Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    OpenVPN Server / Dual Stack

    Scheduled Pinned Locked Moved OpenVPN
    7 Posts 3 Posters 2.2k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • C
      creiss
      last edited by

      Hey folks,

      I am having a mixed client pool of ipv6 and ipv4 so I want openvpn to listen on 6&4. According to https://serverfault.com/questions/651832/openvpn-with-mixed-ipv4-and-ipv6-clients selecting UDP6 will make openvpn bind in Dual-Stack mode, but:

      # sockstat -64 | grep 1194
      root     openvpn    92011 6  udp6   fe:fake::2:1194 *:*
      

      I can see that /var/etc/openvpn/server1.conf employes the local directive that binds the server to a ip. The value changes whether it's udp6 or 4. While writing this I noticed that this value vanished if you do not supply an interface to bind to.
      Even with interface set to "any" it will only listen on either udp4 or 6.

      How to get openvpn to correctly server ipv4 and ipv6 clients?

      Cheers,
      -Chris.

      1 Reply Last reply Reply Quote 0
      • jimpJ
        jimp Rebel Alliance Developer Netgate
        last edited by

        That response on serverfault is incorrect. udp6 is IPv6 only.

        You can't do dual stack until OpenVPN 2.4, which is in pfSense 2.4 snapshots. To use it there, you need to use one of the options labeled "IPv4 and IPv6 on all interfaces (multihome)", there is one for UDP and one for TCP.

        It can't be dual stack currently without binding to all interfaces, and the multihome keyword lets it properly source replies based on how the packets arrived.

        Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

        Need help fast? Netgate Global Support!

        Do not Chat/PM for help!

        1 Reply Last reply Reply Quote 0
        • johnpozJ
          johnpoz LAYER 8 Global Moderator
          last edited by

          ^ that being said jim it doesn't seem to export the ipv6 IP addresses in the client export.

          I just tried to fire that up, and when I do the export it only lists the ipv4 address.  I have to do more testing because I normally just have my HE tunnel up for ipv6 and don't have ipv6 on my normal isp wan.

          But the way I read that "all interfaces" it would list my IP address of my tunnel interface?

          To the OP - why can you not just fire up an other instance?  One udp4 and the other upd6 - this is what I currently do.  Partly because not really dual stack since like I said my IPv6 is on my HE tunnel interface.  But be happy to try the ipv4 and ipv6 mode.. And get the isp ipv6 working on my wan.. Just enabling it didn't seem to grab a IPv6 on the wan - but to be honest the comcast ipv6 in my area is flaky at best.  This is why I run a HE tunnel ;)

          An intelligent man is sometimes forced to be drunk to spend time with his fools
          If you get confused: Listen to the Music Play
          Please don't Chat/PM me for help, unless mod related
          SG-4860 24.11 | Lab VMs 2.8, 24.11

          1 Reply Last reply Reply Quote 0
          • jimpJ
            jimp Rebel Alliance Developer Netgate
            last edited by

            multihome isn't going to work well with anything automatic in the export package. You'll have to set the remote addresses yourself or go by hostname not IP address.

            There is no way for it to accurately list everything you want in there without maybe listing something you don't.

            Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

            Need help fast? Netgate Global Support!

            Do not Chat/PM for help!

            1 Reply Last reply Reply Quote 0
            • johnpozJ
              johnpoz LAYER 8 Global Moderator
              last edited by

              ^ valid point ;)

              I will test when I get a chance.

              It does put in the IPv6 for sure when running udp6 on my HE.. and I pick interface address.

              I was hoping when I pick the udp4 and 6 option and in the openvpn setup it still lists wan as the interface it would list out the ipv4 and ipv6 address on my wan interface vs all of them..  But you make a good point.  Prob want to note something like that in the export client.

              An intelligent man is sometimes forced to be drunk to spend time with his fools
              If you get confused: Listen to the Music Play
              Please don't Chat/PM me for help, unless mod related
              SG-4860 24.11 | Lab VMs 2.8, 24.11

              1 Reply Last reply Reply Quote 0
              • jimpJ
                jimp Rebel Alliance Developer Netgate
                last edited by

                The best thing to do there is to make your own DNS record with both A and AAAA responses and set that as what clients use to connect.

                Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

                Need help fast? Netgate Global Support!

                Do not Chat/PM for help!

                1 Reply Last reply Reply Quote 0
                • johnpozJ
                  johnpoz LAYER 8 Global Moderator
                  last edited by

                  Agreed that would be the best option to be sure!

                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                  If you get confused: Listen to the Music Play
                  Please don't Chat/PM me for help, unless mod related
                  SG-4860 24.11 | Lab VMs 2.8, 24.11

                  1 Reply Last reply Reply Quote 0
                  • First post
                    Last post
                  Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.