Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #202711 > unrolled thread

openvpn over ipv6 /65

Back to article view | Back to linux.debian.user

Contents

  openvpn over ipv6 /65 tony <lists@vanderhoff.org> - 2018-11-23 13:20 +0100
    Re: openvpn over ipv6 /65 Reco <recoverym4n@enotuniq.net> - 2018-11-23 13:40 +0100
      Re: openvpn over ipv6 /65 tony <lists@vanderhoff.org> - 2018-11-23 15:10 +0100
        Re: openvpn over ipv6 /65 Reco <recoverym4n@enotuniq.net> - 2018-11-23 15:30 +0100
          Re: openvpn over ipv6 /65 Steve Kemp <skx@debian.org> - 2018-11-23 16:50 +0100
            Re: openvpn over ipv6 /65 Reco <recoverym4n@enotuniq.net> - 2018-11-23 17:00 +0100
              Re: openvpn over ipv6 /65 Steve Kemp <skx@debian.org> - 2018-11-23 19:50 +0100

#202711 — openvpn over ipv6 /65

Hi,

I have a Stretch VPServer with a /64 netbloch, of which only the first 2
addresses are used. I've been struggling for some time to get the right
stanza to split that into two /65s, using the upper half for openvpn.

There are many 'quick config' tutorials on the web, but none seem to
suit my objectives, the most enlightened being
https://community.openvpn.net/openvpn/wiki/IPv6, but I'm tripping over
the stanza:

### check this on your OS!
# ifconfig igb0 inet6 2001:db8:0:123::/64 -alias
# ifconfig igb0 inet6 2001:db8:0:123::/65
###
### re-assign the other aliases previously set under the /64 block
# ifconfig igb0 inet6 2001:db8:0:123::dead/128 alias
# ifconfig igb0 inet6 2001:db8:0:123::ea:beef/128 alias
# ...

which seems to apply to FreeBSD.

Could some knowledgeable person please give me the equivalent contents
and where to put them for Debian Linux.

TIA, Tony

[toc] | [next] | [standalone]

#202714

	Hi.

On Fri, Nov 23, 2018 at 01:18:45PM +0100, tony wrote:
> Hi,
> 
> I have a Stretch VPServer with a /64 netbloch, of which only the first 2
> addresses are used. I've been struggling for some time to get the right
> stanza to split that into two /65s, using the upper half for openvpn.

I'd check first that some other addresses from this /64 range are routed
by your VPS provider.


> There are many 'quick config' tutorials on the web, but none seem to
> suit my objectives, the most enlightened being
> https://community.openvpn.net/openvpn/wiki/IPv6, but I'm tripping over
> the stanza:
> 
> ### check this on your OS!
> # ifconfig igb0 inet6 2001:db8:0:123::/64 -alias
> # ifconfig igb0 inet6 2001:db8:0:123::/65
> ###
> ### re-assign the other aliases previously set under the /64 block
> # ifconfig igb0 inet6 2001:db8:0:123::dead/128 alias
> # ifconfig igb0 inet6 2001:db8:0:123::ea:beef/128 alias
> # ...
> 
> which seems to apply to FreeBSD.

Yep.


> Could some knowledgeable person please give me the equivalent contents
> and where to put them for Debian Linux.

Ad-hoc configuration:

### check this on your OS!
# ip a d igb0 2001:db8:0:123::/64
# ip a a igb0 2001:db8:0:123::/65
###
### re-assign the other aliases previously set under the /64 block
# ip a a igb0 2001:db8:0:123::dead/128
# ip a a igb0 2001:db8:0:123::ea:beef/128

As for the persistent configuration, that depends on the contents of
/etc/network/interfaces. Can be static (it's straightforward then),
DHCPv6 (you won't be able to do the split) or RA (ditto).

Reco

[toc] | [prev] | [next] | [standalone]

#202729

Thanks for your quick response, Reco,

On 23/11/2018 13:33, Reco wrote:
> 	Hi.
> 
> On Fri, Nov 23, 2018 at 01:18:45PM +0100, tony wrote:
>> Hi,
>>
>> I have a Stretch VPServer with a /64 netbloch, of which only the first 2
>> addresses are used. I've been struggling for some time to get the right
>> stanza to split that into two /65s, using the upper half for openvpn.
> 
> I'd check first that some other addresses from this /64 range are routed
> by your VPS provider.
> 
I'm not sure I understand what you mean. As far as I'm aware, my VPS
provider furnishes a full native /64 netblock for my exclusive use.
They'll provide more, at a cost, but I see no point in that.
> 
[snip]

> Ad-hoc configuration:
> 
> ### check this on your OS!
> # ip a d igb0 2001:db8:0:123::/64
> # ip a a igb0 2001:db8:0:123::/65
> ###
> ### re-assign the other aliases previously set under the /64 block
> # ip a a igb0 2001:db8:0:123::dead/128
> # ip a a igb0 2001:db8:0:123::ea:beef/128
> 
I'm not using any addresses other than the ::1 and ::2 in the /64 block,
so presumably the last two lines are redundant.

> As for the persistent configuration, that depends on the contents of
> /etc/network/interfaces. Can be static (it's straightforward then),
> DHCPv6 (you won't be able to do the split) or RA (ditto).
> 
No, it's all static:

auto lo
iface lo inet loopback

auto eth0
iface eth0 inet static
        address 188.246.204.210
        netmask 255.255.255.0
        gateway 188.246.204.1


iface eth0 inet6 static
           address 2a03:9800:10:54::2
           netmask 64
           gateway 2a03:9800:10:54::1

So what is igb0? What do you mean by ad-hoc and persistent configuration?

Thanks again, Tony

[toc] | [prev] | [next] | [standalone]

#202732

	HI.

On Fri, Nov 23, 2018 at 03:07:01PM +0100, tony wrote:
> Thanks for your quick response, Reco,
> 
> On 23/11/2018 13:33, Reco wrote:
> > 	Hi.
> > 
> > On Fri, Nov 23, 2018 at 01:18:45PM +0100, tony wrote:
> >> Hi,
> >>
> >> I have a Stretch VPServer with a /64 netbloch, of which only the first 2
> >> addresses are used. I've been struggling for some time to get the right
> >> stanza to split that into two /65s, using the upper half for openvpn.
> > 
> > I'd check first that some other addresses from this /64 range are routed
> > by your VPS provider.
> > 
> I'm not sure I understand what you mean. As far as I'm aware, my VPS
> provider furnishes a full native /64 netblock for my exclusive use.
> They'll provide more, at a cost, but I see no point in that.
> > 
> [snip]

Assign some other IPv6 address from your range to your VPS.
Ensure that it's reachable from the outside world.
For instance, I do not get any response from your gateway while I'm
pinging 2a03:9800:10:54::dead (which you do not have), and get a reply
from 2a03:9800:10:54::2 (which belongs to your VPS).


> > Ad-hoc configuration:
> > 
> > ### check this on your OS!
> > # ip a d igb0 2001:db8:0:123::/64
> > # ip a a igb0 2001:db8:0:123::/65
> > ###
> > ### re-assign the other aliases previously set under the /64 block
> > # ip a a igb0 2001:db8:0:123::dead/128
> > # ip a a igb0 2001:db8:0:123::ea:beef/128
> > 
> I'm not using any addresses other than the ::1 and ::2 in the /64 block,
> so presumably the last two lines are redundant.

Yes, you do not need them.


> > As for the persistent configuration, that depends on the contents of
> > /etc/network/interfaces. Can be static (it's straightforward then),
> > DHCPv6 (you won't be able to do the split) or RA (ditto).
> > 
> No, it's all static:

That simplifies things greatly.
Replace this:

iface eth0 inet6 static
           address 2a03:9800:10:54::2
           netmask 64
           gateway 2a03:9800:10:54::1

with this:

iface eth0 inet6 static
           address 2a03:9800:10:54::2
           netmask 65
           gateway 2a03:9800:10:54::1

Leave all the other entries intact.
Then invoke this as root (one-time only):

ip a d dev eth0 2a03:9800:10:54::2/64
ip a a dev eth0 2a03:9800:10:54::2/65
ip ro d default via 2a03:9800:10:54::1


> So what is igb0?

A name of interface that's used in OpenVPN documentation. Yours is called eth0.


> What do you mean by ad-hoc and persistent configuration?

ad-hoc means that you're using certain OS binaries (in this case - ip)
to create a network configuration that does not survive the reboot.
persistent means the opposite - you're trying to create a configuration
that should reproduce itself after the reboot (in this case - e/n/i).

Reco

[toc] | [prev] | [next] | [standalone]

#202736

> with this:
> 
> iface eth0 inet6 static
>            address 2a03:9800:10:54::2
>            netmask 65
>            gateway 2a03:9800:10:54::1
> 
> Leave all the other entries intact.
> Then invoke this as root (one-time only):
> 
> ip a d dev eth0 2a03:9800:10:54::2/64
> ip a a dev eth0 2a03:9800:10:54::2/65
> ip ro d default via 2a03:9800:10:54::1

  This will need to be repeated at every reboot, better to use `up`, for
 example:

    iface eth0 ...
        ...
        gateway ...
        up ip -6 addr  ..

  "up" will run the given command after the interface is brought up, as
 per "man 5 interfaces".

Steve
-- 

[toc] | [prev] | [next] | [standalone]

#202737

	Hi.

On Fri, Nov 23, 2018 at 03:39:16PM +0000, Steve Kemp wrote:
> > with this:
> > 
> > iface eth0 inet6 static
> >            address 2a03:9800:10:54::2
> >            netmask 65
> >            gateway 2a03:9800:10:54::1
> > 
> > Leave all the other entries intact.
> > Then invoke this as root (one-time only):
> > 
> > ip a d dev eth0 2a03:9800:10:54::2/64
> > ip a a dev eth0 2a03:9800:10:54::2/65
> > ip ro d default via 2a03:9800:10:54::1
> 
>   This will need to be repeated at every reboot,

No, it won't. OP has two stanzas regarding eth0 in e/n/i already - one
for inet and another one for inet6.
The whole point of this exercise is to get persistent configuration for
/65 netmask *and* to avoid ifdown/ifup sequence to implement it now.
And, of course, do the thing without the reboot.

Reco

[toc] | [prev] | [next] | [standalone]

#202739

> 	Hi.
> 
> >   This will need to be repeated at every reboot,
> 
> No, it won't. OP has two stanzas regarding eth0 in e/n/i already - one
> for inet and another one for inet6.

  You're right; I'm clearly not having a good day!  Thank-you
 for the correction.

Steve
-- 
https://www.steve.org.uk/

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.user

csiph-web