Using IPv6

In this recipe, we extend the complete site-to-site network recipe to include support for IPv6.

Getting ready

Install OpenVPN 2.3.9 or higher on two computers. Make sure the computers are connected over a network. For this recipe, the server computer was running CentOS 6 Linux and OpenVPN 2.3.9 and the client was running Fedora 22 Linux and OpenVPN 2.3.10. We'll use the secret.key file from the OpenVPN secret keys recipe here.

We will use the following network layout:

Getting ready

How to do it...

  1. Create the server configuration file:
            dev tun 
            proto udp 
            local  openvpnserver.example.com 
            lport  1194 
            remote openvpnclient.example.com 
            rport  1194 
     
            secret secret.key 0 
            ifconfig 10.200.0.1 10.200.0.2 
            route 192.168.4.0 255.255.255.0 
     
            tun-ipv6 
            ifconfig-ipv6 2001:db8:100::1 2001:db8:100::2 
     
            user  nobody 
            group nobody  # use "group nogroup" on some distros 
            persist-tun 
            persist-key 
            keepalive 10 60 
            ping-timer-rem 
     
            verb 3 
            daemon 
            log-append /tmp/openvpn.log 
    
  2. Save it as example1-9-server.conf.
  3. On the client side, create the configuration file:
            dev tun 
            proto udp 
            local  openvpnclient.example.com 
            lport  1194 
            remote openvpnserver.example.com 
            rport  1194 
     
            secret secret.key 1 
            ifconfig 10.200.0.2 10.200.0.1 
            route 172.31.32.0 255.255.255.0 
     
            tun-ipv6 
            ifconfig-ipv6 2001:db8:100::2 2001:db8:100::1 
     
            user  nobody 
            group nobody  # use "group nogroup" on some distros 
            persist-tun 
            persist-key 
            keepalive 10 60 
            ping-timer-rem 
     
            verb 3 
    
  4. Save it as example1-9-client.conf.
  5. Then start the tunnel on both ends The following is for the server end:
              [root@server]# openvpn --config example1-9-server.conf
    

    This is the code for the client end:

              [root@client]# openvpn --config example1-9-client.conf
    

    Now our site-to-site tunnel is established.

  6. After the connection comes up, the machines on the LANs behind both end points can be reached over the OpenVPN tunnel. Notice that the client OpenVPN session is running in the foreground.
  7. Next, ping the IPv6 address of the server endpoint to verify that IPv6 traffic over the tunnel is working:
             [client]$ ping6 -c 4 2001:db8:100::1
             PING 2001:db8:100::1(2001:db8:100::1) 56 data bytes
             64 bytes from 2001:db8:100::1: icmp_seq=1 ttl=64 time=7.43 ms
             64 bytes from 2001:db8:100::1: icmp_seq=2 ttl=64 time=7.54 ms
             64 bytes from 2001:db8:100::1: icmp_seq=3 ttl=64 time=7.77 ms
             64 bytes from 2001:db8:100::1: icmp_seq=4 ttl=64 time=7.42 ms
             --- 2001:db8:100::1 ping statistics ---
             4 packets transmitted, 4 received, 0% packet loss, time 3005ms
             rtt min/avg/max/mdev = 7.425/7.546/7.778/0.177 ms
    
  8. Finally, abort the client-side session by pressing CtrlC. The following screenshot lists the full client-side log:
    How to do it...

How it works...

Both client and server configuration files are very similar to the ones from the Complete site-to-site setup recipe, with the addition of the following two lines:

tun-ipv6 
ifconfig-ipv6 2001:db8:100::2 2001:db8:100::1 

This enables IPv6 support, next to the default IPv4 support.

Also, in the client configuration, the options daemon and log-append are not present, hence all of the OpenVPN output is sent to the screen and the process continues running in the foreground.

There's more...

Let's talk a bit about log file errors and the IPv6-only tunnel.

Log file errors

If we take a closer look at the client-side connection output, we will see a few error messages after pressing Ctrl C , most notably the following:

RTNETLINK answers: operation not permitted 

This is a side-effect when you use the user nobody option to protect an OpenVPN setup, and it often confuses new users. What happens is this:

OpenVPN starts as root, opens the appropriate tun device, and sets the right IPv4 and IPv6 addresses on this tun interface.

For extra security, OpenVPN then switches to nobody, dropping all the privileges associated with root.

When OpenVPN terminates (in our case, by pressing  Ctrl C ), it closes the access to the tun device and tries to remove the IPv4 and IPv6 addresses assigned to that device. At this point, the error messages appear, as nobody is not allowed to perform these operations.

Upon termination of the OpenVPN process, the Linux kernel closes the tun device and all the configuration settings are removed.

In this case, these error messages are harmless, but in general, one should pay close attention to the warning and error messages that are printed by OpenVPN.

IPv6-only tunnel

With OpenVPN 2.3, the IPv6-only tunnel is required to always enable IPv4 support. From OpenVPN 2.4 on, it is possible to set up an IPv6-only connection.

See also

The recipe Complete site-to-site setup, earlier in this chapter, in which an IPv4-only site-to-site setup is explained in detail.

The last recipe of Chapter 6Troubleshooting OpenVPN - Configurations, which explains how to interpret the OpenVPN log files in detail.

..................Content has been hidden....................

You can't read the all page of ebook, please click here login for view all page.
Reset
3.147.74.27