OpenVPN and Deutsche Glasfaser - IPV6 and CGNAT blocking connection?
-
Hello everyone, I am struggling to get OpenVPN running on my PFSense firewall. This is something I managed a couple of years back with no problems, but now I get no reaction at all from my pfsense. I followed the instructions carefully working through the wizard and still nothing. None of the clients I tried (Android OpenVPN and Tunnelblick on Mac) get any response at all, packet capture on the firewall shows nothing on 1194, all configuration settings look fine. This really should work.
Since I got OpenVPN working last a few things have changed, one of them is my internet provider - switched from Deutsche Telekom to Deutsche Glasfaser and now I read that DG use IPV6 internally with CGNAT to give an IPV4 address in the 100.xxx.yyy.zzz range. These 100.xxx addresses are not accessible from the internet. I say that like I know what it means, which I half do. PFSense shows the WAN address is indeed a 100.x.y.z.
Putting these two together - I have got OpenVPN working before and now I get absolutely nothing and a hint of an issue from my internet provider - I am wondering if my internet provider and IPV6 may be playing a role in confounding my OpenVPN setup? If so, how do I fix it?
-
If you have CGNAT you can't make inbound connections to it from the outside. The inbound connections would never reach the firewall. If the connection never reaches the firewall there is nothing for it to do.
-
Many thanks for the reply - so that means if the provider uses CGNAT then I am SOOL? No chance to get OpenVPN connections working?
I did some more digging round this topic and found this - I followed through the points best I can and now get packets arriving at the WAN:
23:30:32.743269 IP 100.69.223.179.18813 > 94.31.96.153.1194: UDP, length 54 23:30:34.902711 IP 100.69.223.179.18813 > 94.31.96.153.1194: UDP, length 54However the server still does not manage to respond. Perhaps now this is an internal problem - but with this IPV4 & IPV6 stuff I am completely out of my depth. Any help gratefully received.
-
Which one of those is your WAN address? The 100.69.223.179 is a CGNAT address but that indicates an outbound connection being attempted by an OpenVPN client on your node, not an inbound connection to an OpenVPN server on your node.
Outbound clients should work fine. Your problem will be connecting inbound.
-
You are right, I realised my mistake just after posting - the PC attempting the OpenVPN connection was inside the LAN. The WAN address is 100.69.223.179. This starts to explain why my phone on its data connection cannot reach the WAN at all.
What can be done to get OpenVPN working again?
-
@charry2014 said in OpenVPN and Deutsche Glasfaser - IPV6 and CGNAT blocking connection?:
No chance to get OpenVPN connections working?
Can you connect to your IPv6 address? It shouldn't matter to OpenVPN whether you connect via IPv4 or IPv6. It can also carry both.
but with this IPV4 & IPV6 stuff I am completely out of my depth
Other than address length, the fundamentals are much the same, though IPv6 relies on ICMP for a lot of things, such as Neighbour Discovery, instead of ARP on IPv4. There are a lot of referrences around that cover IPv6.
The smallest address block (/64) you get from an ISP contains 18.4 billion, billion addresses, but many ISPs provide a /56 or /48 prefix for 256 or 65536 /64s.
-
Honestly I do not know if/how to connect with the IPV6 address as I never used it.
I made a quick hacky attempt to try it out - I got the WAN IPV6 address using ifconfig as a shell command, then replaced the OpenVPN host name in the client export with this address but no packets are received in the packet capture on 1194. It is late here and I am tired so possibly I overlooked something but so far no joy.
-
The easiest way is to connect to ipv6.google.com, which is reachable via IPv6 only. You can also try a test site, such as ipv6-test.com or test-ipv6.com. These will show if you have IPv6 available at the remote site you're trying to connect from. If you have IPv6 available, using it is transparent, compared to IPv4. You really shouldn't notice any difference. Once you have verified you have IPv6 at both ends, just recreate the OpenVPN client with the IPv6 address. If possible, you can preferrably use the host name.
-
Sitck with the ip (v6)address initially. Host name resolution for dynamically allocated ipv6 subnets is very rare.
-
OK - this seems to be a good line of attack. From a first quick test I cannot access any of those IPv6 sites so I imagine there is something wrong with my PFSense - firewall rule, NAT or something else - that is missing.
From a first inspection of the firewall settings I do not see anything obvious and my setup is really simple, essentially a basic installation with nothing added. Any tips where to start? I will of course start Googling :)
-
@charry2014 wan settings, ipv6?
Also system advanced networking allow ipv6 -
Many thanks - I now have IPv6 connecting. I found some helpful posts around the net (mostly in German as this is a German internet provider) - listed here for anyone who follows me:
beechy.de
glasfaserforum.de
And here gives some hints about things to look at for IPv6 - pfstore.com.auA combination of these things has made my IPv6 connect - The final detail was this
• 6rd Prefix: 2A00:61E0::
• 6rd Prefix Length: 32
• 6rd BR IPv4 Address: 100.127.0.1
• IPv4 Mask Length: 8Now to go back to OpenVPN and see if I can get that going.
Edit - still nothing. I reconfigured the VPN from scratch, following the wizard again. Got my IPv6 address from the sites mentioned above, used that directly in the client export. I get no packets logged on 1194.
-
@charry2014 Only a reflector site will tell you your ip.
Status interfaces should have it
can you ping ipv6.google.com from pfsense cli? -
The WAN address may often have a host name which can be used. Use host or nslookup command on the WAN address to see what turns up.
-
@charry2014 said in OpenVPN and Deutsche Glasfaser - IPV6 and CGNAT blocking connection?:
6rd Prefix: 2A00:61E0::
They're using a tunnel, rather than native IPv6. I used a tunnel for the first 6 years I had IPv6, but now I get a native IPv6 connection from my ISP. I'm surprised they're using a tunnel and CGNAT. How old is that info? My ISP also used a tunnel (though not the one I used) prior to providing native IPv6. If they're using a tunnel these days, I'd have to question their competence.
-
Does your (smartphone) service provider has IPv6? Than you can connect OVPN via IPv6 directly.
-
I could get my IPv6 address from https://ipv6-test.com/ easily enough but have drawn a blank trying to test OpenVPN connecting to it. Both running the OpenVPN client on my phone, and using the phone as wifi hotspot for my Mac result in no packets received at the PFSense WAN. Tunnelblick on Mac reports:
2020-07-26 15:43:16.288025 write UDPv6: No route to host (code=65) -
Please answer the question:
@Bob-Dig said in OpenVPN and Deutsche Glasfaser - IPV6 and CGNAT blocking connection?:
Does your (smartphone) service provider has IPv6?
-
Yes. My phone (Samsung S20) is on Vodafone in Germany and I have read that they have IPv6 nationwide.
Edit - I did some digging and it has an IPv6 address too. -
@charry2014 That's great, you don't need any IPv4, at least not if you want to connect the phone to home via OVPN.
