search

opnsense / core

OPNsense GUI, API and systems backend
https://opnsense.org/
BSD 2-Clause "Simplified" License
3.36k stars 754 forks source link

6rd; possibly missing direct connect route? #3531

Closed thomasjsn closed 4 years ago

thomasjsn commented 5 years ago

I'm asking my question here, because it is highly development related.

I operate a repository mirror in Norway, behind an OPNsense firewall. On a couple of occasions I've gotten emails from users saying that they are unable to access my mirror over IPv6. Common for all of them - is that they have the same ISP as me, Altibox, and Altibox uses 6rd. They have confirmed that the mirror is reachable from outside the Altibox network. It doesn't seem to be a problem for all Altibox users, I have a colleague, with Altibox and OPNsense which can connect over IPv6 just fine.

Digging into this I've started to suspect that I may be sending the IPv6 traffic to the border relay, instead of directly to the user, as it should be with 6rd. My understanding is that this is a common misconfiguration on a lot of boxes.

According to rfc5969; 

2001:db8::/32 -> 6rd-virtual-int0 (direct connect to 6rd)

If this route is left out, traffic to other 6rd clients, in the same network is sent to the BR when it should in fact be sent directly to the user. And some routers may be rejecting this traffic.

Can anyone confirm, or reject this theory? Ideas for digging deeper?

For those interested, here is an excellent read about 6rd: https://www.cisco.com/c/en/us/products/collateral/ios-nx-os-software/enterprise-ipv6-solution/whitepaper_c11-665758.html

ja-finn commented 5 years ago

I can't really help with the issue but are you able to get IPv6RD with Altibox working at all with 19.7? Mine stopped working after updating. I've tried with pfsense and that works out of the box

thomasjsn commented 5 years ago

I haven't updated yet, but you are not the first person to experience that. I've got a friend which experienced the same, he also got it working with pfsense.

6RD is not that common, and probably doesn't get tested a lot. I suggest you open a new issue and provide as much information as you can.

AdSchellevis commented 4 years ago

This issue has been automatically timed-out (after 180 days of inactivity).

For more information about the policies for this repository, please read https://github.com/opnsense/core/blob/master/CONTRIBUTING.md for further details.

If someone wants to step up and work on this issue, just let us know, so we can reopen the issue and assign an owner to it.