Community discussions

MikroTik App
 
dadabo
just joined
Topic Author
Posts: 4
Joined: Tue Dec 06, 2011 7:32 am

ipv6 and double NATing

Tue Dec 06, 2011 8:16 am

We have performed double NATing with 2 routers because of some security requirements (Diagram can be found in the attached).

Just recently, we needed to set up ipv6 for the entire office but experienced connectivity issue;
We used he.net to create a tunnel and did the following configuration.
PC was not able to ping the end point of IPV6 tunnel.

On 450G:
/interface 6to4 add comment="Hurricane Electric IPv6 Tunnel Broker" disabled=no local-address=115.66.1.1 mtu=1280 name=sit1 remote-address=216.218.221.42
/ipv6 route add comment="" disabled=no distance=1 dst-address=::/0 gateway=2001:470:35:493::1 scope=30 target-scope=10
/ipv6 address add address=2001:470:35:493::2/64 advertise=yes disabled=no eui-64=no interface=sit1
/ipv6 address add address=2001:470:36:493::2/64 advertise=yes disabled=no eui-64=no interface=ether4-local

On 495G:
/ipv6 address add address=2001:470:36:493::1/64 advertise=yes disabled=no eui-64=no interface=ether2-dmz
/ipv6 route add comment="" disabled=no distance=1 dst-address=::/0 gateway=2001:470:36:493::2 scope=30 target-scope=10
/ipv6 address add address=2001:470:37:493::2/64 advertise=yes disabled=no eui-64=no interface=bridge-interface

From PC, I was able to ping:
2001:470:37:493::2
2001:470:36:493::1
but not any other IP addresses

From 493G, I was able to ping:
2001:470:36:493::2
2001:470:35:493::2
2001:470:35:493::1

The 450G was able to ping:
2001:470:35:493::2
2001:470:35:493::1

Any idea why I cannot ping 2001:470:35:493::1 from the PC
You do not have the required permissions to view the files attached to this post.
 
User avatar
ojsa
Member Candidate
Member Candidate
Posts: 181
Joined: Tue Jan 27, 2009 8:53 pm
Location: Norway

Re: ipv6 and double NATing

Tue Dec 06, 2011 10:07 pm

Did your computer receive ipv6 adresser other than link-local address? I could be that those addresses played you a trick.
What about gw on the computer?
 
dadabo
just joined
Topic Author
Posts: 4
Joined: Tue Dec 06, 2011 7:32 am

Re: ipv6 and double NATing

Wed Dec 07, 2011 11:32 am

This was what I did. On Windows :
You do not have the required permissions to view the files attached to this post.
 
User avatar
ojsa
Member Candidate
Member Candidate
Posts: 181
Joined: Tue Jan 27, 2009 8:53 pm
Location: Norway

Re: ipv6 and double NATing

Wed Dec 07, 2011 7:34 pm

Ohh.. to me it seems that your windows have a ::/0 (default route to a fe80..... address, this is a link local address.

http://en.wikipedia.org/wiki/IPv6_addre ... ne_indices

Add a correct default gw and try again.
 
dadabo
just joined
Topic Author
Posts: 4
Joined: Tue Dec 06, 2011 7:32 am

Re: ipv6 and double NATing

Thu Dec 08, 2011 6:37 am

Hmm..looks like the outcome is still the same..
Attached is the a screen shot of the new default gateway. I have manually added it.
You do not have the required permissions to view the files attached to this post.

Who is online

Users browsing this forum: intania, phascogale, washdogg87 and 218 guests