[00:21] *** ballen has joined #arpnetworks [00:22] anyone setup openvpn to tunnel ipv6 before? [00:28] *** ballen has quit IRC (Read error: 104 (Connection reset by peer)) [00:44] *** ballen has joined #arpnetworks [00:45] ballen: I haven't done openvpn w/ ipv6 tunnel, but if you get it working, let me know how you did it; i've been interested in doing the same thing on my laptop [00:45] yea [00:46] so there appears to be two ways [00:46] one routed + tunnled [00:47] i c [00:47] second bridged, setting up like your laptop is on the same net, run router advertiser, etc [00:47] and if you want ipv4 on the same vpn you'd need to run dhcp as well [00:47] openvpn supports ipv6 nativly in option 2 [00:47] natively* [00:48] as the vpn is running at layer 2 instead of 3 [00:48] not sure which way I'll go with [00:48] I can't get my vps to route my /64 subnet off the box, doing option 1 [00:48] i'd probably go with routed, if i had the choice [00:49] yea [00:49] you just have to use connection/disconnection scripts [00:49] i c [00:50] to setup the tunnel [00:50] routes, etc [00:50] kinda annoying [00:50] yeah [00:51] basing my work so far on: http://www.zagbot.com/openvpn_ipv6_tunnel.html [00:51] but if you think about it, that's how you connect to the regular internet too, with scripts that set up your IPs and routes and such. It is just so tranparent / automatic these days [00:51] yea its just less elegant when deploying clients [00:53] oh i think i get that guy is saying.. [00:53] i never did the tunnel mode b/c I generally never have a static IP on my laptop [00:53] but with OpenVPN, you get a static [00:53] and then can tunnel *over that* [00:53] ## Server ## [00:53] ifconfig gif0 create [00:53] ifconfig gif0 tunnel 10.8.0.1 10.8.0.6 [00:53] ifconfig gif0 inet6 2607:f2f8:1100:6::1/64 [00:53] route add -inet6 2607:f2f8:1100:6::/64 2607:f2f8:1100:6::2 [00:53] ## Client ## [00:54] ifconfig gif0 create [00:54] ifconfig gif0 tunnel 10.8.0.6 10.8.0.1 [00:54] ifconfig gif0 inet6 2607:f2f8:1100:6::2/64 [00:54] thats basically what I have so far [00:54] yeah, and gif0 is OpenVPN independent, but I assume 10.8.0.x is either end of your OpenVPN tunnel [00:54] right [00:54] .6 is the client [00:54] .1 the server [00:55] i would be real interested to see this work [00:55] with that setup, I can ping 2607:f2f8:1100::2, but not 2607:f2f8:1100::1 [00:55] from my laptop [00:57] ballen: your server needs a route back to your client [00:58] although i think you have that covered above with 'route add ...' [00:59] 2607:f2f8:1100:6::/64 2607:f2f8:1100:6::2 UGS gif0 [00:59] ballen: can you ping 2607:f2f8:1100::2 from your server? [00:59] yea thats my local address [01:01] ballen: and your server is 2607:f2f8:1100::1. So you can ping your client from the server, but not the other way around? [01:01] 2607:f2f8:1100::1 is your router (ARP Network) [01:02] 2607:f2f8:1100:6::1 is my server's address on the tunnel [01:02] 2607:f2f8:1100:6::2 is my laptop's address on the tunnel [01:02] ballen: sorry, i meant to put the ':6::' in there [01:02] heh k [01:03] so I can ping from my laptop to :6::1 [01:03] ::2 [01:03] but not ::1 [01:03] so I can't get out to ARP [01:04] current routes: [01:04] 2607:f2f8:1100::/48 link#1 UC em0 [01:04] 2607:f2f8:1100::1 52:54:00:27:90:07 UHLW em0 [01:04] 2607:f2f8:1100::2 52:54:00:27:21:15 UHL lo0 [01:04] 2607:f2f8:1100:6::/64 2607:f2f8:1100:6::2 UGS gif0 [01:04] 2607:f2f8:1100:6::1 link#4 UHL lo0 [01:04] so em0 [01:04] em0 is public interface [01:04] lol [01:04] * bigs smacks obsidieth [01:05] let me connect back to the vpn, brb [01:05] *** ballen_ has joined #arpnetworks [01:05] *** ballen has quit IRC (Nick collision from services.) [01:05] *** ballen_ is now known as ballen [01:06] k back [01:06] ballen: so you can ping :6::2 from the server and :6::1 from the client, yes? [01:06] *** up_the_irons changes topic to: On tonight's show, we bring you IPv6 tunnels over OpenVPN [01:07] one sec [01:09] k [01:09] up_the_irons: yes both those work [01:10] ballen: what's the output of: [01:10] sysctl net.inet6.ip6.forwarding [01:10] 1 [01:10] if it's "0", that's the problem [01:10] OK [01:10] cool [01:10] :-) yea already checked that one [01:10] :) [01:11] also on the laptop: default 2607:f2f8:1100:6::1 UGSc gif0 [01:12] ballen: run this on your server: [01:12] sudo tcpdump -ni em0 ip6 [01:12] ballen: then ping from client to server, see where it is going [01:13] one sec change default route [01:13] changing [01:16] http://pastie.org/592053 [01:17] thats a ping to the server's gateway [01:17] that fails [01:19] * up_the_irons ponders [01:22] net.inet6.ip6.fw.enable: 1 ? [01:25] nvm [01:27] this is what I see on my router: http://pastie.org/private/3eg31jycv4ch9ct39unheq [01:27] [root@arp /etc/rc.d]# ndp -a [01:27] Neighbor Linklayer Address Netif Expire S Flags [01:27] 2607:f2f8:1100::1 52:54:0:27:90:7 em0 expired R R [01:27] 2607:f2f8:1100::2 52:54:0:27:21:15 em0 permanent R [01:27] 2607:f2f8:1100:6::1 (incomplete) gif0 permanent R [01:27] 2607:f2f8:1100:6::2 (incomplete) gif0 expired D [01:29] ballen: that's from your server? [01:29] yea [01:29] ndp -a [01:30] radvd [01:30] rtadvd? [01:30] on my router I have: [01:30] ndp -a | grep 2607:f2f8:1100 [01:30] 2607:f2f8:1100::1 52:54:0:27:90:7 vlan115 permanent R [01:30] 2607:f2f8:1100::2 52:54:0:27:21:15 vlan115 23h59m11s S R [01:30] 2607:f2f8:1100:6::2 (incomplete) vlan115 1s I 1 [01:38] wonder what will happen if I make a proxy ndp entry [01:45] so in ipv4 basically the arp router would have to know about my new subnet [01:46] but I assume in ipv6 there's an automagically way of doing this? [01:48] ballen: in IPv4, ARP's router wouldn't need to know about any smaller subnets, it just sees the aggregate [01:48] ah right, I was thinking if I made up a new subnet [01:50] ballen: if you made a completely new subnet (say you had a subnet from another provider), then yes, I'd have to put in a static route to you (simplest case), or we run some routing protocal (rip, ospf, bgp, etc...). [01:50] right [01:54] alright will work on this more later, need to sleep [01:55] ballen: now, IPv6 brought with in a boat load of smaller protocols, one of which is this solicited-node multicast thing from which my router wants a reply [01:55] ballen: ok, l8r [01:56] any idea how to get my server to give a reply [01:57] ballen: not really; but i'm going to investigate [01:57] cool [01:57] might be the gif tunnel [01:58] but who knows, be on tomorrow [01:58] later [01:58] *** ballen is now known as ballen|away [02:00] ballen|away: when you're back, make sure your gif0 tunnel forwards multicast traffic [02:37] *** ConquerorX has joined #arpnetworks [02:38] Welcome ConquerorX [02:38] ballen|away: OK, check this out: [02:39] On my router, if I do: [02:39] s3.lax:~> sudo route add -inet6 -net 2607:f2f8:1100:6:: -prefixlen 56 2607:f2f8:1100::2 [02:39] add net 2607:f2f8:1100:6::: gateway 2607:f2f8:1100::2 [02:39] Now I can ping your laptop: [02:39] s3.lax:~> ping6 2607:f2f8:1100:6::2 [02:39] PING6(56=40+8+8 bytes) 2607:f2f8:1100::1 --> 2607:f2f8:1100:6::2 [02:39] 16 bytes from 2607:f2f8:1100:6::2, icmp_seq=0 hlim=63 time=94.476 ms [02:39] 16 bytes from 2607:f2f8:1100:6::2, icmp_seq=1 hlim=63 time=87.624 ms [02:39] 16 bytes from 2607:f2f8:1100:6::2, icmp_seq=2 hlim=63 time=104.49 ms [02:39] ^C [02:39] --- 2607:f2f8:1100:6::2 ping6 statistics --- [02:39] 3 packets transmitted, 3 packets received, 0.0% packet loss [02:39] round-trip min/avg/max/std-dev = 87.624/95.530/104.490/6.926 ms [02:40] ballen|away: So, this is what is going on, it helps to think about it like IPv4, and it makes sense -- [02:40] I'm routing a /48 to you. From my router's POV, that /48 is one huge subnet, it doesn't know about anything beyond its neighbor (your VPS). [02:42] If that /48 were in IPv4 (let's say it is a /24), anything I ping behind it would generate an "arp who-has" packet [02:42] b/c the router sees that subnet as directly connected, and it is trying to ARP the host belonging the IP I'm pinging [02:43] if there are subnets beyond that block, my router wouldn't know about it, and it would rely on static routes, or rip, or ospf, or bgp, etc... like i noted above, to find out about those routes [02:43] (err, subnets) [02:43] Now, IPv6 doesn't have ARP [02:43] It has ND [02:44] (neighbor discovery) [02:44] which is kinda like ARP on steroids [02:44] It can find information not only about directly connected neighbors (like ARP), but also about subnets beyond them [02:45] this is why, when my router got an ICMP from your laptop, it saw the return address as 2607:f2f8:6::2, and didn't have this in its ND table (would be ARP cache in IPv4) [02:46] so it sends out that "ND who has" packet (neighbor solicitation) [02:46] I'm not seeing the corresponding "ND tgt is" packet (neighbor advertisment) from your laptop [02:47] and so the ND table isn't updated, therefore the ICMP reply can't be sent to you [02:47] [02:47] I hope that made sense [02:47] was pretty educational for me having to deduce it all ;) [02:50] why your laptop isn't sending the neighbor advertisement back is unknown at this time; perhaps it doesn't even see the solicitation. if you tcpdump both your VPS and your laptop, you'll see which side is not propagating the ND packets over the tunnel [03:03] ConquerorX: how's it goin' [03:10] Qsource: you around [03:13] ballen|away: also, when you're back, try a speed test on your OpenVPN connection; you should be getting way more than 6 megs; i made some adjustments [04:43] im going to have to give this a try soon, ive always wondered if you can ste up a vpn without X to do it [04:47] yeah [06:10] *** heavysixer has quit IRC () [06:22] ive got a question if you're still here [07:44] *** heavysixer has joined #arpnetworks [08:46] *** ballen|away has quit IRC (Read error: 60 (Operation timed out)) [09:01] *** ballen has joined #arpnetworks [09:02] *** ConquerorX has quit IRC () [09:22] *** ballen_ has joined #arpnetworks [09:22] *** ballen has quit IRC (Nick collision from services.) [09:22] *** ballen_ is now known as ballen [10:01] *** ballen is now known as ballen|away [10:15] *** vtoms has joined #arpnetworks [11:10] *** vtoms has quit IRC ("Leaving.") [11:16] *** ballen|away is now known as ballen [12:07] up_the_irons: so my laptop doesn't get the solicitation from your router [12:07] appears the VPS isn't forwarding it [12:19] ballen: do you see the solicitation on your VPS (destined to your laptop) ? [12:19] 15:19:42.584527 IP6 2607:f2f8:1100::1 > ff02::1:ff00:2: ICMP6, neighbor solicitation, who has 2607:f2f8:1100:6::2, length 32 [12:19] ballen: and did you see my rather large explanation after you went |away? [12:19] yep [12:19] thats from a dump listening on em0 [12:19] yeah [12:20] now see, I don't know anough about ND yet to know who is supposed to respond to the solicitation, your VPS or your laptop [12:20] yea no idea either [12:20] its not making it to the gif0 on the VPS, and obviously not to the laptop's gif0 [12:21] it sends it to a IPv6 multicast group (ff02::1:ff00:2:), so multicast has to be functioning for this to work, have no idea about that and OpenVPN [12:21] ballen: so gif0 isn't becoming part of the multicast group [12:21] I would assume not [12:22] obsidieth: you had a question b4? [12:23] it's all here: http://tools.ietf.org/html/rfc2461 [12:25] from the introduction, it would appear your VPS (the directly attached neighbor) would respond to the ND [12:25] yea it seems that would be the logical thing [12:25] there is such thing is a Neighbor Proxy [12:28] i c [12:29] http://www.man9.org/bsd/8/ndp.html [12:29] If the word proxy [12:29] is given, this system will act as a proxy NDP server, responding [12:29] to requests for hostname even though the host address is not its [12:29] own. [12:30] holy shat it works [12:31] ballen: give it a try [12:31] ndp -s 2607:f2f8:1100:6::2 52:54:0:27:21:15 proxy [12:31] oh [12:31] really?? [12:31] which is the VPS's linklayer address btw [12:31] right [12:31] not sure what else to put there [12:31] so can u ping? [12:32] ping6 2607:f2f8:1100::1 [12:32] PING6(56=40+8+8 bytes) 2607:f2f8:1100:6::2 --> 2607:f2f8:1100::1 [12:32] 16 bytes from 2607:f2f8:1100::1, icmp_seq=0 hlim=63 time=99.082 ms [12:32] 16 bytes from 2607:f2f8:1100::1, icmp_seq=1 hlim=63 time=93.322 ms [12:32] PING6(56=40+8+8 bytes) 2607:f2f8:1100::1 --> 2607:f2f8:1100:6::2 [12:32] 16 bytes from 2607:f2f8:1100:6::2, icmp_seq=0 hlim=63 time=91.046 ms [12:32] 16 bytes from 2607:f2f8:1100:6::2, icmp_seq=1 hlim=63 time=99.93 ms [12:32] :) [12:32] woot [12:32] w00t [12:32] $ ndp -a | grep 2607:f2f8:1100 [12:32] 2607:f2f8:1100::1 52:54:0:27:90:7 vlan115 permanent R [12:32] 2607:f2f8:1100::2 52:54:0:27:21:15 vlan115 23h59m21s S R [12:32] so you need to make sure you delete the ndp entry before hand as well [12:32] 2607:f2f8:1100:6::2 52:54:0:27:21:15 vlan115 9s R R [12:32] ^^ now my router sees the :6::2 entry [12:33] otherwise ndp will bitch [12:33] delete what ndp entry? [12:33] it already has one for :6::2, just not proxy? [12:33] ndp -d 2607:f2f8:1100:6::2 [12:33] yep [12:33] ah [12:33] the incomplete entry [12:33] gotcha [12:33] i wonder why your VPS sees the :6::2 as incomplete [12:34] likely because gif has not mac address [12:34] no* [12:34] see, this is probably the source of the prob... it *should* see :6::2 [12:34] b/c it is directly connected [12:34] right [12:34] OOH, no MAC [12:34] yeah, there is something funny going on w/ gif0 [12:34] I bet you don't even need gif0 [12:34] is gif the 6to4 tunnel int? [12:34] why not a regular sit? [12:34] b/c at this point, you don't need a tunnel [12:35] i mean, 6to4 tunnel [12:35] hmm [12:35] you're on the native IPv6 Internet [12:35] does sit exist on FreeBSD? [12:35] not sure [12:35] I couldn't find it [12:35] also laptop is a mac [12:35] which has gif [12:36] but yea gif is tunnling 6 over 4 [12:36] looks like gif is a generic tunneling interface (man gif) [12:36] as openvpn doesn't support native v6 over tun adapater [12:36] yea [12:37] adapter* [12:37] ok gotcha, openvpn is the limitation [12:37] woot, laptop can ping www.kame.net [12:38] and i have a dancing turtle [12:38] hahhaa [12:38] that's pretty cool [12:39] kinda dumb that is basically IPv4 -> SSL Tunnel -> IPv4 Tunnel -> IPv6 [12:39] lots of tunnels [12:39] right [12:40] mtu is down to 1280 [12:40] at that point [12:40] right [12:48] now to make this dynamic on vpn connection [12:49] ballen: so what does the inet6 routing table look like on your laptop now? [12:51] http://pastie.org/private/ef0faj3k6yg5hhcgqgw4q [12:51] this is the first time I've seen a major difference between IPv4 and IPv6 routing / subnetting. In IPv4, you wouldn't have been able to subnet your block without us having a /30 PtoP and then running a routing protocol [12:51] so 2 blocks per node, at least [12:51] ignore 2607:f2f8:1100::f1ab:2, thats from previous attempts [12:52] I remember reading one of the goals of IPv6 was to be like "one block per node, at that's it, never need more" [12:52] yea [12:52] its pretty nifty [12:52] so I give you a /48, and my router can work with subnets within your /48 w/o a routing protocol, it just kinda works [12:52] very nifty [12:53] cool routing table, so you use the other end of your tunnel as default gateway for ipv6 [12:53] yep [12:54] nice [12:54] aww can't assign a gif interface a mac address lame [12:56] sucks [12:57] ya [12:59] food time [12:59] k [13:29] *** ballen has quit IRC (Read error: 60 (Operation timed out)) [14:04] *** heavysixer has quit IRC () [15:08] *** vtoms has joined #arpnetworks [15:34] *** ballen has joined #arpnetworks [15:35] *** ballen has quit IRC (Client Quit) [15:35] *** ballen has joined #arpnetworks [15:36] *** vtoms has quit IRC ("Leaving.") [15:36] freenode over the v6 tubes woot [15:38] *** ballen is now known as ballen|away [16:08] *** ballen|away is now known as ballen [16:24] *** ballen is now known as ballen|away [17:50] *** vtoms has joined #arpnetworks [18:25] *** heavysixer has joined #arpnetworks [18:32] *** vtoms has quit IRC ("Leaving.") [18:48] up_the_irons: i was wondering how reverse dns works for the ip block [18:48] i heard of some vps's having a panel/webgui for it. [19:09] *** ballen|away is now known as ballen [19:19] *** vtoms has joined #arpnetworks [19:20] *** vtoms has quit IRC (Client Quit) [20:04] *** heavysixer has quit IRC () [20:16] *** timburke has quit IRC ("leaving") [20:17] *** timburke has joined #arpnetworks [20:25] *** ballen has quit IRC (Read error: 60 (Operation timed out)) [20:36] *** ballen has joined #arpnetworks [20:46] *** ballen has quit IRC (Read error: 60 (Operation timed out)) [20:59] *** ballen has joined #arpnetworks [20:59] anyone know of a mail service that has smtp servers on ipv6 [20:59] beats me [21:04] want to test sending email to my sever over ipv6 [21:04] and none of the big webmail providers have ipv6 setup [21:11] ive never considered trying. [21:11] would it actually have any advantages? [21:11] no idea [21:12] just being able to be assessable by other ipv6 connected people/servers [21:12] accessible* [21:12] just turned on v6 on all my daemons [21:13] so my two websites, imap, and smtp all can be reached via my ipv6 address [21:13] and added AAAA records for the various domains [21:14] nais [21:14] im thinking i might try something similar soon. [21:14] so a /48 is 1,208,925,819,614,629,174,706,176 addresses [21:15] seems a smidge overkill [21:15] haha [21:15] i currently have a /48 and /64 on my home box. [21:15] * obsidieth crunches numbers [21:15] /64 is 18,446,744,073,709,551,616 [21:16] 1.20894427 × 1024 [21:16] bleh, hard to paste. [21:16] yea [21:16] gonna burn through ipv6 address space in no time [21:17] it would be nice to totally do away with NAT though [21:17] over 100 million for every sqaure foot of the earths [21:18] well, 1500 or something. [21:18] heh [21:18] still, lots [21:18] lots and lots [21:19] I ended up getting the openvpn setup working [21:19] kinda a hack though [21:19] likely would work better with linux and sit interface instead of gif [21:19] nice [21:20] i might save the scrollback and review when i give it a shot [21:20] I ended up need to add a static proxy entry in the server's ndp table for the new subnet [21:20] sometime in here I'll get all the configs together and write a post [21:20] if you want them jost me know in mean time [21:20] just* [21:21] its fairly specific to a freebsd server and mac os x client [21:21] but should be adaptable [21:21] i would only need the freebsd server part most likely. [21:21] maybe that wont be as difficult. [21:22] whatever your client is would need to support the gif driver [21:22] to work with how I'm tunneling the traffic [21:23] * obsidieth shrugs [21:28] oh someone has to have a freaking smtp server in v6 [21:30] lmao, http://www.prujem.cz/ IPv6 porn and movies server [21:31] Alert!: Unable to connect to remote host. [21:31] :( [21:31] lol [21:31] IPv6 only [21:31] eh, i can ping it [21:31] maybe lynx doesnt ipv6 without some set up [21:32] not sure [22:17] *** ballen has quit IRC (Read error: 60 (Operation timed out))