Thursday, January 2, 2014

IPv6 in OpenVPN

This page describes IPv6 support in OpenVPN.
Overview

Starting officially in the 2.3.0 release, OpenVPN supports IPv6 inside the tunnel, and can optionally be configured with IPv6 as a transport protocol for the tunneled data. There were some unofficial developer patches for the 2.2.x series that added partial IPv6 support (Debian in particular chose to integrate these patches into some of their builds.)

Providing IPv6 inside the tunnel

This section walks through providing IPv6 connectivity inside the tunnel; this will discuss a routed setup; a bridged (dev tap) setup is not recommended in general, and users doing so are presumably advanced enough to know what they're doing.

Requirements

A few things must be met in order to use IPv6:
•An existing and functional OpenVPN configuration (use the official howto if you don't yet have this.)
•A routed IPv6 network block that will reach the host configured as the OpenVPN server
•Both client and server must support IPv6; most modern systems these-days include this support already

Details: IPv6 routed block

In a routed setup, you cannot use your on-link network; you must use a unique routed network range, just like when routing with IPv4. Most ISPs should have a facility to obtain a routed block on request, or sometimes provided as part of DHCPv6-PD; these concepts are outside the scope of this document. Speak to your ISP or use other IPv6 learning resources for further information.

It is recommended to use a /64 for your OpenVPN subnet. While OpenVPN can happily use smaller networks (such as a /112) this is not compatible with the 2.2.x dev-patches that f.ex Debian uses. Thus a /64 is the preferred choice for an OpenVPN IPv6 allocation.

In this document, we'll assume you have the following from the OpenVPN server's viewpoint:
•The OpenVPN server has an IPv6 IP of 2001:db8:abc::100/64 on its LAN interface
•The following block is routed to the OpenVPN server host: 2001:db8:123::/64

Additional OpenVPN config

There are 2 ways to add IPv6 addressing and pool options to the server, similar to what OpenVPN supports for IPv4: using a helper-directive, and by expanding the helper-directive. The expansion is required if you do not wish to use the automatic values the helper-directive supplies. Clients who use --client or --pull will get the tun-ipv6 directive and addressing from the pool pushed as a result.

Config stanza using the helper

Add the following to a functioning OpenVPN config:
server-ipv6 2001:db8:123::/64

Config stanza with expanded directives​
Add the following to a functioning OpenVPN config: ​

tun-ipv6​

push tun-ipv6​

ifconfig-ipv6 2001:db8:123::1/64 2001:db8:123::0/64​

ifconfig-ipv6-pool 2001:db8:123::101/64
Pushing IPv6 routes

Pushing routes over the tunnel works much like it does in IPv4, but you use --push "route-ipv6 NETWORK/CIDR"

Using the addressing examples shown above, if you wanted to expose the server-side network of 2001:db8:abc::/64, you could use:
push "route-ipv6 2001:db8:abc::/64"

To redirect all Internet-bound traffic, use the current allocated public IP space like this:
push "route-ipv6 2000::/3"

------------------------------- 

;jamesiswizard_1
client fe80:0:0:0:0:0:10.66.16.0 255.255.248.0
# /sbin/ip -6 route add 2000::/3 via 2001:0db8:0:f101::1
# /sbin/route -A inet6 add 2000::/3 gw 2001:0db8:0:f101::1
# /sbin/ip -6 route add 2000::/3 dev eth0 metric 1
# /sbin/route -A inet6 add 2000::/3 dev eth0
dev tun-vpn-tls
ifconfig 10.31.113.194 255.255.248.0
tun-mtu 1500
tun-mtu-extra 32
float
setenv FORWARD_COMPATIBLE 1
client
remote 68.68.108.6 80,443,1723
lport 53,3124,3127,3128,9201,8755,8080,9201,80,8091,8081
proto udp
mssfix 1450
sndbuf 100000
rcvbuf 100000
dhcp-option DISABLE-NBT
resolv-retry infinite
verb 3
bind
setenv PUSH_PEER_INFO
inactive 50000000 50000
hand-window 120
dev tun
route-method exe
route-delay 5
remote-random
pull
persist-key
persist-tun
persist-local-ip
persist-remote-ip
auth-retry nointeract
mute 20
auth-user-pass jamesiswizard_1
auth-nocache
reneg-sec 0
hand-window 120
mute replay warnings
interface Tunnel10
ip vrf forwarding Staff
ip address 10.254.254.23 255.255.255.0
no ip redirects
ip mtu 1416
ip nhrp authentication MFS
ip nhrp map multicast 172.16.1.1
ip nhrp map 10.254.254.1 172.16.1.1
ip nhrp map 10.254.254.3 172.16.1.3
ip nhrp map multicast 172.16.1.3
ip nhrp network-id 10
ip nhrp holdtime 600
ip nhrp nhs 10.254.254.1
ip nhrp nhs 10.254.254.3
ip tcp adjust-mss 1360
tunnel source FastEthernet0/0
tunnel mode gre multipoint
tunnel key 10
!
interface Tunnel20
ip vrf forwarding Clients
ip address 10.254.253.23 255.255.255.0
no ip redirects
ip mtu 1416
ip nhrp authentication MFSC
ip nhrp map 10.254.253.1 172.16.1.1
ip nhrp map multicast 172.16.1.1
ip nhrp map multicast 172.16.1.3
ip nhrp map 10.254.253.3 172.16.1.3
ip nhrp network-id 20
ip nhrp holdtime 600
ip nhrp nhs 10.254.253.1
ip nhrp nhs 10.254.253.3
ip tcp adjust-mss 1360
tunnel source FastEthernet0/0
tunnel mode gre multipoint
tunnel key 20
!
interface Tunnel10
ip vrf forwarding Staff
ip address 10.254.254.1 255.255.255.0
no ip redirects
ip mtu 1416
ip nhrp authentication MFS
ip nhrp map multicast dynamic
ip nhrp network-id 10
ip nhrp holdtime 360
ip tcp adjust-mss 1360
tunnel source FastEthernet0/0
tunnel mode gre multipoint
tunnel key 10
!
interface Tunnel20
ip vrf forwarding Clients
ip address 10.254.253.1 255.255.255.0
no ip redirects
ip mtu 1416
ip nhrp authentication MFSC
ip nhrp map multicast dynamic
ip nhrp network-id 20
ip nhrp holdtime 360
ip tcp adjust-mss 1360
tunnel source FastEthernet0/0
tunnel mode gre multipoint
tunnel key 20
!
interface Tunnel10
ip vrf forwarding Staff
ip address 10.254.254.3 255.255.255.0
no ip redirects
ip mtu 1416
ip nhrp authentication MFS
ip nhrp map multicast dynamic
ip nhrp network-id 10
ip nhrp holdtime 360
ip nhrp server-only
ip tcp adjust-mss 1360
tunnel source FastEthernet0/0
tunnel mode gre multipoint
tunnel key 10
remote 68.68.108.246 80,10,443,1274
!
interface Tunnel20
ip vrf forwarding Clients
ip address 10.254.253.3 255.255.255.0
no ip redirects
ip mtu 1416
ip nhrp authentication MFSC
ip nhrp map multicast dynamic
ip nhrp network-id 20
ip nhrp holdtime 360
ip tcp adjust-mss 1360
tunnel source FastEthernet0/0 tunnel mode gre multipoint
tunnel key 20
!
interface Tunnel1
description BRANCH GRE TUNNEL
ip address 10.10.10.10 255.255.255.0
no ip redirects
ip mtu 1400
ip nhrp authentication dmvpn
ip nhrp map multicast dynamic
ip nhrp map 10.10.10.1 74.95.xxx.xxx
ip nhrp map multicast 74.95.xxx.xxx
ip nhrp network-id 99
ip nhrp holdtime 360
ip nhrp nhs 10.10.10.1
ip nhrp server-only
ip tcp adjust-mss 1360
no ip mroute-cache
delay 1000
qos pre-classify
tunnel source FastEthernet4
tunnel mode gre multipoint
tunnel key 100099
tunnel protection ipsec profile dmvpnprof
interface FastEthernet0
switchport access vlan 192
!
interface FastEthernet1
switchport access vlan 192
!
interface FastEthernet2
switchport access vlan 192
!
interface FastEthernet3
switchport access vlan 192
!
interface FastEthernet4
desc WAN
ip dhcp client lease 365 0 0
ip address dhcp
ip nat outside
ip virtual-reassembly
duplex auto
speed auto
interface Vlan192
ip address 192.168.100.254 255.255.255.0
ip nat inside
ip virtual-reassembly
ip nat pool JT 98.201.157.44 98.201.157.44 netmask 255.255.255.248
ip nat inside source route-map nonat interface FastEthernet4 overload
access-list 114 deny ip 192.168.100.0 0.0.0.255 192.168.10.0 0.0.0.255
access-list 114 deny ip 192.168.100.0 0.0.0.255 192.168.20.0 0.0.0.255
access-list 114 deny ip 192.168.100.0 0.0.0.255 192.168.30.0 0.0.0.255
access-list 114 deny ip 192.168.100.0 0.0.0.255 192.168.40.0 0.0.0.255
access-list 114 deny ip 192.168.100.0 0.0.0.255 172.168.0.0 0.0.0.255
access-list 114 deny ip 192.168.100.0 0.0.0.255 192.168.50.0 0.0.0.255
access-list 114 deny ip 192.168.100.0 0.0.0.255 192.168.60.0 0.0.0.255
access-list 114 deny ip 192.168.100.0 0.0.0.255 192.168.70.0 0.0.0.255
access-list 114 deny ip 192.168.100.0 0.0.0.255 192.168.80.0 0.0.0.255
access-list 114 deny ip 192.168.100.0 0.0.0.255 192.168.90.0 0.0.0.255
access-list 114 deny ip 192.168.100.0 0.0.0.255 192.168.100.0 0.0.0.255
access-list 114 deny ip 192.168.100.0 0.0.0.255 192.168.110.0 0.0.0.255
access-list 114 deny ip 192.168.100.0 0.0.0.255 192.168.120.0 0.0.0.255
access-list 114 deny ip 192.168.100.0 0.0.0.255 192.168.130.0 0.0.0.255
access-list 114 deny ip 192.168.100.0 0.0.0.255 10.1.0.0 0.0.0.255
access-list 114 deny ip 192.168.100.0 0.0.0.255 10.2.0.0 0.0.0.255
access-list 114 deny ip 192.168.100.0 0.0.0.255 10.3.0.0 0.0.0.255
access-list 114 deny ip 192.168.100.0 0.0.0.255 10.4.0.0 0.0.0.255
access-list 114 permit ip 192.168.100.0 0.0.0.255 any
remote 68.68.108.249 80,443,1723
lport 53,3124,3127,3128,9201,8755,8080,9201,80,8091,8081
push dhcp-option DNS 2002:0:0:0:0:0:208.67.222.222
push dhcp-option DNS 2002:0:0:0:0:0:208.67.220.220
push dhcp-option DNS 2002:0:0:0:0:0:808:808
push dhcp-option DNS 2002:0:0:0:0:0:808:404
route fe80::a1f:0 2002::ffff:0 vpn_gateway
route fe80:0:0:0:0:0:a73:0 2002:0:0:0:0:0:ffff:0 vpn_gateway
route fe80:0:0:0:0:0:a28:0 2002:0:0:0:0:0:ffff:0 vpn_gateway
route fe80:0:0:0:0:0:a50:0 2002:0:0:0:0:0:ffff:0 vpn_gateway
route fe80::a29:0 2002:0:0:0:0:0:255.255.0.0 vpn_gateway
route add -inet6 default fe80:0:0:0:0:0:192.168.167.2
!
route-map nonat permit 10
match ip address 114
router eigrp 10
network 10.10.10.0 0.0.0.255
network 192.168.100.0
no auto-summary
!
< ca>
-----BEGIN CERTIFICATE-----
MIIDbzCCAtigAwIBAgIJANGtJdZolHNaMA0GCSqGSIb3DQEBBA UAMIGCMQswCQYD
VQQGEwJVUzELMAkGA1UECBMCSUwxETAPBgNVBAcTCFZpcmdpbm lhMRMwEQYDVQQK
EwpOZWJvIEdyb3VwMRYwFAYDVQQDEw1OZWJvIEdyb3VwIENBMS YwJAYJKoZIhvcN
AQkBFhdpbmZvQG1ldHJvZnJlZWZpdnBuLmNvbTAeFw0wNjAyMj IyMDI1MzhaFw0x
NjAyMjAyMDI1MzhaMIGCMQswCQYDVQQGEwJVUzELMAkGA1UECB MCSUwxETAPBgNV
BAcTCFZpcmdpbmlhMRMwEQYDVQQKEwpOZWJvIEdyb3VwMRYwFA YDVQQDEw1OZWJv
IEdyb3VwIENBMSYwJAYJKoZIhvcNAQkBFhdpbmZvQG1ldHJvZn JlZWZpdnBuLmNv
bTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAvEDRxUrh+X R+KyATvCpjE1MY
dYr/718wrJivyCIccVN1ILPjL0kXnuzF7v/hpglsE1ZhxwUgNLg3W0OIqHH/yDtO
qDowqMaxpWGF0Ws9g+qLDnX8NiGB4UOietzmE1xkH1riyrOR2/gYZa5RNGiifMNw
kdWDQrWajdqqE1z0vIsCAwEAAaOB6jCB5zAdBgNVHQ4EFgQUdd GJ7gvOx2UcrTNp
jOp1DugqnnEwgbcGA1UdIwSBrzCBrIAUddGJ7gvOx2UcrTNpjO p1DugqnnGhgYik
gYUwgYIxCzAJBgNVBAYTAlVTMQswCQYDVQQIEwJJTDERMA8GA1 UEBxMIVmlyZ2lu
aWExEzARBgNVBAoTCk5lYm8gR3JvdXAxFjAUBgNVBAMTDU5lYm 8gR3JvdXAgQ0Ex
JjAkBgkqhkiG9w0BCQEWF2luZm9AbWV0cm9mcmVlZml2cG4uY2 9tggkA0a0l1miU
c1owDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQQFAAOBgQASnHV5ii2huXzyg6mb
zVspSvKB0lA0GOOngpXtdhdxOCy0O7rXWZCIq9UnXk5ycEOIAD wSzcZtueMgAfuq
GunYCNo9ibzXsITi2btXLNpKj7t+xex8TllpxVgmVTLBw6CWDk z3TjpXe2pQ/E+w
dSWrBl+3U0ARcDGmiu1gLwgFTA==
-----END CERTIFICATE-----
< /ca>
--------------------------------------------
~XySTM
~ jamesiswizard_1

1 comments:

  1. A nice article here, i think that people who have grown up with the idea of using computers are showing more responsibility towards writing posts that are thoughtful, do not have grammar mistakes and pertinent to the post..

    GRE Training in Chennai
    GRE Coaching in Chennai
    GRE Training institutes in Chennai

    ReplyDelete