Tunnel Broker IPv6

[LuizMeier]

Hello!

I always used the HE tunnel to get IPv6 working in home. But now, since I’ve changed my ISP for one that only gives me a option to connect with my modem in routed mode, I am having problems to connect.

Below are my configs:

/ipv6 address
add address=2001:470:1f07:a84::1 interface=bridge-local
add address=2001:470:1f06:a84::2 advertise=no interface=sit1

/interface 6to4
add comment="Hurricane Electric IPv6 Tunnel Broker" !keepalive local-address=192.168.100.2 mtu=1280 name=sit1 \
    remote-address=209.51.161.14

/ipv6 route
add distance=1 dst-address=2000::/3 gateway=2001:470:1f06:a84::1

IPv6 Tunnel Endpoints
Server IPv4 Address:A.B.C.D
Server IPv6 Address:2001:xxx:1f06:xxx::1/64
Client IPv4 Address:1.2.3.4
Client IPv6 Address:2001:xxx:1f06:xxx::2/64
Routed IPv6 Prefixes
Routed /64: 2001:xxx:1f07:xxx::/64

Just a note: My tunnel is configured with an internal address because it is the address assigned to wan interface of my Mikrotik. That is the only way the interface gets the status running.

The problem is that I can’t even ping the HE router on the other side of tunnel.

[ZeroByte]

Per the Hurricane Electric FAQ page:

*Two important notes:

• Your IPv4 endpoint address must be reachable via ICMP ECHO_REQUEST (Internet Control Message Protocol).
• If you are using a NAT (Network Address Translation) appliance, please make sure it allows and forwards IP protocol 41.

What is IP Protocol 41?

• IP Protocol 41 is one of the Internet Protocol numbers. Within the IPv4 header, the IPv4 Protocol field is set to 41 to indicate an encapsulated IPv6 packet.

So make sure your ISP’s router answers pings on its public IP.

I’d recommend having them put it in bridge mode and letting you run dhcp-client / pppoe-client on your router directly.
(EDIT - whoops, I just remembered that you already said they won’t do that - that sucks. Do they offer native IPv6, though?)

[LuizMeier]

@ZeroByte

Per the Hurricane Electric FAQ page:

*Two important notes:

• Your IPv4 endpoint address must be reachable via ICMP ECHO_REQUEST (Internet Control Message Protocol).
• If you are using a NAT (Network Address Translation) appliance, please make sure it allows and forwards IP protocol 41.

What is IP Protocol 41?

• IP Protocol 41 is one of the Internet Protocol numbers. Within the IPv4 header, the IPv4 Protocol field is set to 41 to indicate an encapsulated IPv6 packet.

So make sure your ISP’s router answers pings on its public IP.

I’d recommend having them put it in bridge mode and letting you run dhcp-client / pppoe-client on your router directly.
(EDIT - whoops, I just remembered that you already said they won’t do that - that sucks. Do they offer native IPv6, though?)

ZeroByte,

I have 2 rules on my firewal allowing the 41 protocol as below. The problem with my ISP is that they’ve changed the modus operandi in the last year, providing the new clients access to the internet through CGNAT (but with native IPv6). So I’m afraid of requesting IPv6 and end with CGNAT.

At least untill now, I prefer to have a valid IPv4 on my modem as having IPv6 with CGNAT.

/ip firewall filter
add chain=input comment=HE protocol=ipv6 src-address=A.B.C.D
add chain=output protocol=ipv6

[ZeroByte]

@LuizMeier

I have 2 rules on my firewal allowing the 41 protocol as below. The problem with my ISP is that they’ve changed the modus operandi in the last year, providing the new clients access to the internet through CGNAT (but with native IPv6). So I’m afraid of requesting IPv6 and end with CGNAT.

Well, that makes sense about the CGNat - sort of - because in a sense, you’re already in that boat. You have to put a private IP on your Mikrotik right now - so what’s the difference if the box-you-cannot-control happens to be a SOHO router in your own home or else a big-iron router in a data center somewhere?

I’ve never been behind a CGNat so I’m not sure what the reality of that life is like - I can see the public IP changing randomly all the time on a per-connection basis, and that would be daunting to deal with if you wanted to have NAT pinholes for things…

[LuizMeier]

@ZeroByte

@LuizMeier

I have 2 rules on my firewal allowing the 41 protocol as below. The problem with my ISP is that they’ve changed the modus operandi in the last year, providing the new clients access to the internet through CGNAT (but with native IPv6). So I’m afraid of requesting IPv6 and end with CGNAT.

Well, that makes sense about the CGNat - sort of - because in a sense, you’re already in that boat. You have to put a private IP on your Mikrotik right now - so what’s the difference if the box-you-cannot-control happens to be a SOHO router in your own home or else a big-iron router in a data center somewhere?

I’ve never been behind a CGNat so I’m not sure what the reality of that life is like - I can see the public IP changing randomly all the time on a per-connection basis, and that would be daunting to deal with if you wanted to have NAT pinholes for things…

That is the thing. I have some services at home that I can easily nat with an IPv4 valid address assigned. With CGNAT, I’ll have a 100.64.x.x address, not routeable in the internet.

[ZeroByte]

@LuizMeier

I have 2 rules on my firewal allowing the 41 protocol as below.

/ip firewall filter
add chain=input comment=HE protocol=ipv6 src-address=A.B.C.D
add chain=output protocol=ipv6

It just dawned on me that I forgot to address this in your earlier reply.

First of all, the notes on HE’s page specify that you have to be pingable, too. (there’s no allow icmp in your sample code)

However - the “allow ping” and “allow protocol 41” criteria apply to the ISP router with the public IP address on it - not your Mikrotik.
You could allow anything you want in the Mikrotik, but if the router in front of it drops the packets, then you’re never going to get the chance to allow them, yaknow?

Can you ping your public IP from somewhere out in the world? Does your ISP modem allow IP protocol 41? I was dealing with an Adtran router one time where I was frustrated to find that it would simply not forward a packet whose protocol number it didn’t understand, even if I went into the policy-map and specified the protocol as allowed, even if I specified the protocol number…

[LuizMeier]

@ZeroByte

@LuizMeier

I have 2 rules on my firewal allowing the 41 protocol as below.

/ip firewall filter
add chain=input comment=HE protocol=ipv6 src-address=A.B.C.D
add chain=output protocol=ipv6

It just dawned on me that I forgot to address this in your earlier reply.

First of all, the notes on HE’s page specify that you have to be pingable, too. (there’s no allow icmp in your sample code)

However - the “allow ping” and “allow protocol 41” criteria apply to the ISP router with the public IP address on it - not your Mikrotik.
You could allow anything you want in the Mikrotik, but if the router in front of it drops the packets, then you’re never going to get the chance to allow them, yaknow?

Can you ping your public IP from somewhere out in the world? Does your ISP modem allow IP protocol 41? I was dealing with an Adtran router one time where I was frustrated to find that it would simply not forward a packet whose protocol number it didn’t understand, even if I went into the policy-map and specified the protocol as allowed, even if I specified the protocol number…

I configured my ISP modem with DMZ option, so it is forwarding anything that comes from internet to my Mikrotik. And yes, I am pingable from internet and my NAT’s are working pretty well.

Even though, I’ll take a look about the 41 protocol on my modem, and see if that can be some incompatible problem.

[LuizMeier]

@LuizMeier

@ZeroByte

@LuizMeier

I have 2 rules on my firewal allowing the 41 protocol as below.

/ip firewall filter
add chain=input comment=HE protocol=ipv6 src-address=A.B.C.D
add chain=output protocol=ipv6

It just dawned on me that I forgot to address this in your earlier reply.

First of all, the notes on HE’s page specify that you have to be pingable, too. (there’s no allow icmp in your sample code)

However - the “allow ping” and “allow protocol 41” criteria apply to the ISP router with the public IP address on it - not your Mikrotik.
You could allow anything you want in the Mikrotik, but if the router in front of it drops the packets, then you’re never going to get the chance to allow them, yaknow?

Can you ping your public IP from somewhere out in the world? Does your ISP modem allow IP protocol 41? I was dealing with an Adtran router one time where I was frustrated to find that it would simply not forward a packet whose protocol number it didn’t understand, even if I went into the policy-map and specified the protocol as allowed, even if I specified the protocol number…

I configured my ISP modem with DMZ option, so it is forwarding anything that comes from internet to my Mikrotik. And yes, I am pingable from internet and my NAT’s are working pretty well.

Even though, I’ll take a look about the 41 protocol on my modem, and see if that can be some incompatible problem.

Justo to mention, didn’t find anything about problems with 41 protocol. Even though, this modem supports IPv6.

[LuizMeier]

Does anybody know if the tunneling protocol validates the local and remote address in both endpoints?

If so, this is the problem, because for HE, my address is the valid IPv4 address, but for my mikrotik is the Lan address, because my modem is in router mode.

[ZeroByte]

Well, I went reading a little more on the subject and found this blog entry:

@http://blog.endpoint.com/2012/03/ipv6-tunnels-with-debianubuntu-behind.html

Behind NAT
If you’re behind a NAT, the configuration needs to be tweaked a bit. First, you’ll want to setup a static IP address behind your router. If you’re router supports configuration of forwarding more than just TCP/UDP, you’ll want to forward protocol 41 (aka IPv6) (NOT PORT 41), which is responsible for IPv6 tunneling over IPv4, to your static address. If you’ve got a consumer grade router that doesn’t support this, you’ll just have to put your machine in the DMZ, thus putting your computer “in front” of your router’s firewall. Please make sure you are running a local software firewall if you chose this option.

This all makes sense, and I’m sure you know the difference between port 41 and protocol 41… but I’m wondering if the nat router isn’t being dumb. It might be only forwarding */tcp, */udp, and */icmp to the “dmz host” - this is not quite the same thing as forwarding IP->dmz-host which is what would be necessary.

If you have another site where you can set up a Mikrotik, try setting up a sit0 interface that points to your public IP and then do a sniff on your home router to see if you see any packets coming in or not. If no packets, then chances are good that the router is only doing PAT and not NAT - i.e. layer4 protocols but not 1:1 at the IP layer.

[LuizMeier]

@ZeroByte

Well, I went reading a little more on the subject and found this blog entry:

@http://blog.endpoint.com/2012/03/ipv6-tunnels-with-debianubuntu-behind.html

Behind NAT
If you’re behind a NAT, the configuration needs to be tweaked a bit. First, you’ll want to setup a static IP address behind your router. If you’re router supports configuration of forwarding more than just TCP/UDP, you’ll want to forward protocol 41 (aka IPv6) (NOT PORT 41), which is responsible for IPv6 tunneling over IPv4, to your static address. If you’ve got a consumer grade router that doesn’t support this, you’ll just have to put your machine in the DMZ, thus putting your computer “in front” of your router’s firewall. Please make sure you are running a local software firewall if you chose this option.

This all makes sense, and I’m sure you know the difference between port 41 and protocol 41… but I’m wondering if the nat router isn’t being dumb. It might be only forwarding */tcp, */udp, and */icmp to the “dmz host” - this is not quite the same thing as forwarding IP->dmz-host which is what would be necessary.

If you have another site where you can set up a Mikrotik, try setting up a sit0 interface that points to your public IP and then do a sniff on your home router to see if you see any packets coming in or not. If no packets, then chances are good that the router is only doing PAT and not NAT - i.e. layer4 protocols but not 1:1 at the IP layer.

I can do that, but only in no-producting time. I’ll let you know the results.

[LuizMeier]

@LuizMeier

@ZeroByte

Well, I went reading a little more on the subject and found this blog entry:

@http://blog.endpoint.com/2012/03/ipv6-tunnels-with-debianubuntu-behind.html

Behind NAT
If you’re behind a NAT, the configuration needs to be tweaked a bit. First, you’ll want to setup a static IP address behind your router. If you’re router supports configuration of forwarding more than just TCP/UDP, you’ll want to forward protocol 41 (aka IPv6) (NOT PORT 41), which is responsible for IPv6 tunneling over IPv4, to your static address. If you’ve got a consumer grade router that doesn’t support this, you’ll just have to put your machine in the DMZ, thus putting your computer “in front” of your router’s firewall. Please make sure you are running a local software firewall if you chose this option.

This all makes sense, and I’m sure you know the difference between port 41 and protocol 41… but I’m wondering if the nat router isn’t being dumb. It might be only forwarding */tcp, */udp, and */icmp to the “dmz host” - this is not quite the same thing as forwarding IP->dmz-host which is what would be necessary.

If you have another site where you can set up a Mikrotik, try setting up a sit0 interface that points to your public IP and then do a sniff on your home router to see if you see any packets coming in or not. If no packets, then chances are good that the router is only doing PAT and not NAT - i.e. layer4 protocols but not 1:1 at the IP layer.

I can do that, but only in no-producting time. I’ll let you know the results.

Hello!

Thanks to ZeroByte, who configured a tunnel for me for debugging the packets arriving.

The think is thaat packets are arriving, at least for now, correctly. The only thing I can think if about the problem being the different local and remote addresses. May the tunnelbroker validates it?

I’m posting a print of my torch.

[ZeroByte]

Well, the only thing left to do is sniff the packets from Tunnelbroker, capture them to a file on the Mikrotik, and open the capture file in Wireshark.

Perhaps you can poke around in that.

As far as I can tell, you should put 192.168.100.2 as the local IP of your tunnel, and it should work.
If you want, you can build the other end of my test tunnel on your router and we can see if it comes live or not.
I’m not routing any prefixes over it or anything, and I have firewall rules in place so you can’t go into my LAN through the tunnel or anything, but at least you should be able to ping the link-local address of my end of the tunnel. (check IPv6 neighbors to see it)

[LuizMeier]

@ZeroByte

Well, the only thing left to do is sniff the packets from Tunnelbroker, capture them to a file on the Mikrotik, and open the capture file in Wireshark.

Perhaps you can poke around in that.

As far as I can tell, you should put 192.168.100.2 as the local IP of your tunnel, and it should work.
If you want, you can build the other end of my test tunnel on your router and we can see if it comes live or not.
I’m not routing any prefixes over it or anything, and I have firewall rules in place so you can’t go into my LAN through the tunnel or anything, but at least you should be able to ping the link-local address of my end of the tunnel. (check IPv6 neighbors to see it)

Edit
My local address if configured as 192.168.100.2 since the beggining. Actually, only doint this the interface gets the status running. Perhaps it is a validation of Mikrotik to check if the configured local-address field contains any local interface address. It makes some sense, but is a personal though. When I had a pppoe connection, I could put the valid IP address and it worked pretty well.

I’ve tested as your suggestion and it didn’t get your link-local address on my neighbors. Maybe some ND configuration missing in my router?

Also torched the interface looking for HE address and didn’t get any packet comming from them. BTW I don’t know the keepalive configured on their side, but I think it would be minor than a minute, which is the time I’ve spend looking for it.

[LuizMeier]

@LuizMeier

@ZeroByte

Well, the only thing left to do is sniff the packets from Tunnelbroker, capture them to a file on the Mikrotik, and open the capture file in Wireshark.

Perhaps you can poke around in that.

As far as I can tell, you should put 192.168.100.2 as the local IP of your tunnel, and it should work.
If you want, you can build the other end of my test tunnel on your router and we can see if it comes live or not.
I’m not routing any prefixes over it or anything, and I have firewall rules in place so you can’t go into my LAN through the tunnel or anything, but at least you should be able to ping the link-local address of my end of the tunnel. (check IPv6 neighbors to see it)

Edit
My local address if configured as 192.168.100.2 since the beggining. Actually, only doint this the interface gets the status running. Perhaps it is a validation of Mikrotik to check if the configured local-address field contains any local interface address. It makes some sense, but is a personal though. When I had a pppoe connection, I could put the valid IP address and it worked pretty well.

I’ve tested as your suggestion and it didn’t get your link-local address on my neighbors. Maybe some ND configuration missing in my router?

Also torched the interface looking for HE address and didn’t get any packet comming from them. BTW I don’t know the keepalive configured on their side, but I think it would be minor than a minute, which is the time I’ve spend looking for it.

Did the sniff and found some strange thing: My router apparently is not responding the 41 packets. Below is the print.

And I’m allowing the 41 packets (it shows ipv6 on cli, but in interface it is filled with 41):

/ip firewall filter
add chain=input comment=HE protocol=ipv6
add chain=output protocol=ipv6

[ZeroByte]

Your keepalive setting shouldn’t break the tunnel even if it doesn’t match the value (if any) set on HE’s end, because it’s like a ping. Your side pings their side, and if you get replies then it stays up, as far as your router is concerned. PPP is this way - one side can do “no keepalive” and the other side can do “keepalive 15 seconds” and this will work. It’s not like OSPF where both sides have to agree on the hello interval and so forth.

I went ahead and added a /64 address of 2001:db8:1:1::10/64 to my side - feel free to static-assign anything else from that /64 for your end - just in case it wants an address to work (but I don’t think this is necessary)

[LuizMeier]

@ZeroByte

Your keepalive setting shouldn’t break the tunnel even if it doesn’t match the value (if any) set on HE’s end, because it’s like a ping. Your side pings their side, and if you get replies then it stays up, as far as your router is concerned. PPP is this way - one side can do “no keepalive” and the other side can do “keepalive 15 seconds” and this will work. It’s not like OSPF where both sides have to agree on the hello interval and so forth.

I went ahead and added a /64 address of 2001:db8:1:1::10/64 to my side - feel free to static-assign anything else from that /64 for your end - just in case it wants an address to work (but I don’t think this is necessary)

Tried to reach your IPv6, but no success. I don’t even get your router on my neighbors.

May is it some configuration error? Should I give attention to this Wireshark “error”?

Below I’m posting my 6to4 configs:

/interface 6to4
add comment=“Hurricane Electric IPv6 Tunnel Broker” !keepalive local-address=192.168.100.2 mtu=1280
name=sit1 remote-address=your.ip.address.here

Is there any setting that you want to see and I didn’t post?

[ZeroByte]

@LuizMeier

Is there any setting that you want to see and I didn’t post?

Go ahead and configure IPv6 address 2001:db8:1:1::1/64 on the tunnel interface.

I notice that when my router sends the keepalives, it’s from and to :: and the protocol version is set to 0 like you see in the wireshark analysis.

I’m also receiving replies from your public IP:
ICMP Destination Unreachable (Port Unreachable)

[LuizMeier]

@ZeroByte

@LuizMeier

Is there any setting that you want to see and I didn’t post?

Go ahead and configure IPv6 address 2001:db8:1:1::1/64 on the tunnel interface.

I notice that when my router sends the keepalives, it’s from and to :: and the protocol version is set to 0 like you see in the wireshark analysis.

I’m also receiving replies from your public IP:
ICMP Destination Unreachable (Port Unreachable)

Try to reach me now. I changed the tunnel before to do some tests.

I have the 2001:db8:1:1::1/64 now set on my tunnel interface.

[ZeroByte]

@LuizMeier

I have the 2001:db8:1:1::1/64 now set on my tunnel interface.

Okay - I disabled keepalives on my end, and I now have a ping running to 2001:db8:1:1::1 from 2001:db8:1:1::10

The packets look like this:
Untitledxxx.png
Make this the first rule in the IPv4 filter chain:
/ip firewall filter add chain=input src-addr=x.x.x.95 (my public IP)

Make this the first rule in the IPv6 filter chain:
/ipv6 firewall filter add chain=input in-interface=sit1 (or whatever interface is your tunnel interface)

I assume that you have no output filters - but if you do, whitelist my IP and the sit1 interface there as well.