2
I'm trying to set up an OpenVPN server to enable clients to use its IPv6 subnet. The server is running Debian Wheezy, and the client is OS X 10.9.5. Here's the server config:
port 1194
proto udp
dev tun
tun-ipv6
ca ca.crt
cert server.crt
key server.key # This file should be kept secret
dh dh1024.pem
server 10.100.100.0 255.255.255.0
ifconfig-pool-persist ipp.txt
keepalive 10 120
comp-lzo
persist-key
persist-tun
status openvpn-status.log
verb 3
tls-auth ta.key 0
cipher DES-EDE3-CBC
push "redirect-gateway def1"
push "dhcp-option DNS 8.8.8.8"
server-ipv6 MY:PUBLIC:IPV6:SUBNET::/64
push "route-ipv6 0::/0"
And here's the client config:
client
dev tun
tun-ipv6
proto udp
remote server.address 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert client.crt
key client.key
comp-lzo
verb 3
tls-auth ta.key 1
cipher DES-EDE3-CBC
IPv4 connectivity works flawlessly but there are some strange issues with IPv6. The client does obtain an IPv6 address when it connects, but the only thing that responds to pings (or accepts any IPv6 packets for that matter) is the server itself. It looks like the packets that are supposed to go to the global internet are not routed through the appropriate interface on the server which is eth0 in my case. The IPv6 address is assigned to eth0 statically from the subnet provided by my hosting provider and everything works from the server; for example, I can ping ipv6.google.com from it. The net.ipv6.conf.default.forwarding
and net.ipv6.conf.all.forwarding
sysctl options are also enabled.
Thank you, I tried your ip6tables rules but that didn't help. I actually tested my setup using netcat and it turns out that packets only go one way, from my client to the internet. So I can send but I can't receive. The problem might be that the router that the server is connected to doesn't let the incoming VPN packets through to the server. – Grishka – 2016-12-30T11:06:39.683