Routing problems with IPv6 over OpenVPN

ipv6openvpnrouting

I'm trying to set up an OpenVPN server to enable clients to use its IPv6 subnet. The server is running Debian Wheezy, and the client is OS X 10.9.5. Here's the server config:

port 1194
proto udp
dev tun
tun-ipv6
ca ca.crt
cert server.crt
key server.key  # This file should be kept secret
dh dh1024.pem
server 10.100.100.0 255.255.255.0
ifconfig-pool-persist ipp.txt
keepalive 10 120
comp-lzo
persist-key
persist-tun
status openvpn-status.log
verb 3
tls-auth ta.key 0
cipher DES-EDE3-CBC
push "redirect-gateway def1"
push "dhcp-option DNS 8.8.8.8"
server-ipv6 MY:PUBLIC:IPV6:SUBNET::/64
push "route-ipv6 0::/0"

And here's the client config:

client
dev tun
tun-ipv6
proto udp
remote server.address 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert client.crt
key client.key
comp-lzo
verb 3
tls-auth ta.key 1
cipher DES-EDE3-CBC

IPv4 connectivity works flawlessly but there are some strange issues with IPv6. The client does obtain an IPv6 address when it connects, but the only thing that responds to pings (or accepts any IPv6 packets for that matter) is the server itself. It looks like the packets that are supposed to go to the global internet are not routed through the appropriate interface on the server which is eth0 in my case. The IPv6 address is assigned to eth0 statically from the subnet provided by my hosting provider and everything works from the server; for example, I can ping ipv6.google.com from it. The net.ipv6.conf.default.forwarding and net.ipv6.conf.all.forwarding sysctl options are also enabled.

Best Answer

So, I figured out that the upstream router won't just simply unconditionally forward packets for my whole allocated subnet to my server. For it to know to forward them, you have to tell it explicitly via the NDP protocol. This has to be done when a client connects and is assigned an IPv6 address. So, long story short, here's how I fixed it. Add this to the OpenVPN config on the server:

script-security 3
client-connect /etc/openvpn/client-connect.sh

Create a script named /etc/openvpn/client-connect.sh with the following contents:

#!/bin/sh
ip -6 neigh add proxy $ifconfig_pool_remote_ip6 dev eth0

Restart OpenVPN. Connect to the server and enjoy your very own piece of the future of the internet.

Related Question