OpenVPN IPv6 not working
-
"When I switch to a /56"
It doesn't work that way!!! You can not just switch the mask..
You would request a prefix delegation from your ISP for the size of network you need.. Or they need to give you the info on what it is static… There is NO scenario ever that you would change the mask on an interface to /56..
-
You can select a different prefix size on the WAN interface page. This is done in the DHCPv6 Prefix Delegation size box.
-
I said I lacked IPv6 knowledge…guess it shows haha. Anyway, when I "switch to a /56" I am going to the WAN interface and selecting the "DHCP Prefix Delegation size" box and changing that value.
Johnpoz, it sounds like you are saying the Prefix size should only be changed after I verify with my ISP the size that they are giving me or request a different size and set my Prefix size to match?
JKnott, my assumption was that changing the Prefix size would somehow request that Prefix size from my ISP. It sounds like that isn't the case according to johnpoz.
Thanks for the help guys. Apologies for being a newb.
-
"verified with my ISP that each customer is just getting a /64."
If they are not going to to delegate a /X to you then nothing you can do is going to change that. Be it you request a /56 or /60 or whatever.
Like I said before - if your isp ipv6 deployment is borked.. Why dick with it when it takes all of 1 minute to have a /48 that you can do with as you will.. And just forget your stupid ISP until such time they get their act together.. Which I highly doubt they will for years to come.. Since the vast majority of users are idiot users that just plug in their soho router and see if facebook.com loads on their devices.
The other advantage is this /48 you get from HE is yours - it not going to change.. Even if you have your isp delegate you a /60 or /56, etc. That could change to some other IP block at the drop of hat.. It's not like this /X has been assigned to you and only you like you get with a HE delegation.. HE even allows you setup PTR records on this space - your isp going to allow you to do that?
Your talking about dicking with a borked setup for at best shaving off a few extra ms the tunnel to HE is going to add.
I just do not understand the point of dicking with such a setup when it takes all of 1 minute to have a working setup that gives you complete control.
Another advantage of HE tunnel - is you can move ISPs and not care if they support IPv6 or not, etc. You can move your /48 to any isp you wish to use for connectivity. I have had the same IPv6 space from HE since Jun 20, 2013..
-
JKnott, my assumption was that changing the Prefix size would somehow request that Prefix size from my ISP. It sounds like that isn't the case according to johnpoz.
I suspect he means you can't ask for something that isn't offered. With my ISP, I can request any size prefix up to /56. So, if I only wanted a /60, I could configure pfSense to request that. On the other hand, requesting a /48 would not work, as my ISP doesn't provide that. I have pfSense configured to request a /56.
-
Johnpoz, at this point I agree. It's not a simple fix for me on the ISP side. Just want to clarify you are talking about their tunnel broker service. Do you know right off hand if it'll work with me having CGNAT'ed IPv4 and a /64 IPv6? I'm assuming you wouldn't recommend it if it wouldn't work for me. I'll prolly just Google some setup tutorials unless you can recommend one. Thanks for all the help.
-
JKnott, thanks for the clarification.
-
If you are behind a carrier grade nat for your IPv4. Then you could have some problems with a tunnel.. Is it a 1:1 nat where all traffic is sent to your rfc1918 IPv4?
My bad!! I did not catch the CGNat part… Sorry.. But depends on how the CGnat is being done.
Off the top a way around your shitty ISP.. They put you behind a nat for ipv4 and only give you 1 /64.. Would be to change ISP ;) That is not always an options though..
You could just get a VPS somewhere... There are many that offer /48 with your vps.. Then create a tunnel to this VPS where your the initiator.. Say openvpn tunnel.. Then tunnel the ipv6 through this tunnel.. Its a bit of a hack.. But there are many ways to work around the incompetence of some of these so called ISPs..
-
I can't say for sure that it is a 1:1 nat. I'm happy to test it, if there is a way I can. All I know is that I have a 10.x.x.x address behind a public IP. It's fiber internet so I do see some broadcast traffic from neighbors that share the fiber splitter.
Not to go off topic but as far as my "shitty ISP" goes, they are the only real competition in town. They offer gigabit and the next fastest competitor maxes out at 60mbits from the cable company (Granted the cable company offers public IPv4 and IPv6 addresses). With my ISP the upload speeds are much better too. I would rather deal with these guys than the cable company. The customer service is a lot better. They originally were handing out public IPv4 addresses when I signed up but ran out of them shortly thereafter and started NATing. I don't like it either but I'll deal.
Not looking to sign up for a vps. If I have to spend money, I'll just setup something like teamviewer and deal. I'd rather not, but works in a pinch for my needs (mostly just local access to my machines)
-
Stupid question…I'm making some assumptions based on what I know of IPv4 that probably don't translate to IPv6 but here it goes...I am only using the VPN to access remote machines at home. I don't "need" a public IPv6 handed to my client from the OpenVPN server (assuming that is even right to say), I just need access to a couple machines at the house. Is there any way to accomplish that? When I had OpenVPN setup before my IPv4 address was put behind CGNAT I just used a 10.x.x.x address for the OpenVPN clients while my actual network used 192.168.x.x addresses. Does IPv6 have anything like this? A non-routable address that I could hand out to the client just to provide some connectivity across OpenVPN.
Like I said, I'm probably missing something. I know the fundamental idea behind IPv6 is to NOT need non-routable IP's. Hoping someone can correct any of my misconceptions.
Thanks
-
^^^^
You could use Unique Local Addresses, which are the IPv6 version of the IPv4 RFC 1918 addresses. -
Thanks for the quick reply. I'll try it out tonight. Looks like something in the fc00::/7 block is what I need to use?
Thanks again
-
If all you want is ipv6 access into your local network from your vpn clients then yes you could use a ULA prefixes. But these remote clients will not be able to get access to internet from this ULA address. But you could then NPt that to your /64 you get from isp.. But off the top of my head not sure if possible to nat multiple ULA to a single /64 prefix via NPt? (network prefix translation).. JKnott would know..
What exactly is your end game with IPv6? What are you hoping to accomplish with it?
-
Thanks for the quick reply. I'll try it out tonight. Looks like something in the fc00::/7 block is what I need to use?
Thanks again
While the entire fc::/7 block is ULA, officially, fc:: /8 is supposed to be assigned from a central server and fd::/8 is used with a random 40 bit number you can choose, to create a /48 prefix.
-
If all you want is ipv6 access into your local network from your vpn clients then yes you could use a ULA prefixes. But these remote clients will not be able to get access to internet from this ULA address. But you could then NPt that to your /64 you get from isp.. But off the top of my head not sure if possible to nat multiple ULA to a single /64 prefix via NPt? (network prefix translation).. JKnott would know..
I've never used it, as I'm allergic to NAT. ;)
However, I believe NAT is possible, but not recommended. Regardless, I believe the OP only wanted access to his own network and not the Internet, so ULA, without NAT would be fine
-
End game is secure access to my home network from my devices when out of the house. This basically boils down to SSH access from my android phone to multiple devices on my network. OpenVPN was the easiest way to accomplish this in my mind (at the time) so that I only needed one port open instead of a different port for each SSH server and managing all of that. Originally I had a public IPv4 and all was well. Then my ISP NATed my IPv4 and I was screwed. Then a few months later they enabled IPv6 (/64) and that's where I'm at now. My only need for IPv6 is that my pfSense box now has a public IP. When my VPN was working I would access devices using IPv4 addresses anyway. So my only real need for IPv6 is the fact that it is the only public IP address my router (OpenVPN server) has.
Edit: Beyond SSH access, would also like access to some locally hosted web pages and the pfSense web GUI :D
-
End game is secure access to my home network from my devices when out of the house.
Then ULA will do fine. As I said, pick a 40 bit number to append to fd, to create a /48 prefix. Then assign 1 of the /64 prefixes, from the /48 to OpenVPN. PfSense should be able to route appropriately.
Incidentally, the reason for the 40 bit random number is to avoid the collisions that often happened with the limited RFC 1918 space on IPv4. It's highly unlikely that 2 people would choose the same number. One way to create a "random" number is to go to www.grc.com to the Perfect Passwords page, where you'll find one box that has 64 random hex digits. Select any 10 for your 40 bit random number.
-
Ok cool. I'm familiar with grc.com so I will head over there. Sorry for not leading off with the "end game"…would've saved everyone some time. We will see how this all goes.
Thanks again JKnott and johnpoz for the help.
-
So I was feeling good about everything but when it came time to implement I ended up with more questions than answers. I'm feeling a bit in over my head at the moment and I know this should be pretty easy. I made up a /48 but am I supposed to enter it somewhere? I used the /48 and made up a /64 that I entered into the OpenVPN server under IPv6 Tunnel Network. That didn't make any difference so I'm obviously missing something. :-\
-
I assume the /64 was one of the 65536 /64s in your /48? When you set up the server, you put the /64 in "IPv6 Tunnel Network". Do you see an IPv6 address on the client?
