IPv6 connectivity over an IPv4 infrastructure with tunnelbr.

Lowis · Mon Nov 21, 2011 2:12 pm

I have a RB450G and want to make IPv6 available on my network with a tunnelbroker. I want to configure it that the clients on the local network gets it Ipv6 so they can browse on the internet with IPv6. But the clients may not be accessible from the internet byIPv6.

Does anyone know if there is an manual for dummy’s how to configure this? I have found some topics here. But not one of them explains how to do. At least the ones I have found.

fewi · Mon Nov 21, 2011 2:27 pm

If you get a tunnel from tunnelbroker.net their examples contain one for Mikrotik, copy and paste. From there it's just a matter of setting up a stateful filter just like for IPv4, except you have to let ICMPv6 through to customers so MTU path discovery works.

Lowis · Mon Nov 21, 2011 3:40 pm

Have you maybe al link? Because I can’t find it on the site of forum on tunnelbroker.net.

fewi · Mon Nov 21, 2011 3:43 pm

When you create an account and an actual tunnel the tunnel detail page has a drop down menu for generating configuration for all kinds of vendors, including Mikrotik.

Lowis · Mon Nov 21, 2011 6:37 pm

Ok, thanks.

Tue Nov 22, 2011 11:55 am

Here you can get step-by-step configuration example
http://wiki.mikrotik.com/wiki/Manual:My ... v6_Network

Lowis · Fri Nov 25, 2011 1:57 pm

When I try to config my tunnel I receive an error message at “/interface 6to4. It doesn’t understand 6to4. Do I have to enable something first to use IPv6?

Fri Nov 25, 2011 2:02 pm

ipv6 package should be enabled

Lowis · Fri Nov 25, 2011 2:59 pm

Thanks, I have running IPv6. Now I have a second network on ether2-local where ipv6 is available.
But I would use it like a gogo cpe (http://gogoware.gogo6.com/4105/descript ... uct_id=180). Connecting ether1-gateway to my network and all computers in the network gets its ipv6 ip from the MikroTik. And that the MikroTik also is the ipv6 gateway.

Anyone know if this is possible?

fewi · Fri Nov 25, 2011 3:14 pm

Sounds like that should work without a problem, you'll just have to make sure you forward the tunnel traffic (IP protocol 41) to the Mikrotik router.

Lowis · Fri Nov 25, 2011 4:40 pm

Euh, how do you mean. Doesn’t it find automatically the router? The router provides the IPv6 address through the tunnel. So it should be advertising automatically to the client.

fewi · Fri Nov 25, 2011 4:48 pm

Maybe I misunderstood - I thought you were going to put some sort of CPE in front of the Mikrotik router. You would then have to forward things so the tunnel still terminates on the Mikrotik router, which no longer has a public IP address on it.

If I did misunderstand please post a network diagram of what you're asking about.

I don't know what that gogo client whatever thing has to do with this, according to their web site that builds IPv6 tunnels of its own back to some appliance you have to buy from them.

Or were you asking if RouterOS can act as a 'gogoserver'? The answer to that would be that no, it cannot.

Lowis · Fri Nov 25, 2011 6:56 pm

I want to create the following. I have a local network 192.168.1.0/24 This network is connect to the internet with a cable modem. The wan ip number of the cable modem is 194.119.x.x

The ether1-gateway of the MikroTik is connected to the local network and have ip 192.168.1.10. On the MikroTik is a “Hurricane Electric IPv6 Tunnel Broker” VPN created.

What I want now is that all the computers in the local network gets IPv6 address from MikroTik and use it as default gateway for IPv6.

I hope you understand what I mean…

fewi · Fri Nov 25, 2011 8:12 pm

Sure. Though now I don't know what that gogo thing had to do with anything.

Just put the IP address in the routed network that HE gave you on ether1-gateway and make sure that 'advertise' is set to
'yes' on it, which is the default. That's it.

Lowis · Fri Nov 25, 2011 8:23 pm

This is what I have placed into my router

/interface 6to4 add comment="Hurricane Electric IPv6 Tunnel Broker" disabled=no local-address=194.119.x.x mtu=1280 name=sit1 remote-address=216.66.80.26
/ipv6 route add comment="" disabled=no distance=1 dst-address=2000::/3 gateway=2001:470:1f09:1e81::1 scope=30 target-scope=10
/ipv6 address add address=2001:470:1f09:1e81::2/64 advertise=yes disabled=no eui-64=no interface=sit1

I’m not sure if local-address=194.119.x.x is correct. Maybe it must be my local address 192.168.1.10. I have tried both. But none of them works…..

fewi · Fri Nov 25, 2011 9:07 pm

I thought you said you had the HE tunnel up. Do you? Can you ping the other side?

HE gave you two IP addresses: one for the tunnel, and a /48 or a /64 for LAN use depending on what you requested. Put that LAN IPv6 address on the ether1-gateway interface. Then clients behind it will start receiving IPv6 addresses from the router on that network.

Lowis · Sat Nov 26, 2011 1:05 pm

Yes, sorry I thought so. But it was the gogo6 software client that was still running. I have tested it again and I can’t ping the other site so it isn’t working at all.

I have received the following addresses:
Server IPv6 Address: 2001:470:1f09:1e81::1/64
Client IPv6 Address: 2001:470:1f09:1e81::2/64

And have them configured as mention on the HE website like:

/interface 6to4 add comment="Hurricane Electric IPv6 Tunnel Broker" disabled=no local-address= 194.119.x.x mtu=1280 name=sit1 remote-address=216.66.80.26
/ipv6 route add comment="" disabled=no distance=1 dst-address=2000::/3 gateway=2001:470:1f09:1e81::1 scope=30 target-scope=10
/ipv6 address add address=2001:470:1f09:1e81::2/64 advertise=yes disabled=no eui-64=no interface=sit1

Can you tell me what I have to do more?

fewi · Sat Nov 26, 2011 3:26 pm

That is sufficient based on what you've shared so far.

Do you have firewall filter rules blocking the tunnel, maybe?

Lowis · Sat Nov 26, 2011 4:26 pm

From my MikroTik I can ping goole’s IP 6 address. So there is be a tunnel 6to4 tunnel. But the client’s did not get it IP6 address.

fewi · Sat Nov 26, 2011 5:27 pm

We're going in circles here, and it's getting a little bit frustrating. First the tunnel is up, then it isn't, and now it is apparently because the router can ping out via IPv6. Please be more clear when posting or this isn't going to go anywhere.

From my MikroTik I can ping goole’s IP 6 address. So there is be a tunnel 6to4 tunnel. But the client’s did not get it IP6 address.

When you say "client" I assume you mean the router, because it's a client to HE's 6 over 4 infrastructure. Can the router ping out via IPv6? What do you mean when you say "client" - a node on the LAN connected directly to the router?

If that's the case and the tunnel is up and now you're just working on the LAN routing part, did you read this post I made way back yesterday?

HE gave you two IP addresses: one for the tunnel, and a /48 or a /64 for LAN use depending on what you requested. Put that LAN IPv6 address on the ether1-gateway interface. Then clients behind it will start receiving IPv6 addresses from the router on that network.

Did you do that? Did you put an IPv6 address in the routed /64 or /48 that HE provided to you, and which you can look up in the tunnel details, on the LAN interface so that the LAN network is IPv6 enabled?

Post the output of "/ipv6 address print detail" and "/ipv6 route print detail" if you don't know.

Lowis · Sat Nov 26, 2011 8:02 pm

When I mean client I mean my local computers. And I describe my router as MikroTik.

Did you do that? Did you put an IPv6 address in the routed /64 or /48 that HE provided to you, and which you can look up in the tunnel details, on the LAN interface so that the LAN network is IPv6 enabled?

As far as I know I have done this. Only not to ether1-gateway but to the interface sit 1. As I mention above. When I place this on the ether1-gateway interface the completely IPv4 local network doesn’t works anymore.

[admin@MikroTik] > ipv6 address print detail
Flags: X - disabled, I - invalid, D - dynamic, G - global, L - link-local 
 0  G address=2001:470:1f09:1e81::2/64 interface=sit1 actual-interface=sit1 eui-64=no advertise=yes 
 1 DL address=fe80::5065:d2dc/128 interface=sit1 actual-interface=sit1 eui-64=no advertise=no 
 2 DL address=fe80::20c:42ff:febd:8e01/64 interface=ether1-gateway actual-interface=ether1-gateway eui-64=no advertise=no 
 3 DL address=fe80::20c:42ff:febd:8e02/64 interface=ether2-local actual-interface=bridge eui-64=no advertise=no 
 4 DL address=fe80::20c:42ff:febd:8e05/64 interface=ether5-local actual-interface=bridge eui-64=no advertise=no 
 5 DL address=fe80::20c:42ff:febd:8e03/64 interface=ether3-local actual-interface=bridge eui-64=no advertise=no 
 6 DL address=fe80::20c:42ff:febd:8e04/64 interface=ether4-local actual-interface=bridge eui-64=no advertise=no 
 7 DL address=fe80::20c:42ff:febd:8e02/64 interface=bridge actual-interface=bridge eui-64=no advertise=no 

[admin@MikroTik] > ipv6 route print detail  
Flags: X - disabled, A - active, D - dynamic, C - connect, S - static, r - rip, o - ospf, b - bgp, U - unreachable 
 0 A S  dst-address=2000::/3 gateway=2001:470:1f09:1e81::1 gateway-status=2001:470:1f09:1e81::1 reachable sit1 distance=1 scope=30 target-scope=10 
 1 ADC  dst-address=2001:470:1f09:1e81::/64 gateway=sit1 gateway-status=sit1 reachable distance=0 scope=10

fewi · Sat Nov 26, 2011 8:32 pm

OK, one more time, then I'll give up.

HE assigned you routed prefixes in addition to the IPv6 addressing for the point to point tunnel. They are listed on your tunnel detail page as "routed prefixes". You need to assign that IPv6 address to your ether1-gateway interface (not the sit1 interface, that's the tunnel interface), like I've been saying several times now.

Forget for a moment that this is IPv6. Pretend it's IPv4 - they really are very similar. Right now you have a router with a WAN interface (sit1, the tunnel interface) and a LAN interface (ether1-gateway). You've assigned an IPv4 address to the WAN interface and can ping but you haven't assigned an IPv4 address to ether1-gateway. How are hosts behind ether1-gateway supposed to get to the Internet? They CANNOT have IP addresses from the router because THE ROUTER DOES NOT HAVE AN IP ADDRESS ON THAT INTERFACE. You haven't assigned IP addressing to your LAN yet, so the LAN doesn't work. This is not at all surprising. Assign IP addressing to your LAN and things will start working. In IPv6 all you need to do is assign an IPv6 address to the router interface on that network (which is ether1-gateway - you may want to rename that, btw, that's the default WAN interface name) and stateless autoconfiguration will have hosts on the LAN assign themselves IPv6 addresses from there. You get that IPv6 address from HE, and it's listed on your tunnel detail page under "routed prefixes". There are two parts where you need to assign addressing for this: your WAN port, and your LAN port. sit1 is your WAN port, ether1-gateway is your LAN port. You've completed configuring the WAN port. Now configure the LAN port.

If that still isn't descriptive enough for you I'm afraid I can't help you.

Lowis · Sun Nov 27, 2011 2:39 pm

Hi fewi,

Thanks for your explanation. I understand it now a little bit more how IPv6 works and how the tunnel works.
I now have:

 
[admin@MikroTik] > ipv6 address print detail
Flags: X - disabled, I - invalid, D - dynamic, G - global, L - link-local 
 0  G address=2001:470:1f09:1e81::2/64 interface=sit1 actual-interface=sit1 eui-64=no advertise=yes 
 1  G address=2001:470:1f0a:1e81::/64 interface=ether1-gateway actual-interface=ether1-gateway eui-64=no advertise=yes 
 2 DL address=fe80::5065:d2dc/128 interface=sit1 actual-interface=sit1 eui-64=no advertise=no 
 3 DL address=fe80::20c:42ff:febd:8e05/64 interface=ether5-local actual-interface=bridge eui-64=no advertise=no 
 4 DL address=fe80::20c:42ff:febd:8e03/64 interface=ether3-local actual-interface=bridge eui-64=no advertise=no 
 5 DL address=fe80::20c:42ff:febd:8e01/64 interface=ether1-gateway actual-interface=ether1-gateway eui-64=no advertise=no 
 6 DL address=fe80::20c:42ff:febd:8e02/64 interface=ether2-local actual-interface=bridge eui-64=no advertise=no 
 7 DL address=fe80::20c:42ff:febd:8e04/64 interface=ether4-local actual-interface=bridge eui-64=no advertise=no 
 8 DL address=fe80::20c:42ff:febd:8e02/64 interface=bridge actual-interface=bridge eui-64=no advertise=no 


[admin@MikroTik] > ipv6 route print detail 
Flags: X - disabled, A - active, D - dynamic, C - connect, S - static, r - rip, o - ospf, b - bgp, U - unreachable 
 0 A S  dst-address=2000::/3 gateway=2001:470:1f09:1e81::1 gateway-status=2001:470:1f09:1e81::1 reachable sit1 distance=1 scope=30 target-scope=10 
 1 ADC  dst-address=2001:470:1f09:1e81::/64 gateway=sit1 gateway-status=sit1 reachable distance=0 scope=10 
 2 ADC  dst-address=2001:470:1f0a:1e81::/64 gateway=ether1-gateway gateway-status=ether1-gateway reachable distance=0 scope=10

The computers in the local network receive there IP 6 number. But I when ping from one off these computers to google or to my own tunnel I don’t get response.