Changes between Version 4 and Version 5 of IPv6

Timestamp:

03/11/14 14:58:36 (10 years ago)

Author:

michele

Comment:

add alternative setup that requires one IPv6 netblock only

IPv6

@@ -18 +18 @@
 
 * An existing and functional OpenVPN configuration (use the official howto if you don't yet have this.)
-* A routed IPv6 network block that will reach the host configured as the OpenVPN server
 * Both client and server must support IPv6; most modern systems these-days include this support already
+
+Additionally:
+
+* **Recommended** A routed IPv6 network block that will reach the host configured as the OpenVPN server
+* alternatively, check section "Splitting a single routable IPv6 netblock" below
+
 
 === Details: IPv6 routed block ===
@@ -78 +83 @@
 push "route-ipv6 2000::/3"
 }}}
+
+
+== Splitting a single routable IPv6 netblock ==
+
+Otherwise, there is a way out. Typically /64 IPv6 netblocks are assigned, leaving a large address space. For an OpenVPN setup, this address space can be broken in 2, /65-prefix parts, the first being assigned to the physical network interface, and the second to the VPN. **Warning** operating netblocks smaller than /64 might break some network features.
+
+**Avoid** this setup if you are using any of:
+
+* SLAAC. If you are using SLAAC and have no way around, ask your ISP for permission to use static address assignment on your VPN server.
+* IPv6 Multicast - RFC3306
+* Cryptographically Generated Address - CGA - RFC3972
+* NAT64 - RFC6052
+* IPv6-to-IPv6 Network Prefix Translation - NPTv6 - RFC6296
+* Identifier-Locator Network Protocol - ILNP - RFC6741
+* Multihoming Shim Protocol for IPv6 - shim6 - RFC5533
+
+See this [http://tools.ietf.org/html/draft-carpenter-6man-why64-00 Internet Draft] for details.
+
+=== Split netblock configuration ===
+
+Get the original IPv6 netblock on your OpenVPN server; let's assume it's
+{{{
+2001:db8:123::/64
+}}}
+
+1. check that your NIC uses no addresses in the upper /65 block (in this case, addresses greater than 2001:db8:123:8000::/65). If you do, you can't use this setup until you eliminate those.
+1. re-assign the new restricted netblock – lower part. The command for this depends on your OS. For example, in **FreeBSD**:
+{{{
+### check this on your OS!
+# ifconfig igb0 inet6 2001:db8:123::/64 -alias
+# ifconfig igb0 inet6 2001:db8:123::/65
+###
+### re-assign the other aliases previously set under the /64 block
+# ifconfig igb0 inet6 2001:db8:123::dead/128 alias
+# ifconfig igb0 inet6 2001:db8:123::ea:beef/128 alias
+# ...
+}}}
+1. assign the higher part of the restricted netblock to OpenVPN. Add
+{{{
+# add this line
+server-ipv6 2001:db8:123:8000::/65
+}}}
+1. restart the VPN
+
+You can do this also if your assigned IPv6 netblock is already shorter than /64, e.g. /112 . Just perform the same steps and compute the base address of the upper subnet: the lower starts with the last bit in the netmask set to 0, the upper starts with it set to 1.