2

I have openvpn 2.4.7 on Ubuntu 20.04.2 LTS server and my client is Archlinux with openvpn 2.5.1. I noticed IPv6 leak so after some research decided not to disable IPv6 at my kernel level and make IPv6 available for use. Here is my server.conf:

local 127.0.0.1
port 1194
proto tcp
dev tun
ca ca.crt
cert server.crt
key server.key
dh dh.pem
auth SHA512
tls-crypt tc.key
topology subnet
server 10.8.0.0 255.255.255.0
push "redirect-gateway def1 bypass-dhcp"
ifconfig-pool-persist ipp.txt
push "dhcp-option DNS 1.1.1.1"
push "dhcp-option DNS 1.0.0.1"
keepalive 10 120
cipher AES-256-CBC
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
verb 3
crl-verify crl.pem
server-ipv6 2001:0db8:ee00:abcd::/64
tun-ipv6
push tun-ipv6
ifconfig-ipv6 2001:0db8:ee00:abcd::1 2001:0db8:ee00:abcd::2
push "route-ipv6 2001:0db8:ee00:ee00::2/64"
push "route-ipv6 2000::/3"

The last 6 lines added after reading a solution (IPs are not related to my server, just from tutorial). Here is my client.ovpn:

script-security 2
up /etc/openvpn/update-resolv-conf
down /etc/openvpn/update-resolv-conf

route server_ip 255.255.255.255 net_gateway

client
dev tun
proto tcp
sndbuf 0
rcvbuf 0
remote 127.0.0.1 1194
resolv-retry infinite
nobind
persist-key
persist-tun
remote-cert-tls server
cipher AES-256-CBC
comp-noadapt
auth-nocache
auth SHA512
key-direction 1
verb 3
<ca>
...
</tls-crypt>

The reason my client connects to 127.0.0.1 1194 is I use stunnel which is listening on 1194. When I visit https://ipv6-test.com without VPN I have both IPv4 and IPv6 of my ISP. With VPN (and those 6 lines added) I just have IPv4 of my VPN server and for IPv6 I get Not supported which should be my VPN server. So far at least IPv6 is disabled when using client without manipulationg kernel parameters but I want a working IPv6.

How can I fix this issue?

Improve this question
3
  • I am curious about 2001:0db8:ee00:abcd::/64 Is that your server's only /64 block?. If so, that might be your problem. To get round this you would need to setup an Ethernet bridge on the server: openvpn.net/community-resources/ethernet-bridging Commented Mar 28, 2021 at 16:34
  • @PhilipCouling: That's the bblock from the example. Should I replace it with mine. What command I need to get required block? Commented Mar 28, 2021 at 20:35
  • Sorry that answer turned into an essay. The IPv6 block is allocated by your ISP. Commented Mar 28, 2021 at 23:08

1 Answer 1

Reset to default
2

Overview

I guess the tutorial glossed over some very important points about getting IPv6 to work inside a VPN. I'll try to explain the complexity below. But to start with I'll point out there are basically three approaches to making this work:

  1. Create a TAP VPN and bridge it to your ethernet (see tutorial).
  2. Assign site local IPv6 address block to your VPN (eg FEC0::/64) and setup your VPN server as an IPv6 NAT gateway.
  3. Assign a global internet IPv6 address block to your VPN and configure your server's router to forward traffic to it.

Creating a TAP VPN with bridge

This solution has the least "gotyas", it should be straight forward to follow tutorials from the web. It does have a performance downside in that the VPN will have to send packet headers and broadcast packets where it wouldn't with a TUN VPN.

Assign a site local IPv6 address block

This is less standard but it should work. Clients will be seen on the internet as having your VPN server's IP. However being less standard you're less likely to find help on what went wrong if you can't make it work.

Assigning a global IPv6 block to your VPN

To do this you must have a spare IPv6 /64 block allocated by your ISP.

If your server is in the cloud (eg on AWS) then you might be un luck; AWS allocates a /56 block by default so you can easily allocate a /64 block from this to your VPN.

If your VPN server is at home or in your office then you may be less lucky as some ISPs only allocate a single /64 block.

You will also need to configure your server's router to send all incoming traffic for your VPN subnet to your VPN server.

Why is this complex?

IPv6 is different

Under IPv4 it is common to have a private IP address and then access the internet through a NAT gateway. For example your home router will hold one public IPv4 address and every device on your home wifi (laptop, phones etc.) will have a local IPv4 address. When any of those devices access the internet, your home router replaces your device's local IP address with it's own public IP address.

NAT gateways are uncommon with IPv6, though they are still possible possible.

Instead every device on your local network is configured with it's own global IPv6 address. Your local network (eg your home wifi) is assigned (at least) a whole 64 bit block of addresses. However common advice is that a 64 bit block is the smallest you should use or some things may stop working.

Why is this relevant to VPNs?

A TUN VPN is it's own network (subnet) and thus requires it's own allocation of IPv6 addresses. If your ISP has assigned you a large block (eg a /56 block) then you can just assign the VPN it's own /64 block from within that. However it's not uncommon for ISPs to only allocate a single /64 block, meaning you only have one where you need two.

As I've said. You can split a /64 block into two /63 blocks but you do that at your own risk. At the very least you won't be able to use "auto configuration" with a /63 block.

What else is more tricky?

When your server behaves as a NAT gateway (as with IPv4) there is no need to configure your server's router with any information about your VPN. That's because every VPN client shows on your server's network as having the same IP as the server, so the router just sends all traffic for VPN clients to the sever and lets the server figure it out...

... but without a NAT, your VPN clients have their own IP and it won't even be in a subnet the router understands by default. So you must configure a route on your router to send traffic for the VPN's subnet to the VPN server.

Improve this answer
2
  • Thank you. I'll go with option one but in tutorial it says nothing about IPv6. Commented Mar 28, 2021 at 23:41
  • 1
    With a bridged network, your vpn client will get full networking as if it's on the servers LAN so IPV6 should be implicit. Commented Mar 28, 2021 at 23:45

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.