Open hashworks opened 2 years ago
jamesmcm
commented
2 years ago Hmm I tested this locally with a US config from Mullvad and it works fine for me.
Can you check that ufw, firewalld are not running? i.e. anything that might interfere with the nftables rules?
Also I don't see that relay when I check (the IP address is different) - could you try re-running vopono sync ?
hashworks
commented
2 years ago Can you check that ufw, firewalld are not running? i.e. anything that might interfere with the nftables rules?
No firewall daemon is running. Also, I'm using iptables on that host, and for testing purposes all rules have been reset.
Also I don't see that relay when I check (the IP address is different) - could you try re-running
vopono sync?
The relay exists, it is de11-wireguard:
Any vopono sync shouldn't be needed here since I'm using a custom config file.
hashworks
commented
2 years ago The issue seems to be the IPv6 Endpoint – when I use the IPv4 endpoint, vopono works just fine.
It seems like you didn't run into that issue yet because vopono sync always creates IPv4 configs.
jamesmcm
commented
2 years ago Yeah, this is reproducible just with the netns parts:
sudo ip netns add testnetns2
sudo ip netns exec testnetns2 ip addr add ::1/8 dev lo
sudo ip netns exec testnetns2 ip link set lo up
sudo ip link add testnetns2_d type veth peer name testnetns2_s
sudo ip link set testnetns2_d up
sudo ip link set testnetns2_s netns testnetns2 up
sudo ip addr add 10.200.3.1/24 dev testnetns2_d
sudo ip netns exec testnetns2 ip addr add 10.200.3.2/24 dev testnetns2_s
sudo ip netns exec testnetns2 ip route add default via 10.200.3.1 dev testnetns2_s
sudo ip netns exec testnetns2 ip -6 route add default via fe80::c418:42ff:fec9:62b6 dev testnetns2_s
sudo nft add table inet testnetns2_nat
sudo nft add chain inet testnetns2_nat postrouting { type nat hook postrouting priority 100 ; }
sudo nft add rule inet testnetns2_nat postrouting oifname enp3s0f3u1 ip saddr 10.200.3.0/24 counter masquerade
sudo nft add rule inet testnetns2_nat postrouting oifname enp3s0f3u1 ip6 saddr fe80::c418:42ff:fec9:62b6/24 counter masquerade
sudo nft add table inet testnetns2_bridge
sudo nft add chain inet testnetns2_bridge forward { type filter hook forward priority -10 ; }
sudo nft add rule inet testnetns2_bridge forward iifname testnetns2_d oifname enp3s0f3u1 counter accept
sudo nft add rule inet testnetns2_bridge forward oifname testnetns2_d iifname enp3s0f3u1 counter accept
sudo sysctl -q net.ipv4.ip_forward=1
sudo sysctl -w net.ipv6.conf.default.forwarding=1
sudo ip netns exec testnetns2 sysctl -w net.ipv6.conf.default.forwarding=1Then inside the netns:
ping 8.8.8.8works but:
ping 2001:4860:4860::8888fails
I still can't get it to work atm, even just adjusting the NAT rules.
There's a good summary at https://stackoverflow.com/questions/36438102/ping-external-ipv6-address-from-a-network-namespace - it doesn't seem trivial to have it work for both IPv4 and IPv6 though.
Digitalone1
commented
4 months ago I'm not an expert here, but this seems an issue with private IPv6 which are not routable.
Is there a way to use a global address retrieving the prefix delegated by the ISP?
Reading the question on stackoverflow, using the global addresses solve the issue.
EDIT: The issue is the IPv6 endpoint – currently vopono has no support for those.
I'm trying to connect to Mullvad using the following custom config:
Using this config with wg-quick on the host works just fine.
With vopono, I can't reach the Mullvad DNS IP or any public IP: