17.01.2, problem with configuring ipv6 he.net tunnel

Hi!

I have problem with configure ipv6 - he.net tunnel. When I had openwrt all works good. I installed LEDE and he.net not working.

Here is my config: https://pastebin.com/SaFxk5Dv

ifconfig:
6in4-wan6 Link encap:IPv6-in-IPv4
          inet6 addr: 2001:470:70:cfd::2/64 Scope:Global
          inet6 addr: fe80::c0a8:6402/64 Scope:Link
          UP POINTOPOINT RUNNING NOARP  MTU:1280  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:4 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1
          RX bytes:0 (0.0 B)  TX bytes:320 (320.0 B)

br-lan    Link encap:Ethernet  HWaddr E8:94:F6:ED:BA:36
          inet addr:192.168.100.2  Bcast:192.168.100.255  Mask:255.255.255.0
          inet6 addr: 2001:470:70:cfd::1/64 Scope:Global
          inet6 addr: 2001:470:71:cfd::1/64 Scope:Global
          inet6 addr: fdf4:103e:ff67::1/60 Scope:Global
          inet6 addr: fe80::ea94:f6ff:feed:ba36/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:46132 errors:0 dropped:59 overruns:0 frame:0
          TX packets:78186 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:4693416 (4.4 MiB)  TX bytes:98988878 (94.4 MiB)

Try changing these parameters:

    option ip6addr '2001:470:70:cfd::2'
    option ip6prefix '2001:470:71:cfd::/48'

@eduperez do you use he.net's 6in4? Can you confirm if LEDE's network_find_wan6 function (from /lib/functions/network.sh) finds the tunnel as a wan6 interface?

I haven't actively used he.net for a while as I have now nnative ipv6.
But based on my old he.net config the advice from @eduperez sounds reasonable (as least if you have /48 from he.net). Defining /48 as the prefix gives the router the possibility for prefix delegation for LAN, as it can be split into several /64 prefixes.

Otherwise you he.net config seems similar as mine.

I just tested my he.net tunnel and got it working (in LEDE master).

But it did not work first, as he.net had deleted the inactive tunnel (as I normally use native ISP ipv6). Logging into tunnelbroker site revealed that I had 0 tunnels...

Creating a new tunnel fixed things for me. I requested a routed /48 for the new tunnel.

After adjusting the config, rebooting the router (and reconnecting PC) traffic flowed normally.

config interface 'henet'
        option proto '6in4'
        option mtu '1424'
        option peeraddr '216.66.80.90'
        option ip6addr '2001:470:27:xxx::2/64'
        option ip6prefix '2001:470:zzzz::/48'
        option tunnelid 'xxx'
        option username 'xxx'
        option password 'xxx'
root@LEDE:~# traceroute6 ipv6.google.com
traceroute to ipv6.google.com (2a00:1450:400f:807::200e), 30 hops max, 16 byte packets
 1  hnyman-1.tunnel.tserv24.sto1.ipv6.he.net (2001:470:27:xxx::1)  12.410 ms  13.118 ms  12.472 ms
 2  10ge3-17.core1.sto1.he.net (2001:470:0:11e::1)  10.631 ms  21.129 ms  12.565 ms
 3  100ge12-1.core1.fra1.he.net (2001:470:0:3aa::1)  32.953 ms  27.782 ms  49.115 ms
 4  100ge14-1.core1.prg1.he.net (2001:470:0:213::2)  35.113 ms  45.396 ms  35.158 ms
 5  100ge8-1.core1.vie1.he.net (2001:470:0:1b4::2)  45.771 ms  61.468 ms  80.233 ms
 6  10ge6-6.core1.sof1.he.net (2001:470:0:32f::2)  65.097 ms  58.861 ms  58.804 ms
 7  as15169.2.v6.netix.net (2001:67c:29f0::1:5169:2)  54.508 ms  75.345 ms  57.028 ms
 8  2001:4860:0:11e1::e (2001:4860:0:11e1::e)  54.666 ms  54.535 ms  69.959 ms
 9  2001:4860::c:4000:f874 (2001:4860::c:4000:f874)  56.448 ms  71.160 ms  54.700 ms
10  2001:4860::8:4000:f433 (2001:4860::8:4000:f433)  73.861 ms  67.296 ms  65.235 ms
11  2001:4860::8:0:4fc8 (2001:4860::8:0:4fc8)  79.318 ms  121.387 ms  79.222 ms
12  2001:4860::1:0:26eb (2001:4860::1:0:26eb)  84.824 ms  79.394 ms  79.582 ms
13  2001:4860:0:1::1013 (2001:4860:0:1::1013)  79.524 ms  79.496 ms  81.493 ms
14  arn09s11-in-x0e.1e100.net (2a00:1450:400f:807::200e)  79.409 ms  79.527 ms  79.571 ms
root@LEDE:~# route -A inet6
Kernel IPv6 routing table
Destination                                 Next Hop                                Flags Metric Ref    Use Iface
::/0                                        ::                                      U     1024   1        3 6in4-henet
::/0                                        ::                                      U     1024   2      394 6in4-henet
2001:470:27:xxx::/64                        ::                                      Un    256    0        0 6in4-henet
2001:470:zzzz::/64                          ::                                      U     1024   2      373 br-lan
2001:470:zzzz::/48                          ::                                      !n    2147483647 0        0 lo

No effect. Still no ping, traceroute.

Tunnel still didnt work. Here is my tunnelbroker config:

 14:35:35-root@main:~$ route -A inet6
    Kernel IPv6 routing table
    Destination                                 Next Hop                                Flags Metric Ref    Use Iface
    ::/0                                        ::                                      U     1024   0        0 6in4-wan6
    ::/0                                        ::                                      U     1024   1        7 6in4-wan6
    2001:470:70:cfd::2/128                      ::                                      Un    256    0        0 6in4-wan6
    2001:470:71:cfd::/64                        ::                                      U     1024   1       15 br-lan
    2001:470:71::/48                            ::                                      !n    2147483647 0        0 lo
    fdf4:103e:ff67::/64                         ::                                      U     1024   1      283 br-lan
    fdf4:103e:ff67::/48                         ::                                      !n    2147483647 0        0 lo
    fe80::/64                                   ::                                      U     256    1       17 br-lan
    fe80::/64                                   ::                                      U     256    0        0 eth0
    fe80::/64                                   ::                                      U     256    0        0 wlan0
    fe80::/64                                   ::                                      Un    256    0        0 6in4-wan6
    ::/0                                        ::                                      !n    -1     1     2520 lo
    ::1/128                                     ::                                      Un    0      2       20 lo
    2001:470:70:cfd::2/128                      ::                                      Un    0      1        0 lo
    2001:470:71:cfd::/128                       ::                                      Un    0      1        0 lo
    2001:470:71:cfd::1/128                      ::                                      Un    0      2       25 lo
    fdf4:103e:ff67::/128                        ::                                      Un    0      1        0 lo
    fdf4:103e:ff67::1/128                       ::                                      Un    0      2      334 lo
    fe80::/128                                  ::                                      Un    0      1        0 lo
    fe80::/128                                  ::                                      Un    0      1        0 lo
    fe80::/128                                  ::                                      Un    0      1        0 lo
    fe80::/128                                  ::                                      Un    0      1        0 lo
    fe80::c0a8:6402/128                         ::                                      Un    0      1        0 lo
    fe80::ea94:f6ff:feed:ba36/128               ::                                      Un    0      2       97 lo
    fe80::ea94:f6ff:feed:ba36/128               ::                                      Un    0      1        0 lo
    fe80::ea94:f6ff:feed:ba37/128               ::                                      Un    0      1        0 lo
    ff00::/8                                    ::                                      U     256    1      487 br-lan
    ff00::/8                                    ::                                      U     256    0        0 eth0
    ff00::/8                                    ::                                      U     256    0        0 wlan0
    ff00::/8                                    ::                                      U     256    0        0 6in4-wan6
    ::/0                                        ::                                      !n    -1     1     2520 lo

I have second router with OpenWRT - I instaleld 6in4, some ipv6 mods and this working.

root@MICHAU:~# ping6 ipv6.google.com
PING ipv6.google.com(waw02s06-in-x0e.1e100.net) 56 data bytes
64 bytes from waw02s06-in-x0e.1e100.net: icmp_seq=1 ttl=54 time=111 ms
64 bytes from waw02s06-in-x0e.1e100.net: icmp_seq=2 ttl=54 time=93.8 ms
64 bytes from waw02s06-in-x0e.1e100.net: icmp_seq=3 ttl=54 time=75.2 ms

I have the same config on LEDE but not working. WTF

@stangri: Yes, I am currently using HE's tunnel. With the tunnel active, I made this test:

root@router:~# . /lib/functions/network.sh 
root@router:~# network_find_wan6 TEST true
root@router:~# echo $TEST
wan6

In ifconfig, my WAN6 interface is called 6in4-wan6. Does this answer your question?

@eterror: You have to use the "Client IPv6 Address" address in "ip6addr" (without a suffix), and the "Routed /48" address in "ip6prefix" (with a "/48" suffix). So, it should be

option ip6addr '2001:470:70:cfd::2'
option ip6prefix '2001:470:64c4::/48'
1 Like

I tried. Still nothing. :frowning: I said I tested this tunnel on other owrt router and all works with this config.

6in4-wan6 Link encap:IPv6-in-IPv4
          inet6 addr: 2001:470:70:cfd::2/128 Scope:Global
          inet6 addr: fe80::b2db:7ebe/64 Scope:Link
          UP POINTOPOINT RUNNING NOARP  MTU:1424  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:3 dropped:0 overruns:0 carrier:3
          collisions:0 txqueuelen:1
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

LEDE upgraded to Reboot (17.01-SNAPSHOT, r3491-889638c

root@main:~/download# ping6 ipv6.google.com
PING ipv6.google.com(ham02s15-in-x0e.1e100.net) 56 data bytes
From terror.crabdance.com icmp_seq=1 Destination unreachable: Address unreachable
From terror.crabdance.com icmp_seq=2 Destination unreachable: Address unreachable
From terror.crabdance.com icmp_seq=3 Destination unreachable: Address unreachable

What is the output of "route -A inet6"?

@eduperez

I see problem. Maybe. There is no route to /48.

  LĀ¦[17:29:50] # route -A inet6
    Kernel IPv6 routing table
    Destination                                 Next Hop                                Flags Metric Ref    Use Iface
    ::/0                                        ::                                      U     1024   1        5 6in4-wan6
    2001:470:70:cfd::/64                        ::                                      Un    256    0        0 6in4-wan6
    fd5c:4968:f969::/64                         ::                                      U     1024   1     1053 br-lan
    fd5c:4968:f969::/48                         ::                                      !n    2147483647 0        0 lo
    fe80::/64                                   ::                                      U     256    1       42 br-lan
    fe80::/64                                   ::                                      U     256    0        0 eth0
    fe80::/64                                   ::                                      U     256    0        0 wlan0
    fe80::/64                                   ::                                      Un    256    0        0 6in4-wan6
    ::/0                                        ::                                      !n    -1     1     2712 lo
    ::1/128                                     ::                                      Un    0      2       72 lo
    2001:470:70:cfd::/128                       ::                                      Un    0      1        0 lo
    2001:470:70:cfd::2/128                      ::                                      Un    0      2       12 lo
    2001:470:71:cfd::/128                       ::                                      Un    0      1        0 lo
    2001:470:71:cfd::1/128                      ::                                      Un    0      2       76 lo
    2001:470:64c4::/128                         ::                                      Un    0      1        0 lo
    2001:470:64c4::1/128                        ::                                      Un    0      2      442 lo
    fd5c:4968:f969::/128                        ::                                      Un    0      1        0 lo
    fd5c:4968:f969::1/128                       ::                                      Un    0      2     1173 lo
    fe80::/128                                  ::                                      Un    0      1        0 lo
    fe80::/128                                  ::                                      Un    0      1        0 lo
    fe80::/128                                  ::                                      Un    0      1        0 lo
    fe80::/128                                  ::                                      Un    0      1        0 lo
    fe80::b2db:7ebe/128                         ::                                      Un    0      1        0 lo
    fe80::ea94:f6ff:feed:ba36/128               ::                                      Un    0      2      371 lo
    fe80::ea94:f6ff:feed:ba36/128               ::                                      Un    0      1        0 lo
    fe80::ea94:f6ff:feed:ba37/128               ::                                      Un    0      1        0 lo
    ff00::/8                                    ::                                      U     256    1     1821 br-lan
    ff00::/8                                    ::                                      U     256    0        0 eth0
    ff00::/8                                    ::                                      U     256    0        0 wlan0
    ff00::/8                                    ::                                      U     256    0        0 6in4-wan6
    ::/0                                        ::                                      !n    -1     1     2712 lo

Same, exact, IDENTICAL problem here in Italy, but with both HE and my ISP 6in4 tunnel! Openwrt worked and LEDE doesn't. Synthomos are identical, no packet received on tunnel WAN

[20:04:00]-solaris@main $ ip -6 route
default from 2001:470:70:cfd::/64 dev 6in4-wan6 metric 1024
default from 2001:470:64c4::/48 dev 6in4-wan6 metric 1024
2001:470:70:cfd::/64 dev 6in4-wan6 metric 256
2001:470:64c4::/64 dev br-lan metric 1024
unreachable 2001:470:64c4::/48 dev lo metric 2147483647 error -148
fd5c:4968:f969::/64 dev br-lan metric 1024
unreachable fd5c:4968:f969::/48 dev lo metric 2147483647 error -148
fe80::/64 dev br-lan metric 256
fe80::/64 dev 6in4-wan6 metric 256
fe80::/64 dev eth0 metric 256
fe80::/64 dev wlan0 metric 256
unreachable default dev lo metric -1 error -128
ff00::/8 dev br-lan metric 256
ff00::/8 dev 6in4-wan6 metric 256
ff00::/8 dev eth0 metric 256
ff00::/8 dev wlan0 metric 256
unreachable default dev lo metric -1 error -128

I'm sure you guys wouldn't overlook something like that, but in my case the he.net tunnel would not be established because of the wrong "external" ip address in their system (and/or no icmp ping replies over WAN port on my router with OpenVPN connection setting up default routes).

Just something to keep in mind.

@eterror I stumbled across the exact same problem as well: perfectly working behaviour on OpenWRT, but nothing on LEDE. I found this topic IPv6 on DSL - 2 default Gateways and "Network unreachable", that steered me in the right direction, as I have running latest LEDE (compiled) and had mwan3 installed. I do not need it in my current setup and therefore removed it, solving a similar issue like yours with the routes. One can also disable mwan3 for IPv6, so that should help as well - if that is the source of the problem.

Has the bug/problem been found?. It seems i have the same problem as described.
i was using openwrt with my ISP-Nr.1 and working HE.net. switched to a new ISP-Nr.2 and had to use Sixxs with success. after moving again i could use ISP-Nr.1 again, and use HE.net (sixxxs closed in this time also) and updated to lede. but no success with HE.net so far.

any idea what causes the problems with He.net and LEDE?

@cave I'm still using HE for my IPv6, and it works perfectly. Perhaps you should share your configuration files (remember to hide the passwords) and post the logs from your router.

In my case the problem was with the ISP router that filtered proto 41.
I replaced it with another brand and HE works fine

1 Like

I was once using HE.net on openwrt, with success. Sadly i had to move, change my ISP and use their LTE-router without forwarding proto-41through the nat to my router. so i switched to sixxxs/aiccu.
Now i moved again, and can use my Cable Provider again with my DOCSIS Modem. Sixxs has closed and i can use HE.net again on my own router.
But i cannot bring HE.net 6in4 interface UP and working.

I am using a TP-Link TL-WDR4300 v1, Target: ar71xx My ISP is a CableInternet Provider, and i am behind a Cisco Modem. ISP Cable <-> Modem <-> WAN Port
LEDE Reboot 17.01.4, Kernel Version 4.4.92
My LAN Net is 192.168.100.0/24, my Router LAN IP is 192.168.100.1, my Router WAN is the IP received from my Modem.

root@openwrt:~# cat /etc/config/network wan6
config interface 'wan6'
	option proto '6in4'
	option mtu '1424'
	option peeraddr '216.66.87.14'
	option ip6addr '2001:470:1f1a:b4::2/64'
	option tunnelid 'MY_TUNNELID'
	option username 'MY_USERNAME'
	option ip6prefix '2001:470:xxxx::/48'
	option password 'MY_UPDATE_KEY'
	option auto '0'

I have tried with:
option updatekey 'MY_UPDATE_KEY'
additionally or instead of option password

auto 1 and manually starting does not work. It's disabled atm to check pings to the POP/peeraddr

I have tried with a /64 and a /48 Routed IPv6 Prefix.

root@openwrt:~# cat /etc/config/network lan
config interface 'lan'
... yada yada yada ...
	option ip6assign '60'
	option ip6ifaceid '::1'
	option ip6hint '2001:470:xxxx::'

my firewall configs:

config zone
	option name 'wan'
	option output 'ACCEPT'
	option forward 'REJECT'
	option mtu_fix '1'
	option masq '1'
	option network 'wan wan6'
	option input 'REJECT'

proto41/6in4 is allowed

config rule
	option target 'ACCEPT'
	option name '6in4'
	option src 'wan'
	option proto '41'

Before i connect with my WAN6 interface to HE.net, my routing table looks like:

root@openwrt:~# route
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         h081217094001.d 0.0.0.0         UG    0      0        0 eth0.2
81.217.94.0     *               255.255.255.0   U     0      0        0 eth0.2
81.217.94.1     *               255.255.255.255 UH    0      0        0 eth0.2
192.168.100.0   *               255.255.255.0   U     0      0        0 br-lan

I am able to ping the IPv6 Tunnel endpoint 216.66.87.14 with 14ms
When i connect the WAN6 Interface, the ping fails immediately.

root@openwrt:~# route
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         h081217094001.d 0.0.0.0         UG    0      0        0 eth0.2
81.217.94.0     *               255.255.255.0   U     0      0        0 eth0.2
81.217.94.1     *               255.255.255.255 UH    0      0        0 eth0.2
192.168.100.0   *               255.255.255.0   U     0      0        0 br-lan
216.66.87.14    192.168.100.1   255.255.255.255 UGH   0      0        0 br-lan

Interrestingly, there is a new route... i do not understand why the ping fails and there is a new ipv4 route.

WAN6 does not receive pakets.
the IPv6 Prefix delegations does work well for the LAN Interface.

Uptime: 0h 2m 5s
MAC-Address: C0:A8:64:01:00:00
RX: 0 B (0 Pkts.)
TX: 4.73 KB (46 Pkts.)
IPv6: 2001:470:1f1a:b4::2/64
IPv6-PD: 2001:470:xxxx::/48

root@openwrt:~# ifconfig 6in4-wan6
6in4-wan6 Link encap:IPv6-in-IPv4  
          inet6 addr: fe80::c0a8:6401/64 Scope:Link
          inet6 addr: 2001:470:1f1a:b4::2/64 Scope:Global
          UP POINTOPOINT RUNNING NOARP  MTU:1424  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:77 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1 
          RX bytes:0 (0.0 B)  TX bytes:7916 (7.7 KiB)

any logs needed? any information missing?
any ideas what i am doing wrong? Why is there a new route when i connect WAN6? why does the ping stop to the peeraddr?

Comparing your config with mine, I see you have a "/64" at the end of "option ip6addr", while I have nothing after the ":2". Then, "ifconfig" reports a "/128" on the "global" link.

Also, perhaps you could try connecting to another node.