 -o eth0 -j SNAT --to-source
>> 2a03:9800:10:54::2
> 
> Yep. Good old NAT, in this case in IPv6 form. What they call NAT66.
> 
> 
>> If I remove the line
>> -A POSTROUTING -s 2a03:9800:10:54:8000::/65 -o eth0 -j SNAT --to-source
>> 2a03:9800:10:54::2
>> I lose any ipv6 routing
> 
> Strictly speaking, that's expected. Outside world does not know about
> your network topology. What is does know is to send packets to
> 2a03:9800:10:54::1 (*not* :2) in hope of reaching your :8000::/65.
> The problem is - how your IPv6 gateway (54::1) can possibly know that
> your custom subnet (:8000::/65) is reachable if you have not announced a
> route?
> 
> That's something that I need to think about.

thanks very much for spending so much time on my problem.

Back to linux.debian.user | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Fwd: openvpn over ipv6 /65 tony <lists@vanderhoff.org> - 2018-11-26 11:50 +0100
  Re: Fwd: openvpn over ipv6 /65 Reco <recoverym4n@enotuniq.net> - 2018-11-26 12:50 +0100
    Re: Fwd: openvpn over ipv6 /65 tony <lists@vanderhoff.org> - 2018-11-26 13:50 +0100
      Re: Fwd: openvpn over ipv6 /65 Reco <recoverym4n@enotuniq.net> - 2018-11-26 17:00 +0100
        Re: Fwd: openvpn over ipv6 /65 tony <lists@vanderhoff.org> - 2018-11-26 18:00 +0100
          Re: Fwd: openvpn over ipv6 /65 Reco <recoverym4n@enotuniq.net> - 2018-11-26 18:20 +0100
            Fwd: openvpn over ipv6 /65 tony <lists@vanderhoff.org> - 2018-11-27 11:40 +0100
            Re: Fwd: openvpn over ipv6 /65 Reco <recoverym4n@enotuniq.net> - 2018-11-27 11:50 +0100
              Re: Fwd: openvpn over ipv6 /65 tony <lists@vanderhoff.org> - 2018-11-27 12:00 +0100
                Re: Fwd: openvpn over ipv6 /65 Reco <recoverym4n@enotuniq.net> - 2018-11-27 12:00 +0100
                Re: Fwd: openvpn over ipv6 /65 tony <lists@vanderhoff.org> - 2018-11-27 12:30 +0100
                Re: Fwd: openvpn over ipv6 /65 Reco <recoverym4n@enotuniq.net> - 2018-11-27 12:50 +0100
                Re: Fwd: openvpn over ipv6 /65 tony <lists@vanderhoff.org> - 2018-11-27 13:30 +0100
                Re: Fwd: openvpn over ipv6 /65 Reco <recoverym4n@enotuniq.net> - 2018-11-27 13:40 +0100
                Re: Fwd: openvpn over ipv6 /65 tony <lists@vanderhoff.org> - 2018-11-27 14:00 +0100
                Re: Fwd: openvpn over ipv6 /65 Reco <recoverym4n@enotuniq.net> - 2018-11-27 15:10 +0100
                [SOLVED]: openvpn over ipv6 /65 tony <lists@vanderhoff.org> - 2018-11-27 15:30 +0100

csiph-web