[{"template":"item","lang":"en","langs":["en","zh-CN"],"summary":{"raw":"After so many years, there are still ISPs that don't provide IPv6. Although you can use HE's service to get an IPv6 address for free, the speed and stability of the IPv6 tunneling server really affects your experience. This article explains how to set up your own IPv6 tunneling server with practical examples.","html":"

After so many years, there are still ISPs that don't provide IPv6. Although you can use HE's service to get an IPv6 address for free, the speed and stability of the IPv6 tunneling server really affects your experience. This article explains how to set up your own IPv6 tunneling server with practical examples.

\n"},"visible":true,"routable":true,"title":"Manually establish your own IPv6 Tunnel","comment":{"enabled":true,"reply":true},"discuss":{"enabled":true},"keywords":["IPv6 Tunnel","self-host IPv6 Tunnel","he-ipv6","self TunnelBroker","tunnelbroker.net","dmit ipv6"],"webmention":{"enabled":true,"accept":true,"callback":{"secret":{"hash":{"sha256":"44bb9da44b424c6dfc9233819e907029ff2ccdfaa89919d3696ddf8db7ff6647"}}}},"pingback":{"enabled":true,"accept":true},"slug":"manually-establish-your-own-ipv6-tunnel","taxonomy":{"category":["Internet"],"tag":["IPv6","VPS","dmit.io","NDPPD"],"series":[]},"route":"/manually-establish-your-own-ipv6-tunnel/","toc":{"enabled":true},"published":{"date":"2024-02-16 02:16"},"modified":{"date":"2024-07-19T04:00:32.694Z"},"data":{},"license":"CC-BY-ND-4.0","author":[{"email":{"value":{"encrypted":"ODgyZjdiZDg4OTVmMjllOGZkNmFmYg==","algorithm":"aes-256-gcm","iv":"067f6d66f2ba5dd50c8443be"},"hash":{"md5":"8770854a9222b6bf1ee195220793bcf1"}},"url":"https://dallas.lu","name":"Dallas Lu","lang":"en","user":"dallaslu"}],"contributor":[],"sponsor":[],"image":[],"audio":[],"video":[],"photo":[],"content":{"html":"

\n\n

Currently, one of my dedicated servers has no available IPv6, while the VPS I bought from Dmit has a native IPv6/64 address. The PING is about 4ms between the two places, and the network on the free node on TunnelBroker is much worse. Since I have an endless supply of IPv6 addresses, why not build my own tunnel server?

Network conditions

Let's start by listing the network conditions.

Where Dmit VPS acts as a server, hereafter referred to as Server:

IPv4: 11.11.11.11
IPv6: 2024:2:16:2::/64
Egress NIC: eth0

IPv4-only server as client, hereafter referred to as Client.

IPv4: 22.22.22.22

The plan is to create a subnet, configure an IP 2024:2:16:2:1::2 for the Client, and add an IP 2024:2:16:2::1 for the Server as a gateway to the subnet.

In fact, this is the minimum configuration to enable IPv6 tunneling servers, requiring only three available IPv6 addresses on the Server¹.

Establishing the tunnel

Server configuration

ip tunnel add sit1 mode sit remote 22.22.22.22 local 11.11.11.11 ttl 255\nip link set sit1 up\nip link set sit1 up\n\n### Client configuration\n\nip tunnel add dmit-ip\nip tunnel add dmit-ipv6 mode sit remote 11.11.11.11 local 22.22.22.22 ttl 255\nip link set dmit-ipv6 up\n

The remote and local ip tunnel commands for Server and Client are exactly mirrored.

Configuring Addressing and Routing

Server configuration

ip addr add 2024:2024:2024 ip addr add 2024:2024\nip addr add 2024:2:16:2:1::1/80 dev sit1\nip route add 2024:2:16:2:1::2 dev sit1\n

Client configuration

ip addr add 2024:2:16:2:1::2/80 dev dmit-ipv6\nip route add ::/0 dev dmit-ipv6\n

Checking the network

In theory, the two nodes can now communicate with each other using the newly added IP.

# on server\nping -6 2024:2:16:2:1::2\n

# on client\nping -6 2024:2:16:2:1::1\n

Forwarding traffic to the Client

Outgoing traffic

Edit /etc/sysctl.conf to add:

net.ipv6.conf.sit1.forwarding=1\n

Or if the security policy allows it:

net.ipv6.conf.all.forwarding=1\n

sysctl -p\n

Incoming traffic

The tunnel server needs to use neighbor announcements to forward traffic to the Client, and the NDP proxy needs to be enabled. Edit /etc/sysctl.conf to add:

net.ipv6.conf.sit1.proxy_ndp=1\n

Or if the security policy allows it:

net.ipv6.conf.all.proxy_ndp=1\n

sysctl -p\nip -6 neigh add proxy 2024:2:16:2:1::2 dev eth0\n

Create multiple Tunnel

Simply repeat the above. Or:

Reuse Tunnel

If you continue to access a new Client1 (IPv4: 33.33.33.33), you can repeat the above steps in full. Or create a reusable tunnel definition on the Server.

ip tunnel add sit-any mode sit remote any local 11.11.11.11 ttl 255\nip link set sit-any up\nip -6 addr add 2024:2:16:2:1::1/80 dev sit-any\nip -6 route add 2024:2:16:2:1::2 via ::22.22.22.22 dev sit-any\nip -6 route add 2024:2:16:2:1::3 via ::33.33.33.33 dev sit-any\n

Note that remote any is set here, which means that any host on the Internet can tunnel to the Server. To avoid abuse, you can use your firewall to add a rule that only accepts data from the specified IPv4 address on interface sit-any.

iptables -A INPUT -p ipv6 -i sit-any -s 22.22.22.22 -j ACCEPT\niptables -A INPUT -p ipv6 -i sit-any -s 33.33.33.33 -j ACCEPT\n#....\niptables -A INPUT -p ipv6 -i sit-any -j DROP\n

Configuration on the Client:

ip tunnel add dmit-ipv6 mode sit remote 11.11.11.11 local 22.22.22.22 ttl 255\nip link set dmit-ipv6 up\nip addr add 2024:2:16:2:1::2/80 dev dmit-ipv6\nip route add ::/0 via 2024:2:16:2:1::1 dev dmit-ipv6\n

Configuration on Client1:

ip tunnel add dmit-ipv6 mode sit remote 11.11.11.11 local 33.33.33.33 ttl 255\nip link set dmit-ipv6 up\nip addr add 2024:2:16:2:1::3/80 dev dmit-ipv6\nip route add ::/0 via 2024:2:16:2:1::1 dev dmit-ipv6\n

Outgoing traffic configuration /etc/sysctl.conf on the server:

net.ipv6.conf.sit-any.proxy_ndp=1\n

Incoming traffic configuration on the server:

ip -6 neigh add proxy 2024:2:16:2:1::2 dev eth0\nip -6 neigh add proxy 2024:2:16:2:1::3 dev eth0\n

The NDP proxy only supports a single IPv6 address that is explicitly specified, not segments. Either use multiple ip -6 neigh add proxy statements or switch to NDPPD which supports network segments.

apt install ndppd\n

Edit /etc/ndppd.conf

route-ttl 30000\naddress-ttl 30000\nproxy eth0 {\n   router yes\n   timeout 500\n   autowire no\n   keepalive yes\n   retries 3\n   promiscuous no\n   ttl 30000\n   rule 2024:2:16:2:1::/80 {\n      static\n      autovia no\n   }\n}\n

systemctl enable --now ndppd\n

Assign the entire /80 subnet IP to the client.

There is an endless supply of IP on the Server, so it would be too stingy to assign only one IPv6 to the tunnel, and the TunnelBroker is assigned to the entire subnet. To do this on Server.

ip tunnel add sit-any mode sit remote any local 11.11.11.11 ttl 255\nip link set sit-any up\nip -6 addr add 2024:2:16:2:1::1/72 dev sit-any\nip -6 route add 2024:2:16:2:2::/80 via ::22.22.22.22 dev sit-any\nip -6 route add 2024:2:16:2:3::/80 via ::33.33.33.33 dev sit-any\n

/etc/ndppd.conf

route-ttl 30000\naddress-ttl 30000\nproxy eth0 {\n   router yes\n   timeout 500\n   autowire no\n   keepalive yes\n   retries 3\n   promiscuous no\n   ttl 30000\n   rule 2024:2:16:2:2::/80 {\n      static\n      autovia no\n   }\n   rule 2024:2:16:2:3::/80 {\n      static\n      autovia no\n   }\n}\n

Configuration on the Client:

ip tunnel add dmit-ipv6 mode sit remote 11.11.11.11 local 22.22.22.22 ttl 255\nip link set dmit-ipv6 up\nip addr add 2024:2:16:2:2::/80 dev dmit-ipv6\nip route add ::/0 via 2024:2:16:2:1::1 dev dmit-ipv6\n

Configuration on the Client1:

ip tunnel add dmit-ipv6 mode sit remote 11.11.11.11 local 33.33.33.33 ttl 255\nip link set dmit-ipv6 up\nip addr add 2024:2:16:2:3::/80 dev dmit-ipv6\nip route add ::/0 via 2024:2:16:2:1::1 dev dmit-ipv6\n

Conclusion

This completes the configuration. If it is not available, check the firewall. If the entire network is working, you should consider persisting the configuration of tunnels, IP addresses, routes, etc. so that the tunnels do not fail after a network outage or system reboot. For example, netplan can be used in Ubuntu, and systems such as Debian can write ip commands to /etc/network/interfaces.

If you want more security, you can use IPsec to establish a tunnel connection.

References

\n
Xiaodu. Setting up your own IPv6 Tunnel. Xiaodu Blog. 2020 ↩
\n

\n","headings":[{"level":2,"text":"Network conditions","id":"network-conditions"},{"level":2,"text":"Establishing the tunnel","id":"establishing-the-tunnel"},{"level":3,"text":"Server configuration","id":"server-configuration"},{"level":2,"text":"Configuring Addressing and Routing","id":"configuring-addressing-and-routing"},{"level":3,"text":"Server configuration","id":"server-configuration-1"},{"level":3,"text":"Client configuration","id":"client-configuration"},{"level":2,"text":"Checking the network","id":"checking-the-network"},{"level":2,"text":"Forwarding traffic to the Client","id":"forwarding-traffic-to-the-client"},{"level":3,"text":"Outgoing traffic","id":"outgoing-traffic"},{"level":3,"text":"Incoming traffic","id":"incoming-traffic"},{"level":2,"text":"Create multiple Tunnel","id":"create-multiple-tunnel"},{"level":3,"text":"Reuse Tunnel","id":"reuse-tunnel"},{"level":2,"text":"Assign the entire /80 subnet IP to the client.","id":"assign-the-entire-80-subnet-ip-to-the-client"},{"level":2,"text":"Conclusion","id":"conclusion"}],"meta":{"prism":true},"links":[{"href":"https://dmit.io","type":"mention"},{"href":"https://tunnelbroker.net","type":"mention"},{"href":"https://github.com/DanielAdolfsson/ndppd","type":"mention"},{"href":"https://www.cycloptivity.net/building-your-own-ipv6-tunnel/","type":"mention"},{"href":"https://t.du9l.com/2020/12/setting-up-your-own-ipv6-tunnel/","type":"mention"}]},"newer":"/sync-tabby-config-with-a-self-hosted-tabby-web/","earlier":"/pve-network-manual-config-and-ipv6/"},{"template":"item","lang":"en","langs":["en","zh-CN"],"summary":{"raw":"My dedicated server hosting provider offers an IPv4 address, as well as an IPv6 address for /64. Although additional IPv4 addresses were purchased, they were not sufficient. There are several virtual machines that do not need a public IPv4 address, but only need to be able to access both IPv4 and IPv6 networks, such as monitoring services. There are also temp test services that may only need IPv6 addresses. This article describes the network configuration of PVE on a standalone server, especially the IPv6 part, so that the virtual machine can have both an intranet IPv4 address and a public IPv6 address.","html":"

My dedicated server hosting provider offers an IPv4 address, as well as an IPv6 address for /64. Although additional IPv4 addresses were purchased, they were not sufficient. There are several virtual machines that do not need a public IPv4 address, but only need to be able to access both IPv4 and IPv6 networks, such as monitoring services. There are also temp test services that may only need IPv6 addresses. This article describes the network configuration of PVE on a standalone server, especially the IPv6 part, so that the virtual machine can have both an intranet IPv4 address and a public IPv6 address.

\n"},"visible":true,"routable":true,"title":"Manually configuring network and VM IPv6 public network in PVE","comment":{"enabled":true,"reply":true},"discuss":{"enabled":true},"keywords":["PVE Virtual Machine IPv6 Internet","PVE IPv6 Support","PVE Shared IPv4","PVE Exclusive IPv6"],"webmention":{"enabled":true,"accept":true,"callback":{"secret":{"hash":{"sha256":"44bb9da44b424c6dfc9233819e907029ff2ccdfaa89919d3696ddf8db7ff6647"}}}},"pingback":{"enabled":true,"accept":true},"slug":"pve-network-manual-config-and-ipv6","taxonomy":{"category":["Internet"],"tag":["PVE","IPv6","NDPPD"],"series":[]},"route":"/pve-network-manual-config-and-ipv6/","toc":{"enabled":true},"published":{"date":"2024-02-15 15:02"},"modified":{"date":"2024-07-28T15:12:05.775Z"},"data":{},"license":"CC-BY-NC-SA-4.0","author":[{"email":{"value":{"encrypted":"ODgyZjdiZDg4OTVmMjllOGZkNmFmYg==","algorithm":"aes-256-gcm","iv":"067f6d66f2ba5dd50c8443be"},"hash":{"md5":"8770854a9222b6bf1ee195220793bcf1"}},"url":"https://dallas.lu","name":"Dallas Lu","lang":"en","user":"dallaslu"}],"contributor":[],"sponsor":[],"image":[],"audio":[],"video":[],"photo":[],"content":{"html":"

\n\n

PVE's own network vmbr0 configuration

PVE creates vmbr0 by default, which bridges the first physical port. You need to check which port is plugged into the network cable, maybe not eno1 but eno2. I wasted more than half an hour here.

Configuration of IPv4 on the public network

The hoster provides explicit configuration information, assuming it is:

\n
IPv4: 1.2.3.4/30
\nIPv4 Gateway: 1.2.3.1
\nIPv6: 1:2:3:4::/64
\nIPv6 Gateway: 1:2:3:4::1
\n

Connect to the server using IPMI or VNC, then edit /etc/network/interfaces:

auto vmbr0\niface vmbr0 inet static\n        address 1.2.3.4/30\n        gateway 1.2.3.1\n        bridge-ports eno1\n        bridge-stp off\n        bridge-fd 0\n

Then reboot the network:

systemctl restart networking\n

Visit https://1.2.3.4:8006 to access the PVE control panel^Note1. The rest can be done from the PVE control panel.

PVE's own IPv6 configuration

Edit the configuration of vmbr0, you can already see the IPv4 configuration on the interface, go ahead and set up IPv6:

IPv6/CIDR: 1:2:3:4::a/64
IPv6 gateway: 1:2:3:4::1

After saving and applying the changes, you can verify that 1:2:3:4::a/64 is accessible externally via https://ping6.ping.pe and check in the PVE node shell that the Internet connection is available via IPv6.

# Google DNS\nping6 2001:4860:4860::8888\n

Other

Once the network is working properly, you can perform other network-dependent operations, such as joining a PVE cluster in another server room.

If a virtual machine needs to use an additional standalone IP, it can connect directly to the default vmbr0, and then configure the network address according to the information provided by the hosting provider to connect to both IPv4 and IPv6 networks. Because vmbr0 bridges the physical port where the network cable is plugged in, you can configure the public IP address based on this network without further action.

Configure the virtual machine's dedicated bridged network vmbr1

More often than not, VMs do not need public IPv4, but only a NAT intranet address or IPv6, so add a bridge network (Linux Bridge) vmbr1 to the nodes of the PVE:

IPv4/CIDR: 1.0.0.1/16
IPv6/CIDR: 1:2:3:4:a::1/80

If you plan to use VLANs, the address information here is optional. If you need to test the VM temporarily, use this as the default test network. This IPv4 address is the IPv4 gateway for the VM, and the same for IPv6.

In vmbr0, the VM can choose any IPv6 address in the available range, while in vmbr1, we want the VM to use only one of the subnet segments ^Note2. The first address in 1:2:3:4:aa::/80 is selected.

Configuring VLANs

In vmbr1, turn on 'VLAN aware'. Create a new bridged network, e.g. vmbr1.100, with VLAN tag 100. Configure with the following:

IPv4/CIDR: 1.0.100.1/24
IPv6/CIDR: 1:2:3:4:a:100::1/96.

We want VMs accessing VLANs tagged with 100 to use only addresses in the smaller ranges 1.0.100.0/24 and 1:2:3:4:a:100::/96 ^Note3.

Configuring the VM

A CT instance has been chosen here to test the network configuration of the VM, with the benefit of the convenience of setting up the network directly from the PVE control panel. Edit the network information:

Bridge: vmbr1.
VLAN tagging: 100.
IPv4: static.
IPv4/CIDR: 1.0.100.100/24
IPv4 gateway: 1.0.100.1
IPv6: static
IPv6/CIDR: 1:2:3:4:a:100::100/96
IPv6 gateway: 1:2:3:4:a:100::1.

At this point the VM and PVE can ping each other to test the network.

Configuring IPv4 NAT

Currently the VM does not have access to the network via IPv4, you need to connect to the PVE node shell, edit /etc/network/interfaces and add statements starting with 'post' for vmbr1:

iface vmbr1 inet static\n        address 10.0.0.1/16\n        bridge-ports none\n        bridge-stp off\n        bridge-fd 0\n        bridge-vlan-aware yes\n        bridge-vids 2-4094\n        post-up sysctl -w net.ipv4.ip_forward=1\n        post-up iptables -t nat -A POSTROUTING -s '10.0.0.0/16' -o vmbr0 -j MASQUERADE\n        post-down iptables -t nat -D POSTROUTING -s '10.0.0.0/16' -o vmbr0 -j MASQUERADE\n

Save and restart the network^Note4.

Configuring IPv6 forwarding and NDP proxy

Edit /etc/network/interfaces and add statements starting with 'post' for vmbr1:

iface vmbr1 inet6 static\n        address 1:2:3:4:a::1/80\n        post-up sysctl -w net.ipv6.conf.default.forwarding=1\n        post-up sysctl -w net.ipv6.conf.all.forwarding=1\n        post-up sysctl -w net.ipv6.conf.default.proxy_ndp=1\n        post-up sysctl -w net.ipv6.conf.all.proxy_ndp=1\n

Save and restart the network. the PVE automatically creates the relevant routes, which can be viewed with ip -6 route. If the associated route ¹ is missing, add it manually:

ip -f inet6 route add 1:2:3:4:100::100 dev vmbr1.100\n

Note that this may disappear after a reboot, so add it to your own startup script or to the post-up statement for the /etc/network/interfaces.

At this point, there is no external connection to vmbr1, vmbr1.100 and the IPv6 address configured on the VM. Add the NDP proxy:

# vmbr1\nip -f inet6 neigh add proxy 1:2:3:4:a::1 dev vmbr0\n# vmbr1.100\nip -f inet6 neigh add proxy 1:2:3:4:a:100::1 dev vmbr0\n# virtual machine\nip -f inet6 neigh add proxy 1:2:3:4:a:100::100 dev vmbr0\n

This can be viewed with ip -6 neigh show proxy. If the network is down, try flushing the ndp cache: ip -6 neigh flush all.

NDPPD

When adding VMs in the future, you will also need to add the NDP agent manually. This can be done once and for all with NDPPD.

apt install ndppd\n

Edit /etc/ndppd.conf:

proxy vmbr0 {\n        rule 1:2:3:4::/64 {\n                auto\n        }\n}\n

Enable NDPPD

systemctl enable --now ndppd\n

Other

The home broadband network environment is not applicable to the solution in this article. you can use DHCP/SLAAC and other methods to directly auto-configure IPv6 for the virtual machine²³.

Notes

\n
Sometimes manually changing the PVE's network configuration and rebooting the network has no effect, try rebooting the PVE node. ↩
\n
\n
If you need to limit the VMs in vmbr1 or vmbr1.100 to only use addresses on the planned segments, you can add a firewall rule for them to discard data on non-planned segments. ↩
\n
\n
In this case, different subnet segments are configured in each of the three interfaces to avoid routing conflicts. ↩
\n
\n
In order to connect to a VM on a NAT network from an external IPv4 address, it may be necessary to configure port forwarding in the PVE. ↩
\n

References

\n
coldark. 单IPv4独服利用ProxmoxVE建立IPv4-NAT和IPv6虚拟机（小鸡）(Single IPv4 Solo Service Building IPv4-NAT and IPv6 VMs with ProxmoxVE ). 方舟基地. 2019. \"……这时只能访问IPv4地址，IPv6这个时候还是不通的，需要在主机输入以下命令开启:... ip -f inet6 route add ...(...At this point, only IPv4 addresses can be accessed, IPv6 is still not available at this time, you need to enter the following command in the host to turn it on:... ip -f inet6 route add ... )\" ↩
\n
\n
Insylei. PVE Proxmox VE 使用IPv6(PVE Proxmox VE using IPv6). 自由de风. 2023. ↩
\n
\n
bruj0. ProxmoxIPv6. Github. 46d1aac. 2023. ↩
\n

\n","headings":[{"level":2,"text":"PVE's own network vmbr0 configuration","id":"pves-own-network-vmbr0-configuration"},{"level":3,"text":"Configuration of IPv4 on the public network","id":"configuration-of-ipv4-on-the-public-network"},{"level":3,"text":"PVE's own IPv6 configuration","id":"pves-own-ipv6-configuration"},{"level":3,"text":"Other","id":"other"},{"level":2,"text":"Configure the virtual machine's dedicated bridged network vmbr1","id":"configure-the-virtual-machines-dedicated-bridged-network-vmbr1"},{"level":3,"text":"Configuring VLANs","id":"configuring-vlans"},{"level":3,"text":"Configuring the VM","id":"configuring-the-vm"},{"level":3,"text":"Configuring IPv4 NAT","id":"configuring-ipv4-nat"},{"level":3,"text":"Configuring IPv6 forwarding and NDP proxy","id":"configuring-ipv6-forwarding-and-ndp-proxy"},{"level":3,"text":"NDPPD","id":"ndppd"},{"level":2,"text":"Other","id":"other-1"}],"meta":{"prism":true},"links":[{"href":"https://ping6.ping.pe","type":"mention"},{"href":"https://www.wnark.com/archives/32.html","type":"mention"},{"href":"https://www.icn.ink/pve/57.html","type":"mention"},{"href":"https://github.com/bruj0/ProxmoxIPv6","type":"mention"},{"href":"https://github.com/bruj0/ProxmoxIPv6/tree/46d1aac3f0a43102848b69e36aebcf0a18964e14","type":"mention"}]},"newer":"/manually-establish-your-own-ipv6-tunnel/","earlier":"/pve-reduce-ubuntu-vm-disk-size/"}]

Tag: IPv6

Manually establish your own IPv6 Tunnel

Manually configuring network and VM IPv6 public network in PVE

2024