0

I am trying to setup an ipip6 tunnel between a remote machine and a local one in order to give my machine a public IPv4 address (It has IPv6, but it is behind a carrier grade NAT).

So far I have been able to get this working by manually running a series of ip commands.

On my local machine (machine A) I run the following commands to get the tunnel set up:

sudo ip link add name tun0 type ip6tnl local [machine A ipv6 address] remote [machine B ipv6 address] mode tun0
sudo ip link set dev tun0 up
sudo ip a add dev tun0 10.0.3.1
sudo ip route add 10.0.3.0/24 dev tun0

And on my remote machine (machine B):

sudo ip link add name tun0 type ip6tnl local [machine B ipv6 address] remote [machine A ipv6 address] mode tun0
sudo ip link set dev tun0 up
sudo ip a add dev tun0 10.0.3.2
sudo ip route add 10.0.3.0/24 dev tun0

And everything works great, I can ping each machine from the other over the tunnel.

However, when the machines reboot, the tunnels are lost, so I wanted to use netplan to manage them. So far I have been able to get netplan to create the interfaces properly with addresses:

network:
  version: 2
  tunnels:
    tun0:
      mode: ipip6
      remote: "[machine B ipv6 address]"
      local: "[machine A ipv6 address]"
      addresses:
        - 10.0.3.2/32
      routes:
        - to: 10.0.3.0/24
          via: 10.0.3.1

However, no route is created. When I run ip route, I would expect to see 10.0.3.0/24 dev tun0 scope link in the routing table but netplan is not creating it. How do I get netplan to create this route automatically so I don't have to run sudo ip route add 10.0.3.0/24 dev tun0 every time?

0

Your netplan config and your ip commands don't match: in the working command you are declaring the route on the device with no gateway, in the netplan you are declaring a gateway for the route but it is a gateway for which you do not already have a route.

You either need to declare your netmask such that 10.0.3.1 is in the route for the tunnel (i.e.: 10.3.0.2/30, not 10.3.0.2/32) or you need to declare the route as being on-link.

You should be able to check the output of ip link after setting up the tunnel both ways to compare whether they match.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.