I have a IPv6 tunnel via HE and it correctly works. Clients get IPv6 addresses
I set up an OpenVPN tunnel which is configured by this openvpn guide. I wish to have a secure tunnel to my router.
First problem is The OpenVPN tunnel successfully connects clients but does not provide the internet. I think I missed firewall rules.
Second problem is I tried to configure IPv6 over the OpenVPN tunnel by this guide.
I assume that the router will forward IPv6 addresses to the OpenVPN network
Since you want dual stack in the VPN tunnel, should get v4 working first. Placing the vpn tunnel in the lan zone should have worked. VPNs must be tested from outside, for example when the client is a smartphone test with it on the cell network not your house wifi which is also the vpn server.
The tun interface is created by OpenVPN- by default it is named tun0 so use that same name when assigning IP address to it. A change script is not necessary since henet will not change your prefix. You could even configure a static /64 which is part of your /48 directly into OpenVPN but then you lose OpenWrt automatic assignment.
NAT6 is not necessary here since the clients will have GUAs that route directly to the Internet.
Thank you for answer!
I placed the "tun0" into the lan zone further I checked and fixed again the configuration(firewall, vpn service) and after all the tunnel is working by IPv4!
What I should do for IPv6? What does mean "lose OpenWrt automatic assignment"? Do you mean OpenWrt can not get IPv6 in its wan port?
I'm assuming your local ISP is v4 only, so your wan6 is the HE tunnel. Do devices on the local lan have proper v6 access? Test with a site like test-ipv6.com. Assuming all of that is working, next the LANvpn setup should have placed a /64 part of the HE prefix (a different part than the /60 the local LAN has) on tun0. That can be seen on the Interfaces GUI page or with ip addr show or ifstatus LANvpn in CLI.
Then-- this part I'm not sure about since I have not used OpenVPN for a while-- OpenVPN should push a single IPv6 address from that /64 to each client. The client uses that as its source IP when reaching the v6 Internet. It will get routed to the HE tunnel at your house an then to the v6 Internet from HE.
HE gives each user a /48 prefix. You have configured /64. A /64 can only be passed to one LAN. A /48 can be broken up into 65,000 /64 blocks, or 4096 /60, etc.
I also do not think that is OK you should use a /64 subnet
Instead of
[quote="ARM128bit, post:9, topic:229547"] push "route-ipv6 2000::/3"
[/quote] you can use:
push "redirect-gateway ipv6 def1"
this is ambiguous udp means both udp4 and udp6 which is probably what you want so delete/comment proto udp6
ifconfig-ipv6 is not necessary when using server-ipv6 2001:YYY:XX:5ec:8000::/64 the first address will automatically be the server so use a /64 subnet and I think you can remove this ifconfig-ipv6 line
user nobody
group nogroup
dev tun
port 1194
proto udp
server 192.168.9.0 255.255.255.0
topology subnet
client-to-client
keepalive 10 60
persist-tun
persist-key
push "dhcp-option DNS 192.168.9.1"
push "dhcp-option DOMAIN lan"
push "redirect-gateway ipv6 def1"
push "persist-tun"
push "persist-key"
server-ipv6 2001:YYY:XXX:8000::/64
I also splitted a /48 subnet to one /64 subnet as mk24 advised
It does not work now and not pass tests of test-ipv6 for example. Although a client gets IPv6 address 2001:YYY:XXX:8000::1000
Also, a client does not get DNS and gateway addresses
Also make sure your prefix delegation does not conflict with other LANs that were delegated automatically. Since the prefix is static and I don't think OpenVPN works with OpenWrt's automatic system, it would be best to manually / statically delegate all the LANs.
The usual advice to use Wireguard instead if at all possible really applies here since Wireguard interfaces on OpenWrt readily support automatic delegation and DHCPv6 / RA through the tunnel. Although if multiple "road warrior" clients are involved instead of a site to site link, OpenVPN would allow them to share the same /64 instead of using a separate interface and /64 for each one.
user nobody
group nogroup
dev tun
port 1194
proto udp
server 192.168.9.0 255.255.255.0
topology subnet
client-to-client
keepalive 10 60
persist-tun
persist-key
push "dhcp-option DNS 192.168.9.1"
push "dhcp-option DOMAIN lan"
push "redirect-gateway def1"
push "redirect-gateway ipv6 def1"
push "persist-tun"
push "persist-key"
server-ipv6 2001:YYY:XXX:8000::/64
But I'm getting an error during connecting: WARNING: You have specified redirect-gateway and redirect-private at the same time (or the same option multiple times). This is not well supported and may lead to unexpected results
It is a warning and not an error and you can disregard that
As far as I can tell it looks OK but I do not use HE6 tunnels and do not use part of my PD for my OpenVPN subnet I use an ULA address (for which you need NAT66 on the router for internet access) but it should amount to the same, but routing looks good
You can try to run a tracert to see what is the problem e.g.:
1 129 ms 129 ms 129 ms 2001:YYY:XXX:5ec:8000::1
2 223 ms 223 ms 224 ms tunnelZZZZZZ.tunnel.tserv27.prg1.ipv6.he.net [2001:YYY:XXX:5ec::1]
3 * * * Request timed out
4 216 ms 216 ms 217 ms nixcz-v6.net.google.com [2001:7f8:14::1d:1]
5 217 ms 216 ms 217 ms 2001:4860:0:1::7f33
6 216 ms 216 ms 218 ms 2001:4860:0:1::4e1f
7 217 ms 217 ms 222 ms dns.google [2001:4860:4860::8888]
I think I need to try a wireguard after all
Thank you guys! If you have no more ideas, then I will not waste your time any more. I am already very grateful to you.
