# [SOLVED] wrong IPv6 setup, possible newbie questions

## c00l.wave

The provider of my dedicated root server (Hetzner) recently introduced free native IPv6. I got a /64 subnet allocated but can't make it work... I made my first tries with IPv6 yesterday and that was just using a SixXS tunnel, so I don't know much about IPv6 yet. SixXS works great so far but tunnel setup is automated by AICCU. On my server I have to set it up manually. I have an almost complete understanding of IPv4 but are completely new to IPv6.

The information I got from the data center contained the subnet IP, the gateway IP and the range of IP addresses I could use. Their wiki explains general setup as well as Gentoo specific instructions but it just doesn't work. The gateway I should use is reachable from SixXS but not from my server. It resides on a different subnet and needs extra routing which should go straight through eth0. If I try to ping anything including my own address I get "Destination unreachable", if I do a traceroute the first hop is my own IP with high latencies and "!H". This looks like a loop to me?

Some things that seem strange to me:

 I cannot ping my public IP from it's own host. I cannot do that on SixXS as well, so I don't know if that's an error in setup or just something that simply does not work with IPv6.  I'm told to use /64 when using an IP that has 96 bits fixed. (64 to the subnet that's configured nowhere) Using /80, /96 and /128 I get the same behaviour as with /64. Using /48 I get "traceroute: bind sending socket: Invalid argument" and still "Destination unreachable" on pings. If I traceroute my server's IP from SixXS it ends on a totally different gateway IP at the same hop level as when tracing the gateway IP I was told to use on my server. Seems to happen for my SixXS address as well, so again this may be intentional in IPv6? Other networks end their traceroute at the same hop as my traceroute from SixXS.

Didn't I manage to set it up correctly or is there a real problem (wrong IPs?) for which I should contact their support?

Note: I blanked all unique information; xxx and yyy are always the same as in the information I got.

I was told to use:

```

IPs: 2a01:4f8:xxx:yyy2:: /64

Gateway: 2a01:4f8:xxx:yyy0::1 /59

Usable IP adresses:

2a01:4f8:xxx:yyy2::2 to 2a01:4f8:xxx:yyy2:ffff:ffff:ffff:ffff

```

So the gateway is on yyy0 and my subnet is yyy2.

/etc/conf.d/net is:

```

config_eth0=( "188.40.XX.XX netmask 255.255.255.192 brd 188.40.XX.XX"

              "2a01:4f8:xxx:yyy2::2/64"  )

routes_eth0=( "default via 188.40.XX.1"

              "2a01:4f8:xxx:yyy0::1 dev eth0"

              "default via 2a01:4f8:xxx:yyy0::1 dev eth0" )

dns_servers_eth0="213.133.98.98 213.133.99.99 213.133.100.100"

```

IPv6 routes:

```

# route -A inet6

Kernel IPv6 routing table

Destination                    Next Hop                   Flag Met Ref Use If

2a01:4f8:xxx:yyy0::1/128       ::                         U    1024 0     1 eth0

2a01:4f8:xxx:yyy2::/64         ::                         U    256 0     0 eth0

fe80::/64                      ::                         U    256 0     0 eth0

fe80::/64                      ::                         U    256 0     0 tap1

fe80::/64                      ::                         U    256 0     0 tap0

::/0                           2a01:4f8:xxx:yyy0::1       UG   1024 0    25 eth0

::/0                           ::                         !n   -1  1    37 lo

::1/128                        ::                         Un   0   5   128 lo

2a01:4f8:xxx:yyy2::2/128       ::                         Un   0   1   211 lo

fe80::REMOVED/128   ::                         Un   0   1     3 lo

fe80::REMOVED/128  ::                         Un   0   1     0 lo

fe80::REMOVED/128  ::                         Un   0   1     0 lo

ff00::/8                       ::                         U    256 0     0 eth0

ff00::/8                       ::                         U    256 0     0 tap1

ff00::/8                       ::                         U    256 0     0 tap0

::/0                           ::                         !n   -1  1    37 lo

# ip -6 route show

2a01:4f8:xxx:yyy0::1 dev eth0  metric 1024  mtu 1500 advmss 1440 hoplimit 4294967295

2a01:4f8:xxx:yyy2::/64 dev eth0  proto kernel  metric 256  mtu 1500 advmss 1440 hoplimit 4294967295

fe80::/64 dev eth0  proto kernel  metric 256  mtu 1500 advmss 1440 hoplimit 4294967295

fe80::/64 dev tap1  proto kernel  metric 256  mtu 1500 advmss 1440 hoplimit 4294967295

fe80::/64 dev tap0  proto kernel  metric 256  mtu 1500 advmss 1440 hoplimit 4294967295

default via 2a01:4f8:xxx:yyy0::1 dev eth0  metric 1024  mtu 1500 advmss 1440 hoplimit 4294967295

```

ifconfig:

```

eth0      Link encap:Ethernet  HWaddr REMOVED

          inet addr:188.40.XX.XX  Bcast:188.40.XX.XX  Mask:255.255.255.192

          inet6 addr: 2a01:4f8:xxx:yyy2::2/64 Scope:Global

          inet6 addr: fe80::REMOVED/64 Scope:Link

          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1

          RX packets:144909 errors:0 dropped:0 overruns:0 frame:0

          TX packets:259553 errors:0 dropped:0 overruns:0 carrier:0

          collisions:0 txqueuelen:1000

          RX bytes:33281428 (31.7 MiB)  TX bytes:351989563 (335.6 MiB)

          Interrupt:30 Base address:0xc000

```

Traceroute from server to Google:

```

# traceroute6 ipv6.google.com

traceroute to ipv6.l.google.com (2a00:1450:8004::63) from 2a01:4f8:xxx:yyy2::2, 30 hops max, 24 byte packets

 1  2a01:4f8:xxx:yyy2::2 (2a01:4f8:xxx:yyy2::2)  3000.67 ms !H  3003.33 ms !H  3004.01 ms !H

```

Traceroute from SixXS to the gateway I should use on my server:

```

# traceroute6 2a01:4f8:xxx:yyy0::1

traceroute to 2a01:4f8:xxx:yyy0::1 (2a01:4f8:xxx:yyy0::1) from REMOVED, 30 hops max, 24 byte packets

 1  gw-REMOVED.cgn-01.de.sixxs.net (REMOVED)  20.535 ms  20.048 ms  21.693 ms

 2  2001:4dd0:1234:3:dc40::a (2001:4dd0:1234:3:dc40::a)  20.186 ms  20.247 ms  20.617 ms

 3  2001:4dd0:a2b:21:dc30::1 (2001:4dd0:a2b:21:dc30::1)  21.233 ms  21.051 ms  19.937 ms

 4  2001:4dd0:a2b:14:10::b (2001:4dd0:a2b:14:10::b)  24.982 ms  23.387 ms  26.003 ms

 5  decix2-gw.hetzner.de (2001:7f8::616c:0:2)  23.547 ms  28.09 ms  24.993 ms

 6  2a01:4f8:0:1::10:2 (2a01:4f8:0:1::10:2)  28.471 ms  29.452 ms  28.212 ms

 7  2a01:4f8:xxx:yyy0::1 (2a01:4f8:xxx:yyy0::1)  33.261 ms  29.774 ms  29.391 ms

```

Traceroute from SixXS to my server:

```

# traceroute6 2a01:4f8:xxx:yyy2::2

traceroute to 2a01:4f8:xxx:yyy2::2 (2a01:4f8:xxx:yyy2::2) from REMOVED, 30 hops max, 24 byte packets

 1  gw-REMOVED.cgn-01.de.sixxs.net (REMOVED)  20.752 ms  20.176 ms  19.958 ms

 2  2001:4dd0:1234:3:dc40::a (2001:4dd0:1234:3:dc40::a)  20.456 ms  26.001 ms  20.635 ms

 3  2001:4dd0:a2b:21:dc30::1 (2001:4dd0:a2b:21:dc30::1)  20.645 ms  20.151 ms  19.939 ms

 4  2001:4dd0:a2b:14:10::b (2001:4dd0:a2b:14:10::b)  23.264 ms  23.246 ms  23.545 ms

 5  decix2-gw.hetzner.de (2001:7f8::616c:0:2)  23.878 ms  24.104 ms  23.658 ms

 6  2a01:4f8:0:1::10:2 (2a01:4f8:0:1::10:2)  28.35 ms  28.548 ms  27.925 ms

 7  2a01:4f8:0:10:3:a:10:1 (2a01:4f8:0:10:3:a:10:1)  32.875 ms  29.019 ms  28.625 ms

 8  * * *

 9  *^C

```

I've already set up ip6tables to drop all incoming connections except for ICMP but even if I completely disable it by changing all policies to ACCEPT it doesn't make any difference and I'm still not able to get IPv6 working:

```

# ip6tables -L

Chain INPUT (policy DROP)

target     prot opt source               destination

ACCEPT     all      anywhere             anywhere            state ESTABLISHED

ACCEPT     all      anywhere             anywhere            ctstate RELATED

ACCEPT     icmp     anywhere             anywhere

ACCEPT     all      my.hostname/128  my.hostname/128

Chain FORWARD (policy DROP)

target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)

target     prot opt source               destination

ACCEPT     all      anywhere             anywhere            state ESTABLISHED

ACCEPT     all      anywhere             anywhere            ctstate RELATED

ACCEPT     all      my.hostname/128  my.hostname/128

```

Very short documentation on the data center/provider's wiki:

Generic (German) (Translation by Google; code blocks are messed up, hover to read them correctly)

Gentoo specific (German) (Translation by Google; code blocks are messed up, hover to read them correctly)

----------

## c00l.wave

As always, the problem is (almost) solved shortly after I write a long post...

I noticed that ICMP != ICMPv6 and adjusted my firewall script. Pinging my own IP works now on both the server and SixXS.

Without changing anything, outbound IPv6 connections suddenly started to work on my server. I don't know if the data center wasn't configured to route my server yet, they didn't write anything about a delay I should expect (I got the email with all information 5 hours ago)... I can also ping my server now from SixXS but the traceroute still ends on hop 7 the same as before.

Looks like it has almost solved itself....

----------

## gerdesj

... and you have written what almost amounts to a mini-howto!

Please put [solved] on the end of the title - trust me, someone will be grateful for your posts here.

----------

## c00l.wave

Done (added in front because it's more visible  :Smile:  ). The only issue remaining is that the traceroute runs into some strange IP at the end and doesn't reach the destination. Maybe that fixes itself tomorrow; else I will ask the provider why that happens.

----------

## c00l.wave

I asked on the provider's forums. IPv6 needs ICMPv6, it doesn't work if it's blocked because ICMPv6 replaces ARP and some other stuff. I read the articles about IPv6 on Wikipedia multiple times but missed that fact and failed to recognize that by allowing "ICMP" with ip6tables I only allowed ICMPv4, not ICMPv6.

----------

