Re: [vserver] Re: [Openvpn-users] tunnelling IPv6 subnets through OpenVPN

From: Herbert Poetzl <herbert_at_13thfloor.at>
Date: Mon 21 Dec 2009 - 00:58:21 GMT
Message-ID: <20091221005821.GE31558@MAIL.13thfloor.at>

On Sun, Dec 20, 2009 at 09:45:13PM +0100, Eugen Leitl wrote:
> On Sun, Dec 20, 2009 at 08:24:56PM +0000, Davide Brini wrote:
> > On Sunday 20 December 2009, David Sommerseth wrote:

> > > On 20/12/09 20:36, Adam Tauno Williams wrote:
> > > > It works well, no issues.

> > > I believe you will need to use the TAP device to make this work,
> > > as OpenVPN do not support IPv6 over TUN devices. But I agree, that
> > > this should work, even though I have not tried it in real life
> > > yet.

> > > The caveats is that using TAP devices gives more overhead in the
> > > traffic between the OpenVPN server and client, as raw ethernet
> > > frames are transferred, compared against TUN devices, which
> > > operates on the IP level.

> > > But as TUN do not support IPv6, you need to use TAP.

from the OpenVPN FAQ:

| Is IPv6 support planned/in the works?

| Currently, there's limited support for IPv6.

| Point-to-point IPv6 tunnels are supported on OSes which have IPv6 TUN
| driver support (this includes Linux and the BSDs). IPv6 over TAP is
| always supported as is any other protocol which can run over Ethernet.

so, the limited IPv6 is an artificial OpenVPN limitation
it seems?

> > Or tunnel IPv6 in IPv4, and use TUN (yes, IPv6 MTU will be smaller,
> > but it should work).

> I do not have native IPv6 connectivity (HE.net and SixXs /48 tunnels
> on the linux vserver host), so then TUN is the way to go to terminate
> /56 subnets in the guests?

you could always terminate whatever you are able to
terminate on the host, and simply _use_ the IPv6
addresses for the guests (which won't really care
where the IP comes from :)

of course, putting the TAP _into_ the guest is not
a good idea, unless you use network namespaces ...

best,
Herbert

> --
> Eugen* Leitl leitl http://leitl.org
> ______________________________________________________________
> ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org
> 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE
Received on Mon Dec 21 00:59:04 2009

[Next/Previous Months] [Main vserver Project Homepage] [Howto Subscribe/Unsubscribe] [Paul Sladen's vserver stuff]
Generated on Mon 21 Dec 2009 - 00:59:05 GMT by hypermail 2.1.8