mirror of
https://github.com/vyos/vyos-documentation.git
synced 2025-10-26 08:41:46 +01:00
174 lines
7.1 KiB
ReStructuredText
174 lines
7.1 KiB
ReStructuredText
.. _examples-tunnelbroker-ipv6:
|
|
|
|
#######################
|
|
Tunnelbroker.net (IPv6)
|
|
#######################
|
|
|
|
This guides walks through the setup of https://www.tunnelbroker.net/ for an
|
|
IPv6 Tunnel.
|
|
|
|
Prerequisites
|
|
=============
|
|
|
|
- A public, routable IPv4 address. This does not necessarily need to be static,
|
|
but you will need to update the tunnel endpoint when/if your IP address
|
|
changes, which can be done with a script and a scheduled task.
|
|
- Account at https://www.tunnelbroker.net/
|
|
- Requested a "Regular Tunnel". You want to choose a location that is closest
|
|
to your physical location for the best response time.
|
|
|
|
Setup initial tunnel
|
|
====================
|
|
|
|
Set up initial IPv6 tunnel. Replace the field below from the fields on the
|
|
tunnel information page.
|
|
|
|
.. code-block:: none
|
|
|
|
conf
|
|
set interfaces tunnel tun0 address Client_IPv6_from_Tunnelbroker # This will be your VyOS install's public IPv6 address
|
|
set interfaces tunnel tun0 description 'HE.NET IPv6 Tunnel'
|
|
set interfaces tunnel tun0 encapsulation 'sit'
|
|
set interfaces tunnel tun0 local-ip Client_IPv4_from_Tunnelbroker # This is your public IP
|
|
set interfaces tunnel tun0 mtu '1472'
|
|
set interfaces tunnel tun0 multicast 'disable'
|
|
set interfaces tunnel tun0 remote-ip Server_IPv4_from_Tunnelbroker # This is the IP of the Tunnelbroker server
|
|
set protocols static interface-route6 ::/0 next-hop-interface tun0 # Tell all traffic to go over this tunnel
|
|
commit
|
|
|
|
If your WAN connection is over PPPoE, you may need to set the MTU on the above
|
|
tunnel lower than 1472.
|
|
|
|
At this point you should be able to ping an IPv6 address, try pinging Google:
|
|
|
|
.. code-block:: none
|
|
|
|
ping6 -c2 2001:4860:4860::8888
|
|
|
|
64 bytes from 2001:4860:4860::8888: icmp_seq=1 ttl=57 time=21.7 ms
|
|
64 bytes from 2001:4860:4860::8888: icmp_seq=2 ttl=57 time=21.1 ms
|
|
|
|
--- 2001:4860:4860::8888 ping statistics ---
|
|
2 packets transmitted, 2 received, 0% packet loss, time 1001ms
|
|
rtt min/avg/max/mdev = 21.193/21.459/21.726/0.304 ms
|
|
|
|
Assuming the pings are successful, you need to add some DNS servers.
|
|
Some options:
|
|
|
|
.. code-block:: none
|
|
|
|
set system name-server 2001:4860:4860::8888 # Google
|
|
set system name-server 2001:4860:4860::8844 # Google
|
|
set system name-server 2606:4700:4700::1111 # Cloudflare
|
|
set system name-server 2606:4700:4700::1001 # Cloudflare
|
|
commit
|
|
|
|
You should now be able to ping something by IPv6 DNS name:
|
|
|
|
.. code-block:: none
|
|
|
|
# ping6 -c2 one.one.one.one
|
|
PING one.one.one.one(one.one.one.one) 56 data bytes
|
|
64 bytes from one.one.one.one: icmp_seq=1 ttl=58 time=16.8 ms
|
|
64 bytes from one.one.one.one: icmp_seq=2 ttl=58 time=17.4 ms
|
|
|
|
--- one.one.one.one ping statistics ---
|
|
2 packets transmitted, 2 received, 0% packet loss, time 1001ms
|
|
rtt min/avg/max/mdev = 16.880/17.153/17.426/0.273 ms
|
|
|
|
Assuming everything works, you can proceed to client configuration
|
|
|
|
LAN Configuration
|
|
=================
|
|
|
|
At this point your VyOS install should have full IPv6, but now your LAN devices
|
|
need access.
|
|
|
|
With Tunnelbroker.net, you have two options:
|
|
|
|
- Routed /64. This is the default assignment. In IPv6-land, it's good for a
|
|
single "LAN", and is somewhat equivalent to a /24.
|
|
Example: `2001:470:xxxx:xxxx::/64`
|
|
- Routed /48. This is something you can request by clicking the "Assign /48"
|
|
link in the Tunnelbroker.net tunnel config. It allows you to have up to 65k
|
|
LANs. Example: `2001:470:xxxx::/48`
|
|
|
|
Unlike IPv4, IPv6 is really not designed to be broken up smaller than /64. So
|
|
if you ever want to have multiple LANs, VLANs, DMZ, etc, you'll want to ignore
|
|
the assigned /64, and request the /48 and use that.
|
|
|
|
Single LAN Setup
|
|
================
|
|
|
|
Single LAN setup where eth1 is your LAN interface. Use the /64 (all the xxxx
|
|
should be replaced with the information from your `Routed /64` tunnel):
|
|
|
|
.. code-block:: none
|
|
|
|
set interfaces ethernet eth1 address '2001:470:xxxx:xxxx::1/64'
|
|
set interfaces ethernet eth1 ipv6 router-advert name-server '2001:4860:4860::8888'
|
|
set interfaces ethernet eth1 ipv6 router-advert name-server '2001:4860:4860::8844'
|
|
set interfaces ethernet eth1 ipv6 router-advert prefix 2001:470:xxxx:xxxx::/64 autonomous-flag 'true'
|
|
set interfaces ethernet eth1 ipv6 router-advert prefix 2001:470:xxxx:xxxx::/64 on-link-flag 'true'
|
|
set interfaces ethernet eth1 ipv6 router-advert prefix 2001:470:xxxx:xxxx::/64 valid-lifetime '2592000'
|
|
|
|
This accomplishes a few things:
|
|
|
|
- Sets your LAN interface's IP address
|
|
- Enables router advertisements. This is an IPv6 alternative for DHCP (though
|
|
DHCPv6 can still be used). With RAs, Your devices will automatically find the
|
|
information they need for routing and DNS.
|
|
|
|
Multiple LAN/DMZ Setup
|
|
======================
|
|
|
|
In this, you use the `Routed /48` information. This allows you to assign a
|
|
different /64 to every interface, LAN, or even device. Or you could break your
|
|
network into smaller chunks like /56 or /60.
|
|
|
|
The format of these addresses:
|
|
|
|
- `2001:470:xxxx::/48`: The whole subnet. xxxx should come from Tunnelbroker.
|
|
- `2001:470:xxxx:1::/64`: A subnet suitable for a LAN
|
|
- `2001:470:xxxx:2::/64`: Another subnet
|
|
- `2001:470:xxxx:ffff:/64`: The last usable /64 subnet.
|
|
|
|
In the above examples, 1,2,ffff are all chosen by you. You can use 1-ffff
|
|
(1-65535).
|
|
|
|
So, when your LAN is eth1, your DMZ is eth2, your cameras live on eth3, etc:
|
|
|
|
.. code-block:: none
|
|
|
|
set interfaces ethernet eth1 address '2001:470:xxxx:1::1/64'
|
|
set interfaces ethernet eth1 ipv6 router-advert name-server '2001:4860:4860::8888'
|
|
set interfaces ethernet eth1 ipv6 router-advert name-server '2001:4860:4860::8844'
|
|
set interfaces ethernet eth1 ipv6 router-advert prefix 2001:470:xxxx:1::/64 autonomous-flag 'true'
|
|
set interfaces ethernet eth1 ipv6 router-advert prefix 2001:470:xxxx:1::/64 on-link-flag 'true'
|
|
set interfaces ethernet eth1 ipv6 router-advert prefix 2001:470:xxxx:1::/64 valid-lifetime '2592000'
|
|
|
|
set interfaces ethernet eth2 address '2001:470:xxxx:2::1/64'
|
|
set interfaces ethernet eth2 ipv6 router-advert name-server '2001:4860:4860::8888'
|
|
set interfaces ethernet eth2 ipv6 router-advert name-server '2001:4860:4860::8844'
|
|
set interfaces ethernet eth2 ipv6 router-advert prefix 2001:470:xxxx:2::/64 autonomous-flag 'true'
|
|
set interfaces ethernet eth2 ipv6 router-advert prefix 2001:470:xxxx:2::/64 on-link-flag 'true'
|
|
set interfaces ethernet eth2 ipv6 router-advert prefix 2001:470:xxxx:2::/64 valid-lifetime '2592000'
|
|
|
|
set interfaces ethernet eth3 address '2001:470:xxxx:3::1/64'
|
|
set interfaces ethernet eth3 ipv6 router-advert name-server '2001:4860:4860::8888'
|
|
set interfaces ethernet eth3 ipv6 router-advert name-server '2001:4860:4860::8844'
|
|
set interfaces ethernet eth3 ipv6 router-advert prefix 2001:470:xxxx:3::/64 autonomous-flag 'true'
|
|
set interfaces ethernet eth3 ipv6 router-advert prefix 2001:470:xxxx:3::/64 on-link-flag 'true'
|
|
set interfaces ethernet eth3 ipv6 router-advert prefix 2001:470:xxxx:3::/64 valid-lifetime '2592000'
|
|
|
|
Firewall
|
|
========
|
|
|
|
Finally, don't forget the :ref:`firewall`. The usage is identical, except for
|
|
instead of `set firewall name NAME`, you would use `set firewall ipv6-name
|
|
NAME`.
|
|
|
|
Similarly, to attach the firewall, you would use `set interfaces ethernet eth0
|
|
firewall in ipv6-name` or `set zone-policy zone LOCAL from WAN firewall
|
|
ipv6-name`.
|