Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

Ok, so I have nice Ubuntu 12.04 headless server running. It's very happy. It's my router/firewall/DNS/etc. eth0 is WAN, eth1 is LAN.

I can easily get my IPv6 Hurricane Electric tunnel connected, and my server will continue to work just fine, and sees & browses both ip4 & ip6 sites. Yay.

But if ip6 is running, I can not, for the life of me, get the rest of my network to browse anything outside my network.

But if I roll back the changes, my network is fine.

DNS seems to still work, as I can ping from a client machine & it will resolve the address, but it won't actually return pings.

What information can I give that will help y'all help me?

My guess is it's not bridging from eth1 to eth0 properly after I add ip6. But I can't figure out why the ip4 bridge breaks.

Here is my working interfaces:

# This file describes the network interfaces available on your system
# and how to activate them. For more information, see interfaces(5).

# The loopback network interface
auto lo
iface lo inet loopback

# The primary network interface
auto eth0
iface eth0 inet static
        address <ISP-STATICIP>
        netmask 255.255.255.240
        network <ISP-Assigned>
        broadcast <ISP-Assigned>
        gateway <ISP-Assigned>
        dns-nameservers 208.67.222.222 208.67.220.220 8.8.8.8 8.8.4.4
        post-up iptables-restore < /etc/iptables.up.rules
        dns-domain tymanthius.net
        # dns-* options are implemented by the resolvconf package, if installed
        MTU 9000

auto eth1
iface eth1 inet static
        address 192.168.1.1
        netmask 255.255.255.0
        network 192.168.1.0
        broadcast 192.168.1.255
        MTU 9000

And this is broken one:

# This file describes the network interfaces available on your system
# and how to activate them. For more information, see interfaces(5).

# The loopback network interface
auto lo eth0 eth1 he-ipv6
iface lo inet loopback

# The primary network interface
iface eth0 inet static
        address <ISP-STATICIP>
        netmask 255.255.255.240
        network <ISP-Assigned>
        broadcast <ISP-Assigned>
        gateway <ISP-Assigned>
        dns-nameservers 208.67.222.222 208.67.220.220 8.8.8.8 8.8.4.4 2620:0:ccc::2 2620:0:ccd::2 2001:4860:4860::8888 2001:4860:4860::8844
        dns-domain tymanthius.net
        gateway 98.175.23.209
        # dns-* options are implemented by the resolvconf package, if installed

iface eth1 inet static
        address 192.168.1.1
        netmask 255.255.255.0
        broadcast 192.168.1.255
        network 192.168.1.0

iface he-ipv6 inet6 v4tunnel
        endpoint 216.218.224.42
        address 2001:470:1f0e:1034::2
        netmask 64
        up ip -6 route add default dev he-ipv6
        down ip -6 route del default dev he-ipv6
        gateway 2001:470:1f0e:1034::3

iface eth0 inet6 static
        pre-up /sbin/modprobe -q ipv6 ; /bin/true
        address 2001:470:1f0e:1034::3
        netmask 64

iface eth1 inet6 static
        pre-up /sbin/modprobe -q ipv6 ; /bin/true
        address 2001:470:1f0e:1034::4
        netmask 64

The only other change I made was to add a line to sysctrl.conf that reads "net.ipv6.conf.default.forwarding=1"

share|improve this question
    
Could you test with net.ipv6.conf.all.forwarding=1? See: Linux IPv6 HOWTO –  lgarzo Jan 4 '13 at 14:37
    
Remark. You include more than three IP addresses on "dns-nameservers" lines but please note that the glibc resolver only handles up to three addresses and, accordingly, resolvconf truncates the list of addresses in resolv.conf after the first three. –  jdthood Jan 5 '13 at 10:29
    
JDT: Just curious how this works with having 3 ipv4 & 3 ipv6? Does it resolve 3 per? –  Tymanthius Jan 7 '13 at 13:42
    
The resolver will try up to three nameservers whether their addresses are IPv4 or IPv6. –  jdthood Jan 7 '13 at 19:05
add comment

1 Answer 1

up vote 2 down vote accepted

You removed the line

post-up iptables-restore < /etc/iptables.up.rules

IPv4 uses iptables and IPv6 uses ip6tables. It might be that the change in your iptables configuration breaks your IPv4 connectivity. So you probably don't want to remove that line. It might define the policy for forwarding IPv4 packets between your eth0 and eth1 interfaces, so it might be that that breaks your configuration...

A bit further down you have a broken IPv6 configuration, but this shouldn't affect your IPv4 connectivity.

For the tunnel you define two default gateways:

iface he-ipv6 inet6 v4tunnel
    endpoint 216.218.224.42
    address 2001:470:1f0e:1034::2
    netmask 64
    up ip -6 route add default dev he-ipv6
    down ip -6 route del default dev he-ipv6
    gateway 2001:470:1f0e:1034::3

In the up/down lines you add a default route pointing to the tunnel device. The gateway line adds another default route pointing to an unused address on the tunnel interface (HE always gives its end of the tunnel the address ending in ::1) so that will break things. The following configuration should work better:

iface he-ipv6 inet6 v4tunnel
    endpoint 216.218.224.42
    address 2001:470:1f0e:1034::2
    netmask 64
    gateway 2001:470:1f0e:1034::1

And then you try to do the impossible :-) You try to use the addresses that the tunnel uses on your eth0 link as well. This will not work. The tunnel IPv6 prefix is 2001:470:1f0e:1034::/64, which are all the addresses in the range 2001:0470:1f0e:1034:0000:0000:0000:0000 to 2001:0470:1f0e:1034:ffff:ffff:ffff:ffff. Even though the tunnel only uses two addresses from that range (2001:470:1f0e:1034::1 and 2001:470:1f0e:1034::2) you can't use the other addresses anywhere but on the tunnel.

Your eth0 link seems to be your connection to your ISP or upstream network. If it doesn't offer you IPv6 then don't configure it, especially not with addresses that conflict with another link. Just remove the following lines:

iface eth0 inet6 static
    pre-up /sbin/modprobe -q ipv6 ; /bin/true
    address 2001:470:1f0e:1034::3
    netmask 64

The same goes for the eth1 link. You can't use the addresses of the tunnel on another interface. The following will not work:

iface eth1 inet6 static
    pre-up /sbin/modprobe -q ipv6 ; /bin/true
    address 2001:470:1f0e:1034::4
    netmask 64

When creating the IPv6 tunnel at tunnelbroker.net you got two /64's. If your tunnel has 2001:470:1f0e:1034::/64 then your Routed /64 probably has 2001:470:1f0f:1034::/64, but check the information you got from tunnelbroker.net to confirm that. If I'm right then the correct configuration should be:

iface eth1 inet6 static
    pre-up /sbin/modprobe -q ipv6 ; /bin/true
    address 2001:470:1f0f:1034::1
    netmask 64

And then you should enable IPv6 forwarding. Something like this should be in your /etc/sysctl.conf file:

# Uncomment the next line to enable packet forwarding for IPv6
#  Enabling this option disables Stateless Address Autoconfiguration
#  based on Router Advertisements for this host
net.ipv6.conf.all.forwarding=1

To finish the configuration you should probably also configure ip6tables like you configured iptables.

share|improve this answer
    
Thank you so much Sander! While I am very good at making small ip4 networks, I have discovered with ip6 that I don't truly understand networking. This has gotten me to the point where the server has ip4 & 6, and my home network works just fine. Now to install radvd & see what happens. :) –  Tymanthius Jan 4 '13 at 18:48
    
radvd install went fine, used the config file example from the wiki.ubuntu site, and I'm up. Again, thank you so much!! –  Tymanthius Jan 4 '13 at 18:58
    
You're welcome :-) –  Sander Steffann Jan 4 '13 at 21:11
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.