Printable View
oh yes, forgot that one in the checklist:oQuote:
Originally Posted by Dapper
Sites like?Quote:
Edit 2: I spoke too soon. It would appear that I cannot connect to a whole host of ipv6 enabled sites, with any browser, when IPv6 is enabled. This is true, even though I received at perfect score on test-ipv6.com.
if that's the case you might need to contact HE about this for support
A few of those I tried were Sixxes, sixy.ch and ipv6.internode.on.net as well as any of the HE sites. All failed with IPv6 enabled.Quote:
Sites like?
I've posted pretty much the same stuff in their forums as posted here. So far, there's not really any answers.Quote:
if that's the case you might need to contact HE about this for support
Just checked, all these sites are working and accessable via he.net ipv6 tunnel from router. I'm using Windows XP, Windows 7 and Debian as clients with radvd enabled.
And, btw, about ipv6 firewalling. It's here for ages. ip6tables --help
Quote:
Originally Posted by theMIROn
Thanks for the reply. I don't doubt the sites work, they just won't work for me, with the configuration I'm currently using, even though test-ipv6 tells me everything is up and running. Clearly, I am doing something wrong and that's what I'm trying to sort out.
Hopefully, I'll get some more time tomorrow, so I'll set-up a tunnel without the router, just to see if it makes a difference. I also have an account with gogo6, so I'll create a tunnel with their client, too.
Thanks for the info on ip6tables, I'll take a look at that, once I have a correctly working tunnel.
Is your modem also pingable?
or does it send the ping to the router?
either way, HE tunnel needs that:p
I was thinking, because I have my router in DMZ by default, if the router is behind a firewall and accept pings it doesn't make any difference:)
Hi,
I've setup the 6to4 tunel - I'm able to ping ipv6 sites from router.
But I'm not able to use IPv6 from clients. First, they didn't have IPv6 address. I found I should use radvd daemon. I used following configuration:Code:$ traceroute6 www.abclinuxu.cz
traceroute to www.abclinuxu.cz (2a01:430:10:ab::3), 30 hops max, 16 byte packets
1 2002:c058:6301::1 (2002:c058:6301::1) 7.590 ms 6.985 ms 7.065 ms
2 2001:1488::1 (2001:1488::1) 7.506 ms 7.686 ms 7.186 ms
3 nix-ipv6.masterinter.net (2001:7f8:14::11:1) 8.761 ms 7.549 ms 7.369 ms
4 2a01:430:10:ab::3 (2a01:430:10:ab::3) 21.780 ms 11.335 ms 7.479 ms
Now clients have IPv6 address, but ping6 still does not work.Code:$ cat /opt/etc/radvd.conf
interface br0 {
AdvSendAdvert on;
MinRtrAdvInterval 3;
MaxRtrAdvInterval 10;
prefix 2002:bcaf:2821::/64 {
AdvOnLink off;
AdvAutonomous on;
AdvRouterAddr on;
Base6to4Interface vlan1;
AdvPreferredLifetime 20;
AdvValidLifetime 30;
};
};
I'm using 1.9.2.7-d-r2381.Code:|20:34:25 marian@nb ~| $ tracepath6 www.abclinuxu.cz
1?: [LOCALHOST] 0.047ms pmtu 1500
1: no reply
2: no reply
3: no reply
4: no reply
5: no reply
6: no reply
7: no reply
8: no reply
9: no reply
10: no reply
11: no reply
12: no reply
13: no reply
14: no reply
15: no reply
16: no reply
17: no reply
18: no reply
19: no reply
20: no reply
21: no reply
22: no reply
23: no reply
24: no reply
25: no reply
26: no reply
27: no reply
28: no reply
29: no reply
30: no reply
31: no reply
Too many hops: pmtu 1500
Resume: pmtu 1500
Does I need setup something more?
Is starting of radvd somewhere in web interface?
EDIT: I did touch nothing, but now it works. So the only question is about radvd.
Yes, in the menu you can select to broadcast the ipv6 availability.Quote:
Originally Posted by maros
It's in the ipv6 menu.
For clients you might need to reboot, or reconfigure the interface:)
Do you mean "Enable router advertisements:"? I've set it to 'Yes'.Quote:
Originally Posted by wpte
I did a re-connect to wifi. On NB it works now, but on my second computer still does not work. Even after restart. Unfotunately, I've no time to investigate it deeply this week :-(Quote:
Originally Posted by wpte
Apologies for the delay in posting, I've been very busy.
I finally had some time to come back to this problem and I've established the cause of the problem to be the router.
In trouble shooting, I performed the following tasks:
1. Configured IPv6 in the router and updated the tunnel details with HE.
2. Verified connectivity by ping -6 (from the PC) to various IPv6 enabled sites (ipv6.he.net, ipv6.google.com etc.)
3. Tried browsing to various ipv6 enabled sites. Connectivity was available but it was incredibly slow and often timed out completely.
4. Placed the PC in the router DMZ and performed the steps above. No difference was discernible.
5. Turned off the firewall in the router and performed the steps above. No difference discernible.
5. Removed the router from the equation by connecting the PC directly to the Internet.
6. Updated the tunnel details and ran the netsh script from he to configure the tunnel endpoint on the PC.
7. Everything worked as expected
Clearly the router configuration is incorrect but I don't know what I've done wrong. The configuration is as I outlined in my earlier posts and as I say, I can ping -6 various hosts from the PC and although it's horribly slow, I can connect via the browser.
So any clues as to what I may have done wrong or ideas about what I can do to rectify the problem, would be most welcome.
Thanks
Oh yes, the thing I always forget to mention actually:pQuote:
Originally Posted by Dapper
Is your router pingable from the internet, that's required by HE
Would it be usefull to open icmp on the firewall automagicaly from 6to4 tunnel server?Quote:
Originally Posted by wpte
would be a good idea, since many people have problems with that partQuote:
Originally Posted by theMIROn
but it should also be mentioned then somewhere on the web-gui perhaps?
It is 'pingable' if it wasn't I wouldn't have been able to configure it as the end-point for the tunnel. (For now, I have a dynamic address, which changes when the router is booted)Quote:
Originally Posted by wpte
As I said, once the tunnel is established, I can ping ipv6 sites and I can, albeit painfully slowly, connect to ipv6 sites from within the browser.
If there were some issue with ICMP, would this cause the browser issues?
I think this would be a good idea. As wpte mentioned, it's something easily overlooked.Quote:
Would it be usefull to open icmp on the firewall automagicaly from 6to4 tunnel server?
I could really use some help here, please. I feel like I'm banging my head against a wall.
After more testing today, I've found that when testing against http://www.test-ipv6.com
A. With the router connected the 'IPv6 large packet test' always fails with a timeout. All other tests pass.
B. With the router removed and a direct connection to the Internet from the PC, the test is always passed.
According to the site, if this test fails, it may be due to "PMTUD issues; possibly involving IP tunnels." If this is a possible reason for the problems I'm encountering, which settings in the router might be the cause
Sorry Dapper, I'm also not quite sure what the problem is.
but concerning the path MTU... are you sure the tunnel mtu and ttl is filled in?
for mtu I use 1280, and ttl 64.
perhaps you can try to make the MTU larger?:confused:
for me everything runs fine except "Test with IPv4 DNS record" because I use openDNS, which is a false positive :)
Thanks for taking the time to reply. Te details of my configuration can be seen in the screen shot on the previous page. The values for the settings you mentioned are the same.Quote:
Originally Posted by wpte
When I did an ICMP buffer test, with the router in place, the mtu maximum was 1232, anything above that gave a destination unreachable. The problem is, I'm not sure what the ICMP overhead for IPv6 is. On Ipv4 it's 28 bits.
There is obviously something wrong with the configuration of my router, but I have no idea what it may be or where to look. As I said in an earlier post, placing the PC in the DMZ and/or disabling the firewall has no effect on the problem, which is simply that with IPv6 enabled, sites sit continuously in the 'waiting for xxxxx site' If I disable IPv6 on the network adapter, I connect instantly. If I remove the router but leave IPv6 enabled and configured on the PC, I connect instantly.
I'm thinking now I might just reset the router to factory defaults and see what happens. I might also try some different firmware, perhaps Tomato or OpenWRT.
Final question, could this be an iptables issue, if so, what might it be?
Thanks
Reset to factory defaults might help. Back in the days IPv6 settings couldn't be saved correctly or something, so it might be a bug from older firmwares:)Quote:
Originally Posted by Dapper
I had some major trouble when restoring setting files actually.
obviously you have to manually enter all settings again;)
I heard a lot of good stories about tomato, but I'm not to fond of dd-wrt:p
ip-tables stopping you from browsing? it sounds very specific to be just an ip-tables issue imo:confused:
Which version of the firmware are you using? I have 1.9.2.7-d-r2381 installed.
I wasn't that keen on dd-wrt either. Tomato looks interesting, I just need to find a distribution that supports IPv6 and L2TP tunnels. The latter is needed to connect to my ISP. Still, I'd rather not go down that path yet, as I'm mostly happy with the current firmware.
favour, if I may. If I post screen shots of my config, along with diagnostics, could you take a look and see if you can spot anything...
Thanks again
I'm at revision 2605 at the moment.
When you flash a newer version try resetting to factory defaults first.
It might help:)
Hi,
I'm on 1.9.2.7-d-r2381 (wl500gP) and I have some problems with the 6to4 tunnel.
I'm able to ping ipv6.google.com from the router. But it does not works from clients. I've found this message in log: "Dead loop on virtual device six0, fix it urgently!"
I had to ping the ip6 address of the br0 interface. Then I'm able to ping ipv6.google.com from client. I've also found the same error on http://wl500g.info/showthread.php?t=24357&page=4 - but it is unreadable for me :-(
Should I try the -ng firmware?Code:[00:01:15 marian@gool ~]$ ping6 ipv6.google.com
PING ipv6.google.com(2a00:1450:8007::69) 56 data bytes
^C
--- ipv6.google.com ping statistics ---
4 packets transmitted, 0 received, 100% packet loss, time 2999ms
[00:01:20 marian@gool ~]$ ping6 ipv6.google.com
PING ipv6.google.com(2a00:1450:8007::69) 56 data bytes
^C
--- ipv6.google.com ping statistics ---
4 packets transmitted, 0 received, 100% packet loss, time 2999ms
[00:04:19 marian@gool ~]$ ping6 2002:bcaf:2821::1
PING 2002:bcaf:2821::1(2002:bcaf:2821::1) 56 data bytes
^C
--- 2002:bcaf:2821::1 ping statistics ---
16 packets transmitted, 0 received, 100% packet loss, time 14999ms
[00:04:38 marian@gool ~]$ ping6 2002:bcaf:2821::1
PING 2002:bcaf:2821::1(2002:bcaf:2821::1) 56 data bytes
64 bytes from 2002:bcaf:2821::1: icmp_seq=8 ttl=64 time=2.65 ms
64 bytes from 2002:bcaf:2821::1: icmp_seq=9 ttl=64 time=0.771 ms
64 bytes from 2002:bcaf:2821::1: icmp_seq=10 ttl=64 time=0.760 ms
64 bytes from 2002:bcaf:2821::1: icmp_seq=11 ttl=64 time=0.724 ms
64 bytes from 2002:bcaf:2821::1: icmp_seq=12 ttl=64 time=0.758 ms
64 bytes from 2002:bcaf:2821::1: icmp_seq=13 ttl=64 time=0.728 ms
64 bytes from 2002:bcaf:2821::1: icmp_seq=14 ttl=64 time=0.703 ms
64 bytes from 2002:bcaf:2821::1: icmp_seq=15 ttl=64 time=0.723 ms
64 bytes from 2002:bcaf:2821::1: icmp_seq=16 ttl=64 time=0.722 ms
^C
--- 2002:bcaf:2821::1 ping statistics ---
16 packets transmitted, 9 received, 43% packet loss, time 15002ms
rtt min/avg/max/mdev = 0.703/0.949/2.652/0.602 ms
[00:04:55 marian@gool ~]$ ping6 ipv6.google.com
PING ipv6.google.com(2a00:1450:8007::69) 56 data bytes
64 bytes from 2a00:1450:8007::69: icmp_seq=1 ttl=57 time=23.8 ms
64 bytes from 2a00:1450:8007::69: icmp_seq=2 ttl=57 time=23.9 ms
64 bytes from 2a00:1450:8007::69: icmp_seq=3 ttl=57 time=23.6 ms
64 bytes from 2a00:1450:8007::69: icmp_seq=4 ttl=57 time=24.0 ms
64 bytes from 2a00:1450:8007::69: icmp_seq=5 ttl=57 time=23.9 ms
64 bytes from 2a00:1450:8007::69: icmp_seq=6 ttl=57 time=24.0 ms
^C
--- ipv6.google.com ping statistics ---
6 packets transmitted, 6 received, 0% packet loss, time 5006ms
rtt min/avg/max/mdev = 23.671/23.929/24.089/0.188 ms
[00:05:09 marian@gool ~]$
http://translate.google.com/translat...4%26langid%3D3Quote:
Originally Posted by maros
you need to set the langid to 3 so russian characters are displayed correctly:)
Anyway, why don't you try out more recent firmware?
Many changes have been made for the ipv6 tunnel.
Also you might need to reconfigure the router manually for it to work (I had issues with that)
Thanks, I probably do. I used the last available for download, but now I've found there is core.dumped.ru.Quote:
Originally Posted by wpte
and never mention the link in my signature of every post I make:oQuote:
Originally Posted by maros
Ouuu. It must be my personal adblock :-(Quote:
Originally Posted by wpte
Which fw do you recommend? The kernel 2.4 or 2.6 based?
So I flashed 1.9.2.7-d-r2609. Situation unchanged. Radvd is not started automaticaly, I had to do it manually. And clients are not able to ping ipv6.google.com :-(Quote:
Originally Posted by maros
Since no logs and settings described, I'm sure you have IPv6 under/misconfigurated, so it's not FW related issue.
What logs you need?Quote:
Originally Posted by theMIROn
I just found in log these rows:
And /etc/radvd.conf content:Code:Jan 1 01:00:09 radvd[78]: attempting to reread config file
Jan 1 01:00:09 radvd[78]: automatically selecting the prefix and Base6to4Interface are mutually exclusive
Jan 1 01:00:09 radvd[78]: error parsing or activating the config file: /etc/radvd.conf
Diagnostics log is attached. The strange thing is that I'm able to access ipv6 sites from clients after I connect from one to another client via ssh.Code:interface br0 {IgnoreIfMissing on;AdvSendAdvert on;AdvLinkMTU 1280;prefix ::/64 {AdvOnLink on;AdvAutonomous on;Base6to4Interface vlan1;};};
Attachment 7680
Edit: my initial post is there: http://wl500g.info/showpost.php?p=224199&postcount=126
currently lan prefix should not be blank or equal x:y:z:0::/64Quote:
Originally Posted by maros
wan prefix should not be equal lan prefix.
I added documentation on how to configure a tunnel due to the amount of problems and questions:)
http://code.google.com/p/wl500g/wiki...IPv6HowTo6in4o
Obviously things still could go wrong, but this makes things easier;)
Also added the link in the first post of this thread
But this config is automatically generated :-(Quote:
Originally Posted by theMIROn
I'm using the 6to4 tunel (not 6in4):
http://www.kyralovi.cz/tmp/6to4.png
My radvd config:
Code:$ cat /opt/etc/radvd.conf
interface br0 {
AdvSendAdvert on;
MinRtrAdvInterval 3;
MaxRtrAdvInterval 10;
prefix 2002:bcaf:2821::/64 {
AdvOnLink off;
AdvAutonomous on;
AdvRouterAddr on;
Base6to4Interface vlan1;
AdvPreferredLifetime 20;
AdvValidLifetime 30;
};
};
Thanks for the guide wpte. I haven't had a chance to upgrade the firmware yet, hopefully I'll get to that tomorrow. Just a couple of things to point out about the guide.Quote:
Originally Posted by wpte
The IPv4 server endpoint address is not the same for everyone. In my case it's 216.66.80.30
There are three different /64 used in the connection. in my case:
The Client endpoint - 2001:470:***a:823::2/64 - I believe this should be the WAN Static or local IPv6 address:
The Server endpoint - 2001:470:***a:823::1/64 - I believe this should be the WAN Remote IPv6 gateway:
The Routed /64 for LAN address allocation - 2001:470:***b:823::/64 - I believe this should be the LAN Static IPv6 address:
that's ment for when you only have an IPv6 address and still like to access IPv4 addresses on the internet.Quote:
Originally Posted by maros
So I suggest the 6in4 tunnel;)
the rest looks allright:)
Is this also from HE?
Yes correctQuote:
Originally Posted by Dapper
But I believe the LAN Static IPv6 address should be just like the WAN Remote IPv6 gateway.:)
No:Quote:
Originally Posted by wpte
The advantage is, that the relay server is in my country and it is quicker.Quote:
6to4 is an Internet transition mechanism for migrating from IPv4 to IPv6, a system that allows IPv6 packets to be transmitted over an IPv4 network (generally the IPv4 Internet) without the need to configure explicit tunnels. Special relay servers are also in place that allow 6to4 networks to communicate with native IPv6 networks.
wiki:6to4
But that's the server address. The client endpoint is ::2Quote:
Originally Posted by wpte
Finally!
Reset the router to factory defaults
Installed r6214
Reapplied the IPv6 settings described in my post above
Works! :)
Am I correct in thinking ip6tables are now activated by default with IPv6?
Following on from my previous post, if, as I suspect from reading this thread, ip6tables are active in the router, once IPv6 has been enabled, I'm a little curious about the results of the HE Ipv6 Port scanner.
When I run the test I get:
Not shown: 991 closed ports
PORT STATE SERVICE
135/tcp open msrpc
445/tcp open microsoft-ds
5357/tcp open unknown
49152/tcp open unknown
49153/tcp open unknown
49154/tcp open unknown
49155/tcp open unknown
49156/tcp open unknown
49158/tcp open unknown
I can get my system to filter these and report a clean slate by enabling the Windows 7 firewall.
In terms of what these represent:
135/tcp open msrpc - RPC service
445/tcp open microsoft-ds - SMB over TCP
5357/tcp open unknown - Network Discovery
49152/tcp open unknown - Wininit.exe (Core Windows service)
49153/tcp open unknown - A svchost instance
49154/tcp open unknown - A svchost instance
49155/tcp open unknown - A svchost instance
49156/tcp open unknown - A svchost instance
Each of the svchost containers relate to different services, some of which could be disabled but other not.
49158/tcp open unknown - lsass.exe (Local security authentication server)
This one really needs to be closed.
Because I can filter these using a software firewall, does it mean the ip6tables are opening holes to these services?
Edit: I found another scanner http://www.vikingscan.org/home which also shows ports 134 and 445 as open in the base test against the IPv6 addresses and stealthed against the IPv4 address. On the advanced test the higher number ports were also reported open against the IPv6 address.
it looks like you're scanning your client pc?Quote:
Originally Posted by Dapper
if so: ipv6 does not have NAT, but every ip6 address is unique and can be accessed without forwarding, which means your own computer needs proper protection from the outside:)
Windows firewall (by the looks you're using windows) should be able to filter IPv6 traffic;)
If you scan from a local machine, it might access the other computers via the local ipv6 address range starting with "fe80".
Anyway, good stuff you have it working.
Is it the way I said or did you simply use the range you mentioned?
firmware has ipv6 auto firewall already, check ip6tables -nvL
The scans were online scans and they were using the IPv6 address of the PC as opposed to the IPv6 tunnel endpoint address, on the router. If I scan the endpoint address, it just finds TCP port 21 (FTP) as closed.Quote:
Originally Posted by wpte
I understand IPv6 goes straight through NAT but I thought the point of the rules in the ip6tables, would be to filter unwanted IPv6 traffic from reaching the LAN?
I am on Windows, XP, 7 and 2008R2 and it's easy enough to create firewall rules that block these ports, providing one uses a firewall that works correctly with IPv6. However, if I'm correct, this means I now have to firewall all my LAN clients to explicitly block IPv6 traffic that comes through the router?
Surely it's possible to filter this at the point of entry?
I used the blocks I mentioned in my earlier post, with the routed block for LAN allocation.Quote:
Anyway, good stuff you have it working.
Is it the way I said or did you simply use the range you mentioned?
Thanks for that :)Quote:
firmware has ipv6 auto firewall already, check ip6tables -nvL
I have a feeling I'm missing something fundamental here!