unable to configure GREv6 on latest stable ROS v6.47

fflo · Wed Dec 02, 2020 9:22 am

Hi,

I am unable to get a simple GRE6 tunnel up and running between two RB3011 (arm) devices using the latest stable v6.47.8 ROS.

Tested with and without IPsec password.

/ipv6 firewall filter
add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid
add action=accept chain=input comment="defconf: accept ICMPv6" protocol=icmpv6
add action=accept chain=input comment="defconf: accept UDP traceroute" port=33434-33534 protocol=udp
add action=accept chain=input comment="defconf: accept DHCPv6-Client prefix delegation." dst-port=546 protocol=udp src-address=\
    fe80::/16
add action=accept chain=input comment="defconf: accept IKE" dst-port=500,4500 protocol=udp
add action=accept chain=input comment="defconf: accept IPIPv6" protocol=ipv6-encap
add action=accept chain=input comment="defconf: accept GREv6" protocol=gre
add action=accept chain=input comment="defconf: accept ipsec ESP" protocol=ipsec-esp
add action=accept chain=input comment="defconf: accept ipsec AH" protocol=ipsec-ah
add action=accept chain=input comment="defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=input comment="defconf: drop everything else not coming from LAN" in-interface-list=!LAN log=yes \
    log-prefix="INPUT DROP IPv6:"

Curiosity: Packet Sniffer shows packets between both peers (inbound and outbound), but the IPv6 firewall has no matching GREv6 packets (counter = 0) and the drop counter does not increase either.

Are there any known bugs with GREv6 or IPv6 tunnels on the latest v6.47.x firmware series?

sindy · Wed Dec 02, 2020 9:37 am

A blind shot, try to add protocol=!gre to the action=drop chain=input comment="defconf: drop invalid" connection-state=invalid rule. This makes it possible for GRE (and EoIP) to work in IPv4 if PPTP helper in firewall is disabled, so maybe the same treatment is necessary in IPv6.

If your firewall is composed following the "deny everything except what you explicitly allow" principle, and you want to use GRE keepalive to monitor the transparency of the tunnel, it is also necessary to add a rule in-interface=the-gre-interface-name protocol=gre action=accept to chain forward of /ip firewall filter.

CZFan · Wed Dec 02, 2020 9:55 am

Your rule below allowing GE should be before the drop invalid rule, so you have 2 choices:

add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid
add action=accept chain=input comment="defconf: accept ICMPv6" protocol=icmpv6
add action=accept chain=input comment="defconf: accept UDP traceroute" port=33434-33534 protocol=udp
add action=accept chain=input comment="defconf: accept DHCPv6-Client prefix delegation." dst-port=546 protocol=udp src-address=\
fe80::/16
add action=accept chain=input comment="defconf: accept IKE" dst-port=500,4500 protocol=udp
add action=accept chain=input comment="defconf: accept IPIPv6" protocol=ipv6-encap
add action=accept chain=input comment="defconf: accept GREv6" protocol=gre

1. Follow @sindy's advise above,
or
2. Move that rule to before drop invalid

unable to configure GREv6 on latest stable ROS v6.47

unable to configure GREv6 on latest stable ROS v6.47

Re: unable to configure GREv6 on latest stable ROS v6.47

Re: unable to configure GREv6 on latest stable ROS v6.47

Who is online