[09:57] *** RandalSchwartz has quit IRC (Quit: joining via adium because upgrading server) [09:58] *** RandalSchwartz has joined #arpnetworks [09:58] * RandalSchwartz waves at the channel [10:02] looks like I can still get to my console… that's a good thing [10:07] pkg upgrade done, rebooting [10:09] i could use some help if anyone's up [10:09] what kind of help? [10:10] i did a release-upgrade yesterday. it installed a bunch of stuff and the rebooted. after the reboot it took a loooong time to come back, and i thought it was dead, so i did a reboot via the console. now it's on the rescue mode installer main menu [10:10] is that linux? [10:10] ubuntu [10:10] yeah, sorry, I don't run linux anywhre [10:10] np thanks! [10:13] jbum: which sort of Linux [10:14] Ubuntu 14.04 [10:15] I don't know anything about Ubuntu but if they're using grub2 there's all sorts of contortions the OS must do to get a new kernel to boot [10:15] see what the kernel list looks like at boot [10:16] if it is really busted your files are probably still there at least... [10:19] alright! distro updated to FreeBSD 9.3-RELEASE-p24 [10:20] only a few weeks after the CVE came out :) [10:21] heading back to reboot my tmux + emacs + irc client [10:21] *** RandalSchwartz has quit IRC (Quit: Leaving.) [10:22] *** RandalSchwartz has joined #arpnetworks [10:22] there we are. [10:23] does emacs + irc client mean erc? [10:25] no [10:25] irc.el [10:25] older, but I know it better because I contributed to it [10:25] heh [10:25] missing some modern features though [11:45] There's really not much "modern" to IRC though [12:22] what's the simplest way of giving my laptop ipv6 using my arp v6 connectivity? [12:23] considering your laptop is mobile, probably OpenVPN [12:23] ahh, that's right openvpn does v6 nw [12:24] since a gif tunnel would have you updating both sides whenever you changed external IP's. Plus gif would require external IP's on both sides. [12:24] That it does. I've used it extensively in fact - whenever I VPN to my home, I get an IPv6 address :D [12:25] From the OpenVPN side, it's as simple as adding the right server-ipv6 line to the server [12:25] (might be a route push too, can't recall its syntax though) [12:30] what would Iuse for my v6 server address [12:31] the /64 that's already routed to my box? [12:31] inet6 2607:f2f8:3080:: prefixlen 64 [12:31] or should it be a part of the /48 that's not the /64? [12:36] or wait... the whole /48 is routed to me, so I could use 2607:f2f8:3080:beef::/64, right? [12:43] Correct it will need to be a whole /64, slicked from a larger subnet [12:43] *sliced [12:44] so like my second example? [12:44] Right [12:45] Incidentally, :beef: is the same subnet I use for my OpenVPN :D [12:45] push "route-ipv6 2000::/3" [12:45] That's what she said!! [12:45] BryceBot: no [12:45] Oh, okay... I'm sorry. 'push "route-ipv6 2000::/3"' [12:45] ^ That's the server line to default all ipv6 traffic over the openvpn connection [12:46] Hmm. missing a route [12:47] oh - not just server-ipv6? [12:47] need both lines? [12:49] still don't have default v6 route [12:50] yeah... it didn't add the route [12:53] Yes you need both lines [12:53] With those two lines, it "Just Works" for me. You might have client-side issues, maybe? OpenVPN's -v is your friend [12:53] where does 2000::/3 come rom [12:54] is that "all public routable"? [12:54] Yep [12:54] Aggregatable Global Unicast Addresses [12:54] still not seeing that route [12:54] If you had ::0/0 that covers link-local traffic and the like. Some OS will still behave properly, others will not. [12:55] https://community.openvpn.net/openvpn/wiki/IPv6 [12:55] guess you might need tun-ipv6 too [12:55] (which I have too, just forgot about) [12:55] that's implied by server-ipv6 [12:55] as a push or a local? [12:55] I'm getting the right /64 addrs [12:56] just local in my config [12:58] do you have any of those rtadv things running? [12:59] For reference, this is my full openvpn server config http://sprunge.us/ZgER (It's not exactly "bare-bones" so there's lots that doesn't apply to getting ipv6 working.) [12:59] I do, but they don't get routed over th vpn [12:59] * brycec goes afk [12:59] I figure at some point, I should be seeing a route to 2000::/3 [12:59] but not happening [13:00] RandalSchwartz: you should see in your openvpn client's verbose output (at least --verb 4) the parsing of information from the server, including pushed routes and addresses [13:00] * brycec goes afk for real now [13:01] Oh! typo [13:01] push "route-ipv6 2000://3" [13:01] No buena [13:03] Ok... with the typo fixed, I can ping my server, but nothing beyond [13:03] do I need to add a default route on the server? [13:04] linux has ipv6 routing / forwarding setting [13:04] not sure about freebsd [13:04] well - that's weird [13:04] yeah - I have a default outbound route that says "here arp, go find 'em" [13:04] via the link local [13:05] maybe I need to advertise the new /64 somewhere? [13:05] but I thought it automatically goes to me because of the /48 [13:13] Yeah for inbound. Do you have your server setup for forwarding? Any firewalling blocking it? If you tcpdump on your external interface, do you see the ip6 traffic, indicating that everything I mentioned is working right and it's something else? [13:14] > /etc/rc.conf >> ipv6_router_enable="YES" [13:15] net.inet6.ip6.forwarding: 1, net.inet6.ip6.redirect: 1, etc [13:15] ipv6_gateway_enable=YES [13:16] (I can't really help with configuring the server's OS as that get into specifics that I just don't know, sorry.) [13:16] no parameter called router_enable [13:16] so maybe arp isn't routing the whole /48 to me [13:16] (Remember mnathani_, RandalSchwartz is running 9.x) [13:17] RandalSchwartz: mtr shows that it is [13:17] that would make sense [13:17] hmm [13:17] well... something isn't letting it bend the corner [13:17] But seriously, check with tcpdump, see whether any ip6 traffic is being routed out or not. [13:17] Double check that the tun interface for your server has the IP's assigned too. It should, openvpn usually does that automatically. But it's worth checking. [13:18] is your default gateway somthing like fe80::1 ? [13:18] yeah - they all looked good on both sides [13:18] yes [13:18] (Yeah of course it looked good on both sides - you said you could ping the server at least) [13:18] on the ARP server end [13:18] yes - that would be one of the two sides. :) [13:18] If the arp end weren't configured right, then he'd have 0 traffic whatsoever [13:19] (0 ipv6 traffic, that is) [13:19] anyway - this isn't an urgent need... I'm just working out how to upgrade my 8.x syntax to 9.x [13:19] I was sondering if this was still only the /64 rather than the entire /48 [13:20] and figured I'd also see if I could get the VPN to work [13:20] s/sond/wond [13:20] I was wondering if this was still only the /64 rather than the entire /48 [13:20] I've got other things to do today... but thank you for the help already. [13:20] you *did* prove that something in the /48 but not the /64 is routed right? [13:21] Right [13:21] ok - so the real question is whether I'm routing outbound then [13:21] Bingo. Hence why I keep telling you to tcpdump :P [13:22] yeah - I'll do that next time I get curious about this. :) [13:22] that'd be dumping the fe80 [13:22] I'd say "tcpdump -i em0 -nn network 2607:f2f8:3080:beef::/64" or so [13:23] Either you see the traffic leaving your box and you figure out why it's not routing correctly, check the addresses etc. Or it's not leaving your box and you have an internal configuration issue to sort out. [14:19] *** DaCa has quit IRC (Quit: WeeChat 1.0) [14:19] *** toeshred has quit IRC (Ping timeout: 272 seconds) [14:19] *** DaCa has joined #arpnetworks [14:58] *** toeshred has joined #arpnetworks [21:36] *** mnathani_ has quit IRC (Read error: Connection reset by peer) [21:58] *** mnathani_ has joined #arpnetworks [22:16] *** mnathani_ has quit IRC (Read error: Connection reset by peer) [22:35] *** mnathani_ has joined #arpnetworks [23:04] *** jbum has quit IRC (Read error: Connection reset by peer) [23:05] *** jbum has joined #arpnetworks