{"id":533,"date":"2012-02-24T16:35:54","date_gmt":"2012-02-24T16:35:54","guid":{"rendered":"http:\/\/www.fbcs.co.uk\/wp\/?p=533"},"modified":"2012-02-24T16:35:54","modified_gmt":"2012-02-24T16:35:54","slug":"ipv6-tunnelling","status":"publish","type":"post","link":"https:\/\/wp.fbcs.co.uk\/ipv6-tunnelling\/","title":{"rendered":"IPv6 Tunnelling on Linux"},"content":{"rendered":"<h1>IPv6 Tunnelling on Linux<\/h1>\n<p>This is probably fairly basic stuff, and there are many other webpages with similar information, but here, the information is set out in a way that makes sense to me.&nbsp; Hopefully it will to others too.<\/p>\n<p>These notes will help you set up IPv6 routing on your local network.<\/p>\n<p><strong>The plan<\/strong>: to enable one of the Linux computers on my home network to handle IPv6 tunnelling and route advertising.&nbsp; All computers on the local network will then be able to access the IPv6 internet.<\/p>\n<p>Prerequisites:<\/p>\n<ul>\n<li>An ADSL\/Cable\/whatever modem\/router that does NOT block protocol 41 packets.&nbsp; If yours does block protocol 41, the tunnel won&#39;t work.&nbsp; I don&#39;t know of a specific way of testing whether a router blocks protocol 41.<\/li>\n<li>A Linux computer on your home network that will act as IPv6 router (don&#39;t confuse it with the &#39;router&#39; that is probably also your ADSL modem and wifi access point).&nbsp; (No doubt this can be done on Windows too, but don&#39;t ask me how).<\/li>\n<li>An internet connection for the Linux computer with a fixed IP address (not a dynamically allocated one).&nbsp; I&#39;ll refer to that fixed IP address as 5.6.7.8.&nbsp; Note that this need <em>not<\/em> be an externally routable address: if the computer is behind a NAT box, and has a local address such as 192.168.1.8, then that&#39;s the address to use where these instructions say &#39;5.6.7.8&#39;.&nbsp; [This is a correction to the previous version of these instructions.]<\/li>\n<\/ul>\n<p>Assumptions<\/p>\n<ul>\n<li>Your Linux computer is running a Debian-based system (including Ubuntu and Mint).&nbsp; If not, you&#39;ll need find equivalent versions of some of the commands given here.<\/li>\n<\/ul>\n<p>Post-requisites<\/p>\n<ul>\n<li>Once you&#39;ve got IPv6 networking going, you&#39;ll suddenly need an IPv6 firewall, because your computers all now have externally accessible addresses.&nbsp; This post won&#39;t tell you how to do that.<\/li>\n<\/ul>\n<h2>Step 1<\/h2>\n<p>Go to Hurricane Electric&#39;s <a href=\"http:\/\/tunnelbroker.net\" target=\"_blank\">tunnelbroker.net<\/a> and register for a tunnel.&nbsp; (Other tunnel providers are available).<\/p>\n<p>Hurricane Electric (HE) will allocate a \/64 subnet (aka &#39;prefix&#39;) to you, such as 2001:db8:4321:abcd::\/64.&nbsp; (HE&#39;s tunnels really start with 2001:470: but I&#39;ll use the official example subnet of 2001:db8: in this document.)<\/p>\n<p>Once you&#39;ve registered, signed in, and created a tunnel, HE&#39;s page at www.tunnelbroker.net will list your tunnels (you can have up to five) by their domain names, which will be something like <span style=\"font-family:courier new,courier,monospace;\">user-1.tunnel.tserv10.par1.ipv6.he.net<\/span>.<\/p>\n<p>Click on the name of the tunnel to find all sorts of useful details, including:<\/p>\n<table>\n<tbody>\n<tr>\n<th style=\"text-align: left;\">Server IPv4 Address:<\/th>\n<td style=\"text-align: right;\">1.2.3.4<\/td>\n<\/tr>\n<tr>\n<th style=\"text-align: left;\">Server IPv6 Address:<\/th>\n<td style=\"text-align: right;\">2001:db8:<b>4321<\/b>:abcd::1\/64<\/td>\n<\/tr>\n<tr>\n<th style=\"text-align: left;\">Client IPv4 Address:<\/th>\n<td style=\"text-align: right;\">5.6.7.8<\/td>\n<\/tr>\n<tr>\n<th style=\"text-align: left;\">Client IPv6 Address:<\/th>\n<td style=\"text-align: right;\">2001:db8:<b>4321<\/b>:abcd::2\/64<\/td>\n<\/tr>\n<tr>\n<th colspan=\"2\" style=\"text-align: left;\">Routed IPv6 Prefixes<\/th>\n<\/tr>\n<tr>\n<th style=\"text-align: left;\">Routed \/64:<\/th>\n<td style=\"text-align: right;\">2001:db8:<b>4322<\/b>:abcd::\/64<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>Note that 1.2.3.4 represents the IPv4 address of the tunnel that has been assigned to you.&nbsp; And 5.6.7.8 will be replaced by your own external IPv4 address: if you&#39;re behind a firewall or ADSL router that does NAT, that&#39;s the real-world address of your ADSL router.<\/p>\n<p>The tunnel has two ends, and each end has both an IPv4 address and an IPv6 one.&nbsp; The IPv4 addresses are your own external address (5.6.7.8) and the one assigned by HE (1.2.3.4).&nbsp; The IPv6 addresses are in the \/64 subnet assigned by HE for the purpose: the far end&#39;s address ends in ::1, the local end&#39;s address ends in ::2.&nbsp; No other addresses in that subnet are used.<\/p>\n<p>HE also give you another &#39;routed&#39; \/64 subnet: that&#39;s the one you&#39;ll use on your LAN.&nbsp; In this example it&#39;s 2001:db8:4322:abcd::\/64.<\/p>\n<p>HE provide &#39;Example Configurations&#39; which list the commands needed to set up the tunnel for a range of operating systems.&nbsp; I&#39;ll use the &#39;Linux-route2&#39; example:<\/p>\n<pre style=\"margin-left: 40px;\">modprobe ipv6\nip tunnel add he-ipv6 mode sit remote 1.2.3.4 local 5.6.7.8 ttl 255\nip link set he-ipv6 up\nip addr add 2001:db8:4321:abcd::2\/64 dev he-ipv6\nip route add ::\/0 dev he-ipv6\nip -f inet6 addr<\/pre>\n<p>Run those commands (as root), and you should be in business.&nbsp; Now you can try<\/p>\n<pre style=\"margin-left: 40px;\">ping6 ipv6.google.com<\/pre>\n<p>and browsing to sites such as <a href=\"http:\/\/www.kame.net\" target=\"_blank\">www.kame.net<\/a>, where the famous dancing turtle confirms that you&#39;re using IPv6.<\/p>\n<p>To make those settings permanent you can add them to <span style=\"font-family:courier new,courier,monospace;\">\/etc\/rc.local<\/span> (or whichever file your version of Linux uses for locally-configured start-up commands).&nbsp;<\/p>\n<h2>Step 2<\/h2>\n<p>Step 2 involves sharing the IPv6 goodness with other computers on your network.&nbsp;<\/p>\n<p>First, activate IPv6 packet forwarding on your &#39;router&#39; with these commands:<\/p>\n<pre style=\"margin-left: 40px;\">sudo sysctl -w net.ipv6.conf.all.forwarding=1\nsudo echo net.ipv6.conf.all.forwarding=1 &gt;&gt; \/etc\/sysctl.conf<\/pre>\n<p>The first of those commands enables forwarding now; the second makes the change permanent so that the setting will still be there after the computer is rebooted.<\/p>\n<p>The Route Advertising Daemon <strong>radvd<\/strong> is what I used.&nbsp; Install the radvd package, and then create \/etc\/radvd.conf containing something like this (taken from <a href=\"http:\/\/tomicki.net\/ipv6.router.php\" target=\"_blank\">tomicki.net<\/a>):<\/p>\n<pre style=\"margin-left: 40px;\">interface eth0\n{\n    AdvSendAdvert on;\n    MinRtrAdvInterval 5;\n    MaxRtrAdvInterval 15;     \n\n    prefix 2001:db8:4322:abcd::\/64\n    {\n        AdvOnLink on;\n        AdvAutonomous on;\n    };\n};\n<\/pre>\n<p>Start the radvd daemon (with <span style=\"font-family:courier new,courier,monospace;\">sudo \/etc\/init.d\/radvd start<\/span> on Debian).&nbsp; And then try accessing IPv6 from other computers on your LAN &#8212; magically, it works!&nbsp; Windows Vista\/7 computers will have to have teredo tunnelling turned off first, otherwise they&#39;ll use that instead of your own tunnel.&nbsp; I&#39;m not sure how Windows XP handles this.<\/p>\n<h2>What to do next<\/h2>\n<p>This is just the beginning of life with IPv6.&nbsp; You&#39;ll want to go on to play with:<\/p>\n<ul>\n<li>an IPv6 firewall, i.e. ip6tables settings, possibly wrapped in a more user-friendly scripting language such as <a href=\"http:\/\/ferm.foo-projects.org\/\" target=\"_blank\">ferm<\/a>.<\/li>\n<li>more control over address allocation, using a DHCPv6 server such as <a href=\"http:\/\/klub.com.pl\/dhcpv6\/\" target=\"_blank\">dibbler<\/a>.<\/li>\n<\/ul>\n<p>&nbsp;<\/p>\n","protected":false},"excerpt":{"rendered":"<p>IPv6 Tunnelling on Linux This is probably fairly basic stuff, and there are many other webpages with similar information, but here, the information is set out in a way that makes sense to me.&nbsp; Hopefully it will to others too. These notes will help you set up IPv6 routing on your local network. The plan: [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[17,7,18,29],"tags":[],"_links":{"self":[{"href":"https:\/\/wp.fbcs.co.uk\/wp-json\/wp\/v2\/posts\/533"}],"collection":[{"href":"https:\/\/wp.fbcs.co.uk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/wp.fbcs.co.uk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/wp.fbcs.co.uk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/wp.fbcs.co.uk\/wp-json\/wp\/v2\/comments?post=533"}],"version-history":[{"count":0,"href":"https:\/\/wp.fbcs.co.uk\/wp-json\/wp\/v2\/posts\/533\/revisions"}],"wp:attachment":[{"href":"https:\/\/wp.fbcs.co.uk\/wp-json\/wp\/v2\/media?parent=533"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/wp.fbcs.co.uk\/wp-json\/wp\/v2\/categories?post=533"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/wp.fbcs.co.uk\/wp-json\/wp\/v2\/tags?post=533"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}